com.robotsquid.squidhub 0.5.5 → 0.5.7

package/Editor/SquidHubPump.cs

@@ -0,0 +1,53 @@
+// Running a coroutine outside a Unity player loop.
+//
+// ⚠️ Pure System.* — no UnityEditor — so the nesting rule below is covered by
+// tests under plain dotnet. It exists because getting this wrong produced a
+// completely silent failure: the upload menu item ran, reported nothing, and
+// uploaded nothing.
+using System;
+using System.Collections;
+using System.Collections.Generic;
+
+namespace SquidHub.Editor
+{
+    /// <summary>
+    /// A coroutine driver that understands NESTED iterators.
+    ///
+    /// ⚠️ `yield return SomeOtherIEnumerator()` is the whole reason this is not
+    /// three lines. Unity's own runner descends into a yielded IEnumerator and
+    /// runs it to completion before resuming the parent. A naive driver that
+    /// only calls MoveNext() on the outer routine treats the nested one as an
+    /// ordinary value, discards it, and carries straight on — so the nested work
+    /// NEVER RUNS and nothing anywhere reports a problem.
+    /// </summary>
+    internal sealed class SquidHubPump
+    {
+        private readonly Stack<IEnumerator> _stack = new Stack<IEnumerator>();
+
+        public SquidHubPump(IEnumerator routine)
+        {
+            _stack.Push(routine);
+        }
+
+        public bool Done => _stack.Count == 0;
+
+        /// <summary>Advances by one step. Returns false once everything has finished.</summary>
+        public bool Step()
+        {
+            if (_stack.Count == 0) return false;
+
+            var current = _stack.Peek();
+            if (!current.MoveNext())
+            {
+                // ⚠️ Pop and return true, not false. The PARENT still has work
+                // left; reporting "done" because a child finished would abandon
+                // the rest of the upload silently.
+                _stack.Pop();
+                return _stack.Count > 0;
+            }
+
+            if (current.Current is IEnumerator nested) _stack.Push(nested);
+            return true;
+        }
+    }
+}

package/Editor/SquidHubPump.cs.meta

@@ -0,0 +1,11 @@
+fileFormatVersion: 2
+guid: 4950b7b2580a1a30f9940f07fe016efc
+MonoImporter:
+  externalObjects: {}
+  serializedVersion: 2
+  defaultReferences: []
+  executionOrder: 0
+  icon: {instanceID: 0}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 

package/Editor/SquidHubUploadSettings.cs

@@ -36,7 +36,47 @@ namespace SquidHub.Editor
             set => EditorPrefs.SetString(Scope + "buildFolder", value);
         }
 
+        /// <summary>
+        /// The build profile `Build and Upload` uses, as an asset path.
+        ///
+        /// ⚠️ A PATH, not a cached object reference. EditorPrefs cannot hold one,
+        /// and a GUID would survive the profile being deleted as a dangling id
+        /// that resolves to nothing with no way to say what is missing.
+        /// </summary>
+        public static string BuildProfilePath
+        {
+            get => EditorPrefs.GetString(Scope + "buildProfile", "");
+            set => EditorPrefs.SetString(Scope + "buildProfile", value ?? "");
+        }
+
+        /// <summary>
+        /// Publish the build to players the moment it uploads.
+        ///
+        /// ⚠️ ON by default, and it only ever applies on the DEV environment.
+        /// The server refuses a key-authorised publish on prod — promoting a
+        /// build for every player is an owner decision made in the console, and
+        /// an upload key is not a person. See `setChannelWithKey`.
+        /// </summary>
+        public static bool PublishAfterUpload
+        {
+            get => EditorPrefs.GetBool(Scope + "publishAfterUpload", true);
+            set => EditorPrefs.SetBool(Scope + "publishAfterUpload", value);
+        }
+
         public static bool HasKey => Key.StartsWith("shu_");
+
+        /// <summary>
+        /// `manifest.json` beside `Assets/`, which is what `squidhub-release
+        /// build --manifest manifest.json` already reads.
+        ///
+        /// ⚠️ ONE source of truth, deliberately. Keeping the declaration in a
+        /// Unity-only asset would give the Editor and the CLI two answers to
+        /// "what does this game declare", and they would disagree on the day it
+        /// mattered. It is a normal project file and belongs in the repository.
+        /// </summary>
+        public static string ManifestPath =>
+            System.IO.Path.Combine(
+                System.IO.Path.GetDirectoryName(Application.dataPath) ?? "", "manifest.json");
     }
 
     internal sealed class SquidHubUploadSettingsWindow : EditorWindow

package/Editor/SquidHubUploader.cs

@@ -11,6 +11,7 @@
 using System;
 using System.Collections;
 using System.IO;
+using System.Linq;
 using System.Text;
 using System.Text.RegularExpressions;
 using UnityEditor;
@@ -21,25 +22,44 @@ namespace SquidHub.Editor
 {
     internal static class SquidHubUploader
     {
-        private static IEnumerator _routine;
+        private static SquidHubPump _pump;
 
         [MenuItem("SquidHub/Upload Build…", priority = 11)]
         private static void UploadBuild()
         {
-            if (!SquidHubUploadSettings.HasKey)
-            {
-                EditorUtility.DisplayDialog("SquidHub",
-                    "No upload key set. Create one in the publisher console under your game → " +
-                    "Upload keys, then paste it into SquidHub → Upload Settings.", "OK");
-                SquidHubUploadSettingsWindow.GetWindow<SquidHubUploadSettingsWindow>();
-                return;
-            }
+            if (!EnsureKey()) return;
 
             var start = SquidHubUploadSettings.BuildFolder;
             var folder = EditorUtility.OpenFolderPanel(
                 "Select the WebGL build folder (containing index.html)",
                 string.IsNullOrEmpty(start) ? "" : start, "");
             if (string.IsNullOrEmpty(folder)) return;
+
+            Begin(folder);
+        }
+
+        /// <summary>Nothing can proceed without a key, and saying so early costs nothing.</summary>
+        internal static bool EnsureKey()
+        {
+            if (SquidHubUploadSettings.HasKey) return true;
+
+            EditorUtility.DisplayDialog("SquidHub",
+                "No upload key set. Create one in the publisher console under your game → " +
+                "Upload keys, then paste it into SquidHub → Upload Settings.", "OK");
+            SquidHubUploadSettingsWindow.GetWindow<SquidHubUploadSettingsWindow>();
+            return false;
+        }
+
+        /// <summary>
+        /// Scans a build folder, confirms, and uploads it.
+        ///
+        /// ⚠️ The entry point `Build and Upload` uses too, so a build made here
+        /// and a folder picked by hand go through exactly the same refusals.
+        /// </summary>
+        internal static void Begin(string folder)
+        {
+            if (!EnsureKey()) return;
+
             SquidHubUploadSettings.BuildFolder = folder;
 
             BuildScan scan;
@@ -63,25 +83,44 @@ namespace SquidHub.Editor
                 return;
             }
 
+            var publish = SquidHubUploadSettings.PublishAfterUpload;
+
             if (!EditorUtility.DisplayDialog("SquidHub",
                     $"Upload {scan.Files.Count} files ({scan.TotalBytes / 1024f / 1024f:F1} MB)?" +
                     (scan.Skipped.Count > 0
                         ? $"\n\n{scan.Skipped.Count} OS metadata file(s) will be skipped."
+                        : "") +
+                    // ⚠️ Said before the upload, not after. A build folder with no
+                    // manifest.json declares nothing — save schema 1, no display
+                    // constraints — and the publisher cannot tell from the result.
+                    (scan.Files.Any(f => f.Path == "manifest.json")
+                        ? ""
+                        : "\n\nThere is no manifest.json in this folder, so the build declares " +
+                          "nothing: save schema 1 and no display constraints. Set one up in " +
+                          "SquidHub → Game Manifest… and rebuild.") +
+                    (publish
+                        ? "\n\nIt will be published to players if the server allows it — that is " +
+                          "dev only. On prod, promote it in the console."
                         : ""),
                     "Upload", "Cancel"))
             {
                 return;
             }
 
-            Run(Upload(scan));
+            Run(Upload(scan, publish));
         }
 
         // ⚠️ Driven by EditorApplication.update rather than blocking. Sleeping
         // the main thread would stop UnityWebRequest progressing at all, and the
         // Editor would appear to hang for the length of the upload.
+        //
+        // ⚠️ SquidHubPump, not a bare MoveNext(). `yield return SomeIEnumerator()`
+        // must DESCEND into the nested routine — a driver that does not simply
+        // discards it and carries on, which made the entire upload run, report
+        // nothing and do nothing. That nesting rule is unit-tested.
         private static void Run(IEnumerator routine)
         {
-            _routine = routine;
+            _pump = new SquidHubPump(routine);
             EditorApplication.update -= Pump;
             EditorApplication.update += Pump;
         }
@@ -90,41 +129,50 @@ namespace SquidHub.Editor
         {
             try
             {
-                if (_routine != null && _routine.MoveNext()) return;
+                if (_pump != null && _pump.Step()) return;
             }
             catch (Exception e)
             {
                 EditorUtility.ClearProgressBar();
                 Debug.LogError("[SquidHub] upload failed: " + e);
+                EditorUtility.DisplayDialog("SquidHub — upload failed", e.Message, "OK");
             }
-            _routine = null;
+            _pump = null;
             EditorApplication.update -= Pump;
             EditorUtility.ClearProgressBar();
+            Debug.Log("[SquidHub] upload run finished.");
         }
 
-        private static IEnumerator Upload(BuildScan scan)
+        private static IEnumerator Upload(BuildScan scan, bool publish)
         {
             var endpoint = SquidHubUploadSettings.Endpoint;
             var key = SquidHubUploadSettings.Key;
 
+            Debug.Log($"[SquidHub] uploading {scan.Files.Count} file(s) to {endpoint}");
             EditorUtility.DisplayProgressBar("SquidHub", "Registering build…", 0f);
 
             var startBody = "{\"intent\":\"start\",\"files\":" + SquidHubBuildScan.FilesJson(scan.Files) + "}";
             string startResponse = null;
             yield return Post(endpoint + "/api/ingest", key, startBody, r => startResponse = r);
 
-            if (startResponse == null) yield break;
+            // ⚠️ Post reports its own failure and leaves this null. Returning
+            // quietly here is what made a failed start look like success.
+            if (startResponse == null)
+            {
+                Debug.LogError("[SquidHub] the start request returned nothing — upload abandoned.");
+                yield break;
+            }
 
-            if (Field(startResponse, "alreadyPublished") == "true")
+            if (SquidHubBuildScan.JsonField(startResponse, "alreadyPublished") == "true")
             {
                 EditorUtility.ClearProgressBar();
                 EditorUtility.DisplayDialog("SquidHub",
-                    "These exact bytes are already published as " + Field(startResponse, "buildHash") +
+                    "These exact bytes are already published as " + SquidHubBuildScan.JsonField(startResponse, "buildHash") +
                     ". Nothing to upload.", "OK");
                 yield break;
             }
 
-            var jobId = Field(startResponse, "jobId");
+            var jobId = SquidHubBuildScan.JsonField(startResponse, "jobId");
             if (string.IsNullOrEmpty(jobId))
             {
                 Fail("The server did not start a build job", startResponse);
@@ -167,18 +215,104 @@ namespace SquidHub.Editor
             EditorUtility.ClearProgressBar();
             if (doneResponse == null) yield break;
 
-            if (Field(doneResponse, "ok") != "true")
+            if (SquidHubBuildScan.JsonField(doneResponse, "ok") != "true")
             {
                 Fail("The server refused the build", doneResponse);
                 yield break;
             }
 
-            // ⚠️ Registered, NOT live. Promoting a build to players is a separate,
-            // deliberate act in the console — saying "uploaded" without saying
-            // that invites someone to assume their players already have it.
-            EditorUtility.DisplayDialog("SquidHub",
-                "Registered " + Field(doneResponse, "buildHash") + ".\n\n" +
-                "It is not live yet — promote it in the publisher console when you are ready.",
+            var buildHash = SquidHubBuildScan.JsonField(doneResponse, "buildHash");
+
+            // ⚠️ Surfaced, not swallowed. The server warns rather than fails when
+            // a manifest change had no effect, and that warning is the only thing
+            // standing between a publisher and believing their edit shipped.
+            var warning = SquidHubBuildScan.JsonField(doneResponse, "detail");
+            if (warning != null) Debug.LogWarning("[SquidHub] " + warning);
+
+            if (!publish)
+            {
+                // ⚠️ Registered, NOT live. Promoting a build to players is a
+                // separate, deliberate act — saying "uploaded" without saying
+                // that invites someone to assume their players already have it.
+                EditorUtility.DisplayDialog("SquidHub",
+                    "Registered " + buildHash + ".\n\n" +
+                    "It is not live yet — promote it in the publisher console when you are ready.",
+                    "OK");
+                yield break;
+            }
+
+            yield return PublishStep(endpoint, key, buildHash);
+        }
+
+        /// <summary>
+        /// Asks the server to make the build live.
+        ///
+        /// ⚠️ THE SERVER DECIDES, and it refuses on prod. An upload key lives in
+        /// CI configs and Editor preferences; promoting a build for every player
+        /// is an owner decision made by a person in the console. A refusal here
+        /// is the system working, so it reports as information rather than as a
+        /// failure — the upload really did succeed.
+        /// </summary>
+        private static IEnumerator PublishStep(string endpoint, string key, string buildHash)
+        {
+            if (string.IsNullOrEmpty(buildHash))
+            {
+                Debug.LogError("[SquidHub] the server registered the build but named no buildHash, " +
+                               "so it cannot be published. It is uploaded; promote it in the console.");
+                yield break;
+            }
+
+            EditorUtility.DisplayProgressBar("SquidHub", "Publishing…", 0.995f);
+
+            string response = null;
+            yield return Post(endpoint + "/api/ingest",
+                key,
+                "{\"intent\":\"publish\",\"buildHash\":" + SquidHubBuildScan.JsonString(buildHash) + "}",
+                r => response = r);
+
+            EditorUtility.ClearProgressBar();
+
+            // ⚠️ Post already reported the failure. Reaching here with null means
+            // the publish did not happen, and the build IS still uploaded — which
+            // is the one thing the publisher needs to be told.
+            if (response == null)
+            {
+                Debug.LogWarning("[SquidHub] " + buildHash + " is uploaded but was NOT published.");
+                yield break;
+            }
+
+            if (SquidHubBuildScan.JsonField(response, "ok") == "true")
+            {
+                var stranded = SquidHubBuildScan.JsonField(response, "strandedPlayers");
+                Debug.Log("[SquidHub] published " + buildHash + ".");
+                EditorUtility.DisplayDialog("SquidHub",
+                    "Published " + buildHash + ". Players get it on their next launch." +
+                    (stranded != null && stranded != "0"
+                        ? "\n\n⚠️ " + stranded + " player(s) have a save this build's schema cannot read."
+                        : ""),
+                    "OK");
+                yield break;
+            }
+
+            var code = SquidHubBuildScan.JsonField(response, "code");
+            var message = SquidHubBuildScan.JsonField(response, "message") ?? response;
+
+            if (code == "MANUAL_ON_PROD")
+            {
+                Debug.Log("[SquidHub] uploaded " + buildHash + "; publishing on prod is manual.");
+                EditorUtility.DisplayDialog("SquidHub",
+                    "Uploaded " + buildHash + ".\n\n" +
+                    "It was not published: an upload key can publish on dev, never on prod. " +
+                    "Promote it in the publisher console when you are ready.",
+                    "OK");
+                yield break;
+            }
+
+            Debug.LogWarning("[SquidHub] uploaded " + buildHash + " but the publish was refused: " +
+                             code + ": " + message);
+            EditorUtility.DisplayDialog("SquidHub — uploaded, not published",
+                "The build uploaded and is registered as " + buildHash + ", but publishing it was " +
+                "refused:\n\n" + message + "\n\nPromote it in the publisher console.",
                 "OK");
         }
 
@@ -214,18 +348,5 @@ namespace SquidHub.Editor
             EditorUtility.DisplayDialog("SquidHub — " + title, detail, "OK");
         }
 
-        /// <summary>
-        /// ⚠️ A regex, not a JSON parser, and only for the four flat fields this
-        /// flow reads. Shipping a parser in a package that already asks the
-        /// project to bring its own would be a second, worse one to maintain.
-        /// </summary>
-        private static string Field(string json, string name)
-        {
-            var match = Regex.Match(json, "\"" + Regex.Escape(name) + "\"\\s*:\\s*(\"([^\"]*)\"|true|false|[0-9]+)");
-            if (!match.Success) return null;
-            return match.Groups[2].Success && match.Value.Contains("\"" + match.Groups[2].Value + "\"")
-                ? match.Groups[2].Value
-                : match.Groups[1].Value;
-        }
     }
 }

package/README.md

@@ -82,23 +82,55 @@ Then push the folder:
 node src/cli.mjs push --game <slug> --dir <BuildFolder> --env=dev --verify
 ```
 
+## Declaring what your game is
+
+`SquidHub → Game Manifest…` edits `manifest.json` beside `Assets/` — the game's
+id and title, which capabilities it uses, its save schema version, the
+orientations and aspect window it wants, and whether it makes sound.
+
+It is the same file `squidhub-release build --manifest manifest.json` reads, so
+the Editor and the CLI cannot disagree about what your game declares. It belongs
+in your repository.
+
+The build writes it into the output folder for you. **That is the only thing
+that makes a declaration take effect** — the server reads `manifest.json` out of
+the uploaded bytes and ignores anything a client posts alongside the upload, so
+a build folder without one declares nothing at all: save schema 1, no display
+constraints, and a rollback guard that cannot fire.
+
+⚠️ **Ticking a capability does not grant it.** Capabilities are granted by the
+platform at review. Declaring `commerce.spend` says your game uses it; until it
+is granted the broker still answers `DENIED`, and your game has to handle that.
+New games have `saves` and `analytics`.
+
+⚠️ **Keys the dialog does not model are preserved.** `skus`, `achievements` and
+`rewardTable` live in the same file and survive a save untouched.
+
 ## Uploading from Unity
 
 `SquidHub → Upload Build…` does the whole publish — no console, no command line,
-no repository checkout.
+no repository checkout. `SquidHub → Build and Upload…` picks a **build profile**,
+builds it and uploads the result in one action.
 
 **Once:** in the publisher console open your game → **Upload keys** → create one,
 then paste it into `SquidHub → Upload Settings`.
 
 ⚠️ **The key never enters your project.** It lives in EditorPrefs, per machine
-and per project path, so it cannot reach your repository. It can do exactly one
-thing: upload a build for the one game it was minted for — it cannot read
-anything, publish to a channel, or touch another game. If it leaks, revoke it in
-the console; the worst it could have done is leave an unwanted build somewhere
-no player can see.
+and per project path, so it cannot reach your repository. It can upload a build
+for the one game it was minted for, and on **dev** publish that build — it
+cannot read anything, touch another game, or publish on prod. If it leaks,
+revoke it in the console.
+
+### Publishing on upload
+
+**Publish the build** is ticked by default in `SquidHub → Build and Upload…`.
 
-⚠️ **Uploading is not publishing.** The build arrives registered and not live.
-Promoting it to players stays a deliberate act in the console.
+⚠️ **It works on dev only.** On prod the server refuses it and says so; the
+upload still succeeds and the build arrives registered and not live. Promoting a
+build for every player is an owner decision made by a person in the console, and
+an upload key is not a person — it sits in CI configs and Editor preferences.
+That asymmetry is deliberate: it is what keeps a leaked key from replacing the
+live build for everyone.
 
 The upload is refused before a byte moves if the build is precompressed or has
 no `index.html` at its top level, and OS metadata is dropped rather than sent —
@@ -141,19 +173,20 @@ blocked at load and shows up as a console error, not as a missing style.
 Everything must ship inside the build.
 
 ⚠️ **Do not write your own rotate prompt or call `screen.orientation.lock()`.**
-Declare the orientations you support in your `manifest.json` and the portal
-draws the prompt outside your frame. Two prompts fight, and yours is the one the
+Declare the orientations you support in `SquidHub → Game Manifest…` and the
+portal draws the prompt outside your frame. Two prompts fight, and yours is the one the
 player sees first.
 
 ⚠️ **The mute button is the portal's, but the muting happens in your frame.** A
 cross-origin iframe has no `muted` property, so the SDK interposes a gain node
 on your `AudioContext`. It works without you doing anything — but only because
 the bridge is injected ahead of the loader, which is why step 2 above is not
-merely tidy. Declare `"sound": true` in your manifest or no button appears.
+merely tidy. Tick **Sound** in `SquidHub → Game Manifest…` or no button appears.
 
 ⚠️ **Editing `manifest.json` alone changes nothing.** It is excluded from the
 build hash, so a manifest-only re-upload registers no new version and your edit
-is discarded. Change a real file and rebuild.
+is discarded — the server now says so in a warning rather than staying silent.
+Change a real file and rebuild, or set an override in the console.
 
 ## ⚠️ Status
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "com.robotsquid.squidhub",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "displayName": "SquidHub",
   "description": "Cloud saves, analytics and the coin economy for Unity WebGL games published on SquidHub. Installs the C# wrapper, the .jslib half and the page bridge, and rewrites the exported index.html so it survives the platform's CSP.",
   "unity": "2021.3",