@diagc/cli 0.2.0 → 0.3.0

package/dist/includes.d.ts

@@ -1,4 +1,13 @@
 import type { IncludeSource } from '@diagc/core';
+export declare const AUTH_TOKENS_ENV = "DIAGC_AUTH_TOKENS";
+/**
+ * Credentials for private include hosts, in Deno's `DENO_AUTH_TOKENS` format:
+ * `;`-separated `token@host` (sent as a bearer token) or `user:pass@host`
+ * (basic auth), the host with its port when it has one. Keyed by `URL.host`,
+ * so a credential only ever reaches the host it names. Malformed entries are
+ * skipped rather than failing a compile that may not need them.
+ */
+export declare function parseAuthTokens(raw: string | undefined): Map<string, string>;
 /** diagc's include IO: http(s) URLs via fetch, everything else via the
  * filesystem relative to the declaring file. Returns the canonical resolved
  * ref so compose can detect cycles across mixed URL/path chains. */

package/dist/includes.js

@@ -1,15 +1,52 @@
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 const isHttp = (s) => /^https?:\/\//.test(s);
+export const AUTH_TOKENS_ENV = 'DIAGC_AUTH_TOKENS';
+/**
+ * Credentials for private include hosts, in Deno's `DENO_AUTH_TOKENS` format:
+ * `;`-separated `token@host` (sent as a bearer token) or `user:pass@host`
+ * (basic auth), the host with its port when it has one. Keyed by `URL.host`,
+ * so a credential only ever reaches the host it names. Malformed entries are
+ * skipped rather than failing a compile that may not need them.
+ */
+export function parseAuthTokens(raw) {
+    const out = new Map();
+    for (const entry of (raw ?? '').split(';').map((e) => e.trim())) {
+        const at = entry.lastIndexOf('@');
+        if (at <= 0)
+            continue;
+        const secret = entry.slice(0, at);
+        const host = entry.slice(at + 1).toLowerCase();
+        if (host === '')
+            continue;
+        out.set(host, secret.includes(':') ? `Basic ${Buffer.from(secret).toString('base64')}` : `Bearer ${secret}`);
+    }
+    return out;
+}
+/** The Authorization header for `url`, if one is configured for its host. Only
+ * over https: a token sent over plain http is a token handed to the network. */
+function authFor(url) {
+    if (url.protocol !== 'https:')
+        return undefined;
+    return parseAuthTokens(process.env[AUTH_TOKENS_ENV]).get(url.host);
+}
 /** diagc's include IO: http(s) URLs via fetch, everything else via the
  * filesystem relative to the declaring file. Returns the canonical resolved
  * ref so compose can detect cycles across mixed URL/path chains. */
 export async function resolveInclude(spec, fromRef) {
     if (isHttp(spec) || isHttp(fromRef)) {
         const url = isHttp(spec) ? spec : new URL(spec, fromRef).href;
-        const res = await fetch(url);
-        if (!res.ok)
-            throw new Error(`HTTP ${res.status} fetching ${url}`);
+        const auth = authFor(new URL(url));
+        // fetch drops Authorization on a cross-origin redirect, so a raw host that
+        // bounces to a CDN does not take the token with it
+        const res = await fetch(url, auth !== undefined ? { headers: { authorization: auth } } : undefined);
+        if (!res.ok) {
+            // private hosts answer 404 as often as 401/403, so hint on all three
+            const hint = auth === undefined && [401, 403, 404].includes(res.status)
+                ? ` — if the host is private, set ${AUTH_TOKENS_ENV}=<token>@${new URL(url).host}`
+                : '';
+            throw new Error(`HTTP ${res.status} fetching ${url}${hint}`);
+        }
         return { model: (await res.json()), ref: url };
     }
     const file = path.resolve(path.dirname(fromRef), spec);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diagc/cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Author software-architecture diagrams as code, compile them to a validated model, edit them in a local studio, and publish pages and images.",
   "license": "AGPL-3.0-only",
   "author": "Bogdan Frankovskyi",
@@ -44,7 +44,7 @@
     "fast-glob": "^3.3.0",
     "jiti": "^2.0.0",
     "playwright-core": "^1.62.0",
-    "@diagc/core": "0.2.0"
+    "@diagc/core": "0.3.0"
   },
   "publishConfig": {
     "access": "public"