@bitmagic/cli 0.1.6 → 0.1.8

package/dist/publish/bundle.js

@@ -0,0 +1,77 @@
+import { createHash } from 'crypto';
+import { spawnSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import { CliError } from '../errors.js';
+import { projectBin } from '../project/context.js';
+import { computeFingerprint } from './fingerprint.js';
+/** The config the scaffold vendors alongside `engine/`. */
+export const VITE_PUBLISH_CONFIG = 'vite.publish.config.js';
+export function buildBundlePaths(root) {
+    const dir = path.join(root, '.bitmagic', 'build');
+    return { dir, htmlPath: path.join(dir, 'index.html'), manifestPath: path.join(dir, 'manifest.json') };
+}
+export function writeBuildManifest(root, manifest) {
+    const { dir, manifestPath } = buildBundlePaths(root);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+}
+function isManifest(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const m = value;
+    return (typeof m.engineVersion === 'string'
+        && typeof m.fingerprint === 'string'
+        && typeof m.bytes === 'number'
+        && typeof m.sha256 === 'string'
+        && typeof m.builtAt === 'string');
+}
+/** The last build's manifest, or null if there is none to trust — same contract as readVerifyRecord. */
+export function readBuildManifest(root) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(buildBundlePaths(root).manifestPath, 'utf-8'));
+        return isManifest(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Compile and bundle the project into one self-contained HTML, and record what was built.
+ *
+ * Exit code 1 on failure, matching the table in the spec: a build failure is the creator's own
+ * code, and the compiler's output has already been printed.
+ */
+export function runBuild(root, engineVersion) {
+    const tsc = projectBin(root, 'tsc');
+    const compile = spawnSync(tsc, [], { cwd: root, stdio: 'inherit' });
+    if (compile.error)
+        throw new CliError(`Could not run the TypeScript compiler: ${compile.error.message}`, 1);
+    if (compile.status !== 0)
+        throw new CliError('Build failed: the project does not compile.', 1);
+    const { dir, htmlPath } = buildBundlePaths(root);
+    fs.mkdirSync(dir, { recursive: true });
+    const vite = projectBin(root, 'vite');
+    const bundle = spawnSync(vite, ['build', '--config', VITE_PUBLISH_CONFIG, '--outDir', dir, '--emptyOutDir'], {
+        cwd: root,
+        stdio: 'inherit',
+    });
+    if (bundle.error)
+        throw new CliError(`Could not run vite: ${bundle.error.message}`, 1);
+    if (bundle.status !== 0)
+        throw new CliError('Build failed: the bundle did not complete.', 1);
+    if (!fs.existsSync(htmlPath)) {
+        throw new CliError(`Build produced no ${path.relative(root, htmlPath)}. Check ${VITE_PUBLISH_CONFIG}.`, 1);
+    }
+    const contents = fs.readFileSync(htmlPath);
+    const manifest = {
+        engineVersion,
+        fingerprint: computeFingerprint(root),
+        bytes: contents.byteLength,
+        sha256: createHash('sha256').update(contents).digest('hex'),
+        builtAt: new Date().toISOString(),
+    };
+    writeBuildManifest(root, manifest);
+    return manifest;
+}
+//# sourceMappingURL=bundle.js.map

package/dist/publish/bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/publish/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAiB5D,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,CAAC;AACxG,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,QAAuB;IACtE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;WAChC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;WACjC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;WAC3B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;WAC5B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CACjC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QAClG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,aAAqB;IAC1D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,IAAI,QAAQ,CAAC,0CAA0C,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC;IAE/F,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,EAAE,eAAe,CAAC,EAAE;QAC3G,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK;QAAE,MAAM,IAAI,QAAQ,CAAC,uBAAuB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACvF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;IAE7F,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAAC,qBAAqB,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,mBAAmB,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAkB;QAC9B,aAAa;QACb,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC;QACrC,KAAK,EAAE,QAAQ,CAAC,UAAU;QAC1B,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3D,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC;IACF,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/publish/fingerprint.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A relative path as the fingerprint hashes it: always forward-slashed.
+ *
+ * `sep` is a parameter rather than a direct `path.sep` read so this is testable on any
+ * platform — the Windows behaviour that makes normalization necessary cannot otherwise be
+ * exercised on the POSIX runners CI uses, which is exactly how a vacuous test gets written.
+ */
+export declare function toPosixPath(relativePath: string, sep?: string): string;
+/**
+ * A hash of everything that determines the published bundle.
+ *
+ * This is what lets `publish` decide whether a `verify` is too stale to trust, by CONTENT
+ * rather than by clock: a timestamp policy would accept an edit made one second after
+ * verifying and reject an untouched project that merely sat overnight.
+ *
+ * The path is hashed alongside the content so that moving a file — which changes what the
+ * bundle imports — changes the fingerprint even though no byte of any file did.
+ *
+ * Kept deliberately coarse (every tracked file, not a module graph): a false "stale" costs one
+ * `bitmagic verify`, while a false "fresh" ships an unverified bundle.
+ *
+ * Any filesystem error (unreadable directory, permission denied, etc.) propagates immediately
+ * rather than being silently omitted: the project source is the creator's own files, so an
+ * unreadable subtree is a real problem worth surfacing, not something to hide. An omitted
+ * directory would produce a fingerprint that matches a stale project — the costly failure mode.
+ */
+export declare function computeFingerprint(root: string): string;

package/dist/publish/fingerprint.js

@@ -0,0 +1,64 @@
+import { createHash } from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+/**
+ * Directories whose contents never change what the bundle contains: our own artifacts
+ * (`.bitmagic/`, `dist/`), the dependency tree (`node_modules/` — pinned by the lockfile the
+ * scaffold writes), and vite's cache. Including any of them would make the fingerprint change
+ * on every build, which would make the staleness gate reject every publish.
+ */
+const EXCLUDED_DIRS = new Set(['.bitmagic', 'node_modules', 'dist', '.vite-cache']);
+/**
+ * A relative path as the fingerprint hashes it: always forward-slashed.
+ *
+ * `sep` is a parameter rather than a direct `path.sep` read so this is testable on any
+ * platform — the Windows behaviour that makes normalization necessary cannot otherwise be
+ * exercised on the POSIX runners CI uses, which is exactly how a vacuous test gets written.
+ */
+export function toPosixPath(relativePath, sep = path.sep) {
+    return relativePath.split(sep).join('/');
+}
+function walk(dir, root, out) {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        if (entry.isDirectory()) {
+            if (EXCLUDED_DIRS.has(entry.name))
+                continue;
+            walk(path.join(dir, entry.name), root, out);
+        }
+        else if (entry.isFile()) {
+            const relPath = path.relative(root, path.join(dir, entry.name));
+            out.push(toPosixPath(relPath));
+        }
+    }
+}
+/**
+ * A hash of everything that determines the published bundle.
+ *
+ * This is what lets `publish` decide whether a `verify` is too stale to trust, by CONTENT
+ * rather than by clock: a timestamp policy would accept an edit made one second after
+ * verifying and reject an untouched project that merely sat overnight.
+ *
+ * The path is hashed alongside the content so that moving a file — which changes what the
+ * bundle imports — changes the fingerprint even though no byte of any file did.
+ *
+ * Kept deliberately coarse (every tracked file, not a module graph): a false "stale" costs one
+ * `bitmagic verify`, while a false "fresh" ships an unverified bundle.
+ *
+ * Any filesystem error (unreadable directory, permission denied, etc.) propagates immediately
+ * rather than being silently omitted: the project source is the creator's own files, so an
+ * unreadable subtree is a real problem worth surfacing, not something to hide. An omitted
+ * directory would produce a fingerprint that matches a stale project — the costly failure mode.
+ */
+export function computeFingerprint(root) {
+    const files = [];
+    walk(root, root, files);
+    files.sort();
+    const hash = createHash('sha256');
+    for (const rel of files) {
+        const content = fs.readFileSync(path.join(root, rel));
+        hash.update(`${rel}:${createHash('sha256').update(content).digest('hex')}\n`);
+    }
+    return hash.digest('hex');
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/publish/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../src/publish/fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,YAAoB,EAAE,MAAc,IAAI,CAAC,GAAG;IACtE,OAAO,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,IAAY,EAAE,GAAa;IACpD,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,KAAK,CAAC,IAAI,EAAE,CAAC;IAEb,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/scaffold/dependency-diff.d.ts

@@ -0,0 +1,28 @@
+/** The subset of package.json this module reads — never the whole file. */
+export interface PackageJsonDeps {
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+}
+export interface RequiredDependencies {
+    dependencies: Record<string, string>;
+    devDependencies: Record<string, string>;
+}
+export interface DependencyMismatch {
+    name: string;
+    kind: 'dependency' | 'devDependency';
+    required: string;
+    /** undefined when the package is missing from package.json entirely, not just outdated. */
+    current?: string;
+}
+/**
+ * Compares a project's declared dependencies against what the vendored engine actually needs
+ * (`DEPENDENCIES`/`DEV_DEPENDENCIES` in project-files.ts), and reports every mismatch — missing
+ * entirely, or present at a different version string.
+ *
+ * Pure and filesystem-free by design: `upgradeProject` never writes package.json (a creator's
+ * added dependencies must survive an upgrade untouched), so this is the other half of that
+ * decision — the mismatch it creates has to be *reported*, not silently left for `bitmagic build`
+ * to fail on later with an opaque module-resolution error. Kept separate from the command layer
+ * that reads package.json off disk so the comparison itself is testable without a fixture file.
+ */
+export declare function diffDependencies(pkg: PackageJsonDeps, required: RequiredDependencies): DependencyMismatch[];

package/dist/scaffold/dependency-diff.js

@@ -0,0 +1,28 @@
+/**
+ * Compares a project's declared dependencies against what the vendored engine actually needs
+ * (`DEPENDENCIES`/`DEV_DEPENDENCIES` in project-files.ts), and reports every mismatch — missing
+ * entirely, or present at a different version string.
+ *
+ * Pure and filesystem-free by design: `upgradeProject` never writes package.json (a creator's
+ * added dependencies must survive an upgrade untouched), so this is the other half of that
+ * decision — the mismatch it creates has to be *reported*, not silently left for `bitmagic build`
+ * to fail on later with an opaque module-resolution error. Kept separate from the command layer
+ * that reads package.json off disk so the comparison itself is testable without a fixture file.
+ */
+export function diffDependencies(pkg, required) {
+    const mismatches = [];
+    for (const [name, version] of Object.entries(required.dependencies)) {
+        const current = pkg.dependencies?.[name];
+        if (current !== version) {
+            mismatches.push({ name, kind: 'dependency', required: version, current });
+        }
+    }
+    for (const [name, version] of Object.entries(required.devDependencies)) {
+        const current = pkg.devDependencies?.[name];
+        if (current !== version) {
+            mismatches.push({ name, kind: 'devDependency', required: version, current });
+        }
+    }
+    return mismatches;
+}
+//# sourceMappingURL=dependency-diff.js.map

package/dist/scaffold/dependency-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-diff.js","sourceRoot":"","sources":["../../src/scaffold/dependency-diff.ts"],"names":[],"mappings":"AAmBA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB,EAAE,QAA8B;IACnF,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACvE,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/scaffold/project-files.d.ts

@@ -1,7 +1,29 @@
+/**
+ * Mirrors game/package.json so the pro lane resolves exactly what CI builds against.
+ *
+ * Exported so `bitmagic upgrade` can diff a project's actual package.json against what the
+ * vendored engine currently needs — package.json itself is never rewritten (see
+ * PLATFORM_GENERATED_FILES in project.ts), so this is the only source of truth upgrade has for
+ * telling a creator what to add by hand.
+ */
+export declare const DEPENDENCIES: Record<string, string>;
+export declare const DEV_DEPENDENCIES: Record<string, string>;
 export declare function renderPackageJson(name: string): string;
 export declare function renderTsconfig(): string;
 export declare function renderIndexHtml(): string;
 export declare function renderViteConfig(): string;
+/**
+ * The production bundle config, vendored into the project next to `engine/`.
+ *
+ * One self-contained HTML: `viteSingleFile` with an effectively unlimited inline limit, so the
+ * engine and all JS/CSS land inside index.html. Game ASSETS are deliberately NOT inlined — they
+ * already live on the CDN with absolute URLs, and inlining them is what produced multi-hundred-MB
+ * bundles and OOM-killed the web publish pod.
+ *
+ * Vendored rather than generated per-build so a creator can read exactly what ships, and so it
+ * versions with the engine it was written for.
+ */
+export declare function renderVitePublishConfig(): string;
 export declare function renderGitignore(): string;
 export interface ProjectMetadata {
     gameId: string;

package/dist/scaffold/project-files.js

@@ -1,6 +1,13 @@
 import { tsconfigPaths, importMapEntries, viteAliasEntries } from './aliases.js';
-/** Mirrors game/package.json so the pro lane resolves exactly what CI builds against. */
-const DEPENDENCIES = {
+/**
+ * Mirrors game/package.json so the pro lane resolves exactly what CI builds against.
+ *
+ * Exported so `bitmagic upgrade` can diff a project's actual package.json against what the
+ * vendored engine currently needs — package.json itself is never rewritten (see
+ * PLATFORM_GENERATED_FILES in project.ts), so this is the only source of truth upgrade has for
+ * telling a creator what to add by hand.
+ */
+export const DEPENDENCIES = {
     '@dimforge/rapier2d-compat': '^0.19.3',
     '@dimforge/rapier3d-compat': '^0.19.3',
     '@msgpack/msgpack': '^3.1.3',
@@ -10,7 +17,7 @@ const DEPENDENCIES = {
     jszip: '^3.10.1',
     three: '^0.185.1',
 };
-const DEV_DEPENDENCIES = {
+export const DEV_DEPENDENCIES = {
     '@types/node': '^24.10.0',
     '@types/three': '^0.185.4',
     // engine/types/ammo.d.ts opens with a triple-slash reference to this package's ambient types.
@@ -20,6 +27,7 @@ const DEV_DEPENDENCIES = {
     '@webgpu/types': '^0.1.69',
     typescript: '^5.9.2',
     vite: '^7.3.1',
+    'vite-plugin-singlefile': '^2.3.3',
 };
 /**
  * The three.js release every `three*` import map entry below resolves to. Written once because
@@ -185,10 +193,19 @@ ${JSON.stringify({ imports }, null, 8).replace(/^/gm, '    ')}
 </html>
 `;
 }
-export function renderViteConfig() {
-    const entries = Object.entries(viteAliasEntries())
+/**
+ * The `resolve.alias` body shared by both vendored vite configs (this one and the publish
+ * config below): one `'key': 'target'` line per alias, comma-joined, indented to sit inside a
+ * template literal's `alias: { ... }` block. Kept in one place so the two configs' aliases
+ * cannot drift into two different renderings of the same `viteAliasEntries()` data.
+ */
+function renderAliasEntries() {
+    return Object.entries(viteAliasEntries())
         .map(([key, target]) => `      '${key}': '${target}'`)
         .join(',\n');
+}
+export function renderViteConfig() {
+    const entries = renderAliasEntries();
     return `import { defineConfig } from 'vite';
 
 // Aliases mirror tsconfig paths but point at the COMPILED output: tsc emits to dist/ and the
@@ -209,6 +226,50 @@ ${entries}
 });
 `;
 }
+/**
+ * The production bundle config, vendored into the project next to `engine/`.
+ *
+ * One self-contained HTML: `viteSingleFile` with an effectively unlimited inline limit, so the
+ * engine and all JS/CSS land inside index.html. Game ASSETS are deliberately NOT inlined — they
+ * already live on the CDN with absolute URLs, and inlining them is what produced multi-hundred-MB
+ * bundles and OOM-killed the web publish pod.
+ *
+ * Vendored rather than generated per-build so a creator can read exactly what ships, and so it
+ * versions with the engine it was written for.
+ */
+export function renderVitePublishConfig() {
+    const entries = renderAliasEntries();
+    return `import { defineConfig } from 'vite';
+import { viteSingleFile } from 'vite-plugin-singlefile';
+
+// Aliases mirror vite.config.js's, deliberately NOT wrapped in path.resolve(): every target here
+// already starts with '/', which Vite resolves as project-root-relative in both serve and build
+// mode. A path.resolve(__dirname, target) wrapper looks more "correct" but is actively wrong —
+// Node's path.resolve() drops the trailing slash from an already-absolute second argument, and
+// Vite's directory-style alias substitution needs that slash to join the replacement with the
+// rest of the specifier. Strip it and 'engine/GameTemplate.js' resolves to the nonexistent
+// 'dist/engine/engineGameTemplate.js' instead of 'dist/engine/engine/GameTemplate.js' — silently,
+// since Rollup then just treats the unmatched id as an unresolved bare specifier and fails the
+// build. Verified against a real \`vite build\` before trusting the plain-string form.
+export default defineConfig({
+  resolve: {
+    alias: {
+${entries}
+    }
+  },
+  build: {
+    // Effectively unlimited: everything the bundle references locally is inlined so the
+    // published artifact is a single file. CDN assets are absolute URLs and are untouched.
+    assetsInlineLimit: 100000000,
+    cssCodeSplit: false,
+    rollupOptions: {
+      output: { inlineDynamicImports: true },
+    },
+  },
+  plugins: [viteSingleFile()],
+});
+`;
+}
 export function renderGitignore() {
     return ['dist/', 'node_modules/', '.bitmagic/', '.vite-cache/', ''].join('\n');
 }

package/dist/scaffold/project-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"project-files.js","sourceRoot":"","sources":["../../src/scaffold/project-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEjF,yFAAyF;AACzF,MAAM,YAAY,GAA2B;IAC3C,2BAA2B,EAAE,SAAS;IACtC,2BAA2B,EAAE,SAAS;IACtC,kBAAkB,EAAE,QAAQ;IAC5B,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,kCAAkC,EAAE,QAAQ;IAC5C,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,UAAU;CAClB,CAAC;AAEF,MAAM,gBAAgB,GAA2B;IAC/C,aAAa,EAAE,UAAU;IACzB,cAAc,EAAE,UAAU;IAC1B,8FAA8F;IAC9F,cAAc,EAAE,QAAQ;IACxB,4FAA4F;IAC5F,mFAAmF;IACnF,eAAe,EAAE,SAAS;IAC1B,UAAU,EAAE,QAAQ;IACpB,IAAI,EAAE,QAAQ;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAG;IACjB,uBAAuB;IACvB,oCAAoC,aAAa,WAAW;IAC5D,kDAAkD,aAAa,2CAA2C;IAC1G,8CAA8C,aAAa,uCAAuC;IAClG,gDAAgD,aAAa,wCAAwC;CACtG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEX,oGAAoG;AACpG,MAAM,WAAW,GAA2B;IAC1C,2FAA2F;IAC3F,4FAA4F;IAC5F,4FAA4F;IAC5F,KAAK,EAAE,UAAU;IACjB,cAAc,EAAE,wBAAwB,aAAa,SAAS;IAC9D,WAAW,EAAE,wBAAwB,aAAa,MAAM;IACxD,2FAA2F;IAC3F,6FAA6F;IAC7F,+FAA+F;IAC/F,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,eAAe,EAAE,yBAAyB,aAAa,UAAU;IACjE,qBAAqB,EAAE,yBAAyB,aAAa,gBAAgB;IAC7E,QAAQ,EAAE,wBAAwB,aAAa,GAAG;IAClD,2BAA2B,EAAE,iDAAiD;IAC9E,2BAA2B,EAAE,iDAAiD;IAC9E,OAAO,EAAE,+BAA+B;IACxC,kCAAkC,EAAE,uDAAuD;IAC3F,kBAAkB,EAAE,uCAAuC;IAC3D,MAAM,EAAE,6BAA6B;CACtC,CAAC;AAEF,sFAAsF;AACtF,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,UAAU,CAAC;QAChB,IAAI;QACJ,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE;YACP,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,cAAc;YACrB,GAAG,EAAE,MAAM;SACZ;QACD,YAAY,EAAE,YAAY;QAC1B,eAAe,EAAE,gBAAgB;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,CAAC;QAChB,eAAe,EAAE;YACf,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;YACtB,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG;YACZ,KAAK,EAAE,aAAa,EAAE;YACtB,gBAAgB,EAAE,SAAS;YAC3B,MAAM,EAAE,IAAI;YACZ,wBAAwB,EAAE,IAAI;YAC9B,0BAA0B,EAAE,KAAK;YACjC,oBAAoB,EAAE,IAAI;YAC1B,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,OAAO;YACxB,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,IAAI;YACrB,4BAA4B,EAAE,IAAI;YAClC,gCAAgC,EAAE,IAAI;YACtC,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,IAAI;YACvB,SAAS,EAAE,IAAI;YACf,wFAAwF;YACxF,yFAAyF;YACzF,wFAAwF;YACxF,0FAA0F;YAC1F,sFAAsF;YACtF,yFAAyF;YACzF,gFAAgF;YAChF,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,SAAS,EAAE,CAAC,cAAc,EAAE,qBAAqB,EAAE,wCAAwC,CAAC;SAC7F;QACD,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;QACpC,uFAAuF;QACvF,uFAAuF;QACvF,oFAAoF;QACpF,wFAAwF;QACxF,wDAAwD;QACxD,OAAO,EAAE;YACP,cAAc;YACd,MAAM;YACN,qBAAqB;YACrB,0BAA0B;YAC1B,kBAAkB;YAClB,uBAAuB;YACvB,oBAAoB;SACrB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,YAAY,EAAE,CAAC;IACpD,6FAA6F;IAC7F,yFAAyF;IACzF,MAAM,gBAAgB,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,iBAAiB,CAAC;IACrE,0FAA0F;IAC1F,0FAA0F;IAC1F,wFAAwF;IACxF,2FAA2F;IAC3F,mDAAmD;IACnD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BP,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;;;iCAG5B,gBAAgB;;;CAGhD,CAAC;AACF,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;SAC/C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,UAAU,GAAG,OAAO,MAAM,GAAG,CAAC;SACrD,IAAI,CAAC,KAAK,CAAC,CAAC;IACf,OAAO;;;;;;;;;;;EAWP,OAAO;;;;;;;CAOR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjF,CAAC;AASD,MAAM,UAAU,kBAAkB,CAAC,QAAyB;IAC1D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiHR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO;;;;CAIR,CAAC;AACF,CAAC"}
+{"version":3,"file":"project-files.js","sourceRoot":"","sources":["../../src/scaffold/project-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAA2B;IAClD,2BAA2B,EAAE,SAAS;IACtC,2BAA2B,EAAE,SAAS;IACtC,kBAAkB,EAAE,QAAQ;IAC5B,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,kCAAkC,EAAE,QAAQ;IAC5C,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,UAAU;CAClB,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACtD,aAAa,EAAE,UAAU;IACzB,cAAc,EAAE,UAAU;IAC1B,8FAA8F;IAC9F,cAAc,EAAE,QAAQ;IACxB,4FAA4F;IAC5F,mFAAmF;IACnF,eAAe,EAAE,SAAS;IAC1B,UAAU,EAAE,QAAQ;IACpB,IAAI,EAAE,QAAQ;IACd,wBAAwB,EAAE,QAAQ;CACnC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAG;IACjB,uBAAuB;IACvB,oCAAoC,aAAa,WAAW;IAC5D,kDAAkD,aAAa,2CAA2C;IAC1G,8CAA8C,aAAa,uCAAuC;IAClG,gDAAgD,aAAa,wCAAwC;CACtG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEX,oGAAoG;AACpG,MAAM,WAAW,GAA2B;IAC1C,2FAA2F;IAC3F,4FAA4F;IAC5F,4FAA4F;IAC5F,KAAK,EAAE,UAAU;IACjB,cAAc,EAAE,wBAAwB,aAAa,SAAS;IAC9D,WAAW,EAAE,wBAAwB,aAAa,MAAM;IACxD,2FAA2F;IAC3F,6FAA6F;IAC7F,+FAA+F;IAC/F,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,eAAe,EAAE,yBAAyB,aAAa,UAAU;IACjE,qBAAqB,EAAE,yBAAyB,aAAa,gBAAgB;IAC7E,QAAQ,EAAE,wBAAwB,aAAa,GAAG;IAClD,2BAA2B,EAAE,iDAAiD;IAC9E,2BAA2B,EAAE,iDAAiD;IAC9E,OAAO,EAAE,+BAA+B;IACxC,kCAAkC,EAAE,uDAAuD;IAC3F,kBAAkB,EAAE,uCAAuC;IAC3D,MAAM,EAAE,6BAA6B;CACtC,CAAC;AAEF,sFAAsF;AACtF,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,UAAU,CAAC;QAChB,IAAI;QACJ,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE;YACP,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,cAAc;YACrB,GAAG,EAAE,MAAM;SACZ;QACD,YAAY,EAAE,YAAY;QAC1B,eAAe,EAAE,gBAAgB;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,CAAC;QAChB,eAAe,EAAE;YACf,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;YACtB,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG;YACZ,KAAK,EAAE,aAAa,EAAE;YACtB,gBAAgB,EAAE,SAAS;YAC3B,MAAM,EAAE,IAAI;YACZ,wBAAwB,EAAE,IAAI;YAC9B,0BAA0B,EAAE,KAAK;YACjC,oBAAoB,EAAE,IAAI;YAC1B,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,OAAO;YACxB,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,IAAI;YACrB,4BAA4B,EAAE,IAAI;YAClC,gCAAgC,EAAE,IAAI;YACtC,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,IAAI;YACvB,SAAS,EAAE,IAAI;YACf,wFAAwF;YACxF,yFAAyF;YACzF,wFAAwF;YACxF,0FAA0F;YAC1F,sFAAsF;YACtF,yFAAyF;YACzF,gFAAgF;YAChF,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,SAAS,EAAE,CAAC,cAAc,EAAE,qBAAqB,EAAE,wCAAwC,CAAC;SAC7F;QACD,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;QACpC,uFAAuF;QACvF,uFAAuF;QACvF,oFAAoF;QACpF,wFAAwF;QACxF,wDAAwD;QACxD,OAAO,EAAE;YACP,cAAc;YACd,MAAM;YACN,qBAAqB;YACrB,0BAA0B;YAC1B,kBAAkB;YAClB,uBAAuB;YACvB,oBAAoB;SACrB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,YAAY,EAAE,CAAC;IACpD,6FAA6F;IAC7F,yFAAyF;IACzF,MAAM,gBAAgB,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,iBAAiB,CAAC;IACrE,0FAA0F;IAC1F,0FAA0F;IAC1F,wFAAwF;IACxF,2FAA2F;IAC3F,mDAAmD;IACnD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BP,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;;;iCAG5B,gBAAgB;;;CAGhD,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB;IACzB,OAAO,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,UAAU,GAAG,OAAO,MAAM,GAAG,CAAC;SACrD,IAAI,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,OAAO;;;;;;;;;;;EAWP,OAAO;;;;;;;CAOR,CAAC;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,OAAO;;;;;;;;;;;;;;;EAeP,OAAO;;;;;;;;;;;;;;CAcR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjF,CAAC;AASD,MAAM,UAAU,kBAAkB,CAAC,QAAyB;IAC1D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiHR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO;;;;CAIR,CAAC;AACF,CAAC"}

package/dist/scaffold/project.d.ts

@@ -15,6 +15,23 @@ export interface TemplateEntry {
  * parallel copy that silently goes stale when an entry is added here.
  */
 export declare const VENDORED_DIRS: string[];
+/**
+ * The subset of the generated files that are pure platform output: regenerated byte-for-byte
+ * from these renderers with no creator content ever entering them. `bitmagic upgrade` overwrites
+ * exactly this list (plus bitmagic.json, handled separately since only its engineVersion field is
+ * platform-owned, and engine/ + sw-cache-buster.js, handled separately since they are copied, not
+ * rendered).
+ *
+ * Deliberately excludes package.json (creators add dependencies to it), AGENTS.md/CLAUDE.md (the
+ * creator's own agent reads and may edit them), and .gitignore (same reasoning) — those are
+ * generated once by `scaffoldProject` but are creator-owned from that point on.
+ *
+ * Exported so `scaffoldProject` and `upgradeProject` share one definition instead of two lists
+ * that can drift — the exact failure that motivated this: `vite.publish.config.js` was added
+ * to init's inline list with no equivalent path for existing projects to ever receive it, because
+ * `upgrade` didn't exist yet.
+ */
+export declare const PLATFORM_GENERATED_FILES: Array<[string, () => string]>;
 export declare function resolveTemplate(templatesDir: string, requestedId?: string): TemplateEntry;
 export interface ScaffoldOptions {
     targetDir: string;

package/dist/scaffold/project.js

@@ -2,7 +2,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { CliError } from '../errors.js';
 import { aliasSourceDir } from './aliases.js';
-import { renderPackageJson, renderTsconfig, renderIndexHtml, renderViteConfig, renderGitignore, renderBitmagicJson, renderAgentsMd, renderClaudeMd, renderSkillsReadme, renderGenerateSkill, } from './project-files.js';
+import { renderPackageJson, renderTsconfig, renderIndexHtml, renderViteConfig, renderVitePublishConfig, renderGitignore, renderBitmagicJson, renderAgentsMd, renderClaudeMd, renderSkillsReadme, renderGenerateSkill, } from './project-files.js';
 /**
  * Directories moved out of the extracted tree into the project's vendored engine/.
  *
@@ -24,6 +24,28 @@ export const VENDORED_DIRS = [
     'utils',
     'core',
 ];
+/**
+ * The subset of the generated files that are pure platform output: regenerated byte-for-byte
+ * from these renderers with no creator content ever entering them. `bitmagic upgrade` overwrites
+ * exactly this list (plus bitmagic.json, handled separately since only its engineVersion field is
+ * platform-owned, and engine/ + sw-cache-buster.js, handled separately since they are copied, not
+ * rendered).
+ *
+ * Deliberately excludes package.json (creators add dependencies to it), AGENTS.md/CLAUDE.md (the
+ * creator's own agent reads and may edit them), and .gitignore (same reasoning) — those are
+ * generated once by `scaffoldProject` but are creator-owned from that point on.
+ *
+ * Exported so `scaffoldProject` and `upgradeProject` share one definition instead of two lists
+ * that can drift — the exact failure that motivated this: `vite.publish.config.js` was added
+ * to init's inline list with no equivalent path for existing projects to ever receive it, because
+ * `upgrade` didn't exist yet.
+ */
+export const PLATFORM_GENERATED_FILES = [
+    ['tsconfig.json', renderTsconfig],
+    ['vite.config.js', renderViteConfig],
+    ['vite.publish.config.js', renderVitePublishConfig],
+    ['index.html', renderIndexHtml],
+];
 export function resolveTemplate(templatesDir, requestedId) {
     const indexPath = path.join(templatesDir, 'index.json');
     let raw;
@@ -98,9 +120,7 @@ export function scaffoldProject(options) {
     }
     const files = [
         ['package.json', renderPackageJson(projectName)],
-        ['tsconfig.json', renderTsconfig()],
-        ['vite.config.js', renderViteConfig()],
-        ['index.html', renderIndexHtml()],
+        ...PLATFORM_GENERATED_FILES.map((entry) => [entry[0], entry[1]()]),
         ['bitmagic.json', renderBitmagicJson(metadata)],
         ['AGENTS.md', renderAgentsMd()],
         ['CLAUDE.md', renderClaudeMd()],

package/dist/scaffold/project.js.map

@@ -1 +1 @@
-{"version":3,"file":"project.js","sourceRoot":"","sources":["../../src/scaffold/project.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,oBAAoB,CAAC;AAY5B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;CACP,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,YAAoB,EAAE,WAAoB;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACxD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,8CAA8C,SAAS,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC;IAC1C,8FAA8F;IAC9F,oDAAoD;IACpD,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,QAAQ,CAAC,uCAAuC,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC;IACvD,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,QAAQ,CAChB,qBAAqB,WAAW,2BAA2B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAYD,wEAAwE;AACxE,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY;IAChD,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAwB;IACtD,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAEjG,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAChB,6BAA6B,GAAG,kBAAkB,MAAM,yCAAyC,CAClG,CAAC;QACJ,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,4FAA4F;IAC5F,yFAAyF;IACzF,6FAA6F;IAC7F,4EAA4E;IAC5E,EAAE;IACF,4FAA4F;IAC5F,8FAA8F;IAC9F,wFAAwF;IACxF,sCAAsC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAAC,gDAAgD,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;IACzF,CAAC;IACD,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE/B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,wEAAwE;IACxE,sFAAsF;IACtF,4FAA4F;IAC5F,0FAA0F;IAC1F,wFAAwF;IACxF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;IAC1E,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,KAAK,GAA4B;QACrC,CAAC,cAAc,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAChD,CAAC,eAAe,EAAE,cAAc,EAAE,CAAC;QACnC,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;QACtC,CAAC,YAAY,EAAE,eAAe,EAAE,CAAC;QACjC,CAAC,eAAe,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC,WAAW,EAAE,cAAc,EAAE,CAAC;QAC/B,CAAC,WAAW,EAAE,cAAc,EAAE,CAAC;QAC/B,CAAC,YAAY,EAAE,eAAe,EAAE,CAAC;QACjC,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC;QAClD,CAAC,2CAA2C,EAAE,mBAAmB,EAAE,CAAC;KACrE,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,wFAAwF;QACxF,+EAA+E;QAC/E,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;AACH,CAAC"}
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../../src/scaffold/project.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,oBAAoB,CAAC;AAY5B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;CACP,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAkC;IACrE,CAAC,eAAe,EAAE,cAAc,CAAC;IACjC,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IACpC,CAAC,wBAAwB,EAAE,uBAAuB,CAAC;IACnD,CAAC,YAAY,EAAE,eAAe,CAAC;CAChC,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,YAAoB,EAAE,WAAoB;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACxD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,8CAA8C,SAAS,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC;IAC1C,8FAA8F;IAC9F,oDAAoD;IACpD,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,QAAQ,CAAC,uCAAuC,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC;IACvD,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,QAAQ,CAChB,qBAAqB,WAAW,2BAA2B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAYD,wEAAwE;AACxE,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY;IAChD,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAwB;IACtD,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAEjG,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAChB,6BAA6B,GAAG,kBAAkB,MAAM,yCAAyC,CAClG,CAAC;QACJ,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,4FAA4F;IAC5F,yFAAyF;IACzF,6FAA6F;IAC7F,4EAA4E;IAC5E,EAAE;IACF,4FAA4F;IAC5F,8FAA8F;IAC9F,wFAAwF;IACxF,sCAAsC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAAC,gDAAgD,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;IACzF,CAAC;IACD,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE/B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,wEAAwE;IACxE,sFAAsF;IACtF,4FAA4F;IAC5F,0FAA0F;IAC1F,wFAAwF;IACxF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;IAC1E,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,KAAK,GAA4B;QACrC,CAAC,cAAc,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAChD,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC,eAAe,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC,WAAW,EAAE,cAAc,EAAE,CAAC;QAC/B,CAAC,WAAW,EAAE,cAAc,EAAE,CAAC;QAC/B,CAAC,YAAY,EAAE,eAAe,EAAE,CAAC;QACjC,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC;QAClD,CAAC,2CAA2C,EAAE,mBAAmB,EAAE,CAAC;KACrE,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,wFAAwF;QACxF,+EAA+E;QAC/E,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;AACH,CAAC"}

package/dist/scaffold/upgrade-project.d.ts

@@ -0,0 +1,35 @@
+export interface UpgradeOptions {
+    root: string;
+    /** Where extractEngine unpacked the new engine tree, same shape scaffoldProject reads from. */
+    extractedEngineDir: string;
+    /** The engine version being upgraded to, written into bitmagic.json's engineVersion field. */
+    engineVersion: string;
+}
+export interface UpgradeResult {
+    engineVersion: string;
+    previousEngineVersion: string;
+    /** Every top-level path this run actually rewrote, in the order it rewrote them. */
+    replaced: string[];
+}
+/**
+ * Refreshes the platform-owned parts of a scaffolded project in place, and nothing else. This is
+ * the file-boundary described in the task brief: `engine/` (every VENDORED_DIRS entry) and
+ * sw-cache-buster.js are wholesale-replaced, the config files in PLATFORM_GENERATED_FILES are
+ * re-rendered, and bitmagic.json is read-modified-written so only its engineVersion field
+ * changes. Everything else on disk — src/, world.json, game.json, package.json, AGENTS.md,
+ * CLAUDE.md, .claude/, .gitignore — is never opened.
+ *
+ * Mirrors scaffoldProject's copy behaviour (same VENDORED_DIRS loop, same corrupt-tarball error
+ * when a directory is missing from the extracted tree), except it clears engine/ first: unlike a
+ * brand new project's empty target, an existing engine/ may hold files a since-removed
+ * VENDORED_DIRS entry left behind, or a leftover from a bad manual edit, and cpSync alone would
+ * merge over those rather than remove them.
+ *
+ * That "clear first" step is exactly why every VENDORED_DIRS source is validated to exist
+ * *before* engine/ is touched at all, in its own pass below: scaffoldProject can afford to check
+ * existence inside its copy loop because its target starts empty, so a missing source just leaves
+ * a partially-populated (but otherwise harmless) new directory. Here the target is a live
+ * project's engine/, already rm'd — the same ordering would demolish it and fail partway through
+ * repopulating it, and a project not under version control has no way to recover that.
+ */
+export declare function upgradeProject(options: UpgradeOptions): UpgradeResult;

package/dist/scaffold/upgrade-project.js

@@ -0,0 +1,63 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { CliError } from '../errors.js';
+import { VENDORED_DIRS, PLATFORM_GENERATED_FILES } from './project.js';
+/**
+ * Refreshes the platform-owned parts of a scaffolded project in place, and nothing else. This is
+ * the file-boundary described in the task brief: `engine/` (every VENDORED_DIRS entry) and
+ * sw-cache-buster.js are wholesale-replaced, the config files in PLATFORM_GENERATED_FILES are
+ * re-rendered, and bitmagic.json is read-modified-written so only its engineVersion field
+ * changes. Everything else on disk — src/, world.json, game.json, package.json, AGENTS.md,
+ * CLAUDE.md, .claude/, .gitignore — is never opened.
+ *
+ * Mirrors scaffoldProject's copy behaviour (same VENDORED_DIRS loop, same corrupt-tarball error
+ * when a directory is missing from the extracted tree), except it clears engine/ first: unlike a
+ * brand new project's empty target, an existing engine/ may hold files a since-removed
+ * VENDORED_DIRS entry left behind, or a leftover from a bad manual edit, and cpSync alone would
+ * merge over those rather than remove them.
+ *
+ * That "clear first" step is exactly why every VENDORED_DIRS source is validated to exist
+ * *before* engine/ is touched at all, in its own pass below: scaffoldProject can afford to check
+ * existence inside its copy loop because its target starts empty, so a missing source just leaves
+ * a partially-populated (but otherwise harmless) new directory. Here the target is a live
+ * project's engine/, already rm'd — the same ordering would demolish it and fail partway through
+ * repopulating it, and a project not under version control has no way to recover that.
+ */
+export function upgradeProject(options) {
+    const { root, extractedEngineDir, engineVersion } = options;
+    const replaced = [];
+    for (const dir of VENDORED_DIRS) {
+        const source = path.join(extractedEngineDir, dir);
+        if (!fs.existsSync(source)) {
+            throw new CliError(`The engine bundle has no "${dir}" directory at ${source}. The tarball is incomplete or corrupt.`);
+        }
+    }
+    const engineDir = path.join(root, 'engine');
+    fs.rmSync(engineDir, { recursive: true, force: true });
+    fs.mkdirSync(engineDir, { recursive: true });
+    for (const dir of VENDORED_DIRS) {
+        fs.cpSync(path.join(extractedEngineDir, dir), path.join(engineDir, dir), { recursive: true });
+    }
+    replaced.push('engine/');
+    // Same "missing is not corrupt" allowance as scaffoldProject: a tarball published before this
+    // feature shipped simply won't have it, and upgrade must not fail a project onto that tarball.
+    const serviceWorker = path.join(extractedEngineDir, 'sw-cache-buster.js');
+    if (fs.existsSync(serviceWorker)) {
+        fs.cpSync(serviceWorker, path.join(root, 'sw-cache-buster.js'));
+        replaced.push('sw-cache-buster.js');
+    }
+    for (const [name, render] of PLATFORM_GENERATED_FILES) {
+        fs.writeFileSync(path.join(root, name), render());
+        replaced.push(name);
+    }
+    // Read-modify-write, not re-rendered from renderBitmagicJson: re-rendering would discard any
+    // field a later CLI/engine version adds to the metadata that this version doesn't know about.
+    const bitmagicJsonPath = path.join(root, 'bitmagic.json');
+    const meta = JSON.parse(fs.readFileSync(bitmagicJsonPath, 'utf-8'));
+    const previousEngineVersion = typeof meta.engineVersion === 'string' ? meta.engineVersion : '';
+    meta.engineVersion = engineVersion;
+    fs.writeFileSync(bitmagicJsonPath, `${JSON.stringify(meta, null, 2)}\n`);
+    replaced.push('bitmagic.json');
+    return { engineVersion, previousEngineVersion, replaced };
+}
+//# sourceMappingURL=upgrade-project.js.map

package/dist/scaffold/upgrade-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-project.js","sourceRoot":"","sources":["../../src/scaffold/upgrade-project.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAiBvE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAuB;IACpD,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAC5D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAChB,6BAA6B,GAAG,kBAAkB,MAAM,yCAAyC,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5C,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEzB,8FAA8F;IAC9F,+FAA+F;IAC/F,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;IAC1E,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,wBAAwB,EAAE,CAAC;QACtD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,6FAA6F;IAC7F,8FAA8F;IAC9F,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAA4B,CAAC;IAC/F,MAAM,qBAAqB,GAAG,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACnC,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACzE,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC;AAC5D,CAAC"}