@sky.ui.pro/core 0.0.2 → 0.0.4

package/package.json

@@ -1,24 +1,21 @@
 {
   "name": "@sky.ui.pro/core",
-  "version": "0.0.2",
-  "description": "Sky UI Pro web components (stub — artifacts download on postinstall)",
+  "version": "0.0.4",
+  "description": "Sky UI Pro web components — installs full package via postinstall (online license).",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",
-  "sideEffects": true,
   "main": "./dist/stub/index.js",
-  "types": "./dist/stub/index.d.ts",
   "exports": {
-    ".": {
-      "import": "./dist/stub/index.js",
-      "types": "./dist/stub/index.d.ts"
-    },
-    "./package.json": "./package.json"
+    ".": "./dist/stub/index.js"
   },
   "files": [
     "scripts/postinstall.mjs",
+    "scripts/token.mjs",
     "dist/stub",
     "README.md",
-    "LICENSE.md"
+    "LICENSE.md",
+    "scripts/project-env.mjs",
+    "scripts/merge-manifest.mjs"
   ],
   "scripts": {
     "postinstall": "node ./scripts/postinstall.mjs"
@@ -27,9 +24,14 @@
     "tar": "^7.4.3"
   },
   "peerDependencies": {
-    "@sky.ui/core": "^0.0.2",
+    "@sky.ui/core": "^0.0.3",
     "lit": ">=3 <4"
   },
+  "peerDependenciesMeta": {
+    "lit": {
+      "optional": true
+    }
+  },
   "skyUiPro": {
     "apiBase": "https://library.sky-ui.com",
     "artifactRegistry": "gitlab",
@@ -38,5 +40,14 @@
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
-  }
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.com/sky_ui/sky-ui.git",
+    "directory": "packages/pro-npm/core"
+  },
+  "bugs": {
+    "url": "https://gitlab.com/sky_ui/sky-ui/-/issues"
+  },
+  "homepage": "https://library.sky-ui.com"
 }

package/scripts/merge-manifest.mjs

@@ -0,0 +1,81 @@
+/**
+ * Merge public npm stub manifest with GitLab artifact manifest after postinstall hydration.
+ */
+
+export const ARTIFACT_MANIFEST_SIDECAR = ".sky-ui-pro-artifact-manifest.json";
+
+const PRO_ARTIFACT_PREFIX = "@sky.ui.pro-artifact/";
+const PRO_PUBLIC_PREFIX = "@sky.ui.pro/";
+
+/** Rename @sky.ui.pro-artifact/* deps to @sky.ui.pro/* for installed packages. */
+export function renameProArtifactDeps(deps) {
+  if (!deps || typeof deps !== "object") return deps;
+  const out = { ...deps };
+  for (const [key, value] of Object.entries(out)) {
+    if (key.startsWith(PRO_ARTIFACT_PREFIX)) {
+      const next = `${PRO_PUBLIC_PREFIX}${key.slice(PRO_ARTIFACT_PREFIX.length)}`;
+      if (!(next in out)) out[next] = value;
+      delete out[key];
+    }
+  }
+  return out;
+}
+
+/** True when exports already point at hydrated artifact paths (not stub-only). */
+export function hasHydratedExports(manifest) {
+  const exp = manifest?.exports;
+  if (!exp || typeof exp !== "object") return false;
+  if (exp["./vite"] || exp["./webpack"] || exp["./rollup"] || exp["./license"]) return true;
+  const root = exp["."];
+  if (typeof root === "string") {
+    return root.includes("dist/index") || (root.includes("/dist/") && !root.includes("/stub/"));
+  }
+  if (root && typeof root === "object") {
+    const imp = root.import ?? root.default ?? root.module;
+    return typeof imp === "string" && imp.includes("dist/index");
+  }
+  return false;
+}
+
+/**
+ * Build installed package.json: artifact resolution surface + public stub identity.
+ * @param {Record<string, unknown>} stub
+ * @param {Record<string, unknown>} artifact
+ */
+export function mergeHydratedManifest(stub, artifact) {
+  const stubDeps = stub.dependencies && typeof stub.dependencies === "object" ? stub.dependencies : {};
+  const tarVersion = stubDeps.tar;
+
+  const merged = {
+    name: stub.name,
+    version: stub.version,
+    description: stub.description ?? artifact.description,
+    type: stub.type ?? artifact.type,
+    license: stub.license ?? artifact.license,
+    main: artifact.main,
+    module: artifact.module,
+    types: artifact.types,
+    sideEffects: artifact.sideEffects,
+    exports: artifact.exports,
+    peerDependencies: {
+      ...renameProArtifactDeps(artifact.peerDependencies),
+      ...(stub.peerDependencies ?? {}),
+    },
+    dependencies: {
+      ...renameProArtifactDeps(artifact.dependencies),
+      ...(tarVersion ? { tar: tarVersion } : {}),
+    },
+    scripts: stub.scripts?.postinstall ? { postinstall: stub.scripts.postinstall } : {},
+    skyUiPro: stub.skyUiPro,
+    publishConfig: stub.publishConfig,
+    repository: stub.repository,
+    bugs: stub.bugs,
+    homepage: stub.homepage,
+  };
+
+  if (artifact.peerDependenciesMeta && typeof artifact.peerDependenciesMeta === "object") {
+    merged.peerDependenciesMeta = artifact.peerDependenciesMeta;
+  }
+
+  return merged;
+}

package/scripts/postinstall.mjs

@@ -1,37 +1,47 @@
 #!/usr/bin/env node
 /**
  * Downloads the full @sky.ui.pro/* artifact from the Sky UI npm proxy (GitLab upstream).
- * Install flow matches HeroUI Pro: cache restore → else license-checked download; failed auth
- * does not remove artifacts already on disk.
+ * Cache restore re-validates the access token; install fails closed without a valid token.
  */
 import { createWriteStream } from "node:fs";
-import { access, cp, mkdir, mkdtemp, readdir, readFile, rm, writeFile } from "node:fs/promises";
-import { homedir, tmpdir } from "node:os";
+import { cp, mkdir, mkdtemp, readdir, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { pipeline } from "node:stream/promises";
 import { extract } from "tar";
+import {
+  ARTIFACT_MANIFEST_SIDECAR,
+  hasHydratedExports,
+  mergeHydratedManifest,
+} from "./merge-manifest.mjs";
+import {
+  ENTITLEMENT_MARKER,
+  cacheRoot,
+  exists,
+  isInstallStrict,
+  legacyCacheRoot,
+  loadInstallProjectEnv,
+  resolveApiBase,
+  resolveToken,
+  validateAccessTokenOnline,
+  writeEntitlementMarker,
+  formatRenewalEmailHint,
+} from "./token.mjs";
 
 const scriptDir = dirname(fileURLToPath(import.meta.url));
 const pkgRoot = join(scriptDir, "..");
-const SKY_UI_HOME = join(homedir(), ".sky.ui");
-const LEGACY_SKY_UI_HOME = join(homedir(), ".sky-ui");
-const cacheRoot = join(SKY_UI_HOME, "cache");
-const legacyCacheRoot = join(LEGACY_SKY_UI_HOME, "cache");
 
-async function exists(p) {
-  try {
-    await access(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
+const SKIP_COPY_TO_INSTALL = new Set([ENTITLEMENT_MARKER, ARTIFACT_MANIFEST_SIDECAR]);
 
 async function readJson(p) {
   return JSON.parse(await readFile(p, "utf8"));
 }
 
+async function writeJson(p, data) {
+  await writeFile(p, `${JSON.stringify(data, null, 2)}\n`, "utf8");
+}
+
 function packageSlug(name) {
   return name.replace(/^@/, "").replace("/", "-");
 }
@@ -40,9 +50,10 @@ function cacheVersionDir(root, slug, version) {
   return join(root, slug, version);
 }
 
-async function copyDirectoryContents(src, dest) {
+async function copyDirectoryContents(src, dest, { skip = SKIP_COPY_TO_INSTALL } = {}) {
   await mkdir(dest, { recursive: true });
   for (const entry of await readdir(src, { withFileTypes: true })) {
+    if (skip.has(entry.name)) continue;
     await cp(join(src, entry.name), join(dest, entry.name), { recursive: true, force: true });
   }
 }
@@ -57,52 +68,81 @@ async function enforceCachePolicy(slug, version) {
   }
 }
 
-async function restoreFromCache(slug, version, target) {
+async function readArtifactManifestSidecar(cacheDir) {
+  const sidecar = join(cacheDir, ARTIFACT_MANIFEST_SIDECAR);
+  if (!(await exists(sidecar))) return null;
+  return readJson(sidecar);
+}
+
+/** Read artifact package.json from cached tarball (legacy caches without sidecar). */
+async function readArtifactManifestFromTarball(slug, version) {
+  const tgz = join(cacheRoot, `${slug}-${version}.tgz`);
+  if (!(await exists(tgz))) return null;
+  const stagingDir = await mkdtemp(join(tmpdir(), `sky.ui.pro-manifest-${slug}-${version}-`));
+  try {
+    await extract({ file: tgz, cwd: stagingDir, strip: 1 });
+    return readJson(join(stagingDir, "package.json"));
+  } catch {
+    return null;
+  } finally {
+    await rm(stagingDir, { recursive: true, force: true });
+  }
+}
+
+async function resolveArtifactManifest(stubManifest, slug, version, cacheDir) {
+  const sidecar = cacheDir ? await readArtifactManifestSidecar(cacheDir) : null;
+  if (sidecar) return sidecar;
+  return readArtifactManifestFromTarball(slug, version);
+}
+
+async function applyHydratedManifest(targetRoot, stubManifest, artifactManifest) {
+  const merged = mergeHydratedManifest(stubManifest, artifactManifest);
+  await writeJson(join(targetRoot, "package.json"), merged);
+  return merged;
+}
+
+async function finalizeHydratedManifest(targetRoot, stubManifest, slug, version, cacheDir) {
+  const current = await readJson(join(targetRoot, "package.json"));
+  if (hasHydratedExports(current)) {
+    return current;
+  }
+  const artifactManifest = await resolveArtifactManifest(stubManifest, slug, version, cacheDir);
+  if (!artifactManifest) return current;
+  return applyHydratedManifest(targetRoot, stubManifest, artifactManifest);
+}
+
+async function restoreFromCache(slug, version, target, stubManifest) {
   for (const root of [cacheRoot, legacyCacheRoot]) {
     const src = cacheVersionDir(root, slug, version);
     if (!(await exists(src))) continue;
     const entries = await readdir(src);
     if (entries.length === 0) continue;
     await copyDirectoryContents(src, target);
-    return true;
+    await finalizeHydratedManifest(target, stubManifest, slug, version, src);
+    return { cacheDir: src };
   }
-  return false;
+  return null;
 }
 
-async function saveToCache(slug, version, source) {
+async function saveToCache(slug, version, source, artifactManifest) {
   const dest = cacheVersionDir(cacheRoot, slug, version);
   await rm(dest, { recursive: true, force: true });
   await mkdir(dest, { recursive: true });
   await copyDirectoryContents(source, dest);
+  if (artifactManifest) {
+    await writeJson(join(dest, ARTIFACT_MANIFEST_SIDECAR), artifactManifest);
+  }
 }
 
-async function resolveToken() {
-  const envCi = process.env.SKY_UI_AUTH_TOKEN?.trim();
-  if (envCi) return envCi;
-  const envPersonal = process.env.SKY_UI_PERSONAL_TOKEN?.trim();
-  if (envPersonal) return envPersonal;
-  for (const credPath of [
-    join(SKY_UI_HOME, "credentials.json"),
-    join(LEGACY_SKY_UI_HOME, "credentials.json"),
-  ]) {
-    if (!(await exists(credPath))) continue;
-    const creds = JSON.parse(await readFile(credPath, "utf8"));
-    if (typeof creds.personalToken === "string" && creds.personalToken.trim()) {
-      return creds.personalToken.trim();
-    }
-    if (typeof creds.authToken === "string" && creds.authToken.trim()) {
-      return creds.authToken.trim();
+async function invalidateCache(slug, version) {
+  for (const root of [cacheRoot, legacyCacheRoot]) {
+    const dir = cacheVersionDir(root, slug, version);
+    if (await exists(dir)) {
+      await rm(dir, { recursive: true, force: true });
     }
   }
-  return null;
-}
-
-function resolveApiBase(pkg) {
-  const fromEnv = process.env.SKY_UI_API_URL?.trim();
-  if (fromEnv) return fromEnv.replace(/\/api\/?$/, "").replace(/\/$/, "");
-  const fromPkg = pkg?.skyUiPro?.apiBase?.trim();
-  if (fromPkg) return fromPkg.replace(/\/$/, "");
-  return "https://library.sky-ui.com";
+  const tgz = join(cacheRoot, `${slug}-${version}.tgz`);
+  if (await exists(tgz)) await rm(tgz, { force: true });
 }
 
 function tarballFileName(name, version) {
@@ -116,7 +156,7 @@ function tarballUrl(apiBase, name, version) {
   return `${base}/npm/${scopePath}/-/${file}`;
 }
 
-function printMissingToken(name) {
+function printMissingToken(name, apiBase) {
   console.warn(`
 [@sky.ui.pro] Missing install token — ${name} was not downloaded.
 
@@ -127,8 +167,26 @@ function printMissingToken(name) {
   CI / pipelines:
     export SKY_UI_AUTH_TOKEN=sk_ci_…
 
-  Then re-run:  npm install ${name}
+  Or add SKY_UI_PERSONAL_TOKEN / SKY_UI_AUTH_TOKEN to your project .env
+  API host (SKY_UI_API_URL): ${apiBase}
+
+  Then re-run:  npm install "${name}"
   Docs: https://library.sky-ui.com/docs/getting-started
+
+  Maintainer escape hatch: SKY_UI_PRO_LENIENT=1
+`);
+}
+
+function printInvalidToken(name, result, apiBase) {
+  console.error(
+    `[@sky.ui.pro] License validation failed for ${name}: ${result.status ?? "inactive"}${
+      result.error ? ` — ${result.error}` : ""
+    }`,
+  );
+  console.error(`[@sky.ui.pro] API host: ${apiBase}`);
+  const renewalHint = formatRenewalEmailHint(result);
+  console.error(`
+  Renew or regenerate your token, then re-run:  npm install "${name}"${renewalHint}
 `);
 }
 
@@ -136,10 +194,10 @@ async function installFromTarball(tgzPath, slug, version, stubManifest) {
   const stagingDir = await mkdtemp(join(tmpdir(), `sky.ui.pro-${slug}-${version}-`));
   try {
     await extract({ file: tgzPath, cwd: stagingDir, strip: 1 });
+    const artifactManifest = await readJson(join(stagingDir, "package.json"));
     await copyDirectoryContents(stagingDir, pkgRoot);
-    // Keep npm stub identity (@sky.ui.pro/*) — artifact tarballs use @sky.ui.pro-artifact/* on GitLab.
-    await writeFile(join(pkgRoot, "package.json"), `${JSON.stringify(stubManifest, null, 2)}\n`);
-    await saveToCache(slug, version, pkgRoot);
+    await applyHydratedManifest(pkgRoot, stubManifest, artifactManifest);
+    await saveToCache(slug, version, pkgRoot, artifactManifest);
   } finally {
     await rm(stagingDir, { recursive: true, force: true });
   }
@@ -148,6 +206,8 @@ async function installFromTarball(tgzPath, slug, version, stubManifest) {
 async function main() {
   if (process.env.SKY_UI_PRO_SKIP_POSTINSTALL === "1") return;
 
+  await loadInstallProjectEnv(pkgRoot);
+
   const pkg = await readJson(join(pkgRoot, "package.json"));
   const { name, version } = pkg;
   if (!name?.startsWith("@sky.ui.pro/") || !version) {
@@ -156,25 +216,52 @@ async function main() {
   }
 
   const stubManifest = structuredClone(pkg);
-
   const slug = packageSlug(name);
+  const apiBase = resolveApiBase(pkg);
+  const strict = isInstallStrict();
+
   await enforceCachePolicy(slug, version);
 
-  if (await restoreFromCache(slug, version, pkgRoot)) {
-    console.log(`[@sky.ui.pro] Restored ${name}@${version} from cache.`);
-    return;
+  const token = await resolveToken();
+  const cacheAvailable =
+    (await exists(cacheVersionDir(cacheRoot, slug, version))) ||
+    (await exists(cacheVersionDir(legacyCacheRoot, slug, version)));
+
+  if (cacheAvailable) {
+    if (!token) {
+      printMissingToken(name, apiBase);
+      if (strict) process.exit(1);
+      return;
+    }
+    const validation = await validateAccessTokenOnline(token, apiBase);
+    if (validation.active) {
+      if (await restoreFromCache(slug, version, pkgRoot, stubManifest)) {
+        await writeEntitlementMarker(pkgRoot, { name, version, status: validation.status ?? "active" });
+        console.log(`[@sky.ui.pro] Restored ${name}@${version} from cache.`);
+        return;
+      }
+    } else {
+      printInvalidToken(name, validation, apiBase);
+      await invalidateCache(slug, version);
+      if (strict) process.exit(1);
+      return;
+    }
   }
 
-  const token = await resolveToken();
   if (!token) {
-    printMissingToken(name);
-    if (process.env.SKY_UI_PRO_STRICT === "1" || process.env.SKY_UI_AUTH_TOKEN) {
-      process.exit(1);
-    }
+    printMissingToken(name, apiBase);
+    if (strict) process.exit(1);
+    return;
+  }
+
+  const preDownloadValidation = await validateAccessTokenOnline(token, apiBase);
+  if (!preDownloadValidation.active) {
+    printInvalidToken(name, preDownloadValidation, apiBase);
+    if (strict) process.exit(1);
     return;
   }
 
-  const url = tarballUrl(resolveApiBase(pkg), name, version);
+  const url = tarballUrl(apiBase, name, version);
   const res = await fetch(url, {
     headers: { Authorization: `Bearer ${token}`, Accept: "application/octet-stream" },
   });
@@ -190,6 +277,7 @@ async function main() {
   const tgzPath = join(cacheRoot, `${slug}-${version}.tgz`);
   await pipeline(res.body, createWriteStream(tgzPath));
   await installFromTarball(tgzPath, slug, version, stubManifest);
+  await writeEntitlementMarker(pkgRoot, { name, version, status: "active" });
   console.log(`[@sky.ui.pro] Installed ${name}@${version}`);
 }
 

package/scripts/project-env.mjs

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+/**
+ * Unified Sky UI Pro / CLI project `.env` loading.
+ * Source of truth — synced to @sky.ui/cli and @sky.ui.pro/* postinstall scripts before publish.
+ *
+ * Loads only `SKY_UI_*` keys. Shell env always wins (existing process.env is never overwritten).
+ * Search order: INIT_CWD → npm local prefix → SKY_UI_PROJECT_ROOT → cwd → project roots.
+ */
+import { access, readFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+
+export const SKY_UI_ENV_PREFIX = "SKY_UI_";
+
+/** Filenames tried in each project directory (later files override earlier within the same dir). */
+export const SKY_UI_ENV_FILES = [".env", ".env.local"];
+
+/** Documented variables (for README / tooling — not enforced here). */
+export const SKY_UI_ENV_VARS = [
+  "SKY_UI_API_URL",
+  "SKY_UI_AUTH_TOKEN",
+  "SKY_UI_PERSONAL_TOKEN",
+  "SKY_UI_PROJECT_ROOT",
+  "SKY_UI_PRO_FRAMEWORK",
+  "SKY_UI_PRO_LENIENT",
+  "SKY_UI_PRO_LICENSE_LENIENT",
+  "SKY_UI_PRO_SKIP_POSTINSTALL",
+  "SKY_UI_PRO_STRICT",
+  "SKY_UI_NPM_REGISTRY",
+];
+
+export async function pathExists(p) {
+  try {
+    await access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function normalizeDirKey(dir) {
+  return dir.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+
+function shouldLoadKey(key) {
+  return key.startsWith(SKY_UI_ENV_PREFIX);
+}
+
+function envAlreadySet(key) {
+  const v = process.env[key];
+  return typeof v === "string" && v.trim().length > 0;
+}
+
+function unquote(value) {
+  if (
+    (value.startsWith('"') && value.endsWith('"')) ||
+    (value.startsWith("'") && value.endsWith("'"))
+  ) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+
+/** Parse and apply one `.env` file. Does not overwrite non-empty process.env values. */
+export async function loadEnvFile(envFilePath) {
+  try {
+    const raw = await readFile(envFilePath, "utf8");
+    for (const line of raw.split(/\r?\n/)) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq <= 0) continue;
+      const key = trimmed.slice(0, eq).trim();
+      if (!shouldLoadKey(key)) continue;
+      if (envAlreadySet(key)) continue;
+      process.env[key] = unquote(trimmed.slice(eq + 1).trim());
+    }
+  } catch {
+    /* missing or unreadable */
+  }
+}
+
+/** Load `.env` (+ `.env.local`) from a project directory. */
+export async function loadProjectEnv(cwd = process.cwd()) {
+  for (const name of SKY_UI_ENV_FILES) {
+    await loadEnvFile(join(cwd, name));
+  }
+}
+
+/** Walk up to find the nearest directory containing `package.json`. */
+export async function findProjectRoot(startDir, maxDepth = 12) {
+  let dir = startDir;
+  for (let i = 0; i < maxDepth; i++) {
+    if (await pathExists(join(dir, "package.json"))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return startDir;
+}
+
+/**
+ * Directories to scan for `.env`, in priority order (first match wins per key;
+ * later dirs only fill keys still unset).
+ */
+export async function collectEnvSearchDirs(options = {}) {
+  const { pkgRoot, extraDirs = [] } = options;
+  const seen = new Set();
+  const ordered = [];
+
+  const push = (dir) => {
+    if (!dir || typeof dir !== "string") return;
+    const key = normalizeDirKey(dir);
+    if (seen.has(key)) return;
+    seen.add(key);
+    ordered.push(dir);
+  };
+
+  push(process.env.INIT_CWD);
+  push(process.env.npm_config_local_prefix);
+  push(process.env.SKY_UI_PROJECT_ROOT?.trim());
+  push(process.cwd());
+
+  const cwdRoot = await findProjectRoot(process.cwd());
+  push(cwdRoot);
+
+  if (pkgRoot) {
+    push(await findProjectRoot(dirname(pkgRoot)));
+  }
+
+  for (const dir of extraDirs) {
+    push(dir);
+  }
+
+  return ordered;
+}
+
+/**
+ * Load Sky UI env from consumer project `.env` files.
+ * @param {{ pkgRoot?: string, extraDirs?: string[] }} [options]
+ */
+export async function loadConsumerProjectEnv(options = {}) {
+  for (const dir of await collectEnvSearchDirs(options)) {
+    await loadProjectEnv(dir);
+  }
+}
+
+/** @deprecated Alias used by postinstall — prefer loadConsumerProjectEnv */
+export async function loadInstallProjectEnv(pkgRoot) {
+  return loadConsumerProjectEnv({ pkgRoot });
+}