@endora-commerce/cli 0.100.0

package/dist/new-storefront/index.js

@@ -0,0 +1,329 @@
+/**
+ * `endora new storefront <dir>` — the command.
+ *
+ * It copies the reference storefront out of this repository into a directory the
+ * client then owns outright, rewrites every declaration that names something
+ * above the storefront's own directory, and **forgets it** (D-195). There is no
+ * kit, no shell and no channel back to what it wrote: a scaffold that kept one
+ * would be a kit wearing a different name.
+ *
+ * The order is `endora new module`'s and for the same reason: **validate
+ * completely, then write**. A half-written storefront is worse than none — it
+ * installs against ranges nothing resolves, its configuration extends a file it
+ * does not have, and the author's next command is a manual clean-up.
+ *
+ * Exit codes are `contracts/cli-surface.md` §2's, unchanged: `0` it did what it
+ * was asked, `1` a refusal the author can act on, `2` an input it could not
+ * read. The three refusal classes map cleanly — a target directory that is
+ * occupied and an outward reference no rule classifies are `1`; a checkout with
+ * no reference storefront in it is `2`.
+ *
+ * ## It resolves the copy's environment inputs, in four tiers
+ *
+ * `specs/117-instance-bring-up/` FR-010…FR-015. The storefront declares what it
+ * needs (`storefront/environment-inputs.mjs`) and this command resolves each of
+ * those in one fixed order — an explicit flag, then a `.env` already placed in
+ * the target directory, then a prompt on a terminal, then a refusal naming
+ * **every** missing input at once — and writes the answers into the copy's own
+ * `.env`. The values are the operator's or they are asked for; nothing is
+ * invented, and the run says so in a provenance line whose `defaulted=` is
+ * contract-bound to `0`.
+ *
+ * FR-014 is why it is here and not only in `endora new instance`: one product
+ * means one behaviour, and the resolution is one shared module rather than a
+ * copy per command. This command already exists and already has a customer, and
+ * three of its required inputs are three of the four facts nothing reconciles
+ * across the trees today.
+ */
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, join, resolve, sep } from 'node:path';
+import { scopeToMembers } from '@endora-commerce/contracts';
+import { loadTreeDeclaration } from '../inputs/declaration.js';
+import { parseEnvFile, writeEnvFile } from '../inputs/env-file.js';
+import { promptForInputs } from '../inputs/prompt.js';
+import { flagFor, generateSecret, interactivityOf, missingInputsRefusal, planResolution, provenanceLine, } from '../inputs/resolve.js';
+import { TOKEN_VARIABLE } from './npmrc.js';
+import { addressVariables, ENV_EXAMPLE_FILE, memberDirectories, resolveReference, STOREFRONT_DECLARATION_EXPORT, StorefrontHostError, StorefrontInputError, } from './reference.js';
+import { planStorefront } from './rewrite.js';
+/** Raised when required inputs are missing and this run may not ask (R7.2). */
+export class MissingInputsError extends Error {
+    name = 'MissingInputsError';
+}
+export async function runNewStorefront(options) {
+    const cwd = options.cwd ?? process.cwd();
+    if (options.dir === undefined || options.dir.trim().length === 0) {
+        throw new StorefrontInputError(`\`new storefront\` takes the directory to write, and has no default. The reference ` +
+            `storefront is this repository's own application; a command that defaulted the target ` +
+            `would either overwrite it or invent a name nobody chose.`);
+    }
+    const reference = resolveReference(cwd);
+    const targetDir = isAbsolute(options.dir) ? options.dir : resolve(cwd, options.dir);
+    refuseOccupiedDirectory(targetDir);
+    if (targetDir === reference.dir || targetDir.startsWith(reference.dir + sep)) {
+        throw new StorefrontInputError(`${targetDir} is inside the reference storefront this command copies. A scaffold written ` +
+            `there would be a copy of itself, and the copy would be part of its own population on ` +
+            `the next run.`);
+    }
+    const members = memberDirectories(reference.repoRoot);
+    const plan = planStorefront(reference, members, targetDir, {
+        ...(options.registry === undefined ? {} : { registry: options.registry }),
+    });
+    // Validate completely, then write — and the inputs are part of "completely".
+    // A tree written before the refusal would be a storefront on disk that cannot
+    // build, which is the half-written state this command's whole order exists to
+    // avoid.
+    const dryRun = options.dryRun === true;
+    const interactivity = interactivityOf({
+        nonInteractive: options.nonInteractive === true,
+        dryRun,
+    });
+    const declared = await loadTreeDeclaration(reference.dir, STOREFRONT_DECLARATION_EXPORT);
+    const resolution = planResolution({
+        declared,
+        // `endora new storefront` writes exactly one member. An input read only by
+        // the admin or only by the backend is out of this run's population — not
+        // resolved, not asked for, not refused — which is
+        // `specs/118-instance-member-selection/`'s scoping, applied to the command
+        // that has one member today so that it is already right for the command
+        // that has three tomorrow.
+        members: ['storefront'],
+        flags: options.inputs ?? {},
+        envFile: readTargetEnv(targetDir),
+        interactivity,
+        language: 'en',
+    });
+    if (resolution.missing.length > 0) {
+        throw new MissingInputsError(missingInputsRefusal(resolution.missing, interactivity));
+    }
+    if (dryRun) {
+        // R2.4 / R7.3 — a dry run resolves and reports; it prompts nothing and
+        // generates nothing, and it names each input it would have had to ask for.
+        // Its purpose is to be inspectable before it is trusted, and a dry run that
+        // stopped to ask for a password is not inspectable.
+        return {
+            reference,
+            targetDir,
+            plan,
+            dryRun: true,
+            nextSteps: nextSteps(targetDir, plan, declared, resolution.resolved),
+            resolved: resolution.resolved,
+            provenance: provenanceLine(resolution.resolved),
+            wouldPrompt: resolution.toPrompt.map((input) => input.name),
+            wouldGenerate: resolution.toGenerate.map((input) => input.name),
+            unset: resolution.unset.map((input) => input.name),
+        };
+    }
+    const answered = await promptForInputs(resolution.toPrompt, 'en', options.promptIo ?? { input: process.stdin, output: process.stdout });
+    const generated = resolution.toGenerate.map((input) => ({
+        name: input.name,
+        value: generateSecret(),
+        provenance: 'generated',
+    }));
+    const resolved = [...resolution.resolved, ...answered, ...generated];
+    for (const file of plan.files) {
+        const target = join(targetDir, file.path);
+        mkdirSync(dirname(target), { recursive: true });
+        if (file.content !== null)
+            writeFileSync(target, file.content, 'utf8');
+        else
+            writeFileSync(target, readFileSync(file.source));
+    }
+    writeResolvedEnv(targetDir, resolved);
+    return {
+        reference,
+        targetDir,
+        plan,
+        dryRun: false,
+        nextSteps: nextSteps(targetDir, plan, declared, resolved),
+        resolved,
+        provenance: provenanceLine(resolved),
+        wouldPrompt: [],
+        wouldGenerate: [],
+        unset: resolution.unset.map((input) => input.name),
+    };
+}
+/**
+ * The flags this build accepts for the reference storefront's declared inputs,
+ * without their leading dashes.
+ *
+ * The argv layer calls this **before** it parses, so `parseArgs` keeps
+ * `strict: true` and an unrecognised flag stays a refusal
+ * (`cli-surface.md` §1). The alternative — parsing leniently for this one
+ * subcommand — would trade a typo'd `--next-public-api-base-ur` from a loud
+ * refusal into a silently unset required input, which is the whole class of
+ * failure this feature exists to remove.
+ *
+ * It is derived from the declaration rather than written down, so a storefront
+ * that declares a variable this build has never heard of is supplied by its own
+ * flag with nothing here to update (D-100).
+ */
+export async function storefrontInputFlags(cwd) {
+    return (await storefrontDeclaredInputs(cwd)).map((input) => flagFor(input.name).slice(2));
+}
+/**
+ * The reference storefront's own declaration, scoped to the one member this
+ * command writes.
+ *
+ * Exported because a caller that has to *supply* these inputs needs the same
+ * population the command will *demand*, and deriving it twice is two answers
+ * waiting to disagree — which is exactly how the acceptance criterion came to
+ * invoke this command with none of them. The scoping is `planResolution`'s and
+ * is applied here so that the two cannot part company either: an input read only
+ * by the admin or only by the backend is out of this command's population, so it
+ * is out of a supplier's too.
+ *
+ * The requirement is deliberately **not** filtered here. `isRequiredGiven` reads
+ * a conditional requirement against the values a run has in hand, so which
+ * inputs are required is a property of the invocation rather than of the
+ * declaration, and answering it here would answer it for one invocation and be
+ * wrong for the next.
+ */
+export async function storefrontDeclaredInputs(cwd) {
+    const reference = resolveReference(cwd);
+    const declared = await loadTreeDeclaration(reference.dir, STOREFRONT_DECLARATION_EXPORT);
+    return scopeToMembers(declared, ['storefront']);
+}
+/** The file the copy's own runtime configuration lives in. */
+const ENV_FILE = '.env';
+/**
+ * Tier 2 — the `.env` **of the target directory**, never of the working
+ * directory and never of an ancestor (R1.2).
+ *
+ * That restriction is the whole of the rule: a command run inside a checkout of
+ * ours must not silently inherit that checkout's development configuration,
+ * which is how a client's first instance would come to carry
+ * `postgresql://b2b:b2b@localhost:5432/b2b`.
+ */
+function readTargetEnv(targetDir) {
+    const path = join(targetDir, ENV_FILE);
+    if (!existsSync(path))
+        return new Map();
+    return parseEnvFile(readFileSync(path, 'utf8'));
+}
+/**
+ * The answers, into the copy's own `.env`.
+ *
+ * R4.2 — a generated secret is written **where the operator can read it**,
+ * change it and copy it into a secret store. It is named in the provenance line
+ * and its value is printed nowhere.
+ *
+ * The file the operator may already have placed here is merged into rather than
+ * rewritten: its comments, its ordering and its own keys survive.
+ */
+function writeResolvedEnv(targetDir, resolved) {
+    const path = join(targetDir, ENV_FILE);
+    const existing = existsSync(path) ? readFileSync(path, 'utf8') : '';
+    const values = new Map(resolved.map((entry) => [entry.name, entry.value]));
+    writeFileSync(path, writeEnvFile(existing, values), 'utf8');
+}
+/**
+ * The target must be empty — **or hold nothing but a `.env`**.
+ *
+ * The exception is the owner's own second tier, in their own words: *"I invoke a
+ * command and I can attach arguments, **or place the required things in a
+ * `.env` beforehand**"*. Without it tier 2 is unreachable for this command,
+ * because the only directory it accepts is one that can hold no file at all —
+ * which would leave `input-resolution.md` §1's four tiers implemented as three
+ * and the operator's cheapest path refused by the command that documents it.
+ *
+ * It stays one file rather than "a few harmless ones". Everything else this
+ * command would write over is either hand-written code or a copy of the
+ * reference, and merging into either is the silent discard the refusal exists
+ * for; a `.env` is neither, being the one file whose contents this command reads
+ * *before* it writes and merges into rather than replaces.
+ */
+function refuseOccupiedDirectory(targetDir) {
+    if (!existsSync(targetDir))
+        return;
+    const entries = readdirSync(targetDir);
+    if (entries.length === 0)
+        return;
+    if (entries.length === 1 && entries[0] === ENV_FILE)
+        return;
+    throw new StorefrontInputError(`${targetDir} exists and is not empty (${entries.slice(0, 5).join(', ')}). This command ` +
+        `never merges into a directory: it is not idempotent over an existing storefront, and ` +
+        `pretending otherwise would silently discard hand-written code. A directory holding ` +
+        `nothing but a \`${ENV_FILE}\` is the one exception — that file is where you may place ` +
+        `the values this command would otherwise ask you for.`);
+}
+/**
+ * The steps that are the author's.
+ *
+ * It never runs them, for `endora new module`'s reason: a scaffold that ran the
+ * consuming project's tooling would be a channel back to the instance, and D-195
+ * is that there is none.
+ *
+ * **The first step is about the registry, and it changed with publication**
+ * (feature 104, § 1.5). It used to tell its reader to pack tarballs and pin them
+ * through `pnpm.overrides`, which was honest while nothing under `packages/` was
+ * published and became wrong the moment something was — instructions in a copy a
+ * client owns outright are not something anybody comes back to correct.
+ */
+function nextSteps(targetDir, plan, declared, resolved) {
+    const published = plan.ranges.length;
+    const ranges = `the ${String(published)} \`@endora-commerce/*\` ${published === 1 ? 'range' : 'ranges'}`;
+    const install = plan.registry === null
+        ? `cd ${targetDir} && pnpm install — ${ranges} in the manifest are published semver and ` +
+            `resolve at the public npm registry, which is what this command assumes when it is not ` +
+            `told otherwise. If your instance installs them from a private registry, scaffold again ` +
+            `with \`--registry <url>\`: it writes the \`.npmrc\` for you, with the token as an ` +
+            `environment reference and never as a value.`
+        : `cd ${targetDir} && export ${TOKEN_VARIABLE}=… && pnpm install — the \`.npmrc\` this ` +
+            `command wrote points ${ranges} at ${plan.registry}. The file holds no secret: the ` +
+            `token is \${${TOKEN_VARIABLE}}, expanded at install time, so commit the file and keep ` +
+            `the value in your environment. If a fetch reports that a package "is not in the npm ` +
+            `registry", read the last line of pnpm's output before believing it — the registry ` +
+            `answers an expired credential with 404, in the same words it uses for a package that ` +
+            `genuinely does not exist.`;
+    // The names are the copy's own declaration, never a pair written here: this
+    // step used to name `PUBLIC_API_BASE_URL`, which nothing in the storefront
+    // reads, and the fetchers fall back to `http://localhost:3001` in silence — so
+    // an author who followed it had a storefront talking to nothing in particular
+    // and no error anywhere to say so.
+    //
+    // **It is `addressOf`, not the shape of the value in `.env.example`.** That
+    // was the derivation until `NEXT_PUBLIC_SITE_URL` was supplied there, at which
+    // point a predicate reading *absolute `http(s)` URL* would have swept the
+    // shop's **own** public address into this sentence and told its owner it
+    // "names the backend this storefront talks to" — in a file they own outright
+    // and nobody comes back to correct.
+    const backendVariables = addressVariables(declared, 'backend');
+    // Which of those the run already answered. The step below stops telling an
+    // author to set a value that is already in the file this command wrote:
+    // instructions in a copy the client owns outright are not something anybody
+    // comes back to correct, so a stale one stays wrong for the life of the shop.
+    const answered = new Set(resolved.map((entry) => entry.name));
+    // Next's own convention, not ours: a `NEXT_PUBLIC_` variable is inlined into
+    // the client bundle by `next build`, so setting it afterwards changes nothing
+    // a browser sees. Saying which of the copy's variables that is costs a prefix
+    // test and saves the author a rebuild they would otherwise discover.
+    const baked = backendVariables.filter((name) => name.startsWith('NEXT_PUBLIC_'));
+    const unanswered = backendVariables.filter((name) => !answered.has(name));
+    const backendStep = () => unanswered.length === 0
+        ? `check ${ENV_FILE} — this command wrote it, and every value in it is one you supplied ` +
+            `on the command line, one you had already put there, or one you were asked for. ` +
+            `${backendVariables.length === 0 ? '' : `${backendVariables.join(' and ')} name the ` +
+                `backend this storefront talks to; change ${backendVariables.length === 1 ? 'it' : 'them'} there. `}Nothing in it was invented — a generated secret is named in the ` +
+            `\`[inputs] resolved:\` line above and its value is in the file, never on your screen.`
+        : `set ${unanswered.join(' and ')} (and the rest of ${ENV_EXAMPLE_FILE}) to the ` +
+            `backend this storefront talks to. Its fetchers fall back to a compiled-in address when ` +
+            `the environment names none, so an instance that sets none of them talks to that ` +
+            `address rather than refusing.${baked.length === 0 ? '' : ` Next inlines ${baked.join(' and ')} into the browser bundle at build time, so set ${baked.length === 1 ? 'it' : 'them'} before \`pnpm run build\` rather than after.`}`;
+    return [
+        install,
+        backendStep(),
+        `pnpm run build — it runs \`themes:generate\`, \`next build\` and \`check:themes\`.`,
+        // Baseline step E4 (`specs/125-first-mile-install/spec.md` §2.3), which was
+        // printed nowhere: `storefront/package.json` has declared `start` all
+        // along, and a client who followed this block to the end had a built
+        // storefront and no command to serve it with.
+        `pnpm run start — the built storefront, served. \`pnpm run dev\` is the other one: the ` +
+            `same pages, rebuilt as you edit them, and the only one of the two that does not need a ` +
+            `build first.`,
+        `this storefront is yours now. There is no kit to upgrade and no shell to keep in step: a ` +
+            `fix to the platform reaches you through \`@endora-commerce/contracts\`, where a wire ` +
+            `change is a compile error rather than a runtime surprise.`,
+    ];
+}
+export { StorefrontHostError, StorefrontInputError };
+//# sourceMappingURL=index.js.map

package/dist/new-storefront/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/new-storefront/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAyB,MAAM,4BAA4B,CAAC;AAEnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAiB,MAAM,qBAAqB,CAAC;AACrE,OAAO,EACL,OAAO,EACP,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,cAAc,GAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,6BAA6B,EAC7B,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAuB,MAAM,cAAc,CAAC;AA8BnE,+EAA+E;AAC/E,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACzB,IAAI,GAAG,oBAAoB,CAAC;CAC/C;AAsBD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA6B;IAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,oBAAoB,CAC5B,qFAAqF;YACnF,uFAAuF;YACvF,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAEpF,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,SAAS,KAAK,SAAS,CAAC,GAAG,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,oBAAoB,CAC5B,GAAG,SAAS,8EAA8E;YACxF,uFAAuF;YACvF,eAAe,CAClB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE;QACzD,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;KAC1E,CAAC,CAAC;IAEH,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,SAAS;IACT,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;IACvC,MAAM,aAAa,GAAG,eAAe,CAAC;QACpC,cAAc,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI;QAC/C,MAAM;KACP,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IACzF,MAAM,UAAU,GAAG,cAAc,CAAC;QAChC,QAAQ;QACR,2EAA2E;QAC3E,yEAAyE;QACzE,kDAAkD;QAClD,2EAA2E;QAC3E,wEAAwE;QACxE,2BAA2B;QAC3B,OAAO,EAAE,CAAC,YAAY,CAAC;QACvB,KAAK,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;QAC3B,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC;QACjC,aAAa;QACb,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IAEH,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,uEAAuE;QACvE,2EAA2E;QAC3E,4EAA4E;QAC5E,oDAAoD;QACpD,OAAO;YACL,SAAS;YACT,SAAS;YACT,IAAI;YACJ,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC;YACpE,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC/C,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;YAC3D,aAAa,EAAE,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;YAC/D,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SACnD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CACpC,UAAU,CAAC,QAAQ,EACnB,IAAI,EACJ,OAAO,CAAC,QAAQ,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CACrE,CAAC;IACF,MAAM,SAAS,GAAoB,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,cAAc,EAAE;QACvB,UAAU,EAAE,WAAoB;KACjC,CAAC,CAAC,CAAC;IACJ,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAC;IAErE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;;YAClE,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,MAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAEtC,OAAO;QACL,SAAS;QACT,SAAS;QACT,IAAI;QACJ,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC;QACzD,QAAQ;QACR,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC;QACpC,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,EAAE;QACjB,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAW;IACpD,OAAO,CAAC,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAW;IAEX,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IACzF,OAAO,cAAc,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,8DAA8D;AAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC;AAExB;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACxC,OAAO,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,SAAiB,EAAE,QAAkC;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAU,CAAC,CAAC,CAAC;IACpF,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,uBAAuB,CAAC,SAAiB;IAChD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO;IACnC,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO;IAC5D,MAAM,IAAI,oBAAoB,CAC5B,GAAG,SAAS,6BAA6B,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB;QACvF,uFAAuF;QACvF,qFAAqF;QACrF,mBAAmB,QAAQ,6DAA6D;QACxF,sDAAsD,CACzD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,SAAS,CAChB,SAAiB,EACjB,IAAoB,EACpB,QAAqC,EACrC,QAAkC;IAElC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,SAAS,CAAC,2BACrC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAC9B,EAAE,CAAC;IACH,MAAM,OAAO,GACX,IAAI,CAAC,QAAQ,KAAK,IAAI;QACpB,CAAC,CAAC,MAAM,SAAS,sBAAsB,MAAM,4CAA4C;YACvF,wFAAwF;YACxF,yFAAyF;YACzF,oFAAoF;YACpF,6CAA6C;QAC/C,CAAC,CAAC,MAAM,SAAS,cAAc,cAAc,2CAA2C;YACtF,wBAAwB,MAAM,OAAO,IAAI,CAAC,QAAQ,kCAAkC;YACpF,eAAe,cAAc,2DAA2D;YACxF,sFAAsF;YACtF,oFAAoF;YACpF,uFAAuF;YACvF,2BAA2B,CAAC;IAClC,4EAA4E;IAC5E,2EAA2E;IAC3E,+EAA+E;IAC/E,8EAA8E;IAC9E,mCAAmC;IACnC,EAAE;IACF,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,yEAAyE;IACzE,6EAA6E;IAC7E,oCAAoC;IACpC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/D,2EAA2E;IAC3E,wEAAwE;IACxE,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,MAAM,WAAW,GAAG,GAAW,EAAE,CAC/B,UAAU,CAAC,MAAM,KAAK,CAAC;QACrB,CAAC,CAAC,SAAS,QAAQ,sEAAsE;YACvF,iFAAiF;YACjF,GAAG,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY;gBACnF,4CACE,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MACzC,UAAU,kEAAkE;YAC9E,uFAAuF;QACzF,CAAC,CAAC,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,gBAAgB,WAAW;YAC/E,yFAAyF;YACzF,kFAAkF;YAClF,gCAAgC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,IAAI,CACnF,OAAO,CACR,kDACC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAC9B,+CAA+C,EAAE,CAAC;IACxD,OAAO;QACL,OAAO;QACP,WAAW,EAAE;QACb,oFAAoF;QACpF,4EAA4E;QAC5E,sEAAsE;QACtE,qEAAqE;QACrE,8CAA8C;QAC9C,wFAAwF;YACtF,yFAAyF;YACzF,cAAc;QAChB,2FAA2F;YACzF,uFAAuF;YACvF,2DAA2D;KAC9D,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/new-storefront/npmrc.d.ts

@@ -0,0 +1,98 @@
+/**
+ * The environment variable the auth line refers to.
+ *
+ * One name, spelled here and in `.gitlab-ci.yml`'s `publish:packages` job,
+ * because it is the name the contract writes (R3) and the one an operator is told
+ * to set. It is deliberately not an option: a per-scaffold variable name is a
+ * support conversation per client for no capability.
+ */
+export declare const TOKEN_VARIABLE = "ENDORA_NPM_TOKEN";
+/**
+ * The registry URL as an `.npmrc` line writes it: absolute, `http(s)`, with the
+ * trailing slash GitLab's own troubleshooting requires (R3.2).
+ */
+export declare function normalizeRegistry(registry: string): string;
+/**
+ * The scopes a scaffolded storefront installs from a registry.
+ *
+ * Read off the reference storefront's `workspace:` ranges — the packages that
+ * stop resolving the moment the copy leaves the workspace — rather than off the
+ * checkout's members. The two populations are not the same question: what the
+ * platform *publishes* is `check:release-intent`'s, and what this storefront
+ * *installs* is this one's.
+ */
+export declare function installedScopes(manifest: Record<string, unknown>): readonly string[];
+/**
+ * The keys the auth lines are written under: the endpoint, and the host it is on.
+ *
+ * Both are npm's own spelling for a credential — the request URL with its scheme
+ * removed — and both matter, for two different fetches.
+ *
+ * **The endpoint key** is the narrowest key covering the one address the operator
+ * actually named, and it is what GitLab's own documentation writes. It is kept
+ * rather than replaced by the broader one below: pnpm was measured walking a
+ * request path upward — a key on `//host/api/v4/` authenticates a tarball under
+ * `/api/v4/projects/…` — so for pnpm the endpoint key is redundant, and a client
+ * matching these keys **exactly** would still authenticate the packument with it.
+ * No such client was measured here, so the honest reason to keep the line is the
+ * smaller one: dropping it would make the file say less than it knows about the
+ * one address the operator gave.
+ *
+ * **The host key** is the one that covers a tarball. It is broad on purpose: the
+ * tarball URL is chosen by the server and appears for the first time inside a
+ * packument this file will never see, so the only statically derivable key
+ * guaranteed to cover it is the whole host. Measured with a local registry
+ * standing in for GitLab's shape — a packument served on the endpoint whose
+ * `dist.tarball` names `/api/v4/projects/302/packages/npm/…` on the same host —
+ * under pnpm 9.15.0, the version CI pins, and under pnpm 10:
+ *
+ *   endpoint key alone   ERR_PNPM_FETCH_404 … Not Found - 404
+ *                        "No authorization header was set for the request."
+ *   endpoint + host key  the tarball request carries the header; the install
+ *                        completes.
+ *
+ * ### Why not a narrower prefix
+ *
+ * Not because a narrower one would fail — measured, `//host/api/v4/` and
+ * `//host/api/v4/projects/` both authenticate that same tarball, because pnpm
+ * walks a request's path upward looking for a key. The mechanism is not the
+ * obstacle; the **derivation** is. Getting `/api/v4/` out of
+ * `/api/v4/packages/npm/` means knowing GitLab's URL layout, which is trading one
+ * unexamined premise about the server for a narrower one — and `--registry` names
+ * *a registry*, not *a GitLab*: the flag is documented as the endpoint the
+ * storefront installs from, and a Verdaccio or an Artifactory behind it has its
+ * own layout. `ENDORA_NPM_REGISTRY` is masked and may be the instance endpoint or
+ * a group one, so the file cannot even be written against one observed shape.
+ *
+ * ### What is given up, stated rather than glossed
+ *
+ * The credential is offered to **every** request pnpm makes to this host and
+ * port, not only to the endpoint's own subtree. That is broader than the single
+ * line this file used to write. It is accepted because the host is the one the
+ * operator named on the command line, the credential a client is handed is a
+ * deploy token scoped `read_package_registry` (R3.3) whose whole authority on
+ * that host is reading packages, and the alternative — the credential not
+ * reaching the address the registry itself directed the client to — is an install
+ * that cannot work.
+ *
+ * And what it does **not** cover, so nobody reads it as more than it is: a
+ * registry that serves tarballs from a **different host** (a CDN, a storage
+ * bucket) is not reached by this key or by any other one derivable here, because
+ * that host appears nowhere in the input. Such a registry needs a line naming it,
+ * and the symptom would be this same 404 on the tarball alone.
+ *
+ * A registry configured at the root of its host makes the two keys identical, and
+ * then there is one line rather than two: a duplicate would not be wrong, it
+ * would read as though it said something.
+ */
+export declare function authKeys(registry: string): readonly string[];
+/**
+ * The file's text: one registry line per scope, and the auth lines `authKeys`
+ * derives.
+ *
+ * There is one set of auth lines however many scopes there are, because a
+ * credential is a property of the endpoint rather than of a scope — the half of
+ * this file's original reasoning that survived the measurement above.
+ */
+export declare function npmrcContent(registry: string, scopes: readonly string[]): string;
+//# sourceMappingURL=npmrc.d.ts.map

package/dist/new-storefront/npmrc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npmrc.d.ts","sourceRoot":"","sources":["../../src/new-storefront/npmrc.ts"],"names":[],"mappings":"AAoDA;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAEjD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CA2C1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,MAAM,EAAE,CAQpF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAK5D;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAwBhF"}