@helyx/cli 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.3.1
+
+### Patch Changes
+
+- 9e290e1: Load the current reviewed self-host catalogue from the fixed Helyx API endpoint when generating a downloaded starter project, allowing compatible module-only releases without republishing the CLI. Catalogue requests now reject redirects, non-JSON responses, oversized bodies, invalid schemas and unavailable or stale catalogue data.
+
 ## 0.3.0
 
 ### Minor Changes

package/README.md

@@ -14,7 +14,7 @@ helyx self-host update --confirm
 
 `setup` safely creates `.env` from a generated starter's `.env.example`, never overwrites existing configuration and reports whether Docker Compose is available. Direct Node.js operation remains fully supported with a local or hosted PostgreSQL database. `start` loads local configuration without overriding hosting-platform variables and performs the production bot bootstrap, including database and installed-module migrations. `migrate` applies only core migrations and exits. `doctor` validates the complete bot environment, PostgreSQL connectivity, immutable core migration history and configured module package metadata without logging in to Discord or modifying the database.
 
-`self-host init` validates a build manifest against the reviewed catalogue shipped with this exact CLI version, creates a new starter-project directory, pins the runtime and selected official modules, generates a lockfile with lifecycle scripts disabled, and writes checksums. Add `--install` only when the dependencies should also be installed locally. Unknown, unpublished, duplicated or modified package selections fail closed.
+`self-host init` retrieves the current reviewed catalogue from the fixed Helyx API endpoint, validates a downloaded build manifest against it, creates a new starter-project directory, pins the runtime and selected official modules, generates a lockfile with lifecycle scripts disabled, and writes checksums. The request has strict timeout, response-size, JSON-schema and official-package checks; no arbitrary catalogue URL or stale bundled fallback is accepted. Add `--install` only when the dependencies should also be installed locally. Unknown, unpublished, duplicated, stale or modified package selections fail closed.
 
 `self-host update --check` reads the current project and the reviewed catalogue from `api.helyx.gg`, then reports the complete compatible release-set change without writing files. `--confirm` backs up the managed metadata under `.helyx/backups`, updates exact core, CLI and selected live-module versions together, refreshes and validates the lockfile with lifecycle scripts disabled, and restores the original metadata if generation fails. Run `npm ci` and `npm run doctor` after applying an update. The updater never changes `.env` or customer database data.
 

package/dist/self-host/command.d.ts

@@ -1,11 +1,16 @@
-import { type GeneratedSelfHostProject } from "./project-generator.js";
+import type { SelfHostCatalogue } from "./catalogue.js";
+import { generateSelfHostProject, type GeneratedSelfHostProject } from "./project-generator.js";
 import { type SelfHostUpdatePlan } from "./update.js";
 export interface SelfHostInitArguments {
     manifestPath: string;
     outputPath: string;
     install: boolean;
 }
-export declare function runSelfHostCommand(arguments_: readonly string[]): Promise<GeneratedSelfHostProject | SelfHostUpdatePlan>;
+export interface SelfHostCommandDependencies {
+    catalogueLoader?: () => Promise<SelfHostCatalogue>;
+    projectGenerator?: typeof generateSelfHostProject;
+}
+export declare function runSelfHostCommand(arguments_: readonly string[], dependencies?: SelfHostCommandDependencies): Promise<GeneratedSelfHostProject | SelfHostUpdatePlan>;
 export interface SelfHostUpdateArguments {
     projectPath: string;
     check: boolean;

package/dist/self-host/command.js

@@ -1,16 +1,18 @@
 import { readFile, stat } from "node:fs/promises";
 import { resolve } from "node:path";
-import { loadBundledSelfHostCatalogue } from "./catalogue.js";
 import { generateSelfHostProject, } from "./project-generator.js";
-import { updateSelfHostProject } from "./update.js";
+import { loadCurrentSelfHostCatalogue, updateSelfHostProject, } from "./update.js";
 const maximumManifestBytes = 16 * 1_024;
-export async function runSelfHostCommand(arguments_) {
+export async function runSelfHostCommand(arguments_, dependencies = {}) {
     const [subcommand, ...rest] = arguments_;
     if (subcommand === "update") {
         const parsed = parseSelfHostUpdateArguments(rest);
         const plan = await updateSelfHostProject({
             projectDirectory: parsed.projectPath,
             apply: parsed.confirm,
+            ...(dependencies.catalogueLoader
+                ? { catalogueLoader: dependencies.catalogueLoader }
+                : {}),
         });
         printUpdatePlan(plan);
         return plan;
@@ -33,8 +35,8 @@ export async function runSelfHostCommand(arguments_) {
             cause: error,
         });
     }
-    const catalogue = await loadBundledSelfHostCatalogue();
-    const generated = await generateSelfHostProject({
+    const catalogue = await (dependencies.catalogueLoader ?? loadCurrentSelfHostCatalogue)();
+    const generated = await (dependencies.projectGenerator ?? generateSelfHostProject)({
         catalogue,
         manifest,
         targetDirectory: parsed.outputPath,

package/dist/self-host/update.js

@@ -6,6 +6,8 @@ import { parse, resolve } from "node:path";
 import { z } from "zod";
 import { parseSelfHostCatalogue } from "./catalogue.js";
 export const DEFAULT_SELF_HOST_CATALOGUE_URL = "https://api.helyx.gg/self-host/catalogue";
+const maximumCatalogueBytes = 512 * 1_024;
+const catalogueTimeoutMilliseconds = 15_000;
 const packageName = z.string().regex(/^@helyx\/[a-z0-9][a-z0-9-]*$/u);
 const modulePackage = z.string().regex(/^@helyx\/module-[a-z0-9][a-z0-9-]*$/u);
 const exactVersion = z
@@ -100,34 +102,74 @@ export async function loadCurrentSelfHostCatalogue(fetcher = fetch) {
     try {
         response = await fetcher(DEFAULT_SELF_HOST_CATALOGUE_URL, {
             headers: { Accept: "application/json" },
-            signal: AbortSignal.timeout(15_000),
+            redirect: "error",
+            signal: AbortSignal.timeout(catalogueTimeoutMilliseconds),
         });
     }
     catch (error) {
-        throw new Error("The reviewed Helyx update catalogue is unavailable", {
+        throw new Error("The reviewed Helyx self-host catalogue is unavailable", {
             cause: error,
         });
     }
     if (!response.ok) {
-        throw new Error(`The reviewed Helyx update catalogue returned HTTP ${response.status}`);
+        throw new Error(`The reviewed Helyx self-host catalogue returned HTTP ${response.status}`);
     }
-    const declaredLength = Number(response.headers.get("content-length") ?? "0");
-    if (declaredLength > 512 * 1_024) {
-        throw new Error("The reviewed Helyx update catalogue was too large");
+    const contentType = response.headers.get("content-type")?.toLowerCase();
+    if (!contentType?.startsWith("application/json")) {
+        throw new Error("The reviewed Helyx self-host catalogue did not return JSON");
     }
-    const text = await response.text();
-    if (Buffer.byteLength(text, "utf8") > 512 * 1_024) {
-        throw new Error("The reviewed Helyx update catalogue was too large");
+    const declaredLengthHeader = response.headers.get("content-length");
+    if (declaredLengthHeader !== null) {
+        const declaredLength = Number(declaredLengthHeader);
+        if (!Number.isSafeInteger(declaredLength) ||
+            declaredLength < 0 ||
+            declaredLength > maximumCatalogueBytes) {
+            throw new Error("The reviewed Helyx self-host catalogue had an invalid size");
+        }
     }
+    const text = await readBoundedCatalogueBody(response);
     try {
         return parseSelfHostCatalogue(JSON.parse(text));
     }
     catch (error) {
-        throw new Error("The reviewed Helyx update catalogue was invalid", {
+        throw new Error("The reviewed Helyx self-host catalogue was invalid", {
             cause: error,
         });
     }
 }
+async function readBoundedCatalogueBody(response) {
+    if (!response.body) {
+        throw new Error("The reviewed Helyx self-host catalogue was empty");
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let totalBytes = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            totalBytes += value.byteLength;
+            if (totalBytes > maximumCatalogueBytes) {
+                throw new Error("The reviewed Helyx self-host catalogue was too large");
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    if (totalBytes === 0) {
+        throw new Error("The reviewed Helyx self-host catalogue was empty");
+    }
+    const bytes = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}
 function targetHelyxDependencies(catalogue, selection) {
     if (catalogue.core.availability !== "published" ||
         catalogue.generator.availability !== "published") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helyx/cli",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Command-line tools for running and generating self-hosted Helyx deployments.",
   "keywords": [
     "helyx",

package/self-host-catalogue.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "catalogueVersion": 11,
+  "catalogueVersion": 12,
   "core": {
     "package": "@helyx/bot",
     "version": "0.2.2",
@@ -8,7 +8,7 @@
   },
   "generator": {
     "package": "@helyx/cli",
-    "version": "0.3.0",
+    "version": "0.3.1",
     "command": "helyx",
     "availability": "published"
   },