@gjsify/cli 0.15.1 → 0.16.0

package/lib/actions/build.js

@@ -8,6 +8,7 @@ import { dirname, extname, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { chmod, mkdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { normalizeBundlerOptions, mergeBundlerOptions } from '../utils/normalize-bundler-options.js';
+import { inputSourceDirs, isOutdirInsideSource, libraryOutputLeakError } from '../utils/library-output.js';
 const DEFAULT_GJS_SHEBANG = '#!/usr/bin/env -S gjs -m';
 /**
  * `true` when `path` points at a location that's unsafe to use as a build
@@ -83,6 +84,19 @@ export class BuildAction {
         const { verbose, library, typescript, exclude, aliases } = this.configData;
         const lib = library ?? {};
         const userBundler = normalizeBundlerOptions(this.configData);
+        // Refuse to emit the compiled tree into the input source directory.
+        // The outdir is derived below from `dirname(module ?? main)`; when a
+        // package points `main`/`module` at a source entry (`src/index.ts`)
+        // that derivation is `src/`, so preserve-modules would write `.js`
+        // duplicates + a `_virtual/` dir + a nested `src/<pkg>/src` tree next
+        // to the sources. An explicit `--outdir` is the escape hatch and is
+        // trusted; only the DERIVED default is guarded.
+        const cwd = process.cwd();
+        const sourceDirs = inputSourceDirs(userBundler.input, cwd);
+        const assertDerivedOutdirSafe = (outdir) => {
+            if (outdir && isOutdirInsideSource(outdir, sourceDirs, cwd))
+                throw libraryOutputLeakError(outdir);
+        };
         const moduleOutdir = lib.module ? dirname(lib.module) : undefined;
         const mainOutdir = lib.main ? dirname(lib.main) : undefined;
         const moduleOutExt = lib.module ? extname(lib.module) : '.js';
@@ -92,6 +106,10 @@ export class BuildAction {
         const pnpPlugins = pnp ? [pnp] : [];
         const results = [];
         if (multipleBuilds) {
+            // Both outdirs are derived from module/main — always guard them
+            // (`--outdir` is not consulted on the multi-output path).
+            assertDerivedOutdirSafe(moduleOutdir);
+            assertDerivedOutdirSafe(mainOutdir);
             const moduleFormat = moduleOutdir.includes('/cjs') || moduleOutExt === '.cjs' ? 'cjs' : 'esm';
             results.push(await runOneLibraryBuild({
                 pluginOpts: {
@@ -122,9 +140,14 @@ export class BuildAction {
             }));
         }
         else {
+            const explicitOutdir = userBundler.output?.dir;
             const outfilePath = userBundler.output?.file ?? lib.module ?? lib.main;
             const outExt = outfilePath ? extname(outfilePath) : '.js';
-            const outdir = userBundler.output?.dir ?? (outfilePath ? dirname(outfilePath) : undefined);
+            const outdir = explicitOutdir ?? (outfilePath ? dirname(outfilePath) : undefined);
+            // Only the DERIVED default is a footgun; a user-supplied --outdir
+            // is trusted (the documented escape hatch).
+            if (explicitOutdir === undefined)
+                assertDerivedOutdirSafe(outdir);
             const format = userBundler.output?.format ??
                 (outdir?.includes('/cjs') || outExt === '.cjs' ? 'cjs' : 'esm');
             results.push(await runOneLibraryBuild({

package/lib/cli-app.js

@@ -19,7 +19,7 @@ import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import yargs from 'yargs';
-import { buildCommand as build, testCommand as test, runCommand as run, infoCommand as info, systemCheckCommand as systemCheck, checkCommand as check, showcaseCommand as showcase, createCommand as create, gresourceCommand as gresource, gettextCommand as gettext, gsettingsCommand as gsettings, flatpakCommand as flatpak, dlxCommand as dlx, installCommand as install, foreachCommand as foreach, workspaceCommand as workspace, packCommand as pack, publishCommand as publish, whoamiCommand as whoami, loginCommand as login, logoutCommand as logout, trustCommand as trust, selfUpdateCommand as selfUpdate, generateInstallerCommand as generateInstaller, uninstallCommand as uninstall, formatCommand as format, lintCommand as lint, fixCommand as fix, upgradeCommand as upgrade, barrelsCommand as barrels, tscCommand as tsc, affectedCommand as affected, storybookCommand as storybook, debugCommand as debug, browseCommand as browse, } from './commands/index.js';
+import { buildCommand as build, testCommand as test, runCommand as run, infoCommand as info, systemCheckCommand as systemCheck, checkCommand as check, showcaseCommand as showcase, createCommand as create, gresourceCommand as gresource, gettextCommand as gettext, gsettingsCommand as gsettings, flatpakCommand as flatpak, dlxCommand as dlx, installCommand as install, foreachCommand as foreach, workspaceCommand as workspace, packCommand as pack, publishCommand as publish, whoamiCommand as whoami, loginCommand as login, logoutCommand as logout, trustCommand as trust, onboardCommand as onboard, selfUpdateCommand as selfUpdate, generateInstallerCommand as generateInstaller, uninstallCommand as uninstall, formatCommand as format, lintCommand as lint, fixCommand as fix, upgradeCommand as upgrade, barrelsCommand as barrels, tscCommand as tsc, affectedCommand as affected, storybookCommand as storybook, debugCommand as debug, browseCommand as browse, } from './commands/index.js';
 import { APP_NAME } from './constants.js';
 import { isNode } from '@gjsify/rolldown-plugin-gjsify/runtime';
 import { ensureGjsifyShimOnPath } from './utils/gjsify-shim.js';
@@ -103,6 +103,7 @@ export async function runCli(argv) {
         .command(login.command, login.description, login.builder, login.handler)
         .command(logout.command, logout.description, logout.builder, logout.handler)
         .command(trust.command, trust.description, trust.builder, trust.handler)
+        .command(onboard.command, onboard.description, onboard.builder, onboard.handler)
         .command(selfUpdate.command, selfUpdate.description, selfUpdate.builder, selfUpdate.handler)
         .command(generateInstaller.command, generateInstaller.description, generateInstaller.builder, generateInstaller.handler)
         .command(uninstall.command, uninstall.description, uninstall.builder, uninstall.handler)

package/lib/commands/index.d.ts

@@ -20,6 +20,7 @@ export * from './whoami.js';
 export * from './login.js';
 export * from './logout.js';
 export * from './trust.js';
+export * from './onboard.js';
 export * from './self-update.js';
 export * from './generate-installer.js';
 export * from './uninstall.js';

package/lib/commands/index.js

@@ -20,6 +20,7 @@ export * from './whoami.js';
 export * from './login.js';
 export * from './logout.js';
 export * from './trust.js';
+export * from './onboard.js';
 export * from './self-update.js';
 export * from './generate-installer.js';
 export * from './uninstall.js';

package/lib/commands/login.d.ts

@@ -6,5 +6,34 @@ interface LoginOptions {
     otp?: string;
     json?: boolean;
 }
+/** Options for the reusable {@link runLogin} flow. */
+export interface RunLoginOptions {
+    registry?: string;
+    scope?: string;
+    username?: string;
+    otp?: string;
+    /** Directory whose `.npmrc` seeds scope/registry resolution. Default: cwd. */
+    cwd?: string;
+}
+/** Successful login result. */
+export interface LoginResult {
+    username: string;
+    /** Registry URL (with trailing slash). */
+    registry: string;
+    /** Path of the `.npmrc` the token was written to. */
+    npmrcPath: string;
+}
+/** Thrown by {@link runLogin} on any recoverable login failure (bad creds, no token, …). */
+export declare class LoginError extends Error {
+    constructor(message: string);
+}
 export declare const loginCommand: Command<unknown, LoginOptions>;
+/**
+ * The `gjsify login` core, extracted so `gjsify onboard` can authenticate the
+ * user when the whoami gate fails. Prompts for username + password (unless
+ * provided), PUTs the CouchDB user doc, writes the token to the userconfig
+ * `.npmrc`, and verifies it with `whoami`. Throws {@link LoginError} on any
+ * recoverable failure (the command handler / onboard present it).
+ */
+export declare function runLogin(opts: RunLoginOptions): Promise<LoginResult>;
 export {};

package/lib/commands/login.js

@@ -22,6 +22,13 @@ import { DEFAULT_REGISTRY, registryFor, whoami } from '@gjsify/npm-registry';
 import { loadNpmrc } from '../utils/load-npmrc.js';
 import { writeAuthToken } from '../utils/auth-npmrc.js';
 import { promptCredentials, promptLine } from '../utils/prompt.js';
+/** Thrown by {@link runLogin} on any recoverable login failure (bad creds, no token, …). */
+export class LoginError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'LoginError';
+    }
+}
 export const loginCommand = {
     command: 'login',
     description: "Log in to an npm registry (Node-free `npm login`). Prompts for username + password (hidden) and writes the token to ~/.npmrc. Use --otp for 2FA. Web-OAuth flow is not supported — this is npm's legacy credentials flow.",
@@ -38,105 +45,124 @@ export const loginCommand = {
         .option('otp', { description: 'npm 2FA one-time code (prompted on demand if omitted).', type: 'string' })
         .option('json', { description: 'Emit `{username, registry}` JSON on success.', type: 'boolean' }),
     handler: async (args) => {
-        const npmrc = await loadNpmrc(process.cwd());
-        const registry = args.registry ??
-            process.env.npm_config_registry ??
-            (args.scope ? registryFor(args.scope.startsWith('@') ? `${args.scope}/_` : `@${args.scope}/_`, npmrc) : undefined) ??
-            DEFAULT_REGISTRY;
-        const registryClean = registry.endsWith('/') ? registry : `${registry}/`;
-        // Read username (visible) + password (masked) in a single raw-mode TTY
-        // session — robust against cooked line-discipline state + the shared
-        // stdin resume/pause race that intermittently broke the old two-prompt
-        // sequence (Enter showing `^M`, or an empty username).
-        const { username, password } = await promptCredentials(args.username);
-        if (!username) {
-            console.error('gjsify login: a username is required.');
-            process.exit(1);
-        }
-        if (!password) {
-            console.error('gjsify login: a password is required.');
-            process.exit(1);
-        }
-        // npm legacy auth = HTTP Basic of `<username>:<password>` (the same
-        // credentials being logged in with). The password also lives in the
-        // PUT body, which is how the registry mints the token.
-        const basic = `Basic ${btoa(`${username}:${password}`)}`;
-        const couchUrl = `${registryClean}-/user/org.couchdb.user:${encodeURIComponent(username)}`;
-        const body = {
-            _id: `org.couchdb.user:${username}`,
-            name: username,
-            password,
-            type: 'user',
-            roles: [],
-            date: undefined, // the registry stamps this; Date is unavailable in some runtimes
-        };
-        function authHeaders(otp) {
-            const h = {
-                authorization: basic,
-                'content-type': 'application/json',
-                accept: '*/*',
-            };
-            if (otp)
-                h['npm-otp'] = otp;
-            return h;
-        }
-        async function putUser(path, otp) {
-            return fetch(`${couchUrl}${path}`, { method: 'PUT', headers: authHeaders(otp), body: JSON.stringify(body) });
-        }
-        let otp = args.otp;
-        let res = await putUser('', otp);
-        // 2FA: 401 + www-authenticate "otp" (or a one-time-pass body) → prompt + retry.
-        if (res.status === 401 && !otp) {
-            const wwwAuth = (res.headers.get('www-authenticate') ?? '').toLowerCase();
-            const text = await res.clone().text().catch(() => '');
-            if (wwwAuth.includes('otp') || /one-time pass/i.test(text)) {
-                otp = await promptLine(`This operation requires a one-time password.\nEnter OTP: `);
-                if (!otp) {
-                    console.error('gjsify login: no OTP entered.');
-                    process.exit(1);
-                }
-                res = await putUser('', otp);
+        try {
+            const { username, registry, npmrcPath } = await runLogin({
+                registry: args.registry,
+                scope: args.scope,
+                username: args.username,
+                otp: args.otp,
+            });
+            if (args.json) {
+                process.stdout.write(`${JSON.stringify({ username, registry })}\n`);
             }
-        }
-        // 409 Conflict: the user already exists (the normal login case). Fetch
-        // the current doc for its `_rev`, merge, and PUT to `…/-rev/<rev>`.
-        if (res.status === 409) {
-            const getRes = await fetch(`${couchUrl}?write=true`, { headers: authHeaders(otp) });
-            if (getRes.ok) {
-                const existing = (await getRes.json().catch(() => ({})));
-                for (const k of Object.keys(existing)) {
-                    if (!body[k] || k === 'roles')
-                        body[k] = existing[k];
-                }
-                if (body._rev)
-                    res = await putUser(`/-rev/${body._rev}`, otp);
+            else {
+                process.stdout.write(`Logged in as ${username} on ${registry}\n(token written to ${npmrcPath})\n`);
             }
         }
-        if (res.status === 400) {
-            console.error(`gjsify login: there is no user with the username "${username}" on ${registryClean}.`);
-            process.exit(1);
-        }
-        if (!res.ok) {
-            const text = await res.text().catch(() => '<no body>');
-            console.error(`gjsify login: ${res.status} ${res.statusText} from ${registryClean}\n${text.slice(0, 400)}`);
-            process.exit(1);
-        }
-        const data = (await res.json().catch(() => ({})));
-        if (!data.token) {
-            console.error(`gjsify login: the registry accepted the login but returned no token (unexpected response shape). ` +
-                `Your registry may require the web-OAuth flow — use \`npm login\`.`);
-            process.exit(1);
-        }
-        const npmrcPath = writeAuthToken(registryClean, data.token);
-        // Confirm the freshly-written token authenticates.
-        const verifyNpmrc = await loadNpmrc(process.cwd());
-        const who = await whoami(registryClean, verifyNpmrc);
-        const confirmedName = who.username ?? username;
-        if (args.json) {
-            process.stdout.write(`${JSON.stringify({ username: confirmedName, registry: registryClean })}\n`);
-        }
-        else {
-            process.stdout.write(`Logged in as ${confirmedName} on ${registryClean}\n(token written to ${npmrcPath})\n`);
+        catch (err) {
+            if (err instanceof LoginError) {
+                console.error(err.message);
+                process.exit(1);
+            }
+            throw err;
         }
     },
 };
+/**
+ * The `gjsify login` core, extracted so `gjsify onboard` can authenticate the
+ * user when the whoami gate fails. Prompts for username + password (unless
+ * provided), PUTs the CouchDB user doc, writes the token to the userconfig
+ * `.npmrc`, and verifies it with `whoami`. Throws {@link LoginError} on any
+ * recoverable failure (the command handler / onboard present it).
+ */
+export async function runLogin(opts) {
+    const npmrc = await loadNpmrc(opts.cwd ?? process.cwd());
+    const registry = opts.registry ??
+        process.env.npm_config_registry ??
+        (opts.scope
+            ? registryFor(opts.scope.startsWith('@') ? `${opts.scope}/_` : `@${opts.scope}/_`, npmrc)
+            : undefined) ??
+        DEFAULT_REGISTRY;
+    const registryClean = registry.endsWith('/') ? registry : `${registry}/`;
+    // Read username (visible) + password (masked) in a single raw-mode TTY
+    // session — robust against cooked line-discipline state + the shared stdin
+    // resume/pause race.
+    const { username, password } = await promptCredentials(opts.username);
+    if (!username)
+        throw new LoginError('gjsify login: a username is required.');
+    if (!password)
+        throw new LoginError('gjsify login: a password is required.');
+    // npm legacy auth = HTTP Basic of `<username>:<password>`. The password also
+    // lives in the PUT body, which is how the registry mints the token.
+    const basic = `Basic ${btoa(`${username}:${password}`)}`;
+    const couchUrl = `${registryClean}-/user/org.couchdb.user:${encodeURIComponent(username)}`;
+    const body = {
+        _id: `org.couchdb.user:${username}`,
+        name: username,
+        password,
+        type: 'user',
+        roles: [],
+        date: undefined, // the registry stamps this; Date is unavailable in some runtimes
+    };
+    function authHeaders(otp) {
+        const h = {
+            authorization: basic,
+            'content-type': 'application/json',
+            accept: '*/*',
+        };
+        if (otp)
+            h['npm-otp'] = otp;
+        return h;
+    }
+    async function putUser(path, otp) {
+        return fetch(`${couchUrl}${path}`, { method: 'PUT', headers: authHeaders(otp), body: JSON.stringify(body) });
+    }
+    let otp = opts.otp;
+    let res = await putUser('', otp);
+    // 2FA: 401 + www-authenticate "otp" (or a one-time-pass body) → prompt + retry.
+    if (res.status === 401 && !otp) {
+        const wwwAuth = (res.headers.get('www-authenticate') ?? '').toLowerCase();
+        const text = await res
+            .clone()
+            .text()
+            .catch(() => '');
+        if (wwwAuth.includes('otp') || /one-time pass/i.test(text)) {
+            otp = await promptLine(`This operation requires a one-time password.\nEnter OTP: `);
+            if (!otp)
+                throw new LoginError('gjsify login: no OTP entered.');
+            res = await putUser('', otp);
+        }
+    }
+    // 409 Conflict: the user already exists (the normal login case). Fetch the
+    // current doc for its `_rev`, merge, and PUT to `…/-rev/<rev>`.
+    if (res.status === 409) {
+        const getRes = await fetch(`${couchUrl}?write=true`, { headers: authHeaders(otp) });
+        if (getRes.ok) {
+            const existing = (await getRes.json().catch(() => ({})));
+            for (const k of Object.keys(existing)) {
+                if (!body[k] || k === 'roles')
+                    body[k] = existing[k];
+            }
+            if (body._rev)
+                res = await putUser(`/-rev/${body._rev}`, otp);
+        }
+    }
+    if (res.status === 400) {
+        throw new LoginError(`gjsify login: there is no user with the username "${username}" on ${registryClean}.`);
+    }
+    if (!res.ok) {
+        const text = await res.text().catch(() => '<no body>');
+        throw new LoginError(`gjsify login: ${res.status} ${res.statusText} from ${registryClean}\n${text.slice(0, 400)}`);
+    }
+    const data = (await res.json().catch(() => ({})));
+    if (!data.token) {
+        throw new LoginError(`gjsify login: the registry accepted the login but returned no token (unexpected response shape). ` +
+            `Your registry may require the web-OAuth flow — use \`npm login\`.`);
+    }
+    const npmrcPath = writeAuthToken(registryClean, data.token);
+    // Confirm the freshly-written token authenticates.
+    const verifyNpmrc = await loadNpmrc(opts.cwd ?? process.cwd());
+    const who = await whoami(registryClean, verifyNpmrc);
+    const confirmedName = who.username ?? username;
+    return { username: confirmedName, registry: registryClean, npmrcPath };
+}

package/lib/commands/onboard.d.ts

@@ -0,0 +1,14 @@
+import type { Command } from '../types/index.js';
+interface OnboardOptions {
+    repository?: string;
+    workflow: string;
+    environment?: string;
+    registry?: string;
+    otp?: string;
+    concurrency: number;
+    'dry-run'?: boolean;
+    json?: boolean;
+    yes?: boolean;
+}
+export declare const onboardCommand: Command<unknown, OnboardOptions>;
+export {};