@groundfloorcloud/cli 0.1.3 → 0.1.4

package/README.md

@@ -152,11 +152,12 @@ gf apps publish --path release.zip
 (`/downloads/shell-starter-kit.zip` on the current cell) and stamps
 `APP_ID` / `groundfloor.manifest.json` `appId` to the slug.
 
-`gf apps publish` uploads `release.zip` (or `remoteEntry.js`), flattens a
-Vite `dist/assets/` layout so chunks sit next to `remoteEntry.js`, finalizes
-the release, and by default PATCHes the Portal manifest from
-`groundfloor.manifest.json` next to the bundle. Pass an app id/slug, or set
-`appId` in that manifest. Prefer `npm run release` over zipping `dist/` by hand.
+`gf apps publish` uploads **only** `release.zip` from `npm run release`.
+It flattens a Vite `dist/assets/` layout when needed, then **rejects** a zip
+that is only `remoteEntry.js` (missing `__federation_*.js` / CSS) or whose
+federation `name` does not match `federationRemoteName(slug)`. A lone
+`.js` file is also rejected. Pass an app id/slug, or set `appId` in
+`groundfloor.manifest.json` next to the zip.
 
 Wrap an existing **service** coderunner as a product:
 

package/dist/index.js

@@ -1810,8 +1810,80 @@ function flattenFederatedReleaseZip(bytes) {
   }
   return zip.toBuffer();
 }
-function federatedReleaseZipHint() {
-  return "Run `npm run release` in a kit from `gf apps init --slug <portal-slug>` (do not zip Vite dist/ or dist/assets/ by hand).";
+function federatedReleaseZipHint(slug) {
+  return `Run \`npm run release\` in a kit from \`gf apps init\`, then publish that zip (do not zip Vite dist/ or upload only remoteEntry.js). ${initThenPublishHint(slug)}`;
+}
+function federationRemoteName(appId) {
+  const sanitized = appId.replace(/[^a-zA-Z0-9_$]/g, "_");
+  return sanitized.length > 0 ? sanitized : "federatedApp";
+}
+function initThenPublishHint(slug) {
+  const s = (slug ?? "").trim() || "<portal-slug>";
+  return `gf apps init --slug ${s} && cd ${s} && npm install && npm run release && gf apps publish --path release.zip`;
+}
+function extractReferencedSiblings(remoteEntrySource) {
+  const names = /* @__PURE__ */ new Set();
+  for (const match of remoteEntrySource.matchAll(
+    /["']\.\/([^"'/]+\.(?:js|mjs|cjs|css))["']/g
+  )) {
+    if (match[1] !== REMOTE_ENTRY) names.add(match[1]);
+  }
+  for (const match of remoteEntrySource.matchAll(
+    /["']([A-Za-z0-9._-]+\.css)["']/g
+  )) {
+    names.add(match[1]);
+  }
+  return [...names];
+}
+function extractFederationScope(remoteEntrySource) {
+  return remoteEntrySource.match(/css__([A-Za-z0-9_-]+)__/)?.[1];
+}
+function zipRootNames(bytes) {
+  const zip = new AdmZip2(bytes);
+  return zip.getEntries().filter((entry) => !entry.isDirectory).map((entry) => normalizeZipEntryName(entry.entryName));
+}
+function readZipFile(bytes, rel) {
+  const zip = new AdmZip2(bytes);
+  const entry = zip.getEntries().find((item) => {
+    if (item.isDirectory) return false;
+    return normalizeZipEntryName(item.entryName) === rel;
+  });
+  return entry ? entry.getData().toString("utf8") : void 0;
+}
+function assertFederatedReleaseZip(bytes, slug) {
+  const hint = initThenPublishHint(slug);
+  const names = zipRootNames(bytes);
+  const present = new Set(names.map((name) => basename(name)));
+  const entryRel = chooseRemoteEntry(names);
+  if (!entryRel) {
+    throw new Error(`Zip has no remoteEntry.js. ${hint}`);
+  }
+  const source = readZipFile(bytes, entryRel);
+  if (!source) {
+    throw new Error(`Zip has no remoteEntry.js. ${hint}`);
+  }
+  const siblings = extractReferencedSiblings(source);
+  const missing = siblings.filter((name) => !present.has(name));
+  const jsOrCssAtRoot = names.filter((name) => {
+    if (name.includes("/")) return false;
+    const lower = name.toLowerCase();
+    return lower.endsWith(".js") || lower.endsWith(".mjs") || lower.endsWith(".css");
+  });
+  if (missing.length > 0 || siblings.length === 0 && jsOrCssAtRoot.length < 2) {
+    const detail = missing.length > 0 ? `Missing next to remoteEntry.js: ${missing.join(", ")}.` : "Zip is only remoteEntry.js (Vite chunks were never packed).";
+    throw new Error(
+      `${detail} Do not zip dist/ or upload a lone remoteEntry.js. ${hint}`
+    );
+  }
+  const scope = extractFederationScope(source);
+  if (slug && scope) {
+    const expected = federationRemoteName(slug);
+    if (scope !== expected) {
+      throw new Error(
+        `Federation name is "${scope}" but Shell looks up "${expected}" (from slug ${slug}). Use the starter-kit vite.config (federationRemoteName). ${hint}`
+      );
+    }
+  }
 }
 
 // src/commands/apps.ts
@@ -1854,10 +1926,10 @@ function zipHasRemoteEntry(bytes) {
     return name === REMOTE_ENTRY || name.endsWith(`/${REMOTE_ENTRY}`);
   });
 }
-function prepareReleaseZip(bytes) {
+function prepareReleaseZip(bytes, slug) {
   if (!zipHasRemoteEntry(bytes)) {
     throw new Error(
-      `Zip has no remoteEntry.js. ${federatedReleaseZipHint()}`
+      `Zip has no remoteEntry.js. ${initThenPublishHint(slug)}`
     );
   }
   const flattened = flattenFederatedReleaseZip(bytes);
@@ -1867,10 +1939,11 @@ function prepareReleaseZip(bytes) {
   if (Object.keys(plan).length > 0) {
     process.stderr.write(
       `Note: flattened Vite dist/assets layout so chunks sit next to remoteEntry.js.
-Prefer: ${federatedReleaseZipHint()}
+Prefer: ${federatedReleaseZipHint(slug)}
 `
     );
   }
+  assertFederatedReleaseZip(flattened, slug);
   return flattened;
 }
 async function isDirectory(filePath) {
@@ -1969,7 +2042,8 @@ async function appsCreateCommand(opts) {
   } catch (err) {
     if (err instanceof CpError && err.status === 409) {
       throw new Error(
-        `App slug ${slug} already exists. Use \`gf apps publish ${slug}\` to ship a build.`
+        `App slug ${slug} already exists. Init the kit if you do not have it, then publish:
+  ${initThenPublishHint(slug)}`
       );
     }
     throw err;
@@ -2001,7 +2075,7 @@ async function appsPublishCommand(appRef, opts) {
     bytes = await fs5.readFile(bundlePath);
   } catch {
     throw new Error(
-      `No bundle at ${bundlePath}. Run \`npm run release\` in the starter-kit, then pass --path release.zip.`
+      `No bundle at ${bundlePath}. ${initThenPublishHint()}`
     );
   }
   if (bytes.byteLength === 0) {
@@ -2027,11 +2101,14 @@ async function appsPublishCommand(appRef, opts) {
   }
   const ext = path5.extname(bundlePath).toLowerCase();
   const isZip = ext === ".zip";
-  if (isZip) {
-    bytes = prepareReleaseZip(bytes);
+  if (!isZip) {
+    throw new Error(
+      `Publish release.zip from \`npm run release\`, not a lone ${path5.basename(bundlePath)}. ` + initThenPublishHint(app.slug)
+    );
   }
-  const bundle = isZip ? "zip" : "remote_entry";
-  const contentType = isZip ? "application/zip" : "application/javascript";
+  bytes = prepareReleaseZip(bytes, app.slug);
+  const bundle = "zip";
+  const contentType = "application/zip";
   if (opts.syncManifest !== false && sibling) {
     await patchApp(cfg.apiUrl, cfg.workspaceId, app.id, {
       manifest: sibling.manifest
@@ -2301,7 +2378,7 @@ function run(fn) {
 var program = new Command();
 program.name("gf").description(
   "Groundfloor CLI \u2014 sign in, deploy coderunners, publish Shell apps, and manage workspace resources."
-).version("0.1.1");
+).version("0.1.4");
 program.command("login").description(
   "Log in via the browser (production by default; --dev / --stage for other cells)"
 ).option("--dev", "Sign in to Groundfloor dev").option("--stage", "Sign in to Groundfloor stage").option(
@@ -2398,10 +2475,10 @@ apps.command("create").description("Register a Shell federated or standalone pro
   "Path to groundfloor.manifest.json (Shell apps)"
 ).option("--json", "Output raw JSON").action((opts) => run(() => appsCreateCommand(opts)));
 apps.command("publish [appId]").description(
-  "Upload release.zip (or remoteEntry.js) and publish a Shell app"
+  "Upload release.zip from npm run release (not a lone remoteEntry.js)"
 ).option("-w, --workspace <id>", "Workspace id override").option("--app <id|slug>", "App id or slug (else manifest appId)").option(
   "-p, --path <file>",
-  "release.zip, remoteEntry.js, or a folder containing release.zip",
+  "release.zip from npm run release (or a folder containing it)",
   "release.zip"
 ).option("-m, --label <text>", "Optional release label").option(
   "--no-sync-manifest",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groundfloorcloud/cli",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Groundfloor gf CLI — sign in, deploy coderunners, publish Shell apps, and manage secrets, files, and Dataplane.",
   "type": "module",
   "bin": {