@hubtoolify/icons 1.0.0 → 1.0.1

package/README.md

@@ -1,7 +1,5 @@
 # @hubtoolify/icons
 
-> Proposed package name. npm ownership of the `@hubtoolify` scope has not been verified yet.
-
 Original HubToolify icons as CSS classes, in three styles. For plain HTML sites and any project
 that serves static files. (React or a bundler? Use `@hubtoolify/icons-react` or
 `@hubtoolify/icons-svg`; see "Bundlers" below.)
@@ -45,6 +43,20 @@ makes the bundler try to process all of them (Vite fails with `EMFILE: too many
 package has **no importable entry** on purpose. Put the folder in your static/public directory as
 above, or use `@hubtoolify/icons-react` / `@hubtoolify/icons-svg`, which import one icon at a time.
 
+## HubToolify Pro (private registry)
+
+The Pro icon styles are installed from HubToolify's own registry, not from npmjs.com, and need an active Pro plan.
+Sign in once per machine with this package's login command (Windows PowerShell, macOS and Linux, Node 18+):
+
+```sh
+npx @hubtoolify/icons login
+npm install @hubtoolify-pro/icons-react
+```
+
+It asks for your HubToolify email and password (the password is not shown), then saves a read-only registry token
+for the `@hubtoolify-pro` scope in your user npm config. The token is never printed. Details: the
+`@hubtoolify-pro/icons` README (after sign-in) and https://hubtoolify.com/icons.
+
 ## What's in the package
 
 - `css/` — `hubtoolify-icons.css` and `.min.css`. Link one.

package/bin/cli.mjs

@@ -1,17 +1,170 @@
 #!/usr/bin/env node
-// Copies the stylesheet and the SVG files it loads into a static folder, css/ and svg/ side by
-// side. A bundler must never process this stylesheet: it references every icon file, so Vite or
-// webpack would emit or inline thousands of them. A static folder avoids that.
-import { cp, mkdir } from 'node:fs/promises';
+/*
+ * hubtoolify-icons
+ *
+ *   npx @hubtoolify/icons login            sign in to the HubToolify Pro package registry (Pro plan)
+ *   npx hubtoolify-icons <folder>          copy the CSS kit (css/ and svg/) into a static folder
+ *
+ * login: asks for your HubToolify email and password (the password is not shown), requests a read-only
+ * registry token, and saves it for the @hubtoolify-pro scope in your user-level npm config. The token is
+ * never printed. Works the same on Windows (PowerShell, cmd), macOS and Linux; needs Node 18 or newer.
+ */
+import { cp, mkdir, readFile, writeFile, chmod } from 'node:fs/promises';
+import { spawnSync } from 'node:child_process';
+import { createInterface } from 'node:readline';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const dest = process.argv[2];
-if (!dest || dest.startsWith('-')) {
-  console.error('Usage: hubtoolify-icons <folder>   e.g. npx hubtoolify-icons public/hubtoolify-icons');
-  process.exit(1);
+const DEFAULT_REGISTRY = 'https://hubtoolify.com/api/npm/';
+const SCOPE = '@hubtoolify-pro';
+
+const [command, ...args] = process.argv.slice(2);
+
+try {
+  if (command === 'login') await login(args);
+  else await copyKit(command === 'copy' ? args : [command, ...args]);
+} catch (e) {
+  console.error(`\n${e.message}`);
+  process.exit(e.exitCode || 1);
+}
+
+/* ------------------------------------------------------------------ copy */
+
+async function copyKit([dest]) {
+  const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  if (!dest || dest.startsWith('-')) {
+    throw Object.assign(new Error('Usage:\n  npx @hubtoolify/icons login            sign in to the Pro registry\n  npx hubtoolify-icons <folder>          copy the CSS kit, e.g. public/hubtoolify-icons'), { exitCode: 1 });
+  }
+  // A bundler must never process the stylesheet: it references every icon file. A static folder avoids that.
+  await mkdir(dest, { recursive: true });
+  for (const dir of ['css', 'svg']) await cp(path.join(root, dir), path.join(dest, dir), { recursive: true });
+  console.log(`HubToolify Icons copied to ${dest}. Link ${path.join(dest, 'css', 'hubtoolify-icons.min.css')} in your HTML.`);
+}
+
+/* ----------------------------------------------------------------- login */
+
+async function login(argv) {
+  if (argv.includes('--help') || argv.includes('-h')) {
+    console.log('Usage: npx @hubtoolify/icons login [--print-token]\n\nSigns in to the HubToolify Pro package registry and saves a read-only token for\n' + `${SCOPE} in your user npm config. Needs an active Pro plan.\n\n--print-token   print the token instead of saving it (for storing as a CI secret; treat it like a password)`);
+    return;
+  }
+  const printToken = argv.includes('--print-token');
+  const ri = argv.indexOf('--registry');
+  const registry = withSlash(ri >= 0 ? argv[ri + 1] : DEFAULT_REGISTRY);
+  if (!/^https?:\/\//.test(registry)) throw new Error('--registry needs a URL such as https://hubtoolify.com/api/npm/');
+
+  const { email, password } = await credentials();
+  if (!email || !password) throw new Error('An email and a password are required.');
+
+  // JSON is built by the serialiser, so quotes or backslashes in a password cannot break the request.
+  const url = `${registry}-/user/org.couchdb.user:${encodeURIComponent(email)}`;
+  const body = JSON.stringify({ name: email, password });
+  let res;
+  try {
+    res = await fetch(url, { method: 'PUT', headers: { 'Content-Type': 'application/json', Accept: 'application/json' }, body, signal: AbortSignal.timeout(30000) });
+  } catch (e) {
+    throw new Error(`Could not reach ${new URL(registry).host}: ${e.cause?.code || e.message}. Check your connection and try again.`);
+  }
+  const data = await res.json().catch(() => ({}));
+  if (res.status !== 201 || typeof data.token !== 'string' || data.token.length < 20) {
+    const why = data.error || `the server answered ${res.status}`;
+    const hint = res.status === 429 ? ' Wait a minute and try again.' : '';
+    throw new Error(`Login failed: ${why}${hint}`);
+  }
+  const token = data.token;
+
+  // Confirm the registry accepts the token before anything is saved.
+  const who = await fetch(`${registry}-/whoami`, { headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' }, signal: AbortSignal.timeout(30000) }).catch(() => null);
+  if (!who || who.status !== 200) throw new Error(`The registry signed you in but did not accept the new token (status ${who ? who.status : 'no response'}). Nothing was saved.`);
+
+  if (printToken) {
+    process.stdout.write(`${token}\n`);
+    return;
+  }
+
+  const file = await userConfigPath();
+  await saveToken(file, registry, token);
+  console.log(`\nSigned in to HubToolify Pro as ${email}.`);
+  console.log(`Saved the registry token for ${SCOPE} in ${file} (it is not shown).`);
+  console.log(`\nNext: npm install ${SCOPE}/icons-react`);
+}
+
+function withSlash(u) {
+  return u.endsWith('/') ? u : `${u}/`;
+}
+
+async function credentials() {
+  const envEmail = process.env.HUBTOOLIFY_EMAIL;
+  const envPassword = process.env.HUBTOOLIFY_PASSWORD;
+  if (envEmail && envPassword) return { email: envEmail.trim().toLowerCase(), password: envPassword };
+
+  if (process.stdin.isTTY) {
+    const email = (await ask('HubToolify email: ')).trim().toLowerCase();
+    const password = await askHidden('Password: ');
+    return { email, password };
+  }
+  // Not a terminal (a pipe or a CI job): two lines, email then password.
+  const lines = await readLines(2);
+  return { email: (lines[0] || '').trim().toLowerCase(), password: lines[1] || '' };
+}
+
+function ask(prompt) {
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(prompt, (answer) => { rl.close(); resolve(answer); });
+  });
+}
+
+/** Password prompt: no echo, backspace works, Ctrl+C aborts. Raw mode works in PowerShell, cmd, macOS and Linux terminals. */
+function askHidden(prompt) {
+  return new Promise((resolve) => {
+    process.stdout.write(prompt);
+    const stdin = process.stdin;
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding('utf8');
+    let value = '';
+    const done = () => { stdin.setRawMode(false); stdin.pause(); stdin.removeListener('data', onData); process.stdout.write('\n'); };
+    const onData = (chunk) => {
+      for (const ch of chunk) {
+        if (ch === '\r' || ch === '\n') { done(); resolve(value); return; }
+        if (ch === '\u0003') { done(); process.exit(130); }
+        if (ch === '\u007f' || ch === '\b') value = value.slice(0, -1);
+        else if (ch >= ' ') value += ch;
+      }
+    };
+    stdin.on('data', onData);
+  });
+}
+
+function readLines(n) {
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: process.stdin });
+    const lines = [];
+    rl.on('line', (l) => { lines.push(l); if (lines.length >= n) rl.close(); });
+    rl.on('close', () => resolve(lines));
+  });
+}
+
+/** The user-level npmrc, exactly where `npm config set` would write. */
+async function userConfigPath() {
+  if (process.env.NPM_CONFIG_USERCONFIG) return process.env.NPM_CONFIG_USERCONFIG;
+  const r = spawnSync('npm', ['config', 'get', 'userconfig'], { encoding: 'utf8', shell: process.platform === 'win32' });
+  const p = r.status === 0 ? r.stdout.trim() : '';
+  return p && p !== 'undefined' ? p : path.join(os.homedir(), '.npmrc');
+}
+
+/** Replace this registry's token line and the scope's registry line; keep everything else in the file. */
+async function saveToken(file, registry, token) {
+  const u = new URL(registry);
+  const tokenKey = `//${u.host}${u.pathname}:_authToken`;
+  const scopeKey = `${SCOPE}:registry`;
+  let existing = '';
+  try { existing = await readFile(file, 'utf8'); } catch { /* new file */ }
+  const kept = existing.split(/\r?\n/).filter((l) => l.trim() !== '' && !l.startsWith(`${tokenKey}=`) && !l.startsWith(`${scopeKey}=`));
+  kept.push(`${scopeKey}=${registry}`, `${tokenKey}=${token}`);
+  await mkdir(path.dirname(file), { recursive: true });
+  await writeFile(file, `${kept.join('\n')}\n`, { mode: 0o600 });
+  await chmod(file, 0o600).catch(() => {}); // no-op on Windows
 }
-await mkdir(dest, { recursive: true });
-for (const dir of ['css', 'svg']) await cp(path.join(root, dir), path.join(dest, dir), { recursive: true });
-console.log(`HubToolify Icons copied to ${dest}. Link ${path.join(dest, 'css', 'hubtoolify-icons.min.css')} in your HTML.`);