com.robotsquid.squidhub 0.5.3 → 0.5.5

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 0.5.5
+
+**Upload a build straight from Unity.** `SquidHub → Upload Build…` picks the
+build folder, checks it, and pushes it to SquidHub — no console, no command
+line, no repository checkout.
+
+Set it up once in `SquidHub → Upload Settings` with a key from the publisher
+console (your game → **Upload keys**).
+
+⚠️ **The key is stored in EditorPrefs, never in your project.** It is per-machine
+and per-project-path, so there is no path by which it reaches your repository —
+a better guarantee than being told not to commit it. A key can do exactly one
+thing: upload a build for the one game it was minted for. It cannot read
+anything, publish to a channel, or touch another game.
+
+⚠️ **Uploading is not publishing.** A build arrives registered and not live;
+promoting it to players stays a deliberate act in the console.
+
+The build is refused before anything uploads if it is precompressed, or has no
+`index.html` at its top level. `.DS_Store` and friends are dropped rather than
+uploaded — which is also what makes a Unity-pushed build hash identically to the
+same bytes pushed by `squidhub-release` or dragged into the console.
+
+## 0.5.4
+
+**No functional change from 0.5.3.**
+
+Published to supersede an accidental blanket deprecation: `npm deprecate` was
+run without a version specifier, which marks *every* published version rather
+than one, so 0.5.0 through 0.5.3 all carry npm's generic "Package no longer
+supported" text — including the version people should have been installing.
+
+Deprecation is per-version and there is no package-level flag, so a new release
+is undeprecated by definition. ⚠️ The older versions keep their misleading
+marking; three of them ought to be deprecated anyway (0.5.0 ships no root
+`.meta` files, 0.5.1 predates the uncompressed-upload model, 0.5.2 rewrites
+compressed asset URLs for a hosting model that no longer exists), just not for
+the reason the text gives.
+
+⚠️ **`npm deprecate <package>` with no `@version` applies to everything.** Always
+write `npm deprecate <package>@<version>`.
+
 ## 0.5.3
 
 **Compressed builds are now refused in the Editor**, with a message naming the

package/Editor/SquidHubBuildScan.cs

@@ -0,0 +1,165 @@
+// Turning a build folder into the file list the upload API expects.
+//
+// ⚠️ Pure System.* — no UnityEditor, no UnityEngine, no network. That is
+// deliberate: this is the only part of the uploader with real logic, so it
+// stays runnable under plain `dotnet` in tools/test. The same split is what
+// made SquidHubHtml testable.
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+
+namespace SquidHub.Editor
+{
+    internal sealed class ScannedFile
+    {
+        /// <summary>Forward-slashed path relative to the build root — the R2 key.</summary>
+        public string Path;
+        public string Sha256;
+        public long Bytes;
+        /// <summary>Absolute path, for the upload step.</summary>
+        public string FullPath;
+    }
+
+    internal sealed class BuildScan
+    {
+        public readonly List<ScannedFile> Files = new List<ScannedFile>();
+        /// <summary>Reasons this build cannot be uploaded. Non-empty means stop.</summary>
+        public readonly List<string> Refusals = new List<string>();
+        /// <summary>OS metadata dropped. Reported, never silent.</summary>
+        public readonly List<string> Skipped = new List<string>();
+        public long TotalBytes;
+        public bool HasEntryPoint;
+    }
+
+    internal static class SquidHubBuildScan
+    {
+        /// <summary>
+        /// ⚠️ Dropped, not refused — and it must match what the CLI and console do.
+        /// They hash a directory listing that never contains these, so filtering
+        /// here is what makes all three agree on a buildHash.
+        /// </summary>
+        private static bool IsJunk(string relativePath)
+        {
+            var name = relativePath.Split('/').Last();
+            return name == ".DS_Store" || name == "Thumbs.db" || relativePath.StartsWith("__MACOSX/");
+        }
+
+        /// <summary>
+        /// ⚠️ Precompressed builds cannot be served — Cloudflare either strips
+        /// Content-Encoding or compresses the body a second time. The server
+        /// refuses these too and is the authority; refusing here means finding
+        /// out before uploading a couple of hundred megabytes.
+        /// </summary>
+        private static string RefusalFor(string relativePath)
+        {
+            foreach (var pair in new[] { (".br", "Brotli"), (".gz", "gzip"), (".zz", "deflate") })
+            {
+                if (!relativePath.EndsWith(pair.Item1, StringComparison.OrdinalIgnoreCase)) continue;
+                return relativePath + " is " + pair.Item2 + "-compressed. SquidHub serves build " +
+                       "assets uncompressed and Cloudflare compresses them at the edge. Set Player " +
+                       "Settings > Publishing Settings > Compression Format to Disabled and rebuild.";
+            }
+            return null;
+        }
+
+        public static BuildScan Scan(string root)
+        {
+            var scan = new BuildScan();
+            var full = System.IO.Path.GetFullPath(root);
+
+            foreach (var file in Directory.GetFiles(full, "*", SearchOption.AllDirectories).OrderBy(p => p))
+            {
+                // ⚠️ Backslashes normalised. A path hashed as `Build\x.wasm` on
+                // Windows and `Build/x.wasm` elsewhere is the same bytes producing
+                // two different buildHashes.
+                var relative = file.Substring(full.Length).TrimStart('/', '\\').Replace('\\', '/');
+
+                if (IsJunk(relative))
+                {
+                    scan.Skipped.Add(relative);
+                    continue;
+                }
+
+                var refusal = RefusalFor(relative);
+                if (refusal != null)
+                {
+                    scan.Refusals.Add(refusal);
+                    continue;
+                }
+
+                var bytes = File.ReadAllBytes(file);
+                scan.Files.Add(new ScannedFile
+                {
+                    Path = relative,
+                    Sha256 = ToHex(SHA256.Create().ComputeHash(bytes)),
+                    Bytes = bytes.LongLength,
+                    FullPath = file,
+                });
+                scan.TotalBytes += bytes.LongLength;
+            }
+
+            // ⚠️ Checked before anything uploads. The portal frames
+            // /v/<hash>/index.html, so a build without one registers perfectly
+            // and then fails to launch for every player.
+            scan.HasEntryPoint = scan.Files.Any(f => f.Path == "index.html");
+            if (!scan.HasEntryPoint)
+            {
+                scan.Refusals.Add(
+                    "No index.html at the top level of " + root + ". The game cannot launch. " +
+                    "Point this at the folder Unity built into, not at its parent.");
+            }
+
+            return scan;
+        }
+
+        private static string ToHex(byte[] bytes)
+        {
+            var chars = new char[bytes.Length * 2];
+            for (var i = 0; i < bytes.Length; i++)
+            {
+                chars[i * 2] = "0123456789abcdef"[bytes[i] >> 4];
+                chars[i * 2 + 1] = "0123456789abcdef"[bytes[i] & 0xF];
+            }
+            return new string(chars);
+        }
+
+        /// <summary>
+        /// The `files` array for the start request.
+        ///
+        /// ⚠️ Hand-built rather than via a JSON library, for the same reason the
+        /// generated wrapper writes its own: a Unity project already carries one
+        /// and shipping a second is a second parser to maintain.
+        /// </summary>
+        public static string FilesJson(IEnumerable<ScannedFile> files)
+        {
+            var parts = files.Select(f =>
+                "{\"path\":" + JsonString(f.Path) +
+                ",\"sha256\":\"" + f.Sha256 + "\"" +
+                ",\"bytes\":" + f.Bytes + "}");
+            return "[" + string.Join(",", parts) + "]";
+        }
+
+        internal static string JsonString(string value)
+        {
+            var sb = new System.Text.StringBuilder("\"");
+            foreach (var c in value)
+            {
+                switch (c)
+                {
+                    case '"': sb.Append("\\\""); break;
+                    case '\\': sb.Append("\\\\"); break;
+                    case '\n': sb.Append("\\n"); break;
+                    case '\r': sb.Append("\\r"); break;
+                    case '\t': sb.Append("\\t"); break;
+                    default:
+                        if (c < ' ') sb.Append("\\u").Append(((int)c).ToString("x4"));
+                        else sb.Append(c);
+                        break;
+                }
+            }
+            return sb.Append('"').ToString();
+        }
+    }
+}

package/Editor/SquidHubBuildScan.cs.meta

@@ -0,0 +1,11 @@
+fileFormatVersion: 2
+guid: 90a9c4481ddb3f880e468bdbe270b8a1
+MonoImporter:
+  externalObjects: {}
+  serializedVersion: 2
+  defaultReferences: []
+  executionOrder: 0
+  icon: {instanceID: 0}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 

package/Editor/SquidHubUploadSettings.cs

@@ -0,0 +1,98 @@
+// Where the upload key lives, and where it must not.
+//
+// ⚠️ EditorPrefs, NEVER a file in the project. A key written under Assets/ ends
+// up in the publisher's git repository, and from there in anyone's clone. This
+// is per-machine and per-user by construction, so there is no path by which
+// committing it is possible — which is a better guarantee than telling people
+// not to.
+using UnityEditor;
+using UnityEngine;
+
+namespace SquidHub.Editor
+{
+    internal static class SquidHubUploadSettings
+    {
+        // ⚠️ Keyed per project path, so two games open on one machine cannot
+        // upload to each other by inheriting a key.
+        private static string Scope => "SquidHub." + Application.dataPath.GetHashCode() + ".";
+
+        private const string DefaultEndpoint = "https://publish.robotsquid.dev";
+
+        public static string Key
+        {
+            get => EditorPrefs.GetString(Scope + "uploadKey", "");
+            set => EditorPrefs.SetString(Scope + "uploadKey", value.Trim());
+        }
+
+        public static string Endpoint
+        {
+            get => EditorPrefs.GetString(Scope + "endpoint", DefaultEndpoint).TrimEnd('/');
+            set => EditorPrefs.SetString(Scope + "endpoint", value.Trim().TrimEnd('/'));
+        }
+
+        public static string BuildFolder
+        {
+            get => EditorPrefs.GetString(Scope + "buildFolder", "");
+            set => EditorPrefs.SetString(Scope + "buildFolder", value);
+        }
+
+        public static bool HasKey => Key.StartsWith("shu_");
+    }
+
+    internal sealed class SquidHubUploadSettingsWindow : EditorWindow
+    {
+        private string _key = "";
+        private string _endpoint = "";
+
+        [MenuItem("SquidHub/Upload Settings", priority = 10)]
+        private static void Open()
+        {
+            var window = GetWindow<SquidHubUploadSettingsWindow>(true, "SquidHub Upload", true);
+            window._key = SquidHubUploadSettings.Key;
+            window._endpoint = SquidHubUploadSettings.Endpoint;
+            window.minSize = new Vector2(460, 210);
+        }
+
+        private void OnGUI()
+        {
+            EditorGUILayout.HelpBox(
+                "Create a key in the publisher console under your game → Upload keys. " +
+                "It can only upload builds for that one game.\n\n" +
+                "The key is stored in EditorPrefs on this machine, never in your project, " +
+                "so it cannot reach your repository.",
+                MessageType.Info);
+
+            // ⚠️ A password field. Not because it is secret from the person
+            // typing it, but because it is pasted during screen shares and
+            // recorded tutorials more often than anyone expects.
+            _key = EditorGUILayout.PasswordField("Upload key", _key);
+            _endpoint = EditorGUILayout.TextField("Console URL", _endpoint);
+
+            EditorGUILayout.Space();
+            using (new EditorGUILayout.HorizontalScope())
+            {
+                if (GUILayout.Button("Save"))
+                {
+                    SquidHubUploadSettings.Key = _key;
+                    SquidHubUploadSettings.Endpoint = string.IsNullOrWhiteSpace(_endpoint)
+                        ? "https://publish.robotsquid.dev"
+                        : _endpoint;
+                    Close();
+                }
+                if (GUILayout.Button("Clear key"))
+                {
+                    SquidHubUploadSettings.Key = "";
+                    _key = "";
+                }
+            }
+
+            if (!string.IsNullOrEmpty(_key) && !_key.StartsWith("shu_"))
+            {
+                EditorGUILayout.HelpBox(
+                    "That does not look like an upload key — they begin with shu_. " +
+                    "A console session cookie will not work here.",
+                    MessageType.Warning);
+            }
+        }
+    }
+}

package/Editor/SquidHubUploadSettings.cs.meta

@@ -0,0 +1,11 @@
+fileFormatVersion: 2
+guid: 205543f3c7718670401e28d4a55209ec
+MonoImporter:
+  externalObjects: {}
+  serializedVersion: 2
+  defaultReferences: []
+  executionOrder: 0
+  icon: {instanceID: 0}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 

package/Editor/SquidHubUploader.cs

@@ -0,0 +1,231 @@
+// SquidHub → Upload Build. The whole publish, from the Editor.
+//
+// ⚠️ Runs the same job API the console does: start, PUT each file, complete.
+// Only the authentication differs — a per-game upload key instead of a session
+// cookie — so a build pushed from here is validated by exactly the same server
+// code as one dragged into the console.
+//
+// ⚠️ Thin ON PURPOSE. Everything with real logic lives in SquidHubBuildScan,
+// which has no UnityEditor dependency and is unit-tested under plain dotnet.
+// This file is plumbing, and plumbing is what cannot be tested here.
+using System;
+using System.Collections;
+using System.IO;
+using System.Text;
+using System.Text.RegularExpressions;
+using UnityEditor;
+using UnityEngine;
+using UnityEngine.Networking;
+
+namespace SquidHub.Editor
+{
+    internal static class SquidHubUploader
+    {
+        private static IEnumerator _routine;
+
+        [MenuItem("SquidHub/Upload Build…", priority = 11)]
+        private static void UploadBuild()
+        {
+            if (!SquidHubUploadSettings.HasKey)
+            {
+                EditorUtility.DisplayDialog("SquidHub",
+                    "No upload key set. Create one in the publisher console under your game → " +
+                    "Upload keys, then paste it into SquidHub → Upload Settings.", "OK");
+                SquidHubUploadSettingsWindow.GetWindow<SquidHubUploadSettingsWindow>();
+                return;
+            }
+
+            var start = SquidHubUploadSettings.BuildFolder;
+            var folder = EditorUtility.OpenFolderPanel(
+                "Select the WebGL build folder (containing index.html)",
+                string.IsNullOrEmpty(start) ? "" : start, "");
+            if (string.IsNullOrEmpty(folder)) return;
+            SquidHubUploadSettings.BuildFolder = folder;
+
+            BuildScan scan;
+            try
+            {
+                scan = SquidHubBuildScan.Scan(folder);
+            }
+            catch (Exception e)
+            {
+                EditorUtility.DisplayDialog("SquidHub", "Could not read that folder:\n\n" + e.Message, "OK");
+                return;
+            }
+
+            // ⚠️ Refusals stop the upload before a byte moves. Every one of them
+            // is something the server would reject anyway; finding out here
+            // saves the publisher the round trip and names the fix.
+            if (scan.Refusals.Count > 0)
+            {
+                EditorUtility.DisplayDialog("SquidHub — build not uploadable",
+                    string.Join("\n\n", scan.Refusals), "OK");
+                return;
+            }
+
+            if (!EditorUtility.DisplayDialog("SquidHub",
+                    $"Upload {scan.Files.Count} files ({scan.TotalBytes / 1024f / 1024f:F1} MB)?" +
+                    (scan.Skipped.Count > 0
+                        ? $"\n\n{scan.Skipped.Count} OS metadata file(s) will be skipped."
+                        : ""),
+                    "Upload", "Cancel"))
+            {
+                return;
+            }
+
+            Run(Upload(scan));
+        }
+
+        // ⚠️ Driven by EditorApplication.update rather than blocking. Sleeping
+        // the main thread would stop UnityWebRequest progressing at all, and the
+        // Editor would appear to hang for the length of the upload.
+        private static void Run(IEnumerator routine)
+        {
+            _routine = routine;
+            EditorApplication.update -= Pump;
+            EditorApplication.update += Pump;
+        }
+
+        private static void Pump()
+        {
+            try
+            {
+                if (_routine != null && _routine.MoveNext()) return;
+            }
+            catch (Exception e)
+            {
+                EditorUtility.ClearProgressBar();
+                Debug.LogError("[SquidHub] upload failed: " + e);
+            }
+            _routine = null;
+            EditorApplication.update -= Pump;
+            EditorUtility.ClearProgressBar();
+        }
+
+        private static IEnumerator Upload(BuildScan scan)
+        {
+            var endpoint = SquidHubUploadSettings.Endpoint;
+            var key = SquidHubUploadSettings.Key;
+
+            EditorUtility.DisplayProgressBar("SquidHub", "Registering build…", 0f);
+
+            var startBody = "{\"intent\":\"start\",\"files\":" + SquidHubBuildScan.FilesJson(scan.Files) + "}";
+            string startResponse = null;
+            yield return Post(endpoint + "/api/ingest", key, startBody, r => startResponse = r);
+
+            if (startResponse == null) yield break;
+
+            if (Field(startResponse, "alreadyPublished") == "true")
+            {
+                EditorUtility.ClearProgressBar();
+                EditorUtility.DisplayDialog("SquidHub",
+                    "These exact bytes are already published as " + Field(startResponse, "buildHash") +
+                    ". Nothing to upload.", "OK");
+                yield break;
+            }
+
+            var jobId = Field(startResponse, "jobId");
+            if (string.IsNullOrEmpty(jobId))
+            {
+                Fail("The server did not start a build job", startResponse);
+                yield break;
+            }
+
+            for (var i = 0; i < scan.Files.Count; i++)
+            {
+                var file = scan.Files[i];
+                EditorUtility.DisplayProgressBar("SquidHub",
+                    $"Uploading {i + 1}/{scan.Files.Count} — {file.Path}",
+                    (float)i / scan.Files.Count);
+
+                var request = new UnityWebRequest(endpoint + "/api/ingest/upload", "PUT");
+                request.uploadHandler = new UploadHandlerRaw(File.ReadAllBytes(file.FullPath));
+                request.downloadHandler = new DownloadHandlerBuffer();
+                request.SetRequestHeader("authorization", "Bearer " + key);
+                request.SetRequestHeader("x-squidhub-job", jobId);
+                request.SetRequestHeader("x-squidhub-path", file.Path);
+                request.SetRequestHeader("x-squidhub-sha256", file.Sha256);
+
+                var op = request.SendWebRequest();
+                while (!op.isDone) yield return null;
+
+                if (request.result != UnityWebRequest.Result.Success)
+                {
+                    Fail("Upload failed on " + file.Path, request.downloadHandler.text);
+                    yield break;
+                }
+            }
+
+            EditorUtility.DisplayProgressBar("SquidHub", "Verifying and registering…", 0.99f);
+
+            string doneResponse = null;
+            yield return Post(endpoint + "/api/ingest",
+                key,
+                "{\"intent\":\"complete\",\"jobId\":" + SquidHubBuildScan.JsonString(jobId) + "}",
+                r => doneResponse = r);
+
+            EditorUtility.ClearProgressBar();
+            if (doneResponse == null) yield break;
+
+            if (Field(doneResponse, "ok") != "true")
+            {
+                Fail("The server refused the build", doneResponse);
+                yield break;
+            }
+
+            // ⚠️ Registered, NOT live. Promoting a build to players is a separate,
+            // deliberate act in the console — saying "uploaded" without saying
+            // that invites someone to assume their players already have it.
+            EditorUtility.DisplayDialog("SquidHub",
+                "Registered " + Field(doneResponse, "buildHash") + ".\n\n" +
+                "It is not live yet — promote it in the publisher console when you are ready.",
+                "OK");
+        }
+
+        private static IEnumerator Post(string url, string key, string body, Action<string> onOk)
+        {
+            var request = new UnityWebRequest(url, "POST");
+            request.uploadHandler = new UploadHandlerRaw(Encoding.UTF8.GetBytes(body));
+            request.downloadHandler = new DownloadHandlerBuffer();
+            request.SetRequestHeader("authorization", "Bearer " + key);
+            request.SetRequestHeader("content-type", "application/json");
+
+            var op = request.SendWebRequest();
+            while (!op.isDone) yield return null;
+
+            if (request.responseCode == 401)
+            {
+                Fail("The upload key was refused",
+                    "Check it in SquidHub → Upload Settings, and that it has not been revoked.");
+                yield break;
+            }
+            if (request.result != UnityWebRequest.Result.Success)
+            {
+                Fail("Request failed", request.error + "\n" + request.downloadHandler.text);
+                yield break;
+            }
+            onOk(request.downloadHandler.text);
+        }
+
+        private static void Fail(string title, string detail)
+        {
+            EditorUtility.ClearProgressBar();
+            Debug.LogError("[SquidHub] " + title + ": " + detail);
+            EditorUtility.DisplayDialog("SquidHub — " + title, detail, "OK");
+        }
+
+        /// <summary>
+        /// ⚠️ A regex, not a JSON parser, and only for the four flat fields this
+        /// flow reads. Shipping a parser in a package that already asks the
+        /// project to bring its own would be a second, worse one to maintain.
+        /// </summary>
+        private static string Field(string json, string name)
+        {
+            var match = Regex.Match(json, "\"" + Regex.Escape(name) + "\"\\s*:\\s*(\"([^\"]*)\"|true|false|[0-9]+)");
+            if (!match.Success) return null;
+            return match.Groups[2].Success && match.Value.Contains("\"" + match.Groups[2].Value + "\"")
+                ? match.Groups[2].Value
+                : match.Groups[1].Value;
+        }
+    }
+}

package/Editor/SquidHubUploader.cs.meta

@@ -0,0 +1,11 @@
+fileFormatVersion: 2
+guid: c34878fbb310a03e1c5ddc1aefe730ac
+MonoImporter:
+  externalObjects: {}
+  serializedVersion: 2
+  defaultReferences: []
+  executionOrder: 0
+  icon: {instanceID: 0}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 

package/README.md

@@ -82,6 +82,29 @@ Then push the folder:
 node src/cli.mjs push --game <slug> --dir <BuildFolder> --env=dev --verify
 ```
 
+## Uploading from Unity
+
+`SquidHub → Upload Build…` does the whole publish — no console, no command line,
+no repository checkout.
+
+**Once:** in the publisher console open your game → **Upload keys** → create one,
+then paste it into `SquidHub → Upload Settings`.
+
+⚠️ **The key never enters your project.** It lives in EditorPrefs, per machine
+and per project path, so it cannot reach your repository. It can do exactly one
+thing: upload a build for the one game it was minted for — it cannot read
+anything, publish to a channel, or touch another game. If it leaks, revoke it in
+the console; the worst it could have done is leave an unwanted build somewhere
+no player can see.
+
+⚠️ **Uploading is not publishing.** The build arrives registered and not live.
+Promoting it to players stays a deliberate act in the console.
+
+The upload is refused before a byte moves if the build is precompressed or has
+no `index.html` at its top level, and OS metadata is dropped rather than sent —
+which is also what makes a build pushed from Unity hash identically to the same
+bytes dragged into the console.
+
 ## In the Editor
 
 `Sdk` compiles on every platform and reports `Status() == "failed"` anywhere

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "com.robotsquid.squidhub",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "displayName": "SquidHub",
   "description": "Cloud saves, analytics and the coin economy for Unity WebGL games published on SquidHub. Installs the C# wrapper, the .jslib half and the page bridge, and rewrites the exported index.html so it survives the platform's CSP.",
   "unity": "2021.3",