@gjsify/cli 0.14.0 → 0.16.0

package/lib/utils/library-output.js

@@ -0,0 +1,92 @@
+// Guard against the recurring "library build leaks into src/" footgun.
+//
+// `BuildAction.buildLibrary` derives its output directory from
+// `dirname(package.json "module" ?? "main")`. When a package points `main`
+// at its runtime SOURCE entry (`src/index.ts` — the intended entry for
+// Vite/gjsify-compiled consumers, e.g. `@gjsify/adwaita-web`), that derived
+// outdir is `src/`, so `gjsify build --library` writes the compiled `.js`
+// tree straight next to the sources: `src/*.js` / `*2.js` duplicates, a
+// `src/_virtual/` helper dir, and a nested `src/<pkg>/src/**` preserve-modules
+// tree. These pure helpers let the build action refuse that up front instead
+// of silently corrupting the source tree.
+import { dirname, extname, isAbsolute, relative, resolve } from 'node:path';
+/**
+ * The literal (non-glob) base directories the build's input source files live
+ * in, derived from the bundler `input` patterns. A file entry maps to its
+ * containing dir, a glob is reduced to the literal prefix before the first
+ * wildcard:
+ *   - `src/index.ts`   → `<cwd>/src`
+ *   - `src/**` + `/*.ts` → `<cwd>/src`
+ *   - `src`            → `<cwd>/src`
+ *
+ * The project root itself is intentionally excluded — a flat library that
+ * keeps its source at the project root and emits there is an explicit layout,
+ * not the `src/`-subdir footgun this guard targets.
+ */
+export function inputSourceDirs(input, cwd) {
+    const patterns = [];
+    const push = (v) => {
+        if (typeof v === 'string' && v.length > 0)
+            patterns.push(v);
+    };
+    if (typeof input === 'string')
+        push(input);
+    else if (Array.isArray(input))
+        input.forEach(push);
+    else if (input && typeof input === 'object')
+        Object.values(input).forEach(push);
+    const root = resolve(cwd);
+    const dirs = new Set();
+    for (const raw of patterns) {
+        const norm = raw.replace(/\\/g, '/');
+        // Cut the pattern at the first glob metacharacter — everything before
+        // it is a literal path prefix.
+        const globIdx = norm.search(/[*?{}[\]()!+@]/);
+        let base = globIdx === -1 ? norm : norm.slice(0, globIdx);
+        if (globIdx === -1) {
+            // Whole pattern is literal: a file path collapses to its dirname,
+            // a bare directory stays as-is.
+            base = extname(base) ? dirname(base) : base;
+        }
+        else {
+            // The glob cut mid-segment (`src/`, `src/fo*`) — drop the trailing
+            // partial segment so we keep only the complete literal directory.
+            base = base.replace(/\/[^/]*$/, '');
+        }
+        const abs = resolve(root, base || '.');
+        if (abs !== root)
+            dirs.add(abs);
+    }
+    return [...dirs];
+}
+/** `true` when `child` is `parent` itself or nested somewhere under it. */
+function isInsideOrEqual(child, parent) {
+    const rel = relative(parent, child);
+    return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
+}
+/**
+ * `true` when writing library output to `outdir` would land build artifacts
+ * inside (or directly on top of) the input source tree. Unsafe iff `outdir`
+ * equals, or is nested under, any input source directory.
+ *
+ *   isOutdirInsideSource('src',      ['<cwd>/src'])       → true   (leak)
+ *   isOutdirInsideSource('src/nest', ['<cwd>/src'])       → true   (leak)
+ *   isOutdirInsideSource('dist/esm', ['<cwd>/src'])       → false  (safe)
+ *   isOutdirInsideSource('lib',      ['<cwd>/src'])       → false  (safe)
+ */
+export function isOutdirInsideSource(outdir, sourceDirs, cwd) {
+    const absOut = resolve(cwd, outdir);
+    return sourceDirs.some((dir) => isInsideOrEqual(absOut, dir));
+}
+/**
+ * The error thrown when a `--library` build would emit into its own source
+ * tree. Names both remedies so the fix is actionable at the point of failure.
+ */
+export function libraryOutputLeakError(outdir) {
+    return new Error(`gjsify build --library: refusing to write output into "${outdir}", which holds the ` +
+        `input source — a library build there produces src/*.js duplicates, *2.js, a ` +
+        `_virtual/ helper dir, and a nested preserve-modules tree, silently corrupting the ` +
+        `sources. This output dir was derived from package.json "main"/"module" pointing at ` +
+        `a source path. Fix it by pointing "main"/"module" at the built library (e.g. ` +
+        `lib/index.js) or by passing an explicit --outdir <dir> outside the source tree.`);
+}

package/lib/utils/npm-otp.d.ts

@@ -0,0 +1,67 @@
+/** A function that prompts the user for one line (an OTP code). */
+export type OtpPromptFn = (question: string) => Promise<string>;
+/**
+ * True when a response is an npm OTP / 2FA challenge (401 + a `www-authenticate`
+ * header naming `otp`, or a body mentioning a one-time password / `EOTP`).
+ * Unifies the detection logic previously inlined in both publish.ts and trust.ts.
+ */
+export declare function isOtpChallenge(res: Response): Promise<boolean>;
+/**
+ * Holds ONE OTP code across a run and knows how to prompt for a fresh one.
+ *
+ * `current()` returns the cached code (seeded from `--otp`, or the last one the
+ * user typed). `refresh()` prompts for a new code and caches it. A single
+ * provider instance shared across many publish + trust operations is what makes
+ * `gjsify onboard` need only one OTP entry for the whole sweep.
+ */
+export declare class OtpProvider {
+    private cached;
+    private readonly promptFn;
+    /**
+     * @param seed     Initial cached code (from `--otp`), or undefined.
+     * @param promptFn How to read a fresh code. Defaults to the TTY-aware
+     *                 `promptLine`. Non-interactive callers pass a function that
+     *                 returns `''` so a challenge surfaces instead of hanging.
+     */
+    constructor(seed?: string, promptFn?: OtpPromptFn);
+    /** The currently cached OTP code, if any. */
+    current(): string | undefined;
+    /**
+     * Prompt for a fresh code, cache it, and return it (the trimmed input, or
+     * `''` when nothing was entered — the caller treats empty as "give up").
+     */
+    refresh(question?: string): Promise<string>;
+}
+export interface OtpRetryOptions {
+    /**
+     * Send the cached code on the FIRST attempt instead of trying without an OTP
+     * first. `gjsify publish --otp <code>` uses this so the PUT carries the
+     * `npm-otp` header immediately (matching npm's `--otp` behaviour). The
+     * cache-first flows (`trust`, `onboard`) leave it false so the first attempt
+     * exploits npm's ~5-min 2FA-skip window and only sends a code when actually
+     * challenged.
+     */
+    seedFirstAttempt?: boolean;
+    /** Max fresh prompts after the cached code is exhausted. Default 2. */
+    maxPrompts?: number;
+    /** Prompt text. Default: the standard npm one-time-password question. */
+    question?: string;
+}
+/**
+ * Run `doFetch` with cache-first OTP retry against a shared {@link OtpProvider}.
+ *
+ * Flow:
+ *   1. First attempt — without an OTP (or WITH the cached code when
+ *      `seedFirstAttempt` is set).
+ *   2. On a 2FA challenge, retry with the currently-cached code (unless step 1
+ *      already sent it).
+ *   3. If still challenged (cache empty/rejected/expired), prompt for a fresh
+ *      code — caching it on the provider so the NEXT operation tries it first —
+ *      and retry, up to `maxPrompts` times.
+ *   4. Return the last response (a challenge the caller must handle) when the
+ *      user declines to enter a code.
+ *
+ * The caller owns the actual fetch + all response interpretation; this only
+ * owns the OTP dance.
+ */
+export declare function withOtpRetry(doFetch: (otp?: string) => Promise<Response>, provider: OtpProvider, opts?: OtpRetryOptions): Promise<Response>;

package/lib/utils/npm-otp.js

@@ -0,0 +1,117 @@
+// Shared npm 2FA / OTP handling for the auth-aware CLI commands
+// (`gjsify publish`, `gjsify trust`, `gjsify onboard`).
+//
+// npm signals "OTP required" via HTTP 401 + a `www-authenticate` header
+// containing `otp` (or, for malformed responses, a body mentioning
+// "one-time pass" / `EOTP`) — see
+// refs/npm-cli/node_modules/npm-registry-fetch/lib/check-response.js.
+//
+// Two pieces were previously duplicated in `publish.ts` and `trust.ts`:
+//   1. detecting the challenge (`isOtpChallenge`);
+//   2. prompting for a code, then retrying the request with it.
+//
+// They are centralised here so a single `OtpProvider` can be injected across
+// MANY operations in one run. `gjsify onboard` sweeps ~110 packages and would
+// otherwise prompt once per package; with one shared provider the user types
+// an OTP once — the cached code is tried first on every subsequent challenge,
+// and a fresh prompt only happens when npm actually rejects/expires it.
+//
+// Standalone `publish`/`trust` keep their existing single-command UX: each
+// still constructs its own provider and prompts on demand.
+import { promptLine } from './prompt.js';
+const DEFAULT_QUESTION = 'This operation requires a one-time password.\nEnter OTP: ';
+/**
+ * True when a response is an npm OTP / 2FA challenge (401 + a `www-authenticate`
+ * header naming `otp`, or a body mentioning a one-time password / `EOTP`).
+ * Unifies the detection logic previously inlined in both publish.ts and trust.ts.
+ */
+export async function isOtpChallenge(res) {
+    if (res.status !== 401)
+        return false;
+    const wwwAuth = (res.headers.get('www-authenticate') ?? '').toLowerCase();
+    if (wwwAuth.includes('otp'))
+        return true;
+    const text = await res
+        .clone()
+        .text()
+        .catch(() => '');
+    return /one-time pass/i.test(text) || /\bEOTP\b/.test(text);
+}
+/**
+ * Holds ONE OTP code across a run and knows how to prompt for a fresh one.
+ *
+ * `current()` returns the cached code (seeded from `--otp`, or the last one the
+ * user typed). `refresh()` prompts for a new code and caches it. A single
+ * provider instance shared across many publish + trust operations is what makes
+ * `gjsify onboard` need only one OTP entry for the whole sweep.
+ */
+export class OtpProvider {
+    cached;
+    promptFn;
+    /**
+     * @param seed     Initial cached code (from `--otp`), or undefined.
+     * @param promptFn How to read a fresh code. Defaults to the TTY-aware
+     *                 `promptLine`. Non-interactive callers pass a function that
+     *                 returns `''` so a challenge surfaces instead of hanging.
+     */
+    constructor(seed, promptFn = promptLine) {
+        this.cached = seed && seed.length > 0 ? seed : undefined;
+        this.promptFn = promptFn;
+    }
+    /** The currently cached OTP code, if any. */
+    current() {
+        return this.cached;
+    }
+    /**
+     * Prompt for a fresh code, cache it, and return it (the trimmed input, or
+     * `''` when nothing was entered — the caller treats empty as "give up").
+     */
+    async refresh(question = DEFAULT_QUESTION) {
+        const code = (await this.promptFn(question)).trim();
+        if (code)
+            this.cached = code;
+        return code;
+    }
+}
+/**
+ * Run `doFetch` with cache-first OTP retry against a shared {@link OtpProvider}.
+ *
+ * Flow:
+ *   1. First attempt — without an OTP (or WITH the cached code when
+ *      `seedFirstAttempt` is set).
+ *   2. On a 2FA challenge, retry with the currently-cached code (unless step 1
+ *      already sent it).
+ *   3. If still challenged (cache empty/rejected/expired), prompt for a fresh
+ *      code — caching it on the provider so the NEXT operation tries it first —
+ *      and retry, up to `maxPrompts` times.
+ *   4. Return the last response (a challenge the caller must handle) when the
+ *      user declines to enter a code.
+ *
+ * The caller owns the actual fetch + all response interpretation; this only
+ * owns the OTP dance.
+ */
+export async function withOtpRetry(doFetch, provider, opts = {}) {
+    const maxPrompts = opts.maxPrompts ?? 2;
+    const question = opts.question ?? DEFAULT_QUESTION;
+    const cached = provider.current();
+    const seededFirst = opts.seedFirstAttempt === true && cached !== undefined;
+    let res = await doFetch(seededFirst ? cached : undefined);
+    if (!(await isOtpChallenge(res)))
+        return res;
+    // Try the cached code if we haven't already sent it.
+    if (!seededFirst && provider.current() !== undefined) {
+        res = await doFetch(provider.current());
+        if (!(await isOtpChallenge(res)))
+            return res;
+    }
+    // Cache empty, rejected, or expired → prompt for a fresh code and retry.
+    for (let i = 0; i < maxPrompts; i++) {
+        const fresh = await provider.refresh(question);
+        if (!fresh)
+            return res; // no input — hand the challenge back to the caller
+        res = await doFetch(fresh);
+        if (!(await isOtpChallenge(res)))
+            return res;
+    }
+    return res;
+}

package/lib/utils/suggest.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Levenshtein edit distance between two strings (classic DP, single-row
+ * rolling buffer). Case-sensitive; callers lower-case first if they want a
+ * case-insensitive match.
+ */
+export declare function editDistance(a: string, b: string): number;
+/**
+ * The closest candidate to `target` by edit distance, or `undefined` when no
+ * candidate is close enough. "Close enough" scales with the target length so
+ * a short name doesn't match everything and a long one tolerates a couple of
+ * typos: `max(2, floor(len/3))`. Comparison is case-insensitive.
+ */
+export declare function suggestClosest(target: string, candidates: readonly string[]): string | undefined;

package/lib/utils/suggest.js

@@ -0,0 +1,51 @@
+// Small "did you mean …?" helper for CLI name typos (unknown workspace,
+// unknown script, …). Pure — no platform imports — so it is unit-testable
+// off any runtime and safe to pull into a GJS-bundled command.
+/**
+ * Levenshtein edit distance between two strings (classic DP, single-row
+ * rolling buffer). Case-sensitive; callers lower-case first if they want a
+ * case-insensitive match.
+ */
+export function editDistance(a, b) {
+    if (a === b)
+        return 0;
+    if (a.length === 0)
+        return b.length;
+    if (b.length === 0)
+        return a.length;
+    let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+    let curr = Array.from({ length: b.length + 1 }, () => 0);
+    for (let i = 1; i <= a.length; i++) {
+        curr[0] = i;
+        for (let j = 1; j <= b.length; j++) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            curr[j] = Math.min(prev[j] + 1, // deletion
+            curr[j - 1] + 1, // insertion
+            prev[j - 1] + cost);
+        }
+        [prev, curr] = [curr, prev];
+    }
+    return prev[b.length];
+}
+/**
+ * The closest candidate to `target` by edit distance, or `undefined` when no
+ * candidate is close enough. "Close enough" scales with the target length so
+ * a short name doesn't match everything and a long one tolerates a couple of
+ * typos: `max(2, floor(len/3))`. Comparison is case-insensitive.
+ */
+export function suggestClosest(target, candidates) {
+    if (candidates.length === 0)
+        return undefined;
+    const t = target.toLowerCase();
+    const threshold = Math.max(2, Math.floor(target.length / 3));
+    let best;
+    let bestDistance = Number.POSITIVE_INFINITY;
+    for (const candidate of candidates) {
+        const d = editDistance(t, candidate.toLowerCase());
+        if (d < bestDistance) {
+            bestDistance = d;
+            best = candidate;
+        }
+    }
+    return best !== undefined && bestDistance <= threshold ? best : undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.14.0",
+    "version": "0.16.0",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -95,7 +95,8 @@
                     ]
                 }
             ]
-        }
+        },
+        "tier": 1
     },
     "files": [
         "lib",
@@ -121,19 +122,19 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/buffer": "^0.14.0",
-        "@gjsify/create-app": "^0.14.0",
-        "@gjsify/node-globals": "^0.14.0",
-        "@gjsify/node-polyfills": "^0.14.0",
-        "@gjsify/npm-registry": "^0.14.0",
-        "@gjsify/resolve-npm": "^0.14.0",
-        "@gjsify/rolldown-plugin-gjsify": "^0.14.0",
-        "@gjsify/rolldown-plugin-pnp": "^0.14.0",
-        "@gjsify/semver": "^0.14.0",
-        "@gjsify/tar": "^0.14.0",
-        "@gjsify/tsc": "^0.14.0",
-        "@gjsify/web-polyfills": "^0.14.0",
-        "@gjsify/workspace": "^0.14.0",
+        "@gjsify/buffer": "^0.16.0",
+        "@gjsify/create-app": "^0.16.0",
+        "@gjsify/node-globals": "^0.16.0",
+        "@gjsify/node-polyfills": "^0.16.0",
+        "@gjsify/npm-registry": "^0.16.0",
+        "@gjsify/resolve-npm": "^0.16.0",
+        "@gjsify/rolldown-plugin-gjsify": "^0.16.0",
+        "@gjsify/rolldown-plugin-pnp": "^0.16.0",
+        "@gjsify/semver": "^0.16.0",
+        "@gjsify/tar": "^0.16.0",
+        "@gjsify/tsc": "^0.16.0",
+        "@gjsify/web-polyfills": "^0.16.0",
+        "@gjsify/workspace": "^0.16.0",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
         "pkg-types": "^2.3.1",
@@ -141,13 +142,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "^0.14.0",
+        "@gjsify/unit": "^0.16.0",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "^0.14.0",
-        "@gjsify/rolldown-native": "^0.14.0"
+        "@gjsify/oxfmt-native": "^0.16.0",
+        "@gjsify/rolldown-native": "^0.16.0"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {