@magicpixelart/cli 0.1.0 → 0.1.1

package/README.md

@@ -1,13 +1,13 @@
-# @magicpixel/cli
+# @magicpixelart/cli
 
 Sync MagicPixel pixel-art assets to your local project as flattened PNGs. Zero runtime — just files on disk that your bundler picks up.
 
 ## Install
 
 ```bash
-npm install --save-dev @magicpixel/cli
-# or: pnpm add -D @magicpixel/cli
-# or: bun add -d @magicpixel/cli
+npm install --save-dev @magicpixelart/cli
+# or: pnpm add -D @magicpixelart/cli
+# or: bun add -d @magicpixelart/cli
 ```
 
 Requires Node.js ≥ 18.
@@ -23,6 +23,8 @@ npx magicpixel sync --watch  # keeps assets fresh while you work
 
 Get an API key at [magicpixel.art/settings](https://magicpixel.art/settings) → API Keys. Each key is bound to one project.
 
+The key is read **only** from the `MAGICPIXEL_API_KEY` environment variable — never from `magicpixel.json` or any other file. This is intentional: it keeps secrets out of repos and CI logs.
+
 ## Typed asset index (default on)
 
 If `emitIndex` is true in `magicpixel.json`, every sync writes `<outDir>/index.ts`:
@@ -93,7 +95,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with: { node-version: 20 }
-      - run: npx -y @magicpixel/cli sync --prune --quiet
+      - run: npx -y @magicpixelart/cli sync --prune --quiet
         env:
           MAGICPIXEL_API_KEY: ${{ secrets.MAGICPIXEL_API_KEY }}
       - uses: peter-evans/create-pull-request@v6

package/dist/api.js

@@ -57,12 +57,18 @@ export async function fetchManifestPage(opts) {
 export async function fetchAllManifest(config, since) {
     const out = [];
     let cursor;
-    do {
-        const page = await fetchManifestPage({ config, since, cursor, limit: 500 });
-        out.push(...page.items);
-        cursor = page.nextCursor ?? undefined;
-    } while (cursor);
-    return out;
+    // Cycle guard: caps total pages so a buggy server cursor can't hang the CLI.
+    // At 500 entries/page this is 100k assets — well past any realistic project.
+    const MAX_PAGES = 200;
+    for (let page = 0; page < MAX_PAGES; page++) {
+        const res = await fetchManifestPage({ config, since, cursor, limit: 500 });
+        out.push(...res.items);
+        cursor = res.nextCursor ?? undefined;
+        if (!cursor)
+            return out;
+    }
+    throw new Error(`manifest: pagination exceeded ${MAX_PAGES} pages — possible server cursor loop.\n` +
+        `  Fix: re-run with --full, or report at https://github.com/magicpixel/cli/issues.`);
 }
 /**
  * Download a single asset by key. Returns null on 304 (not modified).

package/dist/commands/init.js

@@ -20,7 +20,7 @@ export async function initCommand(opts) {
     if (interactive) {
         const rl = createInterface({ input: stdin, output: stdout });
         try {
-            console.log(kleur.bold('Set up @magicpixel/cli'));
+            console.log(kleur.bold('Set up @magicpixelart/cli'));
             if (framework)
                 console.log(kleur.dim(`  Detected: ${framework}`));
             console.log();
@@ -115,9 +115,11 @@ function isImportableOutDir(outDir) {
 async function ensureGitignore() {
     const path = resolve(process.cwd(), '.gitignore');
     const marker = '.magicpixel/';
+    // Accept any of these as "already ignored" so we don't append a duplicate.
+    const equivalents = new Set(['.magicpixel', '.magicpixel/', '/.magicpixel', '/.magicpixel/']);
     if (existsSync(path)) {
         const current = await readFile(path, 'utf8');
-        if (current.split('\n').some((l) => l.trim() === marker))
+        if (current.split('\n').some((l) => equivalents.has(l.trim())))
             return false;
         await appendFile(path, (current.endsWith('\n') ? '' : '\n') + `\n# MagicPixel CLI state\n${marker}\n`);
         return true;

package/dist/commands/sync.js

@@ -1,5 +1,6 @@
 import kleur from 'kleur';
 import ora from 'ora';
+import { createHash } from 'node:crypto';
 import { mkdir, writeFile, unlink, readdir, rm, rename } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { dirname, relative, resolve } from 'node:path';
@@ -19,16 +20,26 @@ export async function syncCommand(opts) {
 async function watchLoop(opts) {
     const intervalSec = typeof opts.watch === 'string' ? Math.max(2, parseInt(opts.watch, 10) || 10) : 10;
     console.log(kleur.dim(`[watch] polling every ${intervalSec}s. Ctrl+C to stop.`));
+    let stopping = false;
+    const onSigint = () => {
+        if (stopping)
+            return;
+        stopping = true;
+        // \x1b[2K\r clears any in-flight status line before the goodbye message.
+        process.stdout.write('\x1b[2K\r');
+        console.log(kleur.dim('[watch] stopped.'));
+        process.exit(0);
+    };
+    process.on('SIGINT', onSigint);
     // Run once eagerly so first sync isn't delayed by the interval.
     let inFlight = false;
     const tick = async () => {
-        if (inFlight)
+        if (inFlight || stopping)
             return;
         inFlight = true;
         try {
             const r = await runOnce({ ...opts, quiet: true, watch: false });
             if (r.downloaded > 0 || r.pruned > 0) {
-                // \x1b[2K\r clears any residual "no changes" line from the previous tick.
                 process.stdout.write('\x1b[2K\r');
                 console.log(`${kleur.dim(timestamp())} ${kleur.green('✓')} ${r.downloaded} downloaded` +
                     (r.pruned ? `, ${r.pruned} pruned` : '') +
@@ -46,8 +57,7 @@ async function watchLoop(opts) {
         }
     };
     await tick();
-    // eslint-disable-next-line no-constant-condition
-    while (true) {
+    while (!stopping) {
         await new Promise((r) => setTimeout(r, intervalSec * 1000));
         await tick();
     }
@@ -58,6 +68,11 @@ async function runOnce(opts) {
     const startedAt = new Date().toISOString();
     const concurrency = Math.max(1, Math.min(opts.concurrency ?? 6, 16));
     const quiet = !!opts.quiet;
+    // Warn loudly when a custom endpoint is configured — easy to forget a test
+    // override before committing magicpixel.json to a real repo / CI.
+    if (!quiet && config.endpoint) {
+        console.log(kleur.yellow(`! using custom endpoint: ${config.endpoint}`));
+    }
     // Incremental: only fetch what changed since last successful sync.
     // --full forces a from-scratch fetch.
     const since = opts.full ? undefined : state.lastSync;
@@ -142,6 +157,14 @@ async function runOnce(opts) {
                 result.unchanged++;
             }
             else {
+                // Verify the payload matches what the manifest advertised. Guards
+                // against silently writing a corrupted body to disk.
+                if (entry.sha256) {
+                    const actual = createHash('sha256').update(bytes).digest('hex');
+                    if (actual !== entry.sha256) {
+                        throw new Error(`sha256 mismatch (expected ${entry.sha256.slice(0, 12)}…, got ${actual.slice(0, 12)}…)`);
+                    }
+                }
                 await mkdir(dirname(diskPath), { recursive: true });
                 const tmp = `${diskPath}.${process.pid}.tmp`;
                 await writeFile(tmp, bytes);

package/dist/config.js

@@ -77,4 +77,4 @@ export function getApiKey() {
     }
     return key;
 }
-export const CLI_USER_AGENT = `@magicpixel/cli/0.1.0 (node ${process.versions.node})`;
+export { CLI_USER_AGENT, CLI_VERSION } from './version.js';

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { Command } from 'commander';
+import { Command, InvalidArgumentError } from 'commander';
 import kleur from 'kleur';
 import { initCommand } from './commands/init.js';
 import { syncCommand } from './commands/sync.js';
@@ -8,6 +8,7 @@ import { removeCommand } from './commands/remove.js';
 import { listCommand } from './commands/list.js';
 import { statusCommand } from './commands/status.js';
 import { whoamiCommand } from './commands/whoami.js';
+import { CLI_VERSION } from './version.js';
 // Node version guard
 const major = Number(process.versions.node.split('.')[0]);
 if (major < 18) {
@@ -18,7 +19,7 @@ const program = new Command();
 program
     .name('magicpixel')
     .description('Sync MagicPixel pixel-art assets to your local project')
-    .version('0.1.0');
+    .version(CLI_VERSION);
 const wrap = (fn) => async (...args) => {
     try {
         await fn(...args);
@@ -44,7 +45,13 @@ program
     .option('--full', 'Ignore lastSync state; re-fetch the full manifest')
     .option('-w, --watch [seconds]', 'Poll for changes (default 10s)', (v) => v ?? true)
     .option('-q, --quiet', 'Minimal output (for CI)')
-    .option('-c, --concurrency <n>', 'Parallel downloads (1–16, default 6)', (v) => parseInt(v, 10))
+    .option('-c, --concurrency <n>', 'Parallel downloads (1–16, default 6)', (v) => {
+    const n = parseInt(v, 10);
+    if (!Number.isFinite(n) || String(n) !== v.trim() || n < 1 || n > 16) {
+        throw new InvalidArgumentError(`expected an integer 1–16, got "${v}".`);
+    }
+    return n;
+})
     .action(wrap(async (opts) => syncCommand(opts)));
 program
     .command('add <glob>')

package/dist/util/emitIndex.js

@@ -10,22 +10,36 @@ import { resolve } from 'node:path';
  * time. No runtime, no bundler config.
  */
 export async function emitTypedIndex(outDir, manifest, cwd = process.cwd()) {
-    const sorted = [...manifest].sort((a, b) => a.key.localeCompare(b.key));
+    // Dedupe by key. A well-behaved manifest never has duplicates, but a server
+    // bug here would otherwise emit duplicate object keys and break TS compile.
+    const seen = new Set();
+    const sorted = [...manifest]
+        .sort((a, b) => a.key.localeCompare(b.key))
+        .filter((e) => {
+        if (seen.has(e.key)) {
+            console.warn(`magicpixel: duplicate manifest key "${e.key}" — keeping first.`);
+            return false;
+        }
+        seen.add(e.key);
+        return true;
+    });
     const lines = [
-        '// AUTOGENERATED by @magicpixel/cli. Do not edit.',
+        '// AUTOGENERATED by @magicpixelart/cli. Do not edit.',
         '// Re-runs of `magicpixel sync` overwrite this file.',
         '',
     ];
-    for (const e of sorted) {
+    // Use positional identifiers (asset_0, asset_1, …) so keys that differ only
+    // by non-alphanumeric chars (e.g. `player/walk` vs `player_walk`) can't
+    // collide on the JS identifier and break the consumer's TS build.
+    sorted.forEach((e, i) => {
         const rel = e.folder ? `./${e.folder}/${e.slug}.png` : `./${e.slug}.png`;
-        const safe = JSON.stringify(rel);
-        lines.push(`import asset_${slugToIdent(e.key)} from ${safe};`);
-    }
+        lines.push(`import asset_${i} from ${JSON.stringify(rel)};`);
+    });
     lines.push('');
     lines.push('export const MagicPixelAssets = {');
-    for (const e of sorted) {
-        lines.push(`  ${JSON.stringify(e.key)}: asset_${slugToIdent(e.key)},`);
-    }
+    sorted.forEach((e, i) => {
+        lines.push(`  ${JSON.stringify(e.key)}: asset_${i},`);
+    });
     lines.push('} as const;');
     lines.push('');
     lines.push('export type MagicPixelAssetKey = keyof typeof MagicPixelAssets;');
@@ -34,6 +48,3 @@ export async function emitTypedIndex(outDir, manifest, cwd = process.cwd()) {
     await writeFile(path, lines.join('\n'), 'utf8');
     return path;
 }
-function slugToIdent(key) {
-    return key.replace(/[^a-zA-Z0-9]/g, '_');
-}

package/dist/version.js

@@ -0,0 +1,8 @@
+import { createRequire } from 'node:module';
+// Single source of truth: read version from package.json at runtime so
+// `npm version <bump>` propagates everywhere without code edits.
+// dist/version.js resolves `../package.json` → tools/cli/package.json.
+const require = createRequire(import.meta.url);
+const pkg = require('../package.json');
+export const CLI_VERSION = pkg.version;
+export const CLI_USER_AGENT = `@magicpixelart/cli/${CLI_VERSION} (node ${process.versions.node})`;

package/package.json

@@ -1,16 +1,12 @@
 {
   "name": "@magicpixelart/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Sync MagicPixel pixel-art assets to your local project.",
   "type": "module",
   "bin": {
-    "magicpixel": "dist/index.js"
+    "magicpixel": "./dist/index.js"
   },
-  "files": [
-    "dist",
-    "README.md",
-    "LICENSE"
-  ],
+  "files": ["dist", "README.md", "LICENSE"],
   "scripts": {
     "build": "tsc && node -e \"require('fs').chmodSync('dist/index.js', 0o755)\"",
     "dev": "tsx src/index.ts",
@@ -30,7 +26,7 @@
     "url": "git+https://github.com/handpoke/magicpixel-cli.git"
   },
   "bugs": {
-    "url": "https://github.com/magicpixel/cli/issues"
+    "url": "https://github.com/handpoke/magicpixel-cli/issues"
   },
   "license": "MIT",
   "author": "MagicPixel",