mnfst-publish 0.1.5 → 0.1.7

package/manifest.publish.mjs

@@ -202,6 +202,63 @@ export function isExcludedPath(rel) {
   return false;
 }
 
+// Publish-time exclusions, declared per-project and DECOUPLED from git — so a file
+// can stay versioned yet never ship. Sourced from a `.manifestignore` file
+// (gitignore-style) and/or a `publishIgnore: []` array in manifest.json. Supports
+// comments (#), directory patterns (`dir/`), path-anchored patterns (`a/b`), and
+// `*` / `**` / `?` globs. Returns a matcher; matches nothing when there are no rules.
+export function makePublishIgnore(rawPatterns) {
+  const rules = [];
+  for (let p of rawPatterns || []) {
+    if (typeof p !== 'string') continue;
+    p = p.trim();
+    if (!p || p.startsWith('#')) continue;
+    const dirOnly = p.endsWith('/');
+    if (dirOnly) p = p.slice(0, -1);
+    const anchored = p.startsWith('/');
+    if (anchored) p = p.replace(/^\/+/, '');
+    if (!p) continue;
+    const pathScoped = anchored || p.includes('/');
+    const body = p
+      .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+      .replace(/\*\*/g, '')
+      .replace(/\*/g, '[^/]*')
+      .replace(//g, '.*')
+      .replace(/\?/g, '[^/]');
+    rules.push({ dirOnly, pathScoped, exact: new RegExp('^' + body + '$'), prefix: new RegExp('^' + body + '/') });
+  }
+  if (!rules.length) return () => false;
+  return (rel) => {
+    for (const r of rules) {
+      if (r.pathScoped) {
+        if (!r.dirOnly && r.exact.test(rel)) return true; // exact file/path
+        if (r.prefix.test(rel)) return true;              // anything under the dir/prefix
+      } else {
+        // Unanchored, no slash: match any path segment (a dir name, or a basename).
+        const segs = rel.split('/');
+        for (let i = 0; i < segs.length; i++) {
+          if (r.dirOnly && i === segs.length - 1) continue; // a `dir/` rule can't match the file itself
+          if (r.exact.test(segs[i])) return true;
+        }
+      }
+    }
+    return false;
+  };
+}
+
+export function loadPublishIgnore(root) {
+  const patterns = [];
+  const ignoreFile = join(root, '.manifestignore');
+  if (existsSync(ignoreFile)) {
+    try { patterns.push(...readFileSync(ignoreFile, 'utf8').split(/\r?\n/)); } catch { /* ignore */ }
+  }
+  try {
+    const mf = JSON.parse(readFileSync(join(root, 'manifest.json'), 'utf8'));
+    if (Array.isArray(mf.publishIgnore)) patterns.push(...mf.publishIgnore);
+  } catch { /* no / invalid manifest.json — nothing to add */ }
+  return makePublishIgnore(patterns);
+}
+
 export function collectFiles(root) {
   const git = spawnSync('git', ['ls-files', '-co', '--exclude-standard'], { cwd: root, encoding: 'utf8' });
   let rels;
@@ -221,8 +278,49 @@ export function collectFiles(root) {
     };
     walk(root);
   }
-  // Final guard — drops nested secret files the git/walk lists may include.
-  return rels.filter((r) => !isExcludedPath(r));
+  // Final guards — drop nested secret files, then project-declared publish exclusions.
+  // .manifestignore applies ON TOP of gitignore, so a versioned file can still be
+  // kept out of the published bundle.
+  const publishIgnored = loadPublishIgnore(root);
+  return rels.filter((r) => !isExcludedPath(r) && !publishIgnored(r));
+}
+
+// --- Component version stamp ------------------------------------------------
+
+// Stamp each shipped manifest.json (project root, and the prerender output copy)
+// with `deployment`: a content hash of its component HTML files. The components
+// plugin appends it as ?v= to component fetches, so browser caches bust exactly
+// when component markup changes and persist when it doesn't. Purely publish-time:
+// the on-disk manifest.json is never modified.
+export function stampManifests(root, rels) {
+  const overrides = new Map();
+  const relSet = new Set(rels);
+  const outDir = prerenderOutputDir(root);
+  for (const mfRel of ['manifest.json', outDir + '/manifest.json']) {
+    if (!relSet.has(mfRel)) continue;
+    let mf;
+    try {
+      mf = JSON.parse(readFileSync(join(root, mfRel), 'utf8'));
+    } catch {
+      continue; // invalid JSON — ship as-is
+    }
+    const dir = mfRel.includes('/') ? mfRel.slice(0, mfRel.lastIndexOf('/') + 1) : '';
+    const paths = [...(mf.preloadedComponents || []), ...(mf.components || [])]
+      .filter((p) => typeof p === 'string' && !p.startsWith('http'))
+      .map((p) => dir + p.replace(/^\/+/, ''))
+      .filter((p) => relSet.has(p))
+      .sort();
+    if (!paths.length) continue;
+    const hash = createHash('sha256');
+    for (const p of paths) {
+      hash.update(p + '\0');
+      hash.update(readFileSync(join(root, p)));
+      hash.update('\0');
+    }
+    mf.deployment = hash.digest('hex').slice(0, 12);
+    overrides.set(mfRel, Buffer.from(JSON.stringify(mf, null, 2) + '\n', 'utf8'));
+  }
+  return overrides;
 }
 
 // --- Minimal ZIP writer (DEFLATE), pure Node, no deps ----------------------
@@ -236,7 +334,7 @@ function crc32(buf) {
   return (~c) >>> 0;
 }
 
-function buildZip(root, rels) {
+function buildZip(root, rels, overrides = new Map()) {
   // This packer writes classic (non-Zip64) ZIP records: file count is a uint16
   // and offsets are uint32. Fail loudly rather than emit a silently-corrupt
   // archive past those limits.
@@ -250,7 +348,7 @@ function buildZip(root, rels) {
     if (offset > 0xffffffff) {
       fail('project is too large to package (>4 GB). Contact support.');
     }
-    const data = readFileSync(join(root, rel));
+    const data = overrides.get(rel) ?? readFileSync(join(root, rel));
     const nameBuf = Buffer.from(rel, 'utf8');
     const crc = crc32(data);
     const deflated = deflateRawSync(data);
@@ -311,19 +409,33 @@ export async function main() {
   }
 
   const root = opts.root ? opts.root : findRoot(process.cwd());
-  const key = readApiKey(root, opts.key);
-  if (!key) fail('no API key found. Expected MANIFEST_API_KEY in .env (this folder doesn’t look like a Manifest project, or it isn’t set up for publishing).');
   const url = readMcpUrl(root, opts.mcp);
   const source = detectSource(root, opts.source);
 
-  // Promote a previously-staged build straight to production (no upload).
+  // A connector-driven publish passes a pre-authorised, one-time upload URL in
+  // the environment (minted by the manifest_publish tool for the signed-in
+  // user). When present, no API key is needed — the token IS the authorisation,
+  // so an invited teammate publishes without ever handling a project secret.
+  const injectedUpload = process.env.MNFST_PUBLISH_UPLOAD_URL || null;
+  const key = readApiKey(root, opts.key);
+
+  // Promote a previously-staged build straight to production (no upload). Headless
+  // convenience; interactive users promote via the connector's manifest_promote
+  // tool (no key). Needs a key.
   if (opts.promote) {
+    if (!key) fail('no API key found for --promote. Set MANIFEST_API_KEY in .env for headless use, or promote from Claude with the Manifest connector (no key needed).');
     log('Promoting the staged version to production…');
     const res = await callTool(url, key, 'manifest_promote', {});
     log('✓ Live: ' + (res.url || res._text || 'production updated'));
     return;
   }
 
+  // A normal publish needs either the injected one-time URL (connector) or a
+  // stored key (headless/CI). Without either, there's nothing to authorise with.
+  if (!injectedUpload && !key) {
+    fail('no API key found. Publish from Claude with the Manifest connector (no key needed), or set MANIFEST_API_KEY in .env for headless/CI use.');
+  }
+
   if (source === 'render' && opts.render !== false) {
     log('Rendering the site…');
     const r = spawnSync('npx', ['mnfst-render'], { cwd: root, stdio: 'inherit', shell: process.platform === 'win32' });
@@ -347,11 +459,18 @@ export async function main() {
     }
   }
 
-  log(`Preparing ${opts.env} deploy…`);
-  const handshake = await callTool(url, key, 'manifest_publish', { env: opts.env, source, via_cli: true });
-  if (handshake.already_pro) { /* not applicable */ }
-  const uploadUrl = handshake.upload_url;
-  if (!uploadUrl) fail(handshake._text || 'could not start the publish (no upload URL returned).');
+  let uploadUrl;
+  if (injectedUpload) {
+    // Connector path: the manifest_publish tool already minted the deployment
+    // and a one-time upload URL for the signed-in user. No handshake, no key.
+    uploadUrl = injectedUpload;
+  } else {
+    // Headless/CI: authenticate the handshake with the key to get an upload URL.
+    log(`Preparing ${opts.env} deploy…`);
+    const handshake = await callTool(url, key, 'manifest_publish', { env: opts.env, source, via_cli: true });
+    uploadUrl = handshake.upload_url;
+    if (!uploadUrl) fail(handshake._text || 'could not start the publish (no upload URL returned).');
+  }
   // The upload carries the whole project. Only POST it to an HTTPS endpoint on
   // the SAME host as the MCP server — never to an arbitrary URL a tampered
   // response or misconfigured .mcp.json could inject.
@@ -367,7 +486,7 @@ export async function main() {
 
   const rels = collectFiles(root);
   if (!rels.length) fail('nothing to publish (no files found).');
-  const zip = buildZip(root, rels);
+  const zip = buildZip(root, rels, stampManifests(root, rels));
   log(`Uploading ${rels.length} files (${(zip.length / 1048576).toFixed(1)} MB)…`);
 
   const up = await fetchRetry(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mnfst-publish",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "One-command managed publishing for Manifest projects — render, zip, upload, live URL.",
   "type": "module",
   "bin": {