fix(publish): preserve scope in publish attachment key and tarball URI

[pullfrog]

Problem

Publishing a scoped package to GitHub Packages fails with:

400 Bad Request: {"error":"no attachments present in packument"}

build_publish_body keyed both _attachments and the dist.tarball URI by archive.filename, which is the on-disk nub pack name. pack::tarball_filename flattens the scope (@scope/pkg → scope-pkg), so the publish body advertised oisin-ee-momokaya-brand-0.1.2.tgz instead of the scope-preserving @oisin-ee/momokaya-brand-0.1.2.tgz that GitHub Packages requires. npm's libnpmpublish uses ${manifest.name}-${manifest.version}.tgz (scope intact) for both, so this is a divergence from the reference protocol.

Fix

Add publish_attachment_name (<name>-<version>.tgz, scope preserved) and use it for the _attachments key and the tarball URI. The flattened nub pack filename and the --json filename field are unchanged, keeping npm-compatible pack output intact.

The provenance attachment already used archive.name (scoped), so only the tarball attachment was affected.

Test

publish_body_uses_scoped_attachment_key_and_tarball_uri asserts the serialized body keys _attachments and dist.tarball by the scoped form for @oisin-ee/momokaya-brand, with no live registry needed. Verified locally: all 25 commands::publish tests pass.

Closes #477

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nub	Ready	Preview, Comment	Jul 15, 2026 8:10am

[colinhacks]

Shipped in v0.5.0: https://github.com/nubjs/nub/releases/tag/v0.5.0