@canra/cli 0.1.0 → 0.2.0

package/canra.js

@@ -5,7 +5,7 @@ import os from "node:os";
 import path from "node:path";
 import readline from "node:readline";
 
-// Runs under Node >= 20 (via `npx canra`) and Bun: only node: built-ins and fetch.
+// Runs under Node >= 20 (via `npx @canra/cli`) and Bun: only node: built-ins and fetch.
 // The version comes from package.json, so a release only bumps one place.
 const VERSION = JSON.parse(fs.readFileSync(new URL("./package.json", import.meta.url), "utf8")).version;
 const CONFIG_DIR = path.join(os.homedir(), ".canra");
@@ -22,14 +22,39 @@ function readConfig() {
   }
 }
 
+// The config holds an API token: readable by the owner only (the mode is
+// re-applied in case the file or directory already existed with a looser one).
 function writeConfig(config) {
-  fs.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs.writeFileSync(CONFIG_PATH, `${JSON.stringify(config, null, 2)}\n`);
+  fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  fs.chmodSync(CONFIG_DIR, 0o700);
+  fs.writeFileSync(CONFIG_PATH, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+  fs.chmodSync(CONFIG_PATH, 0o600);
+}
+
+// The token is sent to the registry on every authenticated call, so only an
+// https registry is accepted -- or plain http to this machine, for development.
+function registryError(registry) {
+  let url;
+  try {
+    url = new URL(registry);
+  } catch {
+    return `"${registry}" is not a valid URL`;
+  }
+  if (url.protocol === "https:") return null;
+  const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  if (url.protocol === "http:" && local) return null;
+  return `the registry must use https (got ${url.protocol}//${url.host}); plain http is only allowed for localhost`;
 }
 
 function getRegistry() {
   const config = readConfig();
-  return config.registry || "https://canra.dev";
+  const registry = config.registry || "https://canra.dev";
+  const problem = registryError(registry);
+  if (problem) {
+    console.error(`Error: ${problem}. Run "canra login" again.`);
+    process.exit(1);
+  }
+  return registry;
 }
 
 function getToken() {
@@ -97,17 +122,28 @@ function specApiUrl(registry, { owner, name }) {
 
 // --- Prompt helper ---
 
-function prompt(question) {
-  const rl = readline.createInterface({
-    input: process.stdin,
-    output: process.stdout,
-  });
-  return new Promise((resolve) => {
-    rl.question(question, (answer) => {
-      rl.close();
-      resolve(answer.trim());
-    });
+// Ask questions on ONE readline interface (separate interfaces on piped stdin
+// let the first swallow every line and leave the next prompt hanging). Lines
+// that arrive before a question is asked are queued, so piped answers work.
+function createPrompter() {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: false });
+  const lines = [];
+  const waiting = [];
+  let closed = false;
+  rl.on("line", (line) => (waiting.length ? waiting.shift()(line) : lines.push(line)));
+  rl.on("close", () => {
+    closed = true;
+    while (waiting.length) waiting.shift()("");
   });
+  return {
+    ask(question) {
+      process.stdout.write(question);
+      if (lines.length) return Promise.resolve(lines.shift().trim());
+      if (closed) return Promise.resolve("");
+      return new Promise((resolve) => waiting.push((line) => resolve(line.trim())));
+    },
+    close: () => rl.close(),
+  };
 }
 
 // --- Commands ---
@@ -193,9 +229,18 @@ async function cmdSearch(query) {
   console.log(`\n${specs.length} result${specs.length !== 1 ? "s" : ""}`);
 }
 
-async function cmdPublish(filePath) {
+async function cmdPublish(args) {
+  // canra publish <file> [--owner <org>]: --owner publishes into an org you
+  // belong to instead of your own scope.
+  const ownerAt = args.indexOf("--owner");
+  const owner = ownerAt >= 0 ? args[ownerAt + 1] : null;
+  const filePath = args.find((a, i) => !a.startsWith("--") && (ownerAt < 0 || i !== ownerAt + 1));
+  if (ownerAt >= 0 && (!owner || !OWNER_RE.test(owner))) {
+    console.error("Error: --owner needs a valid organization name");
+    process.exit(1);
+  }
   if (!filePath) {
-    console.error("Usage: canra publish <file>");
+    console.error("Usage: canra publish <file> [--owner <org>]");
     process.exit(1);
   }
 
@@ -213,7 +258,8 @@ async function cmdPublish(filePath) {
   const registry = getRegistry();
   const headers = authHeaders();
 
-  const res = await fetchRegistry(`${registry}/api/specs`, {
+  const target = owner ? `${registry}/api/specs?owner=${encodeURIComponent(owner)}` : `${registry}/api/specs`;
+  const res = await fetchRegistry(target, {
     method: "POST",
     body: content,
     headers,
@@ -232,8 +278,16 @@ async function cmdLogin() {
   const currentConfig = readConfig();
   const defaultRegistry = currentConfig.registry || "https://canra.dev";
 
-  const registry = (await prompt(`Registry URL (${defaultRegistry}): `)) || defaultRegistry;
-  const token = await prompt("API token: ");
+  const prompter = createPrompter();
+  const registry = ((await prompter.ask(`Registry URL (${defaultRegistry}): `)) || defaultRegistry).replace(/\/+$/, "");
+  const registryProblem = registryError(registry);
+  if (registryProblem) {
+    prompter.close();
+    console.error(`Error: ${registryProblem}`);
+    process.exit(1);
+  }
+  const token = await prompter.ask("API token: ");
+  prompter.close();
 
   if (!token) {
     console.error("Error: token is required");
@@ -393,7 +447,9 @@ Commands:
   fetch <owner>/<name>[@version]
                            Fetch spec from registry, save to .canra/specs/
   search <query>           Search registry, print formatted results
-  publish <file>           Publish a spec file (requires auth token)
+  publish <file> [--owner <org>]
+                           Publish a spec file (requires auth token); --owner
+                           publishes into an organization you belong to
   login                    Prompt for registry URL and token
   logout                   Remove saved credentials
   whoami                   Print the user your saved token authenticates as
@@ -424,7 +480,7 @@ async function main() {
       await cmdSearch(arg);
       break;
     case "publish":
-      await cmdPublish(args[1]);
+      await cmdPublish(args.slice(1));
       break;
     case "login":
       await cmdLogin();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canra/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "CLI for Canra, the registry of machine-readable specs: fetch, search, and publish specs.",
   "keywords": [
     "canra",