summer-engine 2.7.0 → 2.8.0

package/dist/commands/login.js

@@ -1,49 +1,143 @@
 import { Command } from "commander";
 import { randomUUID } from "crypto";
 import open from "open";
-import { getAuthToken, saveAuthToken, saveCloudToken, saveUserInfo } from "../lib/auth.js";
-const GATEWAY_URL = process.env.SUMMER_GATEWAY_URL || "https://www.summerengine.com";
+import { getAuthToken, getCreatorToken, saveCreatorToken, saveLoginSession, } from "../lib/auth.js";
+import { getCreatorApiUrl, getGatewayUrl } from "../lib/config.js";
 const POLL_INTERVAL_MS = 2000;
 const POLL_TIMEOUT_MS = 120000;
 export const loginCommand = new Command("login")
     .description("Sign in to Summer Engine via your browser")
+    .option("--creator", "Connect a separately scoped Summercraft creator token for publishing")
     .option("--force", "Force re-authentication even if already logged in")
     .action(async (opts) => {
+    if (opts.creator) {
+        const existingCreator = await getCreatorToken();
+        if (existingCreator && !opts.force) {
+            console.log("A creator token is already connected. Use --creator --force to replace it.");
+            return;
+        }
+        await runCreatorLogin();
+        return;
+    }
     const existing = await getAuthToken();
     if (existing && !opts.force) {
         console.log("Already logged in. Use --force to re-authenticate.");
         return;
     }
-    await doLogin();
+    await runLogin();
 });
-async function doLogin() {
-    const sessionId = randomUUID();
-    const loginUrl = `${GATEWAY_URL}/login?cli_session=${sessionId}`;
-    console.log("Sign in at: " + loginUrl);
-    console.log("");
+async function readHiddenLine(prompt) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        process.stdout.write(prompt);
+        let value = "";
+        for await (const chunk of process.stdin)
+            value += String(chunk);
+        return value.trim();
+    }
+    process.stdout.write(prompt);
+    const input = process.stdin;
+    const wasRaw = input.isRaw;
+    input.setRawMode(true);
+    input.resume();
+    return new Promise((resolve, reject) => {
+        let value = "";
+        const finish = (error) => {
+            input.off("data", onData);
+            input.setRawMode(Boolean(wasRaw));
+            input.pause();
+            process.stdout.write("\n");
+            if (error)
+                reject(error);
+            else
+                resolve(value.trim());
+        };
+        const onData = (chunk) => {
+            for (const char of String(chunk)) {
+                if (char === "\u0003") {
+                    finish(new Error("Creator token entry cancelled."));
+                    return;
+                }
+                if (char === "\r" || char === "\n" || char === "\u0004") {
+                    finish();
+                    return;
+                }
+                if (char === "\u007f" || char === "\b") {
+                    value = value.slice(0, -1);
+                }
+                else if (char >= " ") {
+                    value += char;
+                }
+            }
+        };
+        input.on("data", onData);
+    });
+}
+const defaultCreatorLoginDependencies = {
+    openUrl: open,
+    readSecret: readHiddenLine,
+    log: console.log,
+};
+/**
+ * The browser session mints the token; the token is pasted once into a hidden
+ * prompt. This deliberately does not replace the core Summer login JWT.
+ */
+export async function runCreatorLogin(overrides = {}) {
+    const deps = { ...defaultCreatorLoginDependencies, ...overrides };
+    const settingsUrl = `${await getCreatorApiUrl()}/creator/settings/tokens`;
+    deps.log(`Opening creator token settings: ${settingsUrl}`);
+    deps.log('Mint a token with the exact "publish" scope, copy its one-time sc_ value, then return here.');
     try {
-        await open(loginUrl);
+        await deps.openUrl(settingsUrl);
     }
     catch {
-        console.log("Could not open browser. Copy the URL above and open it manually.");
-        console.log("");
+        deps.log("Could not open the browser. Copy the URL above and open it manually.");
     }
-    console.log("Waiting for authentication...");
-    const pollUrl = `${GATEWAY_URL}/api/auth/cli-login?session=${sessionId}`;
-    const startTime = Date.now();
+    const token = await deps.readSecret("Creator token (input hidden): ");
+    await saveCreatorToken(token);
+    deps.log("Creator publishing connected. Your core Summer login token was not changed.");
+}
+const defaultDependencies = {
+    fetch,
+    openUrl: open,
+    randomId: randomUUID,
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    now: Date.now,
+    log: console.log,
+};
+export async function runLogin(overrides = {}) {
+    const deps = { ...defaultDependencies, ...overrides };
+    const gatewayUrl = await getGatewayUrl();
+    const sessionId = deps.randomId();
+    const loginUrl = `${gatewayUrl}/login?cli_session=${encodeURIComponent(sessionId)}`;
+    deps.log("Sign in at: " + loginUrl);
+    deps.log("");
+    try {
+        await deps.openUrl(loginUrl);
+    }
+    catch {
+        deps.log("Could not open browser. Copy the URL above and open it manually.");
+        deps.log("");
+    }
+    deps.log("Waiting for authentication...");
+    const pollUrl = `${gatewayUrl}/api/auth/cli-login?session=${encodeURIComponent(sessionId)}`;
+    const startTime = deps.now();
     let lastError = null;
-    while (Date.now() - startTime < POLL_TIMEOUT_MS) {
-        await sleep(POLL_INTERVAL_MS);
+    while (deps.now() - startTime < POLL_TIMEOUT_MS) {
+        await deps.sleep(POLL_INTERVAL_MS);
         try {
-            const res = await fetch(pollUrl, {
+            const res = await deps.fetch(pollUrl, {
                 signal: AbortSignal.timeout(5000),
             });
             if (!res.ok) {
                 if (res.status === 503) {
-                    lastError = "Server not ready (Redis/auth not configured). Try again later.";
+                    lastError =
+                        "The login service is unavailable (Redis/auth is not configured).";
+                }
+                else if (res.status >= 400 && res.status < 500) {
+                    lastError = `The login request was rejected (${res.status}).`;
                 }
                 else if (res.status >= 500) {
-                    lastError = `Server error (${res.status}). Try again later.`;
+                    lastError = `The login service failed (${res.status}).`;
                 }
                 continue;
             }
@@ -51,28 +145,21 @@ async function doLogin() {
             if (data.status === "pending")
                 continue;
             if (data.status === "complete" && data.token) {
-                await saveAuthToken(data.token);
-                if (data.cloudToken) {
-                    await saveCloudToken(data.cloudToken);
-                }
-                if (data.user) {
-                    await saveUserInfo(data.user);
-                }
-                console.log(`\nLogged in as ${data.user?.email || "unknown"}`);
+                await saveLoginSession({
+                    token: data.token,
+                    cloudToken: data.cloudToken,
+                    user: data.user,
+                    scopes: data.scopes,
+                    cloudScopes: data.cloudScopes,
+                });
+                deps.log(`\nLogged in as ${data.user?.email || "unknown"}`);
                 return;
             }
+            lastError = "The login service returned an incomplete authentication result.";
         }
         catch (err) {
             lastError = err instanceof Error ? err.message : "Network error";
         }
     }
-    console.error("\nLogin timed out. Please try again.");
-    if (lastError) {
-        console.error(`Last error: ${lastError}`);
-    }
-    console.error("\nDid you click \"Yes, Sign In\" in the browser after opening the URL?");
-    process.exit(1);
-}
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
+    throw new Error(`Login timed out after 120 seconds.${lastError ? ` Last error: ${lastError}` : ""} Recovery: run "summer login" again, complete "Yes, Sign In" in the browser, and return to the terminal within two minutes.`);
 }

package/dist/commands/logout.js

@@ -1,23 +1,10 @@
 import { Command } from "commander";
-import { unlink } from "fs/promises";
-import { join } from "path";
-import { getSummerDir } from "../lib/auth.js";
+import { clearAuthCredentials } from "../lib/auth.js";
 export const logoutCommand = new Command("logout")
     .description("Sign out and clear stored auth tokens")
     .action(async () => {
-    const dir = getSummerDir();
-    const files = ["auth-token", "cloud-token", "user.json"];
-    let cleared = false;
-    for (const file of files) {
-        try {
-            await unlink(join(dir, file));
-            cleared = true;
-        }
-        catch {
-            // File doesn't exist, that's fine
-        }
-    }
-    if (cleared) {
+    const removed = await clearAuthCredentials();
+    if (removed > 0) {
         console.log("Logged out. Auth tokens cleared.");
     }
     else {

package/dist/commands/logs.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare const logsCommand: Command;

package/dist/commands/logs.js

@@ -0,0 +1,19 @@
+import { Command } from "commander";
+import { readCreatorLogs } from "../lib/creator.js";
+export const logsCommand = new Command("logs")
+    .description("Read creator runtime logs")
+    .option("--project-id <id>", "Creator project ID")
+    .option("--release <id>", "Restrict logs to one release")
+    .option("--limit <count>", "Maximum log entries to return", "100")
+    .action(async (opts) => {
+    const limit = Number.parseInt(opts.limit, 10);
+    if (!Number.isInteger(limit) || limit < 1 || limit > 1000) {
+        throw new Error("--limit must be between 1 and 1000. Recovery: pass a whole number in that range.");
+    }
+    await readCreatorLogs({
+        projectId: opts.projectId,
+        releaseId: opts.release,
+        limit,
+        face: "cli",
+    });
+});

package/dist/commands/mcp.js

@@ -3,8 +3,13 @@ import { configureAgentMcp, parseAgent, parseScope, supportedAgents, } from "../
 import { startMcpServer } from "../mcp/server.js";
 export const mcpCommand = new Command("mcp")
     .description("Start the MCP server for AI tool integration (Cursor, Claude Code, etc.)")
-    .action(async () => {
-    await startMcpServer();
+    .option("--project <path>", "Bind local engine tools to the editor running this project")
+    .option("--instance <id>", "Bind local engine tools to one exact Summer editor instance")
+    .action(async (opts) => {
+    await startMcpServer({
+        projectPath: opts.project,
+        instanceId: opts.instance,
+    });
 });
 mcpCommand
     .command("setup <agent>")

package/dist/commands/open.js

@@ -13,7 +13,7 @@ export const openCommand = new Command("open")
     }
     if (!existsSync(`${fullPath}/project.godot`)) {
         console.error(`No project.godot found in ${fullPath}\n` +
-            "This doesn't look like a Godot/Summer Engine project.\n" +
+            "This doesn't look like a Summer Engine project.\n" +
             "Create one with: summer create 3d-basic my-game");
         process.exit(1);
     }

package/dist/commands/publish.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare const publishCommand: Command;

package/dist/commands/publish.js

@@ -0,0 +1,20 @@
+import { Command } from "commander";
+import { publishCreator } from "../lib/creator.js";
+export const publishCommand = new Command("publish")
+    .description("Publish a confirmed creator release")
+    .argument("[project]", "Project root. Defaults to the current directory.")
+    .requiredOption("--artifact <path>", "Exact exported Summer .pck artifact")
+    .requiredOption("--version <value>", "Immutable release version")
+    .option("--manifest <path>", "Optional JSON release manifest")
+    .option("--project-id <id>", "Creator project ID")
+    .option("--channel <name>", "Release channel")
+    .option("--notes <text>", "Release notes")
+    .option("--confirm", "Confirm the exact project and channel after reviewing them")
+    .action(async (project, opts) => {
+    const result = await publishCreator({
+        project,
+        ...opts,
+        face: "cli",
+    });
+    console.log(JSON.stringify(result, null, 2));
+});

package/dist/commands/releases.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare const releasesCommand: Command;

package/dist/commands/releases.js

@@ -0,0 +1,20 @@
+import { Command } from "commander";
+import { listCreatorReleases } from "../lib/creator.js";
+export const releasesCommand = new Command("releases")
+    .description("List creator releases for a project")
+    .option("--project-id <id>", "Creator project ID")
+    .option("--limit <count>", "Maximum releases to return", "20")
+    .option("--cursor <value>", "Opaque cursor returned by the previous page")
+    .action(async (opts) => {
+    const limit = Number.parseInt(opts.limit, 10);
+    if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+        throw new Error("--limit must be between 1 and 100. Recovery: pass a whole number in that range.");
+    }
+    const result = await listCreatorReleases({
+        projectId: opts.projectId,
+        limit,
+        cursor: opts.cursor,
+        face: "cli",
+    });
+    console.log(JSON.stringify(result, null, 2));
+});

package/dist/commands/run.js

@@ -100,7 +100,7 @@ export const runCommand = new Command("run")
         }
         if (!existsSync(join(fullProjectPath, "project.godot"))) {
             console.error(`No project.godot found in ${fullProjectPath}\n` +
-                "This doesn't look like a Godot/Summer Engine project.");
+                "This doesn't look like a Summer Engine project.");
             process.exit(1);
         }
     }

package/dist/lib/api-client.d.ts

@@ -1,3 +1,4 @@
+import { type EngineSelection } from "./engine.js";
 export type EngineSnapshot = {
     ok: boolean;
     localPath?: string;
@@ -42,8 +43,9 @@ export declare class EngineApiClient {
     private port;
     private token;
     private targetIdentity;
-    constructor(port: number, token: string, targetIdentity?: EngineTargetIdentity | string);
-    static connect(): Promise<EngineApiClient>;
+    private selection;
+    constructor(port: number, token: string, targetIdentity?: EngineTargetIdentity | string, selection?: EngineSelection | null);
+    static connect(selection?: EngineSelection): Promise<EngineApiClient>;
     /** The projectIdHash this session is bound to (undefined if none was reported
      *  at connect — e.g. no project open yet). */
     getBoundProjectIdHash(): string | undefined;

package/dist/lib/api-client.js

@@ -2,7 +2,7 @@ import { mkdir, writeFile } from "fs/promises";
 import { tmpdir } from "os";
 import { join } from "path";
 import { randomUUID } from "node:crypto";
-import { getApiToken, getApiPort, checkEngineHealth } from "./engine.js";
+import { getApiToken, getApiPort, checkEngineHealth, resolveEngineConnection, } from "./engine.js";
 import { classifyOpsResponse, pollOpToTerminal, } from "./async-op-lifecycle.js";
 function asRecord(value) {
     return value && typeof value === "object" && !Array.isArray(value)
@@ -74,15 +74,25 @@ export class EngineApiClient {
     // preserves the pre-2.6.6 constructor contract for existing callers that only
     // supplied a projectIdHash.
     targetIdentity;
-    constructor(port, token, targetIdentity = {}) {
+    selection;
+    constructor(port, token, targetIdentity = {}, selection = null) {
         this.port = port;
         this.token = token;
         this.targetIdentity =
             typeof targetIdentity === "string"
                 ? { projectIdHash: targetIdentity }
                 : { ...targetIdentity };
-    }
-    static async connect() {
+        this.selection = selection ? { ...selection } : null;
+    }
+    static async connect(selection) {
+        if (selection) {
+            const connection = await resolveEngineConnection(selection);
+            return new EngineApiClient(connection.port, connection.token, {
+                instanceId: connection.health.instanceId,
+                projectId: connection.health.projectId,
+                projectIdHash: connection.health.projectIdHash,
+            }, { ...selection });
+        }
         const port = await getApiPort();
         const token = await getApiToken();
         if (!token) {
@@ -558,6 +568,20 @@ export class EngineApiClient {
      * will fail and trigger a reconnect+retry if the client really is stale.
      */
     async credentialsChanged() {
+        if (this.selection) {
+            try {
+                const connection = await resolveEngineConnection(this.selection);
+                return (connection.port !== this.port ||
+                    connection.token !== this.token ||
+                    connection.health.instanceId !== this.targetIdentity.instanceId);
+            }
+            catch {
+                // A selected editor disappearing is real drift. Dropping the cached
+                // client makes the next connect report which project/instance is absent
+                // instead of silently following another editor's global pointer.
+                return true;
+            }
+        }
         try {
             const [port, token] = await Promise.all([getApiPort(), getApiToken()]);
             if (!token)

package/dist/lib/auth.d.ts

@@ -1,15 +1,43 @@
-export declare function getSummerDir(): string;
-export declare function getAuthToken(): Promise<string | null>;
-export declare function saveAuthToken(token: string): Promise<void>;
-export declare function getCloudToken(): Promise<string | null>;
-export declare function saveCloudToken(token: string): Promise<void>;
-export declare function getUserInfo(): Promise<{
+export { getSummerDir } from "./store.js";
+export interface SummerUserInfo {
     id: string;
     email: string;
     name?: string;
-} | null>;
-export declare function saveUserInfo(info: {
-    id: string;
-    email: string;
-    name?: string;
-}): Promise<void>;
+}
+export interface CredentialMetadata {
+    audience: string[];
+    scopes: string[];
+    tokenType?: string;
+    issuedAt?: string;
+    expiresAt?: string;
+}
+interface CredentialMetadataDocument {
+    schemaVersion: 1;
+    auth?: CredentialMetadata;
+    cloud?: CredentialMetadata;
+    creator?: CredentialMetadata;
+}
+export interface LoginSession {
+    token: string;
+    cloudToken?: string | null;
+    user?: SummerUserInfo;
+    scopes?: string[];
+    cloudScopes?: string[];
+}
+export declare function getAuthToken(): Promise<string | null>;
+export declare function saveAuthToken(token: string, scopes?: string[]): Promise<void>;
+export declare function getCloudToken(): Promise<string | null>;
+export declare function saveCloudToken(token: string, scopes?: string[]): Promise<void>;
+/**
+ * Summercraft creator tokens are a separate credential audience from the
+ * core-compatible Summer CLI JWT. Never store an sc_ token in auth-token:
+ * the engine reads that file and expects the summer-cli JWT contract.
+ */
+export declare function getCreatorToken(): Promise<string | null>;
+export declare function saveCreatorToken(token: string): Promise<void>;
+export declare function getUserInfo(): Promise<SummerUserInfo | null>;
+export declare function saveUserInfo(info: SummerUserInfo): Promise<void>;
+export declare function saveLoginSession(session: LoginSession): Promise<void>;
+export declare function getCredentialMetadata(): Promise<CredentialMetadataDocument>;
+export declare function clearAuthCredentials(): Promise<number>;
+export declare function assertCredentialScopes(metadata: CredentialMetadata | undefined, requiredScopes: string[]): void;