mnfst-publish 0.1.5 → 0.1.6

package/manifest.publish.mjs

@@ -202,6 +202,63 @@ export function isExcludedPath(rel) {
   return false;
 }
 
+// Publish-time exclusions, declared per-project and DECOUPLED from git — so a file
+// can stay versioned yet never ship. Sourced from a `.manifestignore` file
+// (gitignore-style) and/or a `publishIgnore: []` array in manifest.json. Supports
+// comments (#), directory patterns (`dir/`), path-anchored patterns (`a/b`), and
+// `*` / `**` / `?` globs. Returns a matcher; matches nothing when there are no rules.
+export function makePublishIgnore(rawPatterns) {
+  const rules = [];
+  for (let p of rawPatterns || []) {
+    if (typeof p !== 'string') continue;
+    p = p.trim();
+    if (!p || p.startsWith('#')) continue;
+    const dirOnly = p.endsWith('/');
+    if (dirOnly) p = p.slice(0, -1);
+    const anchored = p.startsWith('/');
+    if (anchored) p = p.replace(/^\/+/, '');
+    if (!p) continue;
+    const pathScoped = anchored || p.includes('/');
+    const body = p
+      .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+      .replace(/\*\*/g, '')
+      .replace(/\*/g, '[^/]*')
+      .replace(//g, '.*')
+      .replace(/\?/g, '[^/]');
+    rules.push({ dirOnly, pathScoped, exact: new RegExp('^' + body + '$'), prefix: new RegExp('^' + body + '/') });
+  }
+  if (!rules.length) return () => false;
+  return (rel) => {
+    for (const r of rules) {
+      if (r.pathScoped) {
+        if (!r.dirOnly && r.exact.test(rel)) return true; // exact file/path
+        if (r.prefix.test(rel)) return true;              // anything under the dir/prefix
+      } else {
+        // Unanchored, no slash: match any path segment (a dir name, or a basename).
+        const segs = rel.split('/');
+        for (let i = 0; i < segs.length; i++) {
+          if (r.dirOnly && i === segs.length - 1) continue; // a `dir/` rule can't match the file itself
+          if (r.exact.test(segs[i])) return true;
+        }
+      }
+    }
+    return false;
+  };
+}
+
+export function loadPublishIgnore(root) {
+  const patterns = [];
+  const ignoreFile = join(root, '.manifestignore');
+  if (existsSync(ignoreFile)) {
+    try { patterns.push(...readFileSync(ignoreFile, 'utf8').split(/\r?\n/)); } catch { /* ignore */ }
+  }
+  try {
+    const mf = JSON.parse(readFileSync(join(root, 'manifest.json'), 'utf8'));
+    if (Array.isArray(mf.publishIgnore)) patterns.push(...mf.publishIgnore);
+  } catch { /* no / invalid manifest.json — nothing to add */ }
+  return makePublishIgnore(patterns);
+}
+
 export function collectFiles(root) {
   const git = spawnSync('git', ['ls-files', '-co', '--exclude-standard'], { cwd: root, encoding: 'utf8' });
   let rels;
@@ -221,8 +278,11 @@ export function collectFiles(root) {
     };
     walk(root);
   }
-  // Final guard — drops nested secret files the git/walk lists may include.
-  return rels.filter((r) => !isExcludedPath(r));
+  // Final guards — drop nested secret files, then project-declared publish exclusions.
+  // .manifestignore applies ON TOP of gitignore, so a versioned file can still be
+  // kept out of the published bundle.
+  const publishIgnored = loadPublishIgnore(root);
+  return rels.filter((r) => !isExcludedPath(r) && !publishIgnored(r));
 }
 
 // --- Minimal ZIP writer (DEFLATE), pure Node, no deps ----------------------
@@ -311,19 +371,33 @@ export async function main() {
   }
 
   const root = opts.root ? opts.root : findRoot(process.cwd());
-  const key = readApiKey(root, opts.key);
-  if (!key) fail('no API key found. Expected MANIFEST_API_KEY in .env (this folder doesn’t look like a Manifest project, or it isn’t set up for publishing).');
   const url = readMcpUrl(root, opts.mcp);
   const source = detectSource(root, opts.source);
 
-  // Promote a previously-staged build straight to production (no upload).
+  // A connector-driven publish passes a pre-authorised, one-time upload URL in
+  // the environment (minted by the manifest_publish tool for the signed-in
+  // user). When present, no API key is needed — the token IS the authorisation,
+  // so an invited teammate publishes without ever handling a project secret.
+  const injectedUpload = process.env.MNFST_PUBLISH_UPLOAD_URL || null;
+  const key = readApiKey(root, opts.key);
+
+  // Promote a previously-staged build straight to production (no upload). Headless
+  // convenience; interactive users promote via the connector's manifest_promote
+  // tool (no key). Needs a key.
   if (opts.promote) {
+    if (!key) fail('no API key found for --promote. Set MANIFEST_API_KEY in .env for headless use, or promote from Claude with the Manifest connector (no key needed).');
     log('Promoting the staged version to production…');
     const res = await callTool(url, key, 'manifest_promote', {});
     log('✓ Live: ' + (res.url || res._text || 'production updated'));
     return;
   }
 
+  // A normal publish needs either the injected one-time URL (connector) or a
+  // stored key (headless/CI). Without either, there's nothing to authorise with.
+  if (!injectedUpload && !key) {
+    fail('no API key found. Publish from Claude with the Manifest connector (no key needed), or set MANIFEST_API_KEY in .env for headless/CI use.');
+  }
+
   if (source === 'render' && opts.render !== false) {
     log('Rendering the site…');
     const r = spawnSync('npx', ['mnfst-render'], { cwd: root, stdio: 'inherit', shell: process.platform === 'win32' });
@@ -347,11 +421,18 @@ export async function main() {
     }
   }
 
-  log(`Preparing ${opts.env} deploy…`);
-  const handshake = await callTool(url, key, 'manifest_publish', { env: opts.env, source, via_cli: true });
-  if (handshake.already_pro) { /* not applicable */ }
-  const uploadUrl = handshake.upload_url;
-  if (!uploadUrl) fail(handshake._text || 'could not start the publish (no upload URL returned).');
+  let uploadUrl;
+  if (injectedUpload) {
+    // Connector path: the manifest_publish tool already minted the deployment
+    // and a one-time upload URL for the signed-in user. No handshake, no key.
+    uploadUrl = injectedUpload;
+  } else {
+    // Headless/CI: authenticate the handshake with the key to get an upload URL.
+    log(`Preparing ${opts.env} deploy…`);
+    const handshake = await callTool(url, key, 'manifest_publish', { env: opts.env, source, via_cli: true });
+    uploadUrl = handshake.upload_url;
+    if (!uploadUrl) fail(handshake._text || 'could not start the publish (no upload URL returned).');
+  }
   // The upload carries the whole project. Only POST it to an HTTPS endpoint on
   // the SAME host as the MCP server — never to an arbitrary URL a tampered
   // response or misconfigured .mcp.json could inject.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mnfst-publish",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "One-command managed publishing for Manifest projects — render, zip, upload, live URL.",
   "type": "module",
   "bin": {