@hiyve/cli 1.0.20 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hiyve/cli",
-  "version": "1.0.20",
+  "version": "1.1.0",
   "description": "Hiyve SDK CLI - Configure npm for private @hiyve packages",
   "type": "module",
   "bin": {

package/src/commands/init.js

@@ -8,6 +8,8 @@ import { writeFileSync, mkdirSync, existsSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import chalk from 'chalk';
 import ora from 'ora';
+import { fetchLatestVersions } from '../utils/registryApi.js';
+import { getCurrentConfig } from '../utils/npmrc.js';
 import prompts from 'prompts';
 
 const TEMPLATES = {
@@ -135,6 +137,20 @@ export async function init(projectName, options) {
     process.exit(1);
   }
 
+  const resolving = ora('Resolving @hiyve package versions...').start();
+  const hiyveVersions = await fetchLatestVersions(
+    template.packages,
+    getCurrentConfig()?.apiKey,
+  );
+  const unresolved = template.packages.filter((p) => !hiyveVersions[p]);
+  if (unresolved.length === 0) {
+    resolving.succeed(`Pinned ${template.packages.length} @hiyve packages`);
+  } else {
+    resolving.warn(
+      `${unresolved.length} package(s) left on "latest" — run ${chalk.cyan('hiyve login')} first to pin exact versions`,
+    );
+  }
+
   const spinner = ora(`Creating ${chalk.cyan(projectName)} with ${template.name} template...`).start();
 
   try {
@@ -144,7 +160,7 @@ export async function init(projectName, options) {
     mkdirSync(join(projectDir, 'server'), { recursive: true });
 
     // Generate files
-    writeFile(projectDir, 'package.json', generatePackageJson(projectName, template));
+    writeFile(projectDir, 'package.json', generatePackageJson(projectName, template, hiyveVersions));
     writeFile(projectDir, 'tsconfig.json', generateTsConfig());
     writeFile(projectDir, 'vite.config.ts', generateViteConfig());
     writeFile(projectDir, '.env.example', generateEnvExample(template));
@@ -190,10 +206,19 @@ function usesPrebuiltRoom(template) {
   return template.features.intelligence && template.features.collaboration;
 }
 
-export function generatePackageJson(name, template) {
+/**
+ * @param {string} name Project name.
+ * @param {{packages: string[]}} template
+ * @param {Record<string, string>} [hiyveVersions] name → version resolved from
+ *   the registry. Anything missing falls back to `latest`.
+ */
+export function generatePackageJson(name, template, hiyveVersions = {}) {
   const deps = {};
   for (const pkg of template.packages) {
-    deps[pkg] = 'latest';
+    // Caret, not `latest`: it locks the major, which is what keeps the set
+    // mutually consistent, while still picking up patches.
+    const version = hiyveVersions[pkg];
+    deps[pkg] = version ? `^${version}` : 'latest';
   }
   for (const k of ['react', 'react-dom', '@mui/material', '@mui/icons-material', '@emotion/react', '@emotion/styled', 'express', 'cors', 'dotenv']) {
     deps[k] = PINS[k];
@@ -341,32 +366,46 @@ async function fetchRoomToken(): Promise<string> {
   return data.roomToken;
 }
 
-/** Fetch a cloud token for AI features from the same server. */
-async function fetchCloudToken(): Promise<string> {
-  const res = await fetch('/api/generate-cloud-token', { method: 'POST' });
+/**
+ * Fetch a cloud token for AI features from the same server.
+ *
+ * HiyveRoom calls this with the current \`userId\`, which MUST be the email
+ * address of a user that exists in your organization's identity system: the
+ * cloud-token endpoint looks the user up and answers 404 for anyone it does
+ * not know. Sign users in with @hiyve/react-identity, or add them at
+ * console.hiyve.dev, before turning AI features on.
+ */
+async function fetchCloudToken({ userId }: { userId: string }) {
+  const res = await fetch('/api/generate-cloud-token', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ userId }),
+  });
   const data = await res.json().catch(() => ({}));
   if (!res.ok) throw new Error(data.message || 'Failed to generate cloud token');
-  return data.cloudToken;
+  return { cloudToken: data.cloudToken as string, environment: data.environment as string };
 }
 
 export default function App() {
   const [roomToken, setRoomToken] = useState<string | null>(null);
-  const [displayName, setDisplayName] = useState('');
+  // The lobby collects an email because the cloud-token endpoint identifies
+  // users by email. Without AI features any display name would do.
+  const [userId, setUserId] = useState('');
 
-  const handleJoin = useCallback(async (name: string) => {
-    setDisplayName(name);
+  const handleJoin = useCallback(async (email: string) => {
+    setUserId(email);
     setRoomToken(await fetchRoomToken());
   }, []);
 
   const handleLeave = useCallback(() => setRoomToken(null), []);
 
   if (!roomToken) {
-    return <PrebuiltLobby onJoin={handleJoin} />;
+    return <PrebuiltLobby onJoin={handleJoin} labels={{ namePlaceholder: 'you@example.com' }} />;
   }
 
   return (
-    <HiyveRoom roomToken={roomToken} region={REGION} generateToken={fetchCloudToken} userId={displayName} intelligence>
-      <PrebuiltRoom userId={displayName} onLeave={handleLeave} />
+    <HiyveRoom roomToken={roomToken} region={REGION} generateToken={fetchCloudToken} userId={userId} intelligence>
+      <PrebuiltRoom userId={userId} onLeave={handleLeave} />
     </HiyveRoom>
   );
 }

package/src/commands/init.test.js

@@ -145,7 +145,9 @@ describe('generated client', () => {
     expect(app).toContain("fetch('/api/generate-room-token'");
     expect(app).toContain('return data.roomToken');
     expect(app).toContain("fetch('/api/generate-cloud-token'");
-    expect(app).toContain('return data.cloudToken');
+    // The cloud route returns { cloudToken, environment }; the template reads
+    // both so CloudProvider can detect the environment that issued the token.
+    expect(app).toContain('data.cloudToken');
     expect(app).not.toContain('/api/token');
   });
 
@@ -155,3 +157,64 @@ describe('generated client', () => {
     expect(ts.compilerOptions.types).toEqual(expect.arrayContaining(['vite/client', 'node']));
   });
 });
+
+
+describe('@hiyve dependency pinning', () => {
+  it('pins the resolved version with a caret, never "latest"', () => {
+    const pkg = JSON.parse(
+      generatePackageJson('demo', TEMPLATES.full, {
+        '@hiyve/react-room': '40.0.0',
+        '@hiyve/react-intelligence': '24.0.0',
+        '@hiyve/react-semantic-relay': '19.0.0',
+        '@hiyve/admin': '2.3.1',
+      }),
+    );
+
+    expect(pkg.dependencies['@hiyve/react-room']).toBe('^40.0.0');
+    expect(pkg.dependencies['@hiyve/admin']).toBe('^2.3.1');
+    expect(Object.values(pkg.dependencies)).not.toContain('latest');
+  });
+
+  it('falls back to "latest" only for what the registry did not resolve', () => {
+    const pkg = JSON.parse(
+      generatePackageJson('demo', TEMPLATES.full, { '@hiyve/react-room': '40.0.0' }),
+    );
+
+    expect(pkg.dependencies['@hiyve/react-room']).toBe('^40.0.0');
+    expect(pkg.dependencies['@hiyve/admin']).toBe('latest');
+  });
+
+  it('still scaffolds with no resolved versions at all (offline)', () => {
+    const pkg = JSON.parse(generatePackageJson('demo', TEMPLATES.full));
+    for (const name of TEMPLATES.full.packages) {
+      expect(pkg.dependencies[name]).toBe('latest');
+    }
+  });
+});
+
+describe('full template cloud token', () => {
+  const app = generateApp(TEMPLATES.full);
+
+  it('sends userId in the request body — the endpoint 400s without it', () => {
+    expect(app).toContain("body: JSON.stringify({ userId })");
+    expect(app).toContain("'Content-Type': 'application/json'");
+    // The shipped bug: a bare POST with no body at all.
+    expect(app).not.toMatch(/generate-cloud-token',\s*\{\s*method:\s*'POST'\s*\}/);
+  });
+
+  it('takes userId as a parameter, because HiyveRoom supplies it', () => {
+    expect(app).toContain('async function fetchCloudToken({ userId }: { userId: string })');
+  });
+
+  it('passes an email as userId, not the lobby display name', () => {
+    // The cloud-token endpoint resolves users by email; a display name 404s.
+    expect(app).toContain('userId={userId}');
+    expect(app).not.toContain('userId={displayName}');
+    expect(app).toContain("namePlaceholder: 'you@example.com'");
+  });
+
+  it('returns the environment so the client can detect which cloud issued it', () => {
+    expect(app).toContain('cloudToken: data.cloudToken');
+    expect(app).toContain('environment: data.environment');
+  });
+});

package/src/utils/registryApi.js

@@ -16,7 +16,12 @@
  *   GET /-/whoami                  200 `{username}` for a valid key — but
  *                                  ALSO 200 `{}` for a bad key or none, so
  *                                  it cannot be the validity check.
- *   GET /-/v1/search?text=@hiyve   200, the live catalogue; unauthenticated.
+ *   GET /-/v1/search?text=@hiyve   200 either way, but the catalogue is only
+ *                                  populated WITH a key: unauthenticated it
+ *                                  answers 200 `{objects:[],total:0}`, not a
+ *                                  401. Re-verified 2026-09-04. Treat an empty
+ *                                  result as "not authenticated", never as
+ *                                  "the registry is empty".
  */
 
 import { getApiUrl } from '../config.js';
@@ -142,4 +147,43 @@ export async function fetchPackageCatalogue(apiKey) {
   return { ok: true, ...catalogueFromSearch(searchResult) };
 }
 
-export default { maskApiKey, verifyApiKey, catalogueFromSearch, fetchPackageCatalogue };
+/**
+ * Resolve the current version of each named @hiyve package.
+ *
+ * `init` pins what it scaffolds with. Left on `latest`, a generated project
+ * resolves a different set of @hiyve packages every day, and because `latest`
+ * resolves each one independently their peer ranges can land mutually
+ * unsatisfiable — this registry ships several majors a week. A developer who
+ * scaffolds today and reads the docs next week is then running code the docs
+ * do not describe.
+ *
+ * @param {string[]} names Package names to resolve.
+ * @param {string} [apiKey] Optional; the catalogue endpoint is unauthenticated.
+ * @returns {Promise<Record<string, string>>} name → version. Empty when the
+ *   registry cannot be reached, so callers can fall back to `latest` rather
+ *   than fail the scaffold offline.
+ */
+export async function fetchLatestVersions(names, apiKey) {
+  try {
+    const catalogue = await fetchPackageCatalogue(apiKey);
+    if (!catalogue.ok) return {};
+
+    const wanted = new Set(names);
+    const versions = {};
+    for (const { name, version } of [...catalogue.sdk, ...catalogue.components]) {
+      if (wanted.has(name) && version) versions[name] = version;
+    }
+    return versions;
+  } catch {
+    // Offline, DNS failure, timeout — scaffolding must still work.
+    return {};
+  }
+}
+
+export default {
+  maskApiKey,
+  verifyApiKey,
+  catalogueFromSearch,
+  fetchPackageCatalogue,
+  fetchLatestVersions,
+};

package/src/utils/registryApi.test.js

@@ -14,6 +14,7 @@ import {
   verifyApiKey,
   catalogueFromSearch,
   fetchPackageCatalogue,
+  fetchLatestVersions,
 } from './registryApi.js';
 
 const REGISTRY = 'https://registry.muziemedia.com/';
@@ -167,3 +168,53 @@ describe('fetchPackageCatalogue', () => {
     expect(result).toEqual({ ok: false, status: 500, error: 'Registry returned HTTP 500' });
   });
 });
+
+
+describe('fetchLatestVersions', () => {
+  const searchBody = (pkgs) => ({
+    objects: pkgs.map(([name, version]) => ({ package: { name, version } })),
+  });
+
+  it('resolves only the packages asked for', async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse(200, searchBody([
+        ['@hiyve/react', '18.0.2'],
+        ['@hiyve/react-room', '40.0.0'],
+        ['@hiyve/react-clips', '34.0.0'],
+      ])),
+    );
+
+    const versions = await fetchLatestVersions(['@hiyve/react', '@hiyve/react-room'], KEY);
+
+    expect(versions).toEqual({ '@hiyve/react': '18.0.2', '@hiyve/react-room': '40.0.0' });
+    expect(versions['@hiyve/react-clips']).toBeUndefined();
+  });
+
+  it('sends the key — an unauthenticated search answers 200 with an EMPTY catalogue', async () => {
+    fetchMock.mockResolvedValue(jsonResponse(200, searchBody([])));
+
+    const versions = await fetchLatestVersions(['@hiyve/react'], KEY);
+
+    expect(fetchMock.mock.calls[0][1].headers.Authorization).toBe(`Bearer ${KEY}`);
+    // Empty means "not authenticated", and the caller must fall back to
+    // `latest` rather than pin nothing at all.
+    expect(versions).toEqual({});
+  });
+
+  it('falls back to an empty map when the registry errors', async () => {
+    fetchMock.mockResolvedValue(jsonResponse(500, {}));
+    await expect(fetchLatestVersions(['@hiyve/react'], KEY)).resolves.toEqual({});
+  });
+
+  it('falls back to an empty map offline instead of throwing', async () => {
+    fetchMock.mockRejectedValue(new Error('getaddrinfo ENOTFOUND'));
+    await expect(fetchLatestVersions(['@hiyve/react'], KEY)).resolves.toEqual({});
+  });
+
+  it('skips a package the registry lists without a version', async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse(200, { objects: [{ package: { name: '@hiyve/react' } }] }),
+    );
+    await expect(fetchLatestVersions(['@hiyve/react'], KEY)).resolves.toEqual({});
+  });
+});