@hailer/mcp 1.3.12 → 1.3.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude/skills/create-and-publish-app/SKILL.md +13 -9
- package/CHANGELOG.md +40 -0
- package/CLAUDE.md +4 -2
- package/dist/app-prep.d.ts +11 -3
- package/dist/app-prep.d.ts.map +1 -1
- package/dist/app-prep.js +77 -3
- package/dist/app-prep.js.map +1 -1
- package/dist/cli.js +2 -2
- package/dist/cli.js.map +1 -1
- package/dist/mcp/publish-auth-injector.d.ts +16 -15
- package/dist/mcp/publish-auth-injector.d.ts.map +1 -1
- package/dist/mcp/publish-auth-injector.js +22 -18
- package/dist/mcp/publish-auth-injector.js.map +1 -1
- package/package.json +1 -1
|
@@ -31,14 +31,14 @@ npx @hailer/create-app <project-name> --template react-ts
|
|
|
31
31
|
npx hailer-mcp prep-app <project-name>
|
|
32
32
|
```
|
|
33
33
|
|
|
34
|
-
**Run `npx hailer-mcp prep-app <project-name>` immediately after scaffolding — it neutralizes the scaffold
|
|
34
|
+
**Run `npx hailer-mcp prep-app <project-name>` immediately after scaffolding — it neutralizes the scaffold papercuts so you never hit them:** clears the placeholder `appId` (`65143728…`) and fake "Magic Apps Ltd." author from `public/manifest.json` (so first-publish detection is clean and no demo identity leaks), fixes the `StoreSet` `tsc` error in `src/hailer/use-app.ts`, writes a `.npmrc` with `include=dev` (so `npm install` pulls build deps even under Studio's `NODE_ENV=production` — which otherwise omits devDeps and breaks the build), and wires the `publish-*` scripts with `--env-file ../../.env` (per-project publish auth). Idempotent and safe to re-run. **`prep-app` writes `.npmrc` *after* `create-app`'s own install, so run `npm install --include=dev` once more after prep-app to pull the devDeps that first install skipped.** (Run prep-app from the SDK project root, where `npx hailer-mcp` resolves; pass the app dir or `apps/<name>`.)
|
|
35
35
|
|
|
36
36
|
**This exact form is non-interactive — it runs with zero prompts. Do NOT deviate:**
|
|
37
37
|
- **`<project-name>` is a POSITIONAL argument, not a flag.** `--name <x>` is silently ignored and the CLI drops to an interactive "Project name:" prompt that hangs an agent. Put the name first, bare.
|
|
38
38
|
- **`--template` must be a real template name:** `react-ts` (recommended), `react`, `react-swc-ts`, `vanilla-ts`, `vanilla`, `preact-ts`, `preact`, `svelte-ts`, `svelte`. NOT `minimal` (invalid → drops to a "Select a framework" prompt that hangs).
|
|
39
39
|
- **Use a fresh, lowercase, kebab-case name** in an empty target dir — that skips the overwrite prompt AND the package-name prompt. e.g. `injured-players-cost`.
|
|
40
40
|
- Never run `npx @hailer/create-app` bare and never pipe input to it (`echo …|`, `printf`, `expect`) — the one-line form above already needs no input.
|
|
41
|
-
- Run from a parent directory (`mkdir -p apps` first if needed), NEVER copy an existing app, then `cd <project-name> && npm install`.
|
|
41
|
+
- Run from a parent directory (`mkdir -p apps` first if needed), NEVER copy an existing app, then `cd <project-name> && npm install --include=dev` (the `--include=dev` survives `NODE_ENV=production`; the `.npmrc` prep-app writes makes later bare `npm install` safe too).
|
|
42
42
|
</scaffold>
|
|
43
43
|
|
|
44
44
|
<build>
|
|
@@ -65,7 +65,7 @@ Replace `src/App.tsx` and add components (load `hailer-app-builder` + `hailer-de
|
|
|
65
65
|
**Hailer Studio:** `localhost:3000` is unreachable from outside the sandbox — publishing is the only way to test inside Hailer. Publish a SEPARATE dev app and iterate on it:
|
|
66
66
|
|
|
67
67
|
```bash
|
|
68
|
-
npm run publish-production -- --host
|
|
68
|
+
npm run publish-production -- --host https://api.hailer.com --create --app-name "<App Name> - Dev" --workspace <workspaceId> --force
|
|
69
69
|
```
|
|
70
70
|
|
|
71
71
|
After the first publish `public/manifest.json` holds the dev `appId`; later iterations just need `--host ... --force`. Share it: MCP `manage_app({ action: 'add_member', appId, member: "network_<workspaceId>" })`.
|
|
@@ -79,10 +79,11 @@ After the first publish `public/manifest.json` holds the dev `appId`; later iter
|
|
|
79
79
|
<credentials>
|
|
80
80
|
## Credentials — Read This Before Publishing Fails
|
|
81
81
|
|
|
82
|
-
The publish CLI (`@hailer/app-sdk`'s `publish.cjs`, wrapped as `npm run publish-*`)
|
|
82
|
+
The publish CLI (`@hailer/app-sdk`'s `publish.cjs`, wrapped as `npm run publish-*`) resolves auth as: **`--user-api-key` flag → `USER_API_KEY` env → `HAILER_USER_API_KEY` env** (an API key and `--email` are mutually exclusive — passing one ignores the other). Those env vars are loaded by dotenv from **`--env-file <path>` first (if passed), then `~/.env`** in HOME; dotenv never overrides an already-set var, so the earlier source wins. Last resort: `--email` → interactive password prompt (useless for agents).
|
|
83
83
|
|
|
84
84
|
- **Hailer Studio:** `~/.env` is auto-injected — publishing just works, no flags.
|
|
85
|
-
- **Local machines:** the `npx hailer-mcp` server self-provisions on first boot — it mints a user API key from the project bot's credentials and writes `HAILER_USER_API_KEY` to `~/.env`
|
|
85
|
+
- **Local machines:** the `npx hailer-mcp` server self-provisions on first boot — it mints a user API key from the project bot's credentials and writes `HAILER_USER_API_KEY` to the **project-root `.env`** (not `~/.env`). `prep-app` wires each app's `publish-*` script with `--env-file ../../.env`, so every project publishes to its own workspace. Once the local server has run once, publishing needs no auth flags. (Opt out: `HAILER_MCP_NO_PUBLISH_AUTH=true`.)
|
|
86
|
+
- **⚠ Per-project, not machine-global.** Earlier versions wrote the key to `~/.env` — one slot shared by every project, so the last `npx hailer-mcp` to boot won it and other projects published to the WRONG workspace. Now each project's key lives in its own `.env` and `--env-file ../../.env` makes it win. Apps must live under `apps/<name>/` for that relative path to resolve; a top-level app needs re-homing under `apps/` or an explicit `-- --user-api-key <key>`.
|
|
86
87
|
- **ALWAYS pass `-- --force`.** Without it the publish stops at an interactive `Overwrite the app? (Y/n)` prompt — which an agent cannot answer, so the command hangs until it times out. Every publish command below includes it; never drop it.
|
|
87
88
|
- **If publishing still hits exit code 10** (no auth — the CLI prints usage and quits): the local server hasn't run yet, or injection was disabled. Start `npx hailer-mcp` once, OR ask the user for a Hailer user API key (Hailer → profile → API keys) and pass `-- --user-api-key <key>`. **Never read passwords from .env, never log in via curl, never probe API endpoints for keys.**
|
|
88
89
|
|
|
@@ -112,7 +113,9 @@ If a publish reports success but the app still serves the old/localhost version,
|
|
|
112
113
|
<prod-publish>
|
|
113
114
|
## Step 5 — Production Publish (only when the user explicitly asks)
|
|
114
115
|
|
|
115
|
-
**
|
|
116
|
+
**BEFORE any publish, run `npx hailer-mcp prep-app <name>`** (from the SDK project root; idempotent — safe to re-run, no-ops if already done). Apps scaffolded before the `--env-file` flag existed don't carry it in their `publish-*` scripts, so they'd authenticate from the machine-global `~/.env` and could publish to the WRONG workspace. Re-prepping retrofits `--env-file ../../.env` so this publish targets THIS project's workspace. This is the "prep on the fly" guard — touch an app to publish it, prep it first.
|
|
117
|
+
|
|
118
|
+
**THEN decide first-publish vs update by READING `public/manifest.json` — never guess, never fail-first.** The scaffold ships a placeholder `appId` of `65143728d2bd678b13daf289` (the "Magic Apps" demo). That value, or empty/missing, means this app has never been published:
|
|
116
119
|
|
|
117
120
|
| manifest `appId` | This is a… | Command |
|
|
118
121
|
|---|---|---|
|
|
@@ -125,8 +128,8 @@ A plain publish against the scaffold's placeholder appId silently uploads to the
|
|
|
125
128
|
# FIRST publish (fresh scaffold) — local machine
|
|
126
129
|
npm run publish-production -- --create --app-name "<App Name>" --workspace <workspaceId> --force
|
|
127
130
|
|
|
128
|
-
# FIRST publish — Hailer Studio (cluster
|
|
129
|
-
npm run publish-production -- --host
|
|
131
|
+
# FIRST publish — Hailer Studio (in-cluster; set --host to the public API explicitly)
|
|
132
|
+
npm run publish-production -- --host https://api.hailer.com --create --app-name "<App Name>" --workspace <workspaceId> --force
|
|
130
133
|
|
|
131
134
|
# UPDATE (manifest already has a real appId)
|
|
132
135
|
npm run publish-production -- --force
|
|
@@ -158,7 +161,8 @@ npm run publish-production -- --force
|
|
|
158
161
|
| `--market` | Also publish this version to the marketplace (requires `version` + `versionDescription`; server returns `targetId`, auto-saved to manifest) |
|
|
159
162
|
| `--force` | Skip confirmation prompt |
|
|
160
163
|
| `--host` | API URL override — required in cluster environments |
|
|
161
|
-
| `--user-api-key` / `--email` | Else `USER_API_KEY`/`HAILER_USER_API_KEY` env
|
|
164
|
+
| `--user-api-key` / `--email` | Explicit auth (mutually exclusive). Else `USER_API_KEY`/`HAILER_USER_API_KEY` env — loaded from `--env-file` then `~/.env` |
|
|
165
|
+
| `--env-file <path>` | Load an env file before `~/.env` (wins on conflicts). `prep-app` sets `--env-file ../../.env` so each project publishes with its own key, not whatever last claimed `~/.env` |
|
|
162
166
|
| `--production` / `--development` / `--staging` / `--local` | Environment preset (the `npm run publish-*` wrappers set these) |
|
|
163
167
|
|
|
164
168
|
**Subsequent publishes:** just `npm run publish-production -- --force` (+ `--host` in Studio) — the manifest `appId` picks the target. Bump `version`/`versionDescription` per release.
|
package/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,46 @@ All notable changes to this project will be documented in this file.
|
|
|
4
4
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
5
5
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
6
6
|
|
|
7
|
+
## [1.3.13] - 23-06-2026
|
|
8
|
+
|
|
9
|
+
### Fix
|
|
10
|
+
|
|
11
|
+
**prep-app forces app dev dependencies under `NODE_ENV=production`**
|
|
12
|
+
|
|
13
|
+
Hailer Studio runs with `NODE_ENV=production`, which makes `npm install` omit
|
|
14
|
+
devDependencies — so `vite`/`tsc` are absent and `npm run dev` / build-production
|
|
15
|
+
die. `prep-app` now writes a `.npmrc` with `include=dev` into each app, so every
|
|
16
|
+
install in the app dir pulls build deps regardless of `NODE_ENV` or who runs it
|
|
17
|
+
(deterministic — no flag to remember). These apps build to a static bundle, so
|
|
18
|
+
installing devDeps is always correct.
|
|
19
|
+
|
|
20
|
+
Because `create-app` runs its own install before `.npmrc` exists, the
|
|
21
|
+
`create-and-publish-app` skill and CLAUDE.md now run `npm install --include=dev`
|
|
22
|
+
once after prep-app to repair the scaffold install. This does NOT change
|
|
23
|
+
`NODE_ENV`, so deps that read it at runtime are unaffected.
|
|
24
|
+
|
|
25
|
+
## [1.3.12] - 23-06-2026
|
|
26
|
+
|
|
27
|
+
### Fix
|
|
28
|
+
|
|
29
|
+
**Per-project local publish-auth (supersedes 1.3.11's `~/.env` arbitration)**
|
|
30
|
+
|
|
31
|
+
1.3.11 made the machine-global `~/.env` key "workspace-aware" by re-minting on
|
|
32
|
+
mismatch (last server to boot wins). That only narrowed the bug: `~/.env` is a
|
|
33
|
+
single slot shared by every SDK project, so publishing from two projects
|
|
34
|
+
concurrently still raced — the last boot's key won and the other project
|
|
35
|
+
published to the wrong workspace.
|
|
36
|
+
|
|
37
|
+
The injector now writes the minted key to the **project's own `.env`** (cwd),
|
|
38
|
+
not `~/.env` — one file per project, no shared slot. `prep-app` wires each app's
|
|
39
|
+
`publish-*` scripts with `--env-file ../../.env`, which `publish.cjs` loads
|
|
40
|
+
before `~/.env` (dotenv keeps the first-set value), so every project publishes
|
|
41
|
+
to its own workspace. Concurrent multi-project publishing is now correct.
|
|
42
|
+
|
|
43
|
+
Apps must live under `apps/<name>/` for the relative path to resolve. The
|
|
44
|
+
`create-and-publish-app` skill re-preps (idempotent) before every publish, so
|
|
45
|
+
apps scaffolded before the flag existed are retrofitted on the fly.
|
|
46
|
+
|
|
7
47
|
## [1.3.11] - 22-06-2026
|
|
8
48
|
|
|
9
49
|
### Fix
|
package/CLAUDE.md
CHANGED
|
@@ -100,12 +100,14 @@ Always use `:force` — the non-force variants prompt interactively.
|
|
|
100
100
|
|
|
101
101
|
| Step | How |
|
|
102
102
|
|------|-----|
|
|
103
|
-
| Scaffold | `npx @hailer/create-app <name> --template react-ts
|
|
103
|
+
| Scaffold | `npx @hailer/create-app <name> --template react-ts`, then `npx hailer-mcp prep-app <name>`, then `cd <name> && npm install --include=dev` — scaffold fresh, never copy an existing app (prep-app clears the placeholder appId, fixes the StoreSet tsc error, writes `.npmrc include=dev`, and wires the publish scripts) |
|
|
104
104
|
| Local dev | `cd app && npm run dev` |
|
|
105
105
|
| Publish | `cd app && npm run publish-production -- --force` (add `--market` for marketplace; `--force` skips the overwrite prompt that hangs agents); then share via `manage_app` add_member |
|
|
106
106
|
| Share (after publish) | `npm run pull`, then edit members in `workspace/apps.ts` → `npx hailer-sdk ws-config apps push --force`. NEVER create app entries in apps.ts — `--create` publish makes them |
|
|
107
107
|
|
|
108
|
-
|
|
108
|
+
Dev deps: Hailer Studio runs with `NODE_ENV=production`, which makes `npm install` skip devDependencies (vite/tsc) and breaks the build. Always `npm install --include=dev` in apps; `prep-app` also writes a `.npmrc` with `include=dev` so any bare install in the app dir is safe regardless of `NODE_ENV`.
|
|
109
|
+
|
|
110
|
+
Publish auth: works flag-free once the local `npx hailer-mcp` server has run once — it mints a user API key from the project bot creds into the **project's `.env`** (one slot per project, not the machine-global `~/.env`); `prep-app` wires each app's `publish-*` script with `--env-file ../../.env` so it publishes to its own workspace. Apps must live under `apps/<name>/` for that path to resolve. Exit 10 = no auth yet → start the server once, or pass `-- --user-api-key <key>`; NEVER read passwords or probe login endpoints. Details: `create-and-publish-app` skill.
|
|
109
111
|
|
|
110
112
|
## When MCP Tools Are the Answer
|
|
111
113
|
|
package/dist/app-prep.d.ts
CHANGED
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Post-scaffold prep for freshly created Hailer apps.
|
|
3
3
|
*
|
|
4
|
-
* @hailer/create-app's templates ship
|
|
5
|
-
*
|
|
6
|
-
*
|
|
4
|
+
* @hailer/create-app's templates ship defaults that make every app dance (and
|
|
5
|
+
* we can't change create-app). This neutralizes them from the @hailer/mcp side,
|
|
6
|
+
* deterministically, right after scaffold:
|
|
7
7
|
*
|
|
8
8
|
* 1. public/manifest.json ships a placeholder appId ("65143728…", the
|
|
9
9
|
* "Magic Apps" demo) + fake author. The placeholder makes first-publish
|
|
@@ -12,6 +12,14 @@
|
|
|
12
12
|
* fake author/contributors.
|
|
13
13
|
* 2. src/hailer/use-app.ts types StoreSet `replace?: boolean`, which fails
|
|
14
14
|
* `tsc` under zustand v5. → `replace?: false`.
|
|
15
|
+
* 3. publish-* scripts authenticate from `~/.env`, a machine-global slot every
|
|
16
|
+
* SDK project shares — so concurrent projects publish to the wrong
|
|
17
|
+
* workspace. → add `--env-file ../../.env` so each app publishes with its
|
|
18
|
+
* own project's key (the injector writes it to the project-root .env).
|
|
19
|
+
* 4. under Hailer Studio's NODE_ENV=production, `npm install` omits
|
|
20
|
+
* devDependencies (vite, tsc) and the build dies. → write a `.npmrc` with
|
|
21
|
+
* `include=dev` so every install in the app dir pulls build deps
|
|
22
|
+
* regardless of NODE_ENV.
|
|
15
23
|
*
|
|
16
24
|
* Idempotent and best-effort: missing files are warned, not fatal.
|
|
17
25
|
* Invoked via `npx hailer-mcp prep-app <dir>` (see cli.ts).
|
package/dist/app-prep.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"app-prep.d.ts","sourceRoot":"","sources":["../src/app-prep.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"app-prep.d.ts","sourceRoot":"","sources":["../src/app-prep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,UAAU,UAAU;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACtB;AAgID,4DAA4D;AAC5D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAW3D"}
|
package/dist/app-prep.js
CHANGED
|
@@ -2,9 +2,9 @@
|
|
|
2
2
|
/**
|
|
3
3
|
* Post-scaffold prep for freshly created Hailer apps.
|
|
4
4
|
*
|
|
5
|
-
* @hailer/create-app's templates ship
|
|
6
|
-
*
|
|
7
|
-
*
|
|
5
|
+
* @hailer/create-app's templates ship defaults that make every app dance (and
|
|
6
|
+
* we can't change create-app). This neutralizes them from the @hailer/mcp side,
|
|
7
|
+
* deterministically, right after scaffold:
|
|
8
8
|
*
|
|
9
9
|
* 1. public/manifest.json ships a placeholder appId ("65143728…", the
|
|
10
10
|
* "Magic Apps" demo) + fake author. The placeholder makes first-publish
|
|
@@ -13,6 +13,14 @@
|
|
|
13
13
|
* fake author/contributors.
|
|
14
14
|
* 2. src/hailer/use-app.ts types StoreSet `replace?: boolean`, which fails
|
|
15
15
|
* `tsc` under zustand v5. → `replace?: false`.
|
|
16
|
+
* 3. publish-* scripts authenticate from `~/.env`, a machine-global slot every
|
|
17
|
+
* SDK project shares — so concurrent projects publish to the wrong
|
|
18
|
+
* workspace. → add `--env-file ../../.env` so each app publishes with its
|
|
19
|
+
* own project's key (the injector writes it to the project-root .env).
|
|
20
|
+
* 4. under Hailer Studio's NODE_ENV=production, `npm install` omits
|
|
21
|
+
* devDependencies (vite, tsc) and the build dies. → write a `.npmrc` with
|
|
22
|
+
* `include=dev` so every install in the app dir pulls build deps
|
|
23
|
+
* regardless of NODE_ENV.
|
|
16
24
|
*
|
|
17
25
|
* Idempotent and best-effort: missing files are warned, not fatal.
|
|
18
26
|
* Invoked via `npx hailer-mcp prep-app <dir>` (see cli.ts).
|
|
@@ -80,6 +88,70 @@ function fixUseAppTypes(appDir, result) {
|
|
|
80
88
|
(0, fs_1.writeFileSync)(useAppPath, source.replace('replace?: boolean', 'replace?: false'));
|
|
81
89
|
result.changes.push('use-app.ts: StoreSet replace?: boolean → false');
|
|
82
90
|
}
|
|
91
|
+
/** Per-project publish auth. Apps live at apps/<name>/, so the project-root
|
|
92
|
+
* .env (where the injector writes the key) is two levels up. --env-file loads
|
|
93
|
+
* before ~/.env and wins (dotenv keeps the first-set value), so each project
|
|
94
|
+
* publishes to its OWN workspace. Harmless in Studio: no project .env there,
|
|
95
|
+
* so publish.cjs skips the missing file and falls back to ~/.env. Idempotent.
|
|
96
|
+
* publish-local is skipped — --local mode swaps in its own test credentials. */
|
|
97
|
+
function fixPublishScripts(appDir, result) {
|
|
98
|
+
const pkgPath = (0, path_1.join)(appDir, 'package.json');
|
|
99
|
+
if (!(0, fs_1.existsSync)(pkgPath)) {
|
|
100
|
+
result.warnings.push('package.json not found — skipped publish-script fix');
|
|
101
|
+
return;
|
|
102
|
+
}
|
|
103
|
+
let pkg;
|
|
104
|
+
try {
|
|
105
|
+
pkg = JSON.parse((0, fs_1.readFileSync)(pkgPath, 'utf-8'));
|
|
106
|
+
}
|
|
107
|
+
catch {
|
|
108
|
+
result.warnings.push('package.json is not valid JSON — skipped publish-script fix');
|
|
109
|
+
return;
|
|
110
|
+
}
|
|
111
|
+
const scripts = pkg.scripts ?? {};
|
|
112
|
+
let touched = false;
|
|
113
|
+
for (const name of Object.keys(scripts)) {
|
|
114
|
+
const isRemotePublish = /^publish-(development|staging|production)$/.test(name);
|
|
115
|
+
if (isRemotePublish && scripts[name].includes('publish.cjs') && !scripts[name].includes('--env-file')) {
|
|
116
|
+
scripts[name] = `${scripts[name]} --env-file ../../.env`;
|
|
117
|
+
touched = true;
|
|
118
|
+
}
|
|
119
|
+
}
|
|
120
|
+
if (!touched) {
|
|
121
|
+
result.changes.push('publish scripts already env-file scoped');
|
|
122
|
+
return;
|
|
123
|
+
}
|
|
124
|
+
pkg.scripts = scripts;
|
|
125
|
+
(0, fs_1.writeFileSync)(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
|
|
126
|
+
result.changes.push('publish scripts: added --env-file ../../.env (per-project auth)');
|
|
127
|
+
}
|
|
128
|
+
/** Force devDependencies to install even under NODE_ENV=production (Hailer
|
|
129
|
+
* Studio sets it), so vite/tsc are present for `npm run dev` and
|
|
130
|
+
* build-production. A committed `.npmrc` with `include=dev` makes EVERY install
|
|
131
|
+
* in this dir pull devDeps regardless of NODE_ENV or who runs it —
|
|
132
|
+
* deterministic, no flag to remember. These apps build to a static bundle, so
|
|
133
|
+
* installing devDeps is always correct (they're never shipped to runtime).
|
|
134
|
+
* Idempotent. */
|
|
135
|
+
function fixNpmrc(appDir, result) {
|
|
136
|
+
const npmrcPath = (0, path_1.join)(appDir, '.npmrc');
|
|
137
|
+
const directive = 'include=dev';
|
|
138
|
+
let body = '';
|
|
139
|
+
if ((0, fs_1.existsSync)(npmrcPath)) {
|
|
140
|
+
try {
|
|
141
|
+
body = (0, fs_1.readFileSync)(npmrcPath, 'utf-8');
|
|
142
|
+
}
|
|
143
|
+
catch {
|
|
144
|
+
body = '';
|
|
145
|
+
}
|
|
146
|
+
if (/^\s*include\s*=\s*dev\s*$/m.test(body)) {
|
|
147
|
+
result.changes.push('.npmrc already includes dev deps');
|
|
148
|
+
return;
|
|
149
|
+
}
|
|
150
|
+
}
|
|
151
|
+
const next = body.length > 0 ? `${body.replace(/\s*$/, '')}\n${directive}\n` : `${directive}\n`;
|
|
152
|
+
(0, fs_1.writeFileSync)(npmrcPath, next);
|
|
153
|
+
result.changes.push('.npmrc: added include=dev (install devDeps under NODE_ENV=production)');
|
|
154
|
+
}
|
|
83
155
|
/** Run all post-scaffold fixes against an app directory. */
|
|
84
156
|
function prepScaffoldedApp(input) {
|
|
85
157
|
const appDir = resolveAppDir(input);
|
|
@@ -89,6 +161,8 @@ function prepScaffoldedApp(input) {
|
|
|
89
161
|
const result = { appDir, changes: [], warnings: [] };
|
|
90
162
|
fixManifest(appDir, result);
|
|
91
163
|
fixUseAppTypes(appDir, result);
|
|
164
|
+
fixPublishScripts(appDir, result);
|
|
165
|
+
fixNpmrc(appDir, result);
|
|
92
166
|
return result;
|
|
93
167
|
}
|
|
94
168
|
//# sourceMappingURL=app-prep.js.map
|
package/dist/app-prep.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"app-prep.js","sourceRoot":"","sources":["../src/app-prep.ts"],"names":[],"mappings":";AAAA
|
|
1
|
+
{"version":3,"file":"app-prep.js","sourceRoot":"","sources":["../src/app-prep.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;AA0IH,8CAWC;AAnJD,2BAA6D;AAC7D,+BAAiD;AAQjD,iFAAiF;AACjF,SAAS,aAAa,CAAC,KAAa;IAChC,MAAM,UAAU,GAAG;QACf,IAAA,iBAAU,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAA,cAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC;QACzD,IAAA,cAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC;KACxC,CAAC;IACF,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAA,eAAU,EAAC,IAAA,WAAI,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,2EAA2E;AAC3E,SAAS,WAAW,CAAC,MAAc,EAAE,MAAkB;IACnD,MAAM,YAAY,GAAG,IAAA,WAAI,EAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAA,eAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACjE,OAAO;IACX,CAAC;IACD,IAAI,QAAiC,CAAC;IACtC,IAAI,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QACzE,OAAO;IACX,CAAC;IAED,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;IACtD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,CAAC,KAAK,KAAK,kBAAkB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC3D,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;QACpB,OAAO,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACxC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,cAAc,IAAI,QAAQ,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,YAAY,CAAC;QAC7B,OAAO,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC9C,OAAO;IACX,CAAC;IACD,IAAA,kBAAa,EAAC,YAAY,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;AAC7E,CAAC;AAED,sEAAsE;AACtE,SAAS,cAAc,CAAC,MAAc,EAAE,MAAkB;IACtD,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAClE,OAAO;IACX,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAChD,OAAO;IACX,CAAC;IACD,IAAA,kBAAa,EAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;iFAKiF;AACjF,SAAS,iBAAiB,CAAC,MAAc,EAAE,MAAkB;IACzD,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAA,eAAU,EAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QAC5E,OAAO;IACX,CAAC;IACD,IAAI,GAAyC,CAAC;IAC9C,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QACpF,OAAO;IACX,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,eAAe,GAAG,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,IAAI,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACpG,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC;YACzD,OAAO,GAAG,IAAI,CAAC;QACnB,CAAC;IACL,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QAC/D,OAAO;IACX,CAAC;IACD,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IACtB,IAAA,kBAAa,EAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;kBAMkB;AAClB,SAAS,QAAQ,CAAC,MAAc,EAAE,MAAkB;IAChD,MAAM,SAAS,GAAG,IAAA,WAAI,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,aAAa,CAAC;IAChC,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,IAAA,eAAU,EAAC,SAAS,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACD,IAAI,GAAG,IAAA,iBAAY,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACL,IAAI,GAAG,EAAE,CAAC;QACd,CAAC;QACD,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YACxD,OAAO;QACX,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,CAAC;IAChG,IAAA,kBAAa,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;AACjG,CAAC;AAED,4DAA4D;AAC5D,SAAgB,iBAAiB,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,4BAA4B,KAAK,cAAc,KAAK,GAAG,CAAC,EAAE,CAAC;IAC/G,CAAC;IACD,MAAM,MAAM,GAAe,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACjE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC;AAClB,CAAC"}
|
package/dist/cli.js
CHANGED
|
@@ -77,8 +77,8 @@ function runServer() {
|
|
|
77
77
|
}
|
|
78
78
|
void Promise.resolve().then(() => __importStar(require('./app')));
|
|
79
79
|
// Studio-style publish auth: on the CLI path (prod runs `node dist/app.js`,
|
|
80
|
-
// never this bin), ensure
|
|
81
|
-
// works flag-free. Fire-and-forget — never blocks or fails server boot.
|
|
80
|
+
// never this bin), ensure the project .env has a user API key so
|
|
81
|
+
// `npm run publish-*` works flag-free. Fire-and-forget — never blocks or fails server boot.
|
|
82
82
|
// Opt out with HAILER_MCP_NO_PUBLISH_AUTH=true.
|
|
83
83
|
const publishAuthOptOut = /^true$/i.test(process.env.HAILER_MCP_NO_PUBLISH_AUTH ?? '');
|
|
84
84
|
if (!publishAuthOptOut) {
|
package/dist/cli.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,SAAS,UAAU,CAAC,MAAc;IAC9B,kDAAO,YAAY,IAAE,IAAI,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE;QAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,MAAM,IAAI,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,SAAS;IACd,+DAA+D;IAC/D,wFAAwF;IACxF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,MAAM;QACV,CAAC;IACL,CAAC;IAED,4DAA4D;IAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACnD,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,gFAAgF;IAChF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9C,MAAM;QACV,CAAC;IACL,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,KAAK,CAAC;IAC5C,CAAC;IAED,uDAAY,OAAO,GAAC,CAAC;IAErB,4EAA4E;IAC5E,
|
|
1
|
+
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,SAAS,UAAU,CAAC,MAAc;IAC9B,kDAAO,YAAY,IAAE,IAAI,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE;QAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,MAAM,IAAI,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,SAAS;IACd,+DAA+D;IAC/D,wFAAwF;IACxF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,MAAM;QACV,CAAC;IACL,CAAC;IAED,4DAA4D;IAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACnD,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,gFAAgF;IAChF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9C,MAAM;QACV,CAAC;IACL,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,KAAK,CAAC;IAC5C,CAAC;IAED,uDAAY,OAAO,GAAC,CAAC;IAErB,4EAA4E;IAC5E,iEAAiE;IACjE,4FAA4F;IAC5F,gDAAgD;IAChD,MAAM,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACrB,kDAAO,6BAA6B,IAC/B,IAAI,CAAC,CAAC,EAAE,sBAAsB,EAAE,EAAE,EAAE,CAAC,sBAAsB,EAAE,CAAC;aAC9D,KAAK,CAAC,GAAG,EAAE,GAAqB,CAAC,CAAC,CAAC;IAC5C,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,4EAA4E;AAC5E,0DAA0D;AAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC;AACzC,IAAI,SAAS,EAAE,CAAC;IACZ,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AAC/B,CAAC;AACD,IAAI,CAAC,SAAS,EAAE,CAAC;IACb,SAAS,EAAE,CAAC;AAChB,CAAC"}
|
|
@@ -4,21 +4,22 @@
|
|
|
4
4
|
*
|
|
5
5
|
* Studio writes the session's user API key into the sandbox's `~/.env` so the
|
|
6
6
|
* app publish script (`@hailer/app-sdk` publish.cjs) authenticates with no
|
|
7
|
-
* flags.
|
|
8
|
-
*
|
|
9
|
-
*
|
|
10
|
-
*
|
|
7
|
+
* flags. That's safe in Studio because a sandbox is a single project. On a dev
|
|
8
|
+
* machine one `$HOME` is shared by every SDK project, so `~/.env` is a single
|
|
9
|
+
* machine-global slot — the last server to boot would clobber it and other
|
|
10
|
+
* projects would publish to the wrong workspace.
|
|
11
11
|
*
|
|
12
|
-
*
|
|
13
|
-
*
|
|
14
|
-
*
|
|
15
|
-
*
|
|
16
|
-
*
|
|
17
|
-
*
|
|
12
|
+
* So instead we write the minted key into the *project's own* `.env` (cwd, where
|
|
13
|
+
* the bot's CLIENT_CONFIGS credentials already live), and prep-app points each
|
|
14
|
+
* app's publish script at it with `--env-file ../../.env` (loaded before
|
|
15
|
+
* `~/.env`, so it wins). One file per project → no shared slot.
|
|
16
|
+
*
|
|
17
|
+
* The marker records the workspace the key was minted for: it tells our key from
|
|
18
|
+
* one the user set themselves (left untouched), and re-mints if the project is
|
|
19
|
+
* later re-pointed at a different workspace.
|
|
18
20
|
*
|
|
19
21
|
* Best-effort (never blocks or fails server startup) and CLI-gated (prod never
|
|
20
|
-
* imports this).
|
|
21
|
-
* `~/.env` without our marker — is always left untouched.
|
|
22
|
+
* imports this).
|
|
22
23
|
*/
|
|
23
24
|
interface ExistingKey {
|
|
24
25
|
/** True when this injector wrote the key (our marker comment is present). */
|
|
@@ -27,20 +28,20 @@ interface ExistingKey {
|
|
|
27
28
|
workspaceId: string | null;
|
|
28
29
|
}
|
|
29
30
|
/**
|
|
30
|
-
* Inspect
|
|
31
|
+
* Inspect the env file for a publish key. Returns null when none is present, an
|
|
31
32
|
* unmanaged entry when the user added the key themselves (no marker), or a
|
|
32
33
|
* managed entry carrying the workspace the key was minted for.
|
|
33
34
|
*/
|
|
34
35
|
export declare function readExistingKey(envPath: string): ExistingKey | null;
|
|
35
36
|
/**
|
|
36
|
-
* Rewrite
|
|
37
|
+
* Rewrite the env file with a freshly minted key, stripping any block we wrote
|
|
37
38
|
* before and preserving every other line. The file holds a live credential,
|
|
38
39
|
* so keep it owner-only (0600).
|
|
39
40
|
*/
|
|
40
41
|
export declare function writeManagedKey(envPath: string, key: string, workspaceId: string): void;
|
|
41
42
|
/**
|
|
42
43
|
* Mint a publish user API key from the project bot's CLIENT_CONFIGS account and
|
|
43
|
-
* write it to
|
|
44
|
+
* write it to the project `.env`, scoped to the project's workspace. No-op when the file
|
|
44
45
|
* already holds our key for this workspace, when the user owns the key, or when
|
|
45
46
|
* no account is configured. Swallows every error — publishing convenience must
|
|
46
47
|
* never break the server.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"publish-auth-injector.d.ts","sourceRoot":"","sources":["../../src/mcp/publish-auth-injector.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"publish-auth-injector.d.ts","sourceRoot":"","sources":["../../src/mcp/publish-auth-injector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAkBH,UAAU,WAAW;IACjB,6EAA6E;IAC7E,OAAO,EAAE,OAAO,CAAC;IACjB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAmBnE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAkBvF;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CA0E5D"}
|
|
@@ -5,21 +5,22 @@
|
|
|
5
5
|
*
|
|
6
6
|
* Studio writes the session's user API key into the sandbox's `~/.env` so the
|
|
7
7
|
* app publish script (`@hailer/app-sdk` publish.cjs) authenticates with no
|
|
8
|
-
* flags.
|
|
9
|
-
*
|
|
10
|
-
*
|
|
11
|
-
*
|
|
8
|
+
* flags. That's safe in Studio because a sandbox is a single project. On a dev
|
|
9
|
+
* machine one `$HOME` is shared by every SDK project, so `~/.env` is a single
|
|
10
|
+
* machine-global slot — the last server to boot would clobber it and other
|
|
11
|
+
* projects would publish to the wrong workspace.
|
|
12
12
|
*
|
|
13
|
-
*
|
|
14
|
-
*
|
|
15
|
-
*
|
|
16
|
-
*
|
|
17
|
-
*
|
|
18
|
-
*
|
|
13
|
+
* So instead we write the minted key into the *project's own* `.env` (cwd, where
|
|
14
|
+
* the bot's CLIENT_CONFIGS credentials already live), and prep-app points each
|
|
15
|
+
* app's publish script at it with `--env-file ../../.env` (loaded before
|
|
16
|
+
* `~/.env`, so it wins). One file per project → no shared slot.
|
|
17
|
+
*
|
|
18
|
+
* The marker records the workspace the key was minted for: it tells our key from
|
|
19
|
+
* one the user set themselves (left untouched), and re-mints if the project is
|
|
20
|
+
* later re-pointed at a different workspace.
|
|
19
21
|
*
|
|
20
22
|
* Best-effort (never blocks or fails server startup) and CLI-gated (prod never
|
|
21
|
-
* imports this).
|
|
22
|
-
* `~/.env` without our marker — is always left untouched.
|
|
23
|
+
* imports this).
|
|
23
24
|
*/
|
|
24
25
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
25
26
|
exports.readExistingKey = readExistingKey;
|
|
@@ -34,7 +35,7 @@ const logger_1 = require("../lib/logger");
|
|
|
34
35
|
const logger = (0, logger_1.createLogger)({ component: 'publish-auth' });
|
|
35
36
|
const MANAGED_MARKER = '# Added by hailer-mcp for local app publishing';
|
|
36
37
|
/**
|
|
37
|
-
* Inspect
|
|
38
|
+
* Inspect the env file for a publish key. Returns null when none is present, an
|
|
38
39
|
* unmanaged entry when the user added the key themselves (no marker), or a
|
|
39
40
|
* managed entry carrying the workspace the key was minted for.
|
|
40
41
|
*/
|
|
@@ -60,7 +61,7 @@ function readExistingKey(envPath) {
|
|
|
60
61
|
return { managed: true, workspaceId: wsMatch ? wsMatch[1] : null };
|
|
61
62
|
}
|
|
62
63
|
/**
|
|
63
|
-
* Rewrite
|
|
64
|
+
* Rewrite the env file with a freshly minted key, stripping any block we wrote
|
|
64
65
|
* before and preserving every other line. The file holds a live credential,
|
|
65
66
|
* so keep it owner-only (0600).
|
|
66
67
|
*/
|
|
@@ -83,13 +84,16 @@ function writeManagedKey(envPath, key, workspaceId) {
|
|
|
83
84
|
}
|
|
84
85
|
/**
|
|
85
86
|
* Mint a publish user API key from the project bot's CLIENT_CONFIGS account and
|
|
86
|
-
* write it to
|
|
87
|
+
* write it to the project `.env`, scoped to the project's workspace. No-op when the file
|
|
87
88
|
* already holds our key for this workspace, when the user owns the key, or when
|
|
88
89
|
* no account is configured. Swallows every error — publishing convenience must
|
|
89
90
|
* never break the server.
|
|
90
91
|
*/
|
|
91
92
|
async function injectLocalPublishAuth() {
|
|
92
|
-
|
|
93
|
+
// The server's cwd is the SDK project root; write into THIS project's .env
|
|
94
|
+
// (gitignored, already holds HAILER_PASSWORD). One file per project → no
|
|
95
|
+
// machine-global slot to fight over.
|
|
96
|
+
const envPath = (0, path_1.join)(process.cwd(), '.env');
|
|
93
97
|
// An exported key is a deliberate override — never touch it.
|
|
94
98
|
if (process.env.HAILER_USER_API_KEY || process.env.USER_API_KEY) {
|
|
95
99
|
return;
|
|
@@ -131,8 +135,8 @@ async function injectLocalPublishAuth() {
|
|
|
131
135
|
writeManagedKey(envPath, created.key, workspaceId);
|
|
132
136
|
process.env.HAILER_USER_API_KEY = created.key;
|
|
133
137
|
logger.info(existing?.managed
|
|
134
|
-
? 'Re-minted local publish key for current workspace →
|
|
135
|
-
: 'Minted local publish key →
|
|
138
|
+
? 'Re-minted local publish key for current workspace → project .env'
|
|
139
|
+
: 'Minted local publish key → project .env', { keyName, workspaceId });
|
|
136
140
|
}
|
|
137
141
|
catch (error) {
|
|
138
142
|
logger.debug('Publish-auth injection skipped', {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"publish-auth-injector.js","sourceRoot":"","sources":["../../src/mcp/publish-auth-injector.ts"],"names":[],"mappings":";AAAA
|
|
1
|
+
{"version":3,"file":"publish-auth-injector.js","sourceRoot":"","sources":["../../src/mcp/publish-auth-injector.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;AA8BH,0CAmBC;AAOD,0CAkBC;AASD,wDA0EC;AA3JD,qCAAqC;AACrC,2BAAwE;AACxE,2BAA8B;AAC9B,+BAA4B;AAC5B,sCAAwC;AACxC,0CAA6C;AAE7C,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;AAE3D,MAAM,cAAc,GAAG,gDAAgD,CAAC;AAcxE;;;;GAIG;AACH,SAAgB,eAAe,CAAC,OAAe;IAC3C,IAAI,CAAC,IAAA,eAAU,EAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACD,OAAO,GAAG,IAAA,iBAAY,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,6CAA6C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC5F,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,OAAe,EAAE,GAAW,EAAE,WAAmB;IAC7E,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,IAAA,eAAU,EAAC,OAAO,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC;YACD,IAAI,GAAG,IAAA,iBAAY,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACL,IAAI,GAAG,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAChC,0GAA0G,EAC1G,IAAI,CACP,CAAC;IACF,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,GAAG,cAAc,eAAe,WAAW,2BAA2B,GAAG,KAAK,CAAC;IAC7F,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACvE,IAAA,kBAAa,EAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,IAAA,cAAS,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,sBAAsB;IACxC,2EAA2E;IAC3E,yEAAyE;IACzE,qCAAqC;IACrC,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAE5C,6DAA6D;IAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC9D,OAAO;IACX,CAAC;IAED,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAChC,OAAO;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAW,CAAC,cAAc,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO;IACX,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvG,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACD,MAAM,GAAG,MAAM,YAAM,CAAC,MAAM,CAAC;YACzB,IAAI,EAAE,OAAO,CAAC,UAAU;YACxB,QAAQ,EAAE,OAAO,CAAC,KAAK;YACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,CAAC,UAAU,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;SACnD,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAmC,CAAC;QACnG,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;QACtC,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;YAC9E,OAAO;QACX,CAAC;QAED,oEAAoE;QACpE,IAAI,QAAQ,EAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YAC5D,OAAO;QACX,CAAC;QAED,MAAM,OAAO,GAAG,qBAAqB,IAAA,aAAQ,GAAE,GAAG,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAChC,uBAAuB,EACvB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CACP,CAAC;QAExB,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;YAChB,OAAO;QACX,CAAC;QAED,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC;QAC9C,MAAM,CAAC,IAAI,CACP,QAAQ,EAAE,OAAO;YACb,CAAC,CAAC,kEAAkE;YACpE,CAAC,CAAC,yCAAyC,EAC/C,EAAE,OAAO,EAAE,WAAW,EAAE,CAC3B,CAAC;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;YAC3C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAChE,CAAC,CAAC;IACP,CAAC;YAAS,CAAC;QACP,IAAI,CAAC;YACD,MAAM,EAAE,UAAU,EAAE,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACL,sBAAsB;QAC1B,CAAC;IACL,CAAC;AACL,CAAC"}
|