@gjsify/cli 0.3.8 → 0.3.9

package/lib/actions/build.js

@@ -6,6 +6,20 @@ import { getPnpPlugin } from "@gjsify/resolve-npm/pnp-relay";
 import { dirname, extname } from "node:path";
 import { chmod, readFile, writeFile } from "node:fs/promises";
 const GJS_SHEBANG = "#!/usr/bin/env -S gjs -m\n";
+/**
+ * `true` when `path` points at a location that's unsafe to use as a build
+ * outfile (would overwrite source). Currently catches:
+ *   - any TypeScript extension (`.ts`, `.tsx`, `.mts`, `.cts`, `.mtsx`, `.ctsx`)
+ *   - paths that live under a `src/` segment (relative or absolute)
+ */
+function isUnsafeDefaultOutput(path) {
+    if (/\.[cm]?tsx?$/i.test(path))
+        return true;
+    const norm = path.replace(/\\/g, "/");
+    if (/(?:^|\/)src\//.test(norm))
+        return true;
+    return false;
+}
 /**
  * Resolve the gjsify-flavoured PnP plugin. Anchors the relay on this file's
  * URL so transitive `@gjsify/*` polyfills (reached via @gjsify/cli's deps on
@@ -190,10 +204,20 @@ export class BuildAction {
             !esbuild?.outfile &&
             !esbuild?.outdir &&
             (pgk?.main || pgk?.module)) {
-            esbuild.outfile =
-                esbuild?.format === "cjs"
-                    ? pgk.main || pgk.module
-                    : pgk.module || pgk.main;
+            const candidate = esbuild?.format === "cjs"
+                ? pgk.main || pgk.module
+                : pgk.module || pgk.main;
+            if (candidate && isUnsafeDefaultOutput(candidate)) {
+                // `package.json#main`/`module` commonly points at a TypeScript
+                // source (e.g. `src/index.ts` for TS-direct workflows). Falling
+                // back to that value would have esbuild OVERWRITE the source.
+                // Surface a clear error and require an explicit outfile/outdir
+                // instead of silently destroying the user's code.
+                throw new Error(`gjsify build: refusing to default --outfile to ${candidate} ` +
+                    `(would overwrite a TypeScript source file). Pass --outfile/--outdir ` +
+                    `explicitly, or set "gjsify.esbuild.outfile" in package.json.`);
+            }
+            esbuild.outfile = candidate;
         }
         const { consoleShim, globals } = this.configData;
         const pluginOpts = {

package/lib/config.js

@@ -1,5 +1,23 @@
 import { APP_NAME } from './constants.js';
 import { cosmiconfig } from 'cosmiconfig';
+/** Default cosmiconfig search places for a given module name (matches cosmiconfig defaults). */
+function defaultSearchPlaces(name) {
+    return [
+        'package.json',
+        `.${name}rc`,
+        `.${name}rc.json`,
+        `.${name}rc.yaml`,
+        `.${name}rc.yml`,
+        `.${name}rc.js`,
+        `.${name}rc.ts`,
+        `.${name}rc.mjs`,
+        `.${name}rc.cjs`,
+        `${name}.config.js`,
+        `${name}.config.ts`,
+        `${name}.config.mjs`,
+        `${name}.config.cjs`,
+    ];
+}
 import { readPackageJSON, resolvePackageJSON } from 'pkg-types';
 import { getTsconfig } from 'get-tsconfig';
 /** Deep merge objects (replaces lodash.merge) */
@@ -34,17 +52,46 @@ export class Config {
     }
     /** Loads gjsify config file, e.g `.gjsifyrc.js` */
     async load(searchFrom) {
-        let configFile = await cosmiconfig(APP_NAME, this.loadOptions).search(searchFrom);
-        configFile ||= {
-            config: {},
-            filepath: '',
-            isEmpty: true,
+        // cosmiconfig's default first-match-wins behaviour silently drops one
+        // source when both `package.json#gjsify` and an explicit config file
+        // (`.gjsifyrc.js`, `gjsify.config.mjs`, ...) are present. Project hits
+        // this footgun: adding `gjsify.bin` to package.json (so `gjsify dlx`
+        // resolves the GJS bundle) silently disables `.gjsifyrc.js`. We
+        // explicitly load both sources and merge — package.json is the lower
+        // layer, the explicit file wins on key collisions.
+        //
+        // Run two searches:
+        //   1. Default (includes package.json) — for projects that only use
+        //      package.json#gjsify and no separate file.
+        //   2. Explicit-file only (package.json excluded) — to find the
+        //      `.gjsifyrc.*` / `gjsify.config.*` regardless of whether
+        //      package.json#gjsify exists.
+        const fileExplorer = cosmiconfig(APP_NAME, {
+            ...this.loadOptions,
+            searchPlaces: (this.loadOptions.searchPlaces ?? defaultSearchPlaces(APP_NAME))
+                .filter((p) => p !== 'package.json'),
+        });
+        const fileResult = await fileExplorer.search(searchFrom);
+        const merged = {};
+        try {
+            const pkg = await this.readPackageJSON(searchFrom);
+            if (isPlainObject(pkg?.gjsify))
+                merge(merged, pkg.gjsify);
+        }
+        catch {
+            // Missing or unreadable package.json — skip.
+        }
+        if (fileResult?.config && isPlainObject(fileResult.config)) {
+            merge(merged, fileResult.config);
+        }
+        merged.esbuild ||= {};
+        merged.library ||= {};
+        merged.typescript ||= {};
+        return {
+            config: merged,
+            filepath: fileResult?.filepath ?? '',
+            isEmpty: !fileResult && Object.keys(merged).length === 3, // only the three default-empty objects
         };
-        configFile.config ||= {};
-        configFile.config.esbuild ||= {};
-        configFile.config.library ||= {};
-        configFile.config.typescript ||= {};
-        return configFile;
     }
     /** Loads package.json of the current project */
     async readPackageJSON(dirPath) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjsify/cli",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "CLI for Gjsify",
   "type": "module",
   "main": "lib/index.js",
@@ -23,14 +23,14 @@
     "cli"
   ],
   "dependencies": {
-    "@gjsify/create-app": "^0.3.8",
-    "@gjsify/esbuild-plugin-gjsify": "^0.3.8",
-    "@gjsify/node-polyfills": "^0.3.8",
-    "@gjsify/npm-registry": "^0.3.8",
-    "@gjsify/resolve-npm": "^0.3.8",
-    "@gjsify/semver": "^0.3.8",
-    "@gjsify/tar": "^0.3.8",
-    "@gjsify/web-polyfills": "^0.3.8",
+    "@gjsify/create-app": "^0.3.9",
+    "@gjsify/esbuild-plugin-gjsify": "^0.3.9",
+    "@gjsify/node-polyfills": "^0.3.9",
+    "@gjsify/npm-registry": "^0.3.9",
+    "@gjsify/resolve-npm": "^0.3.9",
+    "@gjsify/semver": "^0.3.9",
+    "@gjsify/tar": "^0.3.9",
+    "@gjsify/web-polyfills": "^0.3.9",
     "@yarnpkg/esbuild-plugin-pnp": "^3.0.0-rc.15",
     "cosmiconfig": "^9.0.1",
     "esbuild": "^0.28.0",

package/src/actions/build.ts

@@ -14,6 +14,19 @@ import { chmod, readFile, writeFile } from "node:fs/promises";
 
 const GJS_SHEBANG = "#!/usr/bin/env -S gjs -m\n";
 
+/**
+ * `true` when `path` points at a location that's unsafe to use as a build
+ * outfile (would overwrite source). Currently catches:
+ *   - any TypeScript extension (`.ts`, `.tsx`, `.mts`, `.cts`, `.mtsx`, `.ctsx`)
+ *   - paths that live under a `src/` segment (relative or absolute)
+ */
+function isUnsafeDefaultOutput(path: string): boolean {
+	if (/\.[cm]?tsx?$/i.test(path)) return true;
+	const norm = path.replace(/\\/g, "/");
+	if (/(?:^|\/)src\//.test(norm)) return true;
+	return false;
+}
+
 /**
  * Resolve the gjsify-flavoured PnP plugin. Anchors the relay on this file's
  * URL so transitive `@gjsify/*` polyfills (reached via @gjsify/cli's deps on
@@ -253,10 +266,23 @@ export class BuildAction {
 			!esbuild?.outdir &&
 			(pgk?.main || pgk?.module)
 		) {
-			esbuild.outfile =
+			const candidate =
 				esbuild?.format === "cjs"
 					? pgk.main || pgk.module
 					: pgk.module || pgk.main;
+			if (candidate && isUnsafeDefaultOutput(candidate)) {
+				// `package.json#main`/`module` commonly points at a TypeScript
+				// source (e.g. `src/index.ts` for TS-direct workflows). Falling
+				// back to that value would have esbuild OVERWRITE the source.
+				// Surface a clear error and require an explicit outfile/outdir
+				// instead of silently destroying the user's code.
+				throw new Error(
+					`gjsify build: refusing to default --outfile to ${candidate} ` +
+					`(would overwrite a TypeScript source file). Pass --outfile/--outdir ` +
+					`explicitly, or set "gjsify.esbuild.outfile" in package.json.`,
+				);
+			}
+			esbuild.outfile = candidate;
 		}
 
 		const { consoleShim, globals } = this.configData;

package/src/config.ts

@@ -1,5 +1,24 @@
 import { APP_NAME } from  './constants.js';
 import { cosmiconfig, type Options as LoadOptions } from 'cosmiconfig';
+
+/** Default cosmiconfig search places for a given module name (matches cosmiconfig defaults). */
+function defaultSearchPlaces(name: string): string[] {
+    return [
+        'package.json',
+        `.${name}rc`,
+        `.${name}rc.json`,
+        `.${name}rc.yaml`,
+        `.${name}rc.yml`,
+        `.${name}rc.js`,
+        `.${name}rc.ts`,
+        `.${name}rc.mjs`,
+        `.${name}rc.cjs`,
+        `${name}.config.js`,
+        `${name}.config.ts`,
+        `${name}.config.mjs`,
+        `${name}.config.cjs`,
+    ];
+}
 import { readPackageJSON, resolvePackageJSON } from 'pkg-types';
 import { getTsconfig } from 'get-tsconfig';
 
@@ -40,20 +59,48 @@ export class Config {
     }
 
     /** Loads gjsify config file, e.g `.gjsifyrc.js` */
-    private async load(searchFrom?: string) {        
-        let configFile = await cosmiconfig(APP_NAME, this.loadOptions).search(searchFrom) as CosmiconfigResult<ConfigData> | null;
-
-        configFile ||= {
-            config: {},
-            filepath: '',
-            isEmpty: true,
+    private async load(searchFrom?: string) {
+        // cosmiconfig's default first-match-wins behaviour silently drops one
+        // source when both `package.json#gjsify` and an explicit config file
+        // (`.gjsifyrc.js`, `gjsify.config.mjs`, ...) are present. Project hits
+        // this footgun: adding `gjsify.bin` to package.json (so `gjsify dlx`
+        // resolves the GJS bundle) silently disables `.gjsifyrc.js`. We
+        // explicitly load both sources and merge — package.json is the lower
+        // layer, the explicit file wins on key collisions.
+        //
+        // Run two searches:
+        //   1. Default (includes package.json) — for projects that only use
+        //      package.json#gjsify and no separate file.
+        //   2. Explicit-file only (package.json excluded) — to find the
+        //      `.gjsifyrc.*` / `gjsify.config.*` regardless of whether
+        //      package.json#gjsify exists.
+        const fileExplorer = cosmiconfig(APP_NAME, {
+            ...this.loadOptions,
+            searchPlaces: (this.loadOptions.searchPlaces ?? defaultSearchPlaces(APP_NAME))
+                .filter((p) => p !== 'package.json'),
+        });
+        const fileResult = await fileExplorer.search(searchFrom) as CosmiconfigResult<ConfigData> | null;
+
+        const merged: ConfigData = {};
+        try {
+            const pkg = await this.readPackageJSON(searchFrom) as { gjsify?: ConfigData };
+            if (isPlainObject(pkg?.gjsify)) merge(merged, pkg.gjsify);
+        } catch {
+            // Missing or unreadable package.json — skip.
         }
+        if (fileResult?.config && isPlainObject(fileResult.config)) {
+            merge(merged, fileResult.config);
+        }
+
+        merged.esbuild ||= {};
+        merged.library ||= {};
+        merged.typescript ||= {};
 
-        configFile.config ||= {};
-        configFile.config.esbuild ||= {};
-        configFile.config.library ||= {};
-        configFile.config.typescript ||= {};
-        return configFile;
+        return {
+            config: merged,
+            filepath: fileResult?.filepath ?? '',
+            isEmpty: !fileResult && Object.keys(merged).length === 3, // only the three default-empty objects
+        };
     }
 
     /** Loads package.json of the current project */