@juuno-sdk/cli 4.0.2 → 4.1.0

package/dist/types/src/deploy-backend/outcome.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Reading a deploy response, and saying what happened.
+ *
+ * Two functions, split so the decision is separable from the printing:
+ * `describeOutcome` is pure and decides, `report` performs. Kept apart from the
+ * command because the distinction they draw is a safety property rather than
+ * presentation — a 404 means the platform refused before anything reached
+ * Cloudflare, so nothing is live and the CLI can fail loudly; any other failure
+ * may have uploaded the script and then failed a later step, so the server's own
+ * message is the only accurate account of what happened and is passed through
+ * untouched.
+ *
+ * Getting that backwards would either hide a live half-deploy behind a tidy
+ * error, or tell a developer to go and register something that already exists.
+ */
+/** The subset of the deploy endpoint's JSON this command reads. */
+export interface DeployResponse {
+    success?: boolean;
+    message?: string;
+    error?: string;
+    errors?: unknown;
+    schema_version?: string | number | null;
+}
+export type DeployOutcome = 
+/** Deployed. `lines` is what to print, in order. */
+{
+    kind: 'success';
+    lines: string[];
+}
+/**
+ * No backend is registered for this script. Nothing was uploaded, so this is
+ * safe to raise as an ordinary error with a fix attached.
+ */
+ | {
+    kind: 'unregistered';
+    message: string;
+}
+/**
+ * Something else went wrong, possibly after the upload. Reported rather than
+ * thrown, so the server's account survives verbatim instead of being wrapped.
+ */
+ | {
+    kind: 'failed';
+    message: string;
+    details?: string;
+};
+/**
+ * What the response means, given the modules that were sent.
+ *
+ * A body of `{ success: false }` on a 200 counts as a failure — the endpoint
+ * reports step failures in the body, so the HTTP status alone is not the answer.
+ */
+export declare function describeOutcome(status: number, body: DeployResponse, moduleNames: string[], api: string): DeployOutcome;
+/**
+ * Turn an outcome into output and an exit code.
+ *
+ * Only `unregistered` throws, and only because nothing was uploaded: the caller
+ * wraps a throw as a one-line `❌ …`, which is the right shape for "this was
+ * refused, here is the fix". A failure that may have half-landed must not be
+ * wrapped, so it is written straight to stderr and the exit code is set by hand.
+ */
+export declare function report(outcome: DeployOutcome): void;
+//# sourceMappingURL=outcome.d.ts.map

package/dist/types/src/deploy-backend/outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.d.ts","sourceRoot":"","sources":["../../../../src/deploy-backend/outcome.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACzC;AAED,MAAM,MAAM,aAAa;AACvB,oDAAoD;AAClD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE;AACtC;;;GAGG;GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3C;;;GAGG;GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,cAAc,EACpB,WAAW,EAAE,MAAM,EAAE,EACrB,GAAG,EAAE,MAAM,GACV,aAAa,CA+Cf;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAmBnD"}

package/dist/types/src/deploy-backend/wrangler-config.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Pure helpers for a Workers-for-Platforms deploy: building the payload from a
+ * worker's wrangler.jsonc, and resolving where to send it.
+ *
+ * Kept free of I/O so the part that fails silently — the metadata — is directly
+ * testable. See wrangler-config.test.ts.
+ */
+/** A wrangler.jsonc, as much of it as this deploy path cares about. */
+export interface WranglerConfig {
+    name?: string;
+    main?: string;
+    compatibility_date?: string;
+    compatibility_flags?: string[];
+    vars?: Record<string, unknown>;
+    kv_namespaces?: ({
+        binding: string;
+    } & Record<string, unknown>)[];
+    d1_databases?: ({
+        binding: string;
+    } & Record<string, unknown>)[];
+    env?: Record<string, WranglerConfig>;
+    [key: string]: unknown;
+}
+export interface DeployBinding {
+    type: 'kv_namespace' | 'd1' | 'plain_text';
+    name: string;
+    text?: string;
+}
+export interface DeployMetadata {
+    main_module: string;
+    compatibility_date: string;
+    compatibility_flags?: string[];
+    bindings?: DeployBinding[];
+}
+/**
+ * Normalise the API base, and refuse to put the developer token on a cleartext
+ * connection.
+ *
+ * Loopback stays exempt so a local Laravel over http still works. Anything else
+ * must be https, because the next thing the caller does with this value is send
+ * a bearer token to it.
+ */
+export declare function resolveApiUrl(value: string): string;
+/**
+ * Strip comments and trailing commas from JSONC so JSON.parse accepts it.
+ *
+ * String-aware: a `//` or block-comment opener inside a quoted value is left
+ * alone, as is an escaped quote. Written by hand rather than pulling in a parser
+ * because this is the only JSONC we read and the input is our own.
+ *
+ * The complexity is suppressed rather than refactored. This is a character
+ * scanner: four mutually-exclusive states over one cursor, sharing `out`, `i`
+ * and three flags. Extracting the branches means threading all of that through
+ * helpers or hoisting it into an object, which trades a shape every reader
+ * recognises for one nobody does — and a state machine you have to reassemble
+ * across functions is exactly where an off-by-one hides. The 31 cases in
+ * `__tests__/wrangler-config.test.ts` are what keeps it honest instead.
+ */
+export declare function stripJsonc(source: string): string;
+export declare function parseWranglerConfig(source: string): WranglerConfig;
+/**
+ * Flatten a wrangler config for one environment.
+ *
+ * Inherited keys come from the top level unless the environment overrides them;
+ * the binding keys in NOT_INHERITED come from the environment alone, matching
+ * wrangler's own rule.
+ */
+export declare function resolveEnvConfig(config: WranglerConfig, env: string): WranglerConfig;
+/**
+ * The entry module's name as it appears in the dry-run output. wrangler compiles
+ * `./src/index.ts` to `dist/index.js`, so the extension is normalised.
+ */
+export declare function entryModuleName(main: string): string;
+/**
+ * Build the `metadata` part for the platform deploy endpoint.
+ *
+ * Store bindings are emitted **by name only**. The platform provisions the
+ * store and fills the id — sending one would make it adopt an existing store
+ * instead, and nothing would report that it had. Note the two are not
+ * symmetric: KV's id field is `namespace_id`, D1's is `id`, and neither is set
+ * here.
+ */
+export declare function buildMetadata(resolved: WranglerConfig): DeployMetadata;
+/**
+ * The tenant script name wrangler will have built for this environment.
+ *
+ * Read off the raw config rather than the resolved one because the rule is not
+ * inheritance: an env that declares its own `name` uses it verbatim, and one
+ * that does not gets `<top-level-name>-<env>`. The merged config cannot tell the
+ * two apart, so reading it would address the upload to `google-reviews` for a
+ * bundle wrangler built as `google-reviews-prod` — refused as unregistered, or
+ * worse, landing on whichever tenant already holds that name.
+ */
+export declare function scriptName(config: WranglerConfig, env: string): string;
+/** Files in the dry-run output that belong in the upload. */
+export declare function isModuleFile(filename: string): boolean;
+/**
+ * The Content-Type of a module part, which is how Cloudflare decides what kind
+ * of module it is — not a formality. `application/javascript+module` makes it an
+ * ES module and `application/wasm` a CompiledWasm one, so labelling a `.wasm`
+ * as JavaScript would have Cloudflare try to parse the binary as source and
+ * reject the upload. isModuleFile() already accepts `.wasm`, so the two have to
+ * agree about what that means.
+ */
+export declare function moduleContentType(filename: string): string;
+//# sourceMappingURL=wrangler-config.d.ts.map

package/dist/types/src/deploy-backend/wrangler-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrangler-config.d.ts","sourceRoot":"","sources":["../../../../src/deploy-backend/wrangler-config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAI/B,aAAa,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAClE,YAAY,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,cAAc,GAAG,IAAI,GAAG,YAAY,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;CAC5B;AAID;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAgBnD;AAoDD;;;;;;;;;;;;;;GAcG;AAEH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAmEjD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAElE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,MAAM,GACV,cAAc,CAqBhB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,GAAG,cAAc,CAwDtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAYtE;AAED,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAItD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI1D"}

package/dist/types/src/utils/bin.d.ts

@@ -0,0 +1,24 @@
+import crossSpawn from 'cross-spawn';
+/**
+ * Spawning a package-manager binary, portably.
+ *
+ * `npx`, `pnpm` and `yarn` are shell scripts on POSIX and `.cmd` shims on
+ * Windows, and neither Node nor libuv will run a `.cmd` from `spawn` without a
+ * shell — `CreateProcess` cannot execute one, and since the fix for
+ * CVE-2024-27980 Node refuses rather than silently routing through cmd.exe.
+ * Naming the shim (`npx.cmd`) fixes PATH resolution and not the spawn.
+ *
+ * Doing it correctly means invoking `cmd.exe /d /s /c` with the command and
+ * every argument escaped for cmd's parser, plus a second round of escaping for
+ * shims under `node_modules/.bin`, and `windowsVerbatimArguments` so Node does
+ * not re-quote what was just escaped. `shell: true` is the wrong shortcut: it
+ * hands the whole line to cmd.exe to re-parse, so a worker directory containing
+ * `&` or `^` becomes a command.
+ *
+ * cross-spawn already does all of it, is the ecosystem's answer to this exact
+ * problem, and was already in the tree transitively. Preferred over a local
+ * reimplementation, which is where the escaping bugs live.
+ */
+export declare const spawn: typeof crossSpawn;
+export declare const spawnSync: typeof import("node:child_process").spawnSync;
+//# sourceMappingURL=bin.d.ts.map

package/dist/types/src/utils/bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../../../../src/utils/bin.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,aAAa,CAAC;AAErC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,KAAK,mBAAa,CAAC;AAChC,eAAO,MAAM,SAAS,+CAAkB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juuno-sdk/cli",
-  "version": "4.0.2",
+  "version": "4.1.0",
   "description": "Official CLI for Juuno external app development: deploy, list and inspect apps",
   "private": false,
   "type": "module",
@@ -19,15 +19,19 @@
     }
   },
   "dependencies": {
+    "cross-spawn": "^7.0.6",
     "inquirer": "^14.0.2",
     "jszip": "^3.10.1",
     "semver": "^7.8.5"
   },
   "devDependencies": {
     "@tsconfig/node22": "^22.0.5",
+    "@types/cross-spawn": "^6.0.6",
     "@types/node": "^26.2.0",
     "@types/semver": "^7.8.0",
     "@vue/tsconfig": "^0.9.1",
+    "eslint": "^10.8.1",
+    "oxlint": "^1.77.0",
     "typescript": "^5.9.3",
     "vitest": "^4.1.10",
     "@juuno/eslint-config": "0.0.1"
@@ -49,7 +53,11 @@
     "dev": "pnpm build && node ./bin/cli.js",
     "build": "pnpm build:cli",
     "build:cli": "tsc --project tsconfig.build.json",
-    "type-check": "tsc --project tsconfig.build.json --noEmit",
+    "type-check": "tsc --project tsconfig.vitest.json",
+    "lint": "pnpm lint:oxlint && pnpm lint:eslint",
+    "lint:oxlint": "oxlint",
+    "lint:eslint": "eslint .",
+    "lint:fix": "eslint . --fix",
     "test": "pnpm test:unit",
     "test:unit": "vitest run",
     "test:unit:watch": "vitest"