@hiyve/cli 1.0.13 → 1.0.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hiyve/cli",
-  "version": "1.0.13",
+  "version": "1.0.14",
   "description": "Hiyve SDK CLI - Configure npm for private @hiyve packages",
   "type": "module",
   "bin": {

package/src/commands/list.js

@@ -6,8 +6,9 @@
 
 import chalk from 'chalk';
 import ora from 'ora';
-import { getApiUrl, isDevMode } from '../config.js';
+import { getApiUrl } from '../config.js';
 import { getCurrentConfig } from '../utils/npmrc.js';
+import { printDevHint, printDevModeBanner, fetchWithTimeout } from '../utils/output.js';
 
 /**
  * List available packages
@@ -16,9 +17,7 @@ export async function list() {
   console.log('');
   console.log(chalk.cyan('Available @hiyve Packages'));
   console.log(chalk.gray('─'.repeat(40)));
-  if (isDevMode()) {
-    console.log(chalk.yellow('  Mode: development (--dev)'));
-  }
+  printDevModeBanner();
   console.log('');
 
   // Get current config for auth token
@@ -33,7 +32,7 @@ export async function list() {
   const spinner = ora('Fetching packages...').start();
 
   try {
-    const response = await fetch(`${getApiUrl()}packages`, {
+    const response = await fetchWithTimeout(`${getApiUrl()}packages`, {
       headers: {
         Authorization: `Bearer ${config.apiKey}`,
       },
@@ -44,14 +43,7 @@ export async function list() {
       const error = await response.json().catch(() => ({ error: 'Unknown error' }));
       console.log('');
       console.log(chalk.red(`  ${error.error || 'Failed to fetch packages'}`));
-      if (isDevMode()) {
-        console.log(chalk.gray('  You are using --dev mode (development registry).'));
-        console.log(chalk.gray('  If you meant to use production, run without --dev:'));
-        console.log(chalk.cyan('    npx @hiyve/cli list'));
-      } else {
-        console.log(chalk.gray('  If you meant to use the development registry, use --dev:'));
-        console.log(chalk.cyan('    npx @hiyve/cli --dev list'));
-      }
+      printDevHint('list');
       process.exit(1);
     }
 
@@ -82,18 +74,17 @@ export async function list() {
     console.log(chalk.gray('  npm install <package-name>'));
     console.log('');
   } catch (err) {
-    spinner.fail('Connection failed');
-    console.log('');
-    console.log(chalk.red(`  ${err.message}`));
-    console.log(chalk.gray('  Please check your internet connection.'));
-    if (isDevMode()) {
-      console.log(chalk.gray('  You are using --dev mode (development registry).'));
-      console.log(chalk.gray('  If you meant to use production, run without --dev:'));
-      console.log(chalk.cyan('    npx @hiyve/cli list'));
+    if (err.name === 'AbortError') {
+      spinner.fail('Request timed out');
+      console.log('');
+      console.log(chalk.gray('  The server did not respond within 15 seconds.'));
     } else {
-      console.log(chalk.gray('  If you meant to use the development registry, use --dev:'));
-      console.log(chalk.cyan('    npx @hiyve/cli --dev list'));
+      spinner.fail('Connection failed');
+      console.log('');
+      console.log(chalk.red(`  ${err.message}`));
     }
+    console.log(chalk.gray('  Please check your internet connection.'));
+    printDevHint('list');
     process.exit(1);
   }
 }

package/src/commands/login.js

@@ -8,7 +8,8 @@ import prompts from 'prompts';
 import chalk from 'chalk';
 import ora from 'ora';
 import { configureNpmrc } from '../utils/npmrc.js';
-import { getApiUrl, getRegistryUrl, isDevMode } from '../config.js';
+import { getApiUrl, getRegistryUrl } from '../config.js';
+import { printDevHint, printDevModeBanner, fetchWithTimeout } from '../utils/output.js';
 
 /**
  * Login to Hiyve and configure npm
@@ -21,9 +22,7 @@ export async function login(options) {
   console.log('');
   console.log(chalk.cyan('Hiyve SDK Authentication'));
   console.log(chalk.gray('─'.repeat(40)));
-  if (isDevMode()) {
-    console.log(chalk.yellow('  Mode: development (--dev)'));
-  }
+  printDevModeBanner();
   console.log('');
 
   // Prompt for API key if not provided
@@ -78,7 +77,7 @@ export async function login(options) {
   const spinner = ora('Verifying API key...').start();
 
   try {
-    const response = await fetch(`${getApiUrl()}verify`, {
+    const response = await fetchWithTimeout(`${getApiUrl()}verify`, {
       headers: {
         Authorization: `Bearer ${apiKey}`,
       },
@@ -89,36 +88,32 @@ export async function login(options) {
       spinner.fail('API key verification failed');
       console.log('');
       console.log(chalk.red(`  ${error.error || 'Invalid API key'}`));
-      if (isDevMode()) {
-        console.log(chalk.gray('  You are using --dev mode (development registry).'));
-        console.log(chalk.gray('  If you meant to use production, run without --dev:'));
-        console.log(chalk.cyan('    npx @hiyve/cli login'));
-      } else {
-        console.log(chalk.gray('  If you are using a test key (pk_test_*), use --dev mode:'));
-        console.log(chalk.cyan('    npx @hiyve/cli --dev login'));
-      }
+      printDevHint('login');
       process.exit(1);
     }
 
     const data = await response.json();
     spinner.succeed('API key verified');
 
+    // Server returns a masked key — always mask client-side as a safety net
     if (data.apiKey) {
-      console.log(chalk.gray(`  Account: ${data.apiKey}`));
+      const display = data.apiKey.length > 12
+        ? `${data.apiKey.slice(0, 8)}...${data.apiKey.slice(-4)}`
+        : data.apiKey;
+      console.log(chalk.gray(`  Account: ${display}`));
     }
   } catch (err) {
-    spinner.fail('Connection failed');
-    console.log('');
-    console.log(chalk.red(`  ${err.message}`));
-    console.log(chalk.gray('  Please check your internet connection.'));
-    if (isDevMode()) {
-      console.log(chalk.gray('  You are using --dev mode (development registry).'));
-      console.log(chalk.gray('  If you meant to use production, run without --dev:'));
-      console.log(chalk.cyan('    npx @hiyve/cli login'));
+    if (err.name === 'AbortError') {
+      spinner.fail('Request timed out');
+      console.log('');
+      console.log(chalk.gray('  The server did not respond within 15 seconds.'));
     } else {
-      console.log(chalk.gray('  If you meant to use the development registry, use --dev:'));
-      console.log(chalk.cyan('    npx @hiyve/cli --dev login'));
+      spinner.fail('Connection failed');
+      console.log('');
+      console.log(chalk.red(`  ${err.message}`));
     }
+    console.log(chalk.gray('  Please check your internet connection.'));
+    printDevHint('login');
     process.exit(1);
   }
 
@@ -142,7 +137,7 @@ export async function login(options) {
 
   // Fetch available packages from registry
   try {
-    const packagesResponse = await fetch(`${getApiUrl()}packages`, {
+    const packagesResponse = await fetchWithTimeout(`${getApiUrl()}packages`, {
       headers: { Authorization: `Bearer ${apiKey}` },
     });
 

package/src/config.js

@@ -28,10 +28,10 @@ export function getApiUrl() {
 
 /**
  * Get the registry URL for ~/.npmrc (where npm fetches tarballs).
- * Must match the API URL since tarballs are served through the API.
+ * Matches the API URL — tarballs are served through the same API.
  */
 export function getRegistryUrl() {
-  return _devMode ? DEV_API_URL : PROD_API_URL;
+  return getApiUrl();
 }
 
 /**

package/src/utils/npmrc.js

@@ -10,6 +10,28 @@ import path from 'path';
 
 const NPMRC_PATH = path.join(os.homedir(), '.npmrc');
 
+// Known Hiyve registry hosts (current and historical)
+const HIYVE_HOSTS = ['//console.hiyve.dev/', '//api.hiyve.dev/', '//api.muziemedia.com/'];
+
+/**
+ * Check if a line in .npmrc is a Hiyve-related config line.
+ * Only matches lines that reference a known Hiyve host or @hiyve scope.
+ * Will NOT match third-party tokens that happen to start with sk_/pk_ (e.g. Stripe).
+ */
+function isHiyveConfigLine(line) {
+  const trimmed = line.trim();
+  if (trimmed.startsWith('@hiyve:registry')) return true;
+  if (HIYVE_HOSTS.some((host) => trimmed.includes(host))) return true;
+  return false;
+}
+
+/**
+ * Filter out all Hiyve-related lines from .npmrc content.
+ */
+function filterOutHiyveLines(content) {
+  return content.split('\n').filter((line) => !isHiyveConfigLine(line));
+}
+
 /**
  * Configure ~/.npmrc for Hiyve registry
  * @param {string} registryUrl - The registry URL (e.g., https://api.hiyve.dev/registry/)
@@ -23,19 +45,8 @@ export async function configureNpmrc(registryUrl, apiKey) {
     content = fs.readFileSync(NPMRC_PATH, 'utf8');
   }
 
-  // Remove any existing @hiyve config lines (both old and new registry URLs)
-  const lines = content.split('\n').filter((line) => {
-    const trimmed = line.trim();
-    return (
-      !trimmed.startsWith('@hiyve:registry') &&
-      !trimmed.includes('//console.hiyve.dev/') &&
-      !trimmed.includes('//api.hiyve.dev/') &&
-      !trimmed.includes('//api.muziemedia.com/') &&
-      !trimmed.includes(':_authToken=mk_') &&
-      !trimmed.includes(':_authToken=sk_') &&
-      !trimmed.includes(':_authToken=pk_')
-    );
-  });
+  // Remove any existing Hiyve config lines (scoped to known Hiyve hosts)
+  const lines = filterOutHiyveLines(content);
 
   // Parse the registry URL to derive the auth token path
   const url = new URL(registryUrl);
@@ -47,7 +58,7 @@ export async function configureNpmrc(registryUrl, apiKey) {
 
   // Write back, removing empty lines at start/end
   const finalContent = lines.filter((line) => line.trim()).join('\n') + '\n';
-  fs.writeFileSync(NPMRC_PATH, finalContent, 'utf8');
+  fs.writeFileSync(NPMRC_PATH, finalContent, { encoding: 'utf8', mode: 0o600 });
 }
 
 /**
@@ -60,23 +71,12 @@ export async function removeNpmrc() {
 
   const content = fs.readFileSync(NPMRC_PATH, 'utf8');
 
-  // Remove @hiyve config lines (both old and new registry URLs)
-  const lines = content.split('\n').filter((line) => {
-    const trimmed = line.trim();
-    return (
-      !trimmed.startsWith('@hiyve:registry') &&
-      !trimmed.includes('//console.hiyve.dev/') &&
-      !trimmed.includes('//api.hiyve.dev/') &&
-      !trimmed.includes('//api.muziemedia.com/') &&
-      !trimmed.includes(':_authToken=mk_') &&
-      !trimmed.includes(':_authToken=sk_') &&
-      !trimmed.includes(':_authToken=pk_')
-    );
-  });
+  // Remove Hiyve config lines (scoped to known Hiyve hosts)
+  const lines = filterOutHiyveLines(content);
 
   // Write back
   const finalContent = lines.filter((line) => line.trim()).join('\n');
-  fs.writeFileSync(NPMRC_PATH, finalContent ? finalContent + '\n' : '', 'utf8');
+  fs.writeFileSync(NPMRC_PATH, finalContent ? finalContent + '\n' : '', { encoding: 'utf8', mode: 0o600 });
 }
 
 /**
@@ -94,10 +94,11 @@ export function getCurrentConfig() {
   // Find registry line
   const registryLine = lines.find((line) => line.trim().startsWith('@hiyve:registry'));
 
-  // Find token line (pk_*, sk_*, or legacy mk_*)
+  // Find token line on a known Hiyve host
   const tokenLine = lines.find((line) => {
     const trimmed = line.trim();
-    return trimmed.includes(':_authToken=pk_') || trimmed.includes(':_authToken=sk_') || trimmed.includes(':_authToken=mk_');
+    return HIYVE_HOSTS.some((host) => trimmed.includes(host)) &&
+      (trimmed.includes(':_authToken=pk_') || trimmed.includes(':_authToken=sk_') || trimmed.includes(':_authToken=mk_'));
   });
 
   if (!registryLine || !tokenLine) {
@@ -114,7 +115,7 @@ export function getCurrentConfig() {
   return {
     apiKey,
     maskedApiKey,
-    registryUrl: registryLine.split('=')[1]?.trim(),
+    registryUrl: registryLine.substring(registryLine.indexOf('=') + 1).trim(),
   };
 }
 

package/src/utils/npmrc.test.js

@@ -139,6 +139,39 @@ describe('configureNpmrc', () => {
     expect(content).toContain('api.hiyve.dev');
   });
 
+  it('does not delete third-party sk_ tokens (e.g. Stripe)', async () => {
+    const existingContent = [
+      '@hiyve:registry=https://api.hiyve.dev/registry/',
+      '//api.hiyve.dev/registry/:_authToken=pk_live_hiyvekey123',
+      '//npm.stripe.com/:_authToken=sk_live_stripekey456',
+      'other-config=value',
+    ].join('\n');
+
+    fs.existsSync.mockReturnValue(true);
+    fs.readFileSync.mockReturnValue(existingContent);
+    fs.writeFileSync.mockImplementation(() => {});
+
+    await configureNpmrc('https://api.hiyve.dev/registry/', 'pk_live_newkey789');
+
+    const [, content] = fs.writeFileSync.mock.calls[0];
+    // Hiyve lines replaced
+    expect(content).not.toContain('pk_live_hiyvekey123');
+    expect(content).toContain(':_authToken=pk_live_newkey789');
+    // Stripe token preserved
+    expect(content).toContain('//npm.stripe.com/:_authToken=sk_live_stripekey456');
+  });
+
+  it('writes correct auth path for dev registry URL', async () => {
+    fs.existsSync.mockReturnValue(false);
+    fs.writeFileSync.mockImplementation(() => {});
+
+    await configureNpmrc('https://api.muziemedia.com/registry/', 'pk_test_abc123def456');
+
+    const [, content] = fs.writeFileSync.mock.calls[0];
+    expect(content).toContain('@hiyve:registry=https://api.muziemedia.com/registry/');
+    expect(content).toContain('//api.muziemedia.com/registry/:_authToken=pk_test_abc123def456');
+  });
+
   it('preserves non-hiyve lines', async () => {
     const existingContent = [
       'registry=https://registry.npmjs.org/',
@@ -163,8 +196,8 @@ describe('configureNpmrc', () => {
 
     await configureNpmrc('https://api.hiyve.dev/registry/', 'sk_live_1a2b3c4d5e6f');
 
-    const [, content, encoding] = fs.writeFileSync.mock.calls[0];
-    expect(encoding).toBe('utf8');
+    const [, content, options] = fs.writeFileSync.mock.calls[0];
+    expect(options).toEqual({ encoding: 'utf8', mode: 0o600 });
 
     const lines = content.split('\n').filter((l) => l.trim());
     const registryLine = lines.find((l) => l.startsWith('@hiyve:registry='));
@@ -281,6 +314,27 @@ describe('removeNpmrc', () => {
     expect(content).not.toContain('mk_abc123');
   });
 
+  it('does not delete third-party sk_ tokens (e.g. Stripe)', async () => {
+    const existingContent = [
+      'registry=https://registry.npmjs.org/',
+      '@hiyve:registry=https://api.hiyve.dev/registry/',
+      '//api.hiyve.dev/registry/:_authToken=pk_live_hiyvekey123',
+      '//npm.stripe.com/:_authToken=sk_live_stripekey456',
+    ].join('\n');
+
+    fs.existsSync.mockReturnValue(true);
+    fs.readFileSync.mockReturnValue(existingContent);
+    fs.writeFileSync.mockImplementation(() => {});
+
+    await removeNpmrc();
+
+    const [, content] = fs.writeFileSync.mock.calls[0];
+    expect(content).not.toContain('@hiyve:registry');
+    expect(content).not.toContain('pk_live_hiyvekey123');
+    // Third-party token preserved
+    expect(content).toContain('//npm.stripe.com/:_authToken=sk_live_stripekey456');
+  });
+
   it('preserves non-hiyve lines', async () => {
     const existingContent = [
       'registry=https://registry.npmjs.org/',

package/src/utils/output.js

@@ -0,0 +1,50 @@
+/**
+ * Shared CLI output helpers
+ */
+
+import chalk from 'chalk';
+import { isDevMode } from '../config.js';
+
+const FETCH_TIMEOUT_MS = 15_000;
+
+/**
+ * Print a --dev mode hint when a CLI command fails.
+ * Suggests the opposite mode to help the user try the right registry.
+ * @param {string} command - The CLI command name (e.g., 'login', 'list')
+ */
+export function printDevHint(command) {
+  if (isDevMode()) {
+    console.log(chalk.gray('  You are using --dev mode (development registry).'));
+    console.log(chalk.gray('  If you meant to use production, run without --dev:'));
+    console.log(chalk.cyan(`    npx @hiyve/cli ${command}`));
+  } else {
+    console.log(chalk.gray('  If you meant to use the development registry, use --dev:'));
+    console.log(chalk.cyan(`    npx @hiyve/cli --dev ${command}`));
+  }
+}
+
+/**
+ * Print the dev mode banner if --dev is active.
+ */
+export function printDevModeBanner() {
+  if (isDevMode()) {
+    console.log(chalk.yellow('  Mode: development (--dev)'));
+  }
+}
+
+/**
+ * Create a fetch call with a timeout via AbortController.
+ * @param {string} url
+ * @param {RequestInit} [options]
+ * @returns {Promise<Response>}
+ */
+export async function fetchWithTimeout(url, options = {}) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+
+  try {
+    return await fetch(url, { ...options, signal: controller.signal });
+  } finally {
+    clearTimeout(timeout);
+  }
+}