refactor: rename npm package to @onesignal/capacitor-plugin

[fadi-george]

Description

One Line Summary

Rename the published npm package from onesignal-capacitor-plugin to the scoped name @onesignal/capacitor-plugin and tighten the published file list.

Details

Motivation

Move the plugin under the @onesignal npm scope to align with the rest of OneSignal's published packages, improve discoverability under the org, and make ownership/access management cleaner. While renaming, also fix that the previously published tarball was shipping the local android/.gradle/ build cache (and other unintended files) by tightening the files allowlist in package.json.

Scope

• Public package name change: consumers will need to migrate from onesignal-capacitor-plugin to @onesignal/capacitor-plugin. This is a breaking install change but the public API surface, native target names, podspec, and SPM product (OnesignalCapacitorPlugin) are unchanged.
• Updated example apps (examples/demo, examples/demo_pods) so they still build against the renamed package: dependency keys, node_modules/@onesignal/capacitor-plugin paths in Capacitor's generated SPM Package.swift, Podfile, and capacitor.settings.gradle, plus examples/setup.sh and examples/build.md.
• Added publishConfig.access: public so the scoped package publishes publicly by default.
• Tightened files in package.json to exact paths (dist, ios/Sources, android/src, android/build.gradle.kts, android/gradle, Package.swift, OneSignalCapacitorPlugin.podspec). Tarball goes from 44 files / ~50 kB packed / ~345 kB unpacked to 12 files / ~32 kB packed / ~199 kB unpacked.
• Not changing: SDK source code, public TypeScript API, native iOS/Android source, version number (still 1.0.0).

Migration note for consumers

npm uninstall onesignal-capacitor-plugin
npm install @onesignal/capacitor-plugin
npx cap sync

Imports change from from 'onesignal-capacitor-plugin' to from '@onesignal/capacitor-plugin'.

Testing

Unit testing

vp test run — 11 files, 165 tests passing, 100% statements/lines coverage.

Manual testing

• vp check src clean (format + lint + types).
• npm publish --dry-run confirms tarball name @onesignal/capacitor-plugin@1.0.0, public access, and the trimmed file list (12 files, no .gradle/ cache artifacts).
• Example apps still resolve the plugin via the local .tgz workflow after setup.sh rename of the INSTALLED_DIR path and vp remove argument.

Affected code checklist

• Public API changes (package name only; TypeScript API surface unchanged)

Checklist

Overview

• I have filled out all REQUIRED sections above
• PR does one thing
• Any Public API changes are explained in the PR details and conform to existing APIs

Testing

• I have included test coverage for these changes, or explained why they are not needed (existing test suite covers behavior; no behavior changed)
• All automated tests pass
• I have personally tested this on my device — covered via dry-run publish + unit tests; recommend a manual demo build before tagging a release

Final pass

• Code is as readable as possible
• I have reviewed this PR myself

Made with Cursor

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[sherwinski]

1. We should add claude review
2. Should we remove CodeQL? It's giving this error:

CodeQL could not process any code written in Java/Kotlin.