Detect incomplete published Aura assets when the manifest still matches

[bajramemini]

Summary

Aura::assetsAreCurrent() only compares the published and package manifest.json files byte-for-byte. It returns true when those manifests match even if the CSS or JavaScript files referenced by the manifest are missing from public/vendor/aura/assets.

The layout then suppresses its local php artisan aura:publish warning, while the browser loads an incomplete Aura runtime and the sidebar fails to initialize correctly.

Affected code on main:

• src/Aura.php:63-76
• src/Commands/PublishCommand.php:29-40
• resources/views/components/layout/app.blade.php:47-50

Reproduction

1. Install Aura CMS in a fresh application or Git worktree.
2. Ensure public/vendor/aura/manifest.json exists and matches resources/dist/manifest.json.
3. Remove public/vendor/aura/assets, or remove one CSS/JS file referenced by the manifest while leaving the published manifest in place.
4. Open an Aura admin route in the local environment.
5. Observe that no stale-assets warning is shown because assetsAreCurrent() returns true.
6. Inspect the browser console and network requests.
7. Run herd php artisan aura:publish (or php artisan aura:publish) and reload.

Actual behavior

In the Aura Demo review worktree:

• The manifest existed and matched the package manifest.
• Its referenced CSS and JavaScript files were absent.
• Chrome reported 47 errors, beginning with tippy is not defined.
• Alpine did not finish sidebar initialization, leaving the sidebar malformed/duplicated and incorrectly styled.
• aura:publish restored the asset files; the console returned to zero runtime errors and the sidebar rendered normally.

Expected behavior

An incomplete published asset tree must be treated as stale even when the manifest contents match. The existing local warning should direct the developer to run php artisan aura:publish before the broken runtime is used.

Recommended implementation

Validate referenced files

• Decode the package and published manifests and fail clearly if either is invalid.
• Keep the manifest equality/version check.
• Recursively collect every referenced Vite entry: file, css, assets, and imported chunks where applicable.
• Normalize each path below public/vendor/aura and reject traversal outside that directory.
• Require every referenced path to exist as a regular file.
• Return false when any referenced file is absent so the existing local warning is displayed.

Make publication failure-safe

PublishCommand deletes the existing assets directory before publishing. If publication fails, a stale manifest can remain beside a partial or empty asset tree.

• Publish to a temporary directory and swap it into place only after verification, or remove/write the manifest in an order that cannot advertise an incomplete bundle.
• Run the same integrity check after vendor:publish and fail the command with the missing paths if the result is incomplete.
• Keep aura:publish idempotent.

Tests

Add feature tests covering:

• Matching manifests with all referenced files present → current.
• Matching manifests with the primary JavaScript file missing → stale.
• Matching manifests with a CSS file missing → stale.
• Missing imported chunk or nested asset → stale.
• Different manifests → stale.
• Malformed manifest → actionable failure.
• aura:publish repairs an incomplete tree and passes the integrity check.
• A simulated publish failure does not leave a manifest that points to missing files.

Acceptance criteria

• Aura never reports assets as current when a manifest-referenced file is missing.
• Local admin pages show the existing publish warning for incomplete assets instead of loading a broken sidebar.
• aura:publish either completes with a verified bundle or leaves the prior valid bundle intact.
• The behavior is covered by deterministic filesystem tests.

Expected result after republishing