@lpm-registry/cli 0.58.0 → 0.59.1

package/lib/lpm-config.js

@@ -1,408 +0,0 @@
-/**
- * LPM Package Config System
- *
- * Handles lpm.config.json parsing, validation, condition evaluation,
- * file filtering, and dependency resolution
- * for the `lpm add` command.
- *
- * Pure logic module — no I/O beyond file reads, no prompts.
- *
- * @module cli/lib/lpm-config
- */
-
-import fs from "node:fs"
-import path from "node:path"
-
-/** Maximum lpm.config.json file size (1 MB) */
-const MAX_CONFIG_FILE_SIZE = 1024 * 1024
-
-/** Maximum number of file rules allowed */
-const MAX_FILE_RULES = 1000
-
-/**
- * Parse a package reference that may include version and URL query params.
- *
- * Supports:
- *   @lpm.dev/owner.pkg
- *   @lpm.dev/owner.pkg@1.0.0
- *   @lpm.dev/owner.pkg?component=dialog&styling=panda
- *   @lpm.dev/owner.pkg@1.0.0?component=dialog,button&styling=panda
- *
- * @param {string} ref - Package reference string
- * @returns {{ name: string, version: string, inlineConfig: Record<string, string>, providedParams: Set<string> }}
- */
-export function parseLpmPackageReference(ref) {
-	// Split query string first
-	const queryIndex = ref.indexOf("?")
-	let packagePart = ref
-	let queryString = ""
-
-	if (queryIndex !== -1) {
-		packagePart = ref.substring(0, queryIndex)
-		queryString = ref.substring(queryIndex + 1)
-	}
-
-	// Extract version from package part
-	let name = packagePart
-	let version = "latest"
-
-	// Find version separator: last @ after position 0 (position 0 is the scope @)
-	const lastAt = packagePart.lastIndexOf("@")
-	if (lastAt > 0) {
-		name = packagePart.substring(0, lastAt)
-		version = packagePart.substring(lastAt + 1)
-	}
-
-	// Parse query params
-	const inlineConfig = {}
-	const providedParams = new Set()
-
-	if (queryString) {
-		const params = new URLSearchParams(queryString)
-		for (const [key, value] of params.entries()) {
-			inlineConfig[key] = value
-			providedParams.add(key)
-		}
-	}
-
-	return { name, version, inlineConfig, providedParams }
-}
-
-/**
- * Read and validate lpm.config.json from an extracted package directory.
- *
- * @param {string} extractDir - Path to extracted tarball directory
- * @returns {import('./lpm-config.js').LpmConfig | null} Parsed config or null if not found
- */
-export function readLpmConfig(extractDir) {
-	const configPath = path.join(extractDir, "lpm.config.json")
-
-	if (!fs.existsSync(configPath)) {
-		return null
-	}
-
-	const stat = fs.statSync(configPath)
-	if (stat.size > MAX_CONFIG_FILE_SIZE) {
-		throw new Error(
-			`lpm.config.json exceeds maximum size of ${MAX_CONFIG_FILE_SIZE / 1024 / 1024}MB`,
-		)
-	}
-
-	const raw = fs.readFileSync(configPath, "utf-8")
-	const config = JSON.parse(raw)
-
-	const errors = validateLpmConfig(config)
-	if (errors.length > 0) {
-		throw new Error(`Invalid lpm.config.json:\n  ${errors.join("\n  ")}`)
-	}
-
-	return config
-}
-
-/**
- * Validate a parsed lpm.config.json object.
- *
- * @param {object} config - Parsed lpm.config.json
- * @returns {string[]} Array of error messages (empty if valid)
- */
-export function validateLpmConfig(config) {
-	const errors = []
-
-	// Validate file rules
-	if (config.files) {
-		if (!Array.isArray(config.files)) {
-			errors.push("'files' must be an array")
-		} else {
-			if (config.files.length > MAX_FILE_RULES) {
-				errors.push(
-					`Too many file rules (${config.files.length}). Maximum is ${MAX_FILE_RULES}.`,
-				)
-			}
-
-			for (let i = 0; i < config.files.length; i++) {
-				const rule = config.files[i]
-
-				if (rule.src) {
-					const normalizedSrc = rule.src.replace(/\\/g, "/")
-					if (normalizedSrc.includes("..")) {
-						errors.push(
-							`files[${i}].src contains path traversal: "${rule.src}"`,
-						)
-					}
-					if (normalizedSrc.startsWith("/")) {
-						errors.push(
-							`files[${i}].src must be a relative path: "${rule.src}"`,
-						)
-					}
-				}
-
-				if (rule.dest) {
-					const normalizedDest = rule.dest.replace(/\\/g, "/")
-					if (normalizedDest.includes("..")) {
-						errors.push(
-							`files[${i}].dest contains path traversal: "${rule.dest}"`,
-						)
-					}
-					if (normalizedDest.startsWith("/")) {
-						errors.push(
-							`files[${i}].dest must be a relative path: "${rule.dest}"`,
-						)
-					}
-				}
-
-				if (
-					rule.include &&
-					!["always", "never", "when"].includes(rule.include)
-				) {
-					errors.push(
-						`files[${i}].include must be "always", "never", or "when". Got: "${rule.include}"`,
-					)
-				}
-
-				if (rule.include === "when" && !rule.condition) {
-					errors.push(`files[${i}] has include "when" but no condition object`)
-				}
-			}
-		}
-	}
-
-	// Validate configSchema
-	if (config.configSchema) {
-		if (
-			typeof config.configSchema !== "object" ||
-			Array.isArray(config.configSchema)
-		) {
-			errors.push("'configSchema' must be an object")
-		} else {
-			for (const [key, entry] of Object.entries(config.configSchema)) {
-				if (!entry.type) {
-					errors.push(`configSchema.${key} is missing 'type'`)
-				} else if (!["select", "boolean"].includes(entry.type)) {
-					errors.push(
-						`configSchema.${key}.type must be "select" or "boolean". Got: "${entry.type}"`,
-					)
-				}
-
-				if (entry.type === "select") {
-					if (
-						!entry.options ||
-						!Array.isArray(entry.options) ||
-						entry.options.length === 0
-					) {
-						errors.push(
-							`configSchema.${key} is type "select" but has no options`,
-						)
-					}
-				}
-			}
-		}
-	}
-
-	// Validate importAlias
-	if (config.importAlias !== undefined) {
-		if (typeof config.importAlias !== "string") {
-			errors.push('\'importAlias\' must be a string (e.g., "@/", "~/")')
-		} else if (!config.importAlias.endsWith("/")) {
-			errors.push(
-				'\'importAlias\' must end with "/" (e.g., "@/", "~/", "@src/")',
-			)
-		}
-	}
-
-	return errors
-}
-
-/**
- * Evaluate whether a file rule should be included based on config and provided params.
- *
- * Implements "include all by default": if a condition key was NOT explicitly
- * provided by the user, the file is included regardless of its condition value.
- *
- * @param {object} fileRule - File rule from lpm.config.json
- * @param {Record<string, string>} mergedConfig - Merged configuration values
- * @param {Set<string>} providedParams - Set of parameter keys explicitly provided by the user
- * @returns {boolean} Whether the file should be included
- */
-export function evaluateCondition(fileRule, mergedConfig, providedParams) {
-	if (!fileRule.include || fileRule.include === "always") return true
-	if (fileRule.include === "never") return false
-
-	if (fileRule.include === "when" && fileRule.condition) {
-		// All condition entries must match (AND logic)
-		for (const [conditionKey, conditionValue] of Object.entries(
-			fileRule.condition,
-		)) {
-			// "Include all by default": if param was NOT provided, skip this check (include the file)
-			if (!providedParams.has(conditionKey)) {
-				continue
-			}
-
-			const configValue = mergedConfig[conditionKey]
-
-			// Handle comma-separated multi-select values
-			if (typeof configValue === "string" && configValue.includes(",")) {
-				const selectedValues = configValue.split(",").map(v => v.trim())
-				if (!selectedValues.includes(String(conditionValue))) {
-					return false
-				}
-			} else {
-				// Single value or boolean comparison
-				if (String(configValue) !== String(conditionValue)) {
-					return false
-				}
-			}
-		}
-
-		return true
-	}
-
-	// Default: include
-	return true
-}
-
-/**
- * Filter file rules based on merged config and provided params.
- *
- * @param {object[]} files - Array of file rules from lpm.config.json
- * @param {Record<string, string>} mergedConfig - Merged configuration values
- * @param {Set<string>} providedParams - Set of parameter keys explicitly provided
- * @returns {object[]} Filtered file rules that should be included
- */
-export function filterFiles(files, mergedConfig, providedParams) {
-	return files.filter(fileRule =>
-		evaluateCondition(fileRule, mergedConfig, providedParams),
-	)
-}
-
-/**
- * Resolve conditional dependencies based on config choices.
- *
- * @param {Record<string, Record<string, string[]>>} depConfig - Dependencies config from lpm.config.json
- * @param {Record<string, string>} mergedConfig - Merged configuration values
- * @returns {{ npm: string[], lpm: string[] }} Separated npm and LPM dependencies
- */
-export function resolveConditionalDependencies(depConfig, mergedConfig) {
-	const allDeps = new Set()
-
-	for (const [configKey, depMap] of Object.entries(depConfig)) {
-		const selectedValue = mergedConfig[configKey]
-		if (!selectedValue) continue
-
-		// Handle comma-separated values
-		const values =
-			typeof selectedValue === "string" && selectedValue.includes(",")
-				? selectedValue.split(",").map(v => v.trim())
-				: [selectedValue]
-
-		for (const value of values) {
-			const deps = depMap[value]
-			if (Array.isArray(deps)) {
-				for (const dep of deps) {
-					allDeps.add(dep)
-				}
-			}
-		}
-	}
-
-	const npm = []
-	const lpm = []
-
-	for (const dep of allDeps) {
-		if (dep.startsWith("@lpm.dev/")) {
-			lpm.push(dep)
-		} else {
-			npm.push(dep)
-		}
-	}
-
-	return { npm, lpm }
-}
-
-/**
- * Expand glob-like src patterns to actual file paths.
- *
- * Supports simple patterns:
- *   - Exact paths: "lib/utils.js"
- *   - Directory wildcards: "components/dialog/**"
- *
- * @param {string} srcPattern - Source pattern from file rule
- * @param {string} extractDir - Extracted tarball directory
- * @returns {string[]} Array of matching file paths (relative to extractDir)
- */
-export function expandSrcGlob(srcPattern, extractDir) {
-	// If pattern doesn't contain *, it's an exact path
-	if (!srcPattern.includes("*")) {
-		const fullPath = path.join(extractDir, srcPattern)
-		if (fs.existsSync(fullPath)) {
-			return [srcPattern]
-		}
-		return []
-	}
-
-	// Handle ** (directory wildcard)
-	if (srcPattern.endsWith("/**")) {
-		const baseDir = srcPattern.slice(0, -3) // Remove /**
-		const fullBaseDir = path.join(extractDir, baseDir)
-
-		if (
-			!fs.existsSync(fullBaseDir) ||
-			!fs.statSync(fullBaseDir).isDirectory()
-		) {
-			return []
-		}
-
-		const results = []
-		const collectFiles = (dir, relativeTo) => {
-			const entries = fs.readdirSync(dir, { withFileTypes: true })
-			for (const entry of entries) {
-				const fullEntryPath = path.join(dir, entry.name)
-				const relPath = path.relative(extractDir, fullEntryPath)
-
-				if (entry.isDirectory()) {
-					collectFiles(fullEntryPath, relativeTo)
-				} else {
-					results.push(relPath)
-				}
-			}
-		}
-
-		collectFiles(fullBaseDir, extractDir)
-		return results
-	}
-
-	// Handle dir/*.ext patterns (single-directory wildcard)
-	const lastSlash = srcPattern.lastIndexOf("/")
-	const dirPart = lastSlash >= 0 ? srcPattern.slice(0, lastSlash) : "."
-	const filePart = lastSlash >= 0 ? srcPattern.slice(lastSlash + 1) : srcPattern
-
-	if (filePart.includes("*")) {
-		const fullDir = path.join(extractDir, dirPart)
-		if (!fs.existsSync(fullDir) || !fs.statSync(fullDir).isDirectory()) {
-			return []
-		}
-
-		// Convert glob pattern to regex: *.mdc → /^.*\.mdc$/
-		const escaped = filePart
-			.replace(/[.+^${}()|[\]\\]/g, "\\$&")
-			.replace(/\*/g, ".*")
-		const regex = new RegExp(`^${escaped}$`)
-
-		const entries = fs.readdirSync(fullDir, { withFileTypes: true })
-		const results = []
-		for (const entry of entries) {
-			if (entry.isFile() && regex.test(entry.name)) {
-				results.push(
-					dirPart === "." ? entry.name : path.join(dirPart, entry.name),
-				)
-			}
-		}
-		return results
-	}
-
-	// For other patterns, treat as exact path
-	const fullPath = path.join(extractDir, srcPattern)
-	if (fs.existsSync(fullPath)) {
-		return [srcPattern]
-	}
-	return []
-}

package/lib/oidc.js

@@ -1,166 +0,0 @@
-/**
- * OIDC (OpenID Connect) token exchange for secret-free CI operations.
- *
- * When running in GitHub Actions with `id-token: write` permission,
- * this module requests an OIDC JWT from GitHub and exchanges it for
- * a short-lived LPM token — no LPM_TOKEN secret required.
- *
- * Two modes:
- * - **Publish**: Requires trusted publisher config in LPM dashboard.
- * - **Read (install)**: Requires GitHub/GitLab account linked to LPM user.
- *
- * @module cli/lib/oidc
- */
-
-import { getRegistryUrl } from "./config.js"
-
-/**
- * Detect whether we are running in GitHub Actions with OIDC available.
- * Both env vars must be set for token request to work.
- *
- * @returns {boolean}
- */
-export function isGitHubActionsWithOidc() {
-	return !!(
-		process.env.ACTIONS_ID_TOKEN_REQUEST_URL &&
-		process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN
-	)
-}
-
-/**
- * Detect whether we are running in GitLab CI with an OIDC token injected.
- * GitLab injects the JWT directly as an env var via id_tokens — no HTTP fetch needed.
- *
- * @returns {boolean}
- */
-export function isGitLabCiWithOidc() {
-	return !!(
-		process.env.GITLAB_CI === "true" && process.env.LPM_GITLAB_OIDC_TOKEN
-	)
-}
-
-/**
- * Request a GitHub Actions OIDC JWT.
- * @returns {Promise<string>} The raw JWT string
- */
-async function requestGitHubOidcJwt() {
-	const githubTokenUrl = `${process.env.ACTIONS_ID_TOKEN_REQUEST_URL}&audience=https://lpm.dev`
-
-	const githubRes = await fetch(githubTokenUrl, {
-		headers: {
-			Authorization: `bearer ${process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN}`,
-		},
-	})
-
-	if (!githubRes.ok) {
-		const body = await githubRes.text().catch(() => "")
-		throw new Error(
-			`GitHub OIDC token request failed (${githubRes.status})${body ? `: ${body}` : ""}`,
-		)
-	}
-
-	const { value: oidcJwt } = await githubRes.json()
-	if (!oidcJwt) {
-		throw new Error("GitHub OIDC response did not contain a token value")
-	}
-
-	return oidcJwt
-}
-
-/**
- * Exchange an OIDC JWT with the LPM server for a short-lived token.
- *
- * @param {string} oidcJwt - The raw OIDC JWT
- * @param {{ scope?: "read"|"publish", packageName?: string }} [options]
- * @returns {Promise<{ token: string, expiresAt: string }>}
- */
-async function exchangeJwtWithServer(oidcJwt, options = {}) {
-	const { scope = "publish", packageName } = options
-	const registryUrl = getRegistryUrl()
-	const scopeParam = scope === "read" ? "?scope=read" : ""
-
-	const body = { token: oidcJwt }
-	if (packageName) body.package = packageName
-
-	const exchangeRes = await fetch(
-		`${registryUrl}/api/registry/-/token/oidc${scopeParam}`,
-		{
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify(body),
-		},
-	)
-
-	if (!exchangeRes.ok) {
-		const text = await exchangeRes.text().catch(() => "")
-		throw new Error(
-			`OIDC token exchange failed (${exchangeRes.status})${text ? `: ${text}` : ""}`,
-		)
-	}
-
-	const data = await exchangeRes.json()
-	if (!data.token) {
-		throw new Error("OIDC exchange response did not contain a token")
-	}
-
-	return data
-}
-
-/**
- * Exchange a GitHub Actions OIDC JWT for a short-lived LPM token.
- *
- * @param {string} [packageName] - Required for publish scope, optional for read
- * @param {{ scope?: "read"|"publish" }} [options]
- * @returns {Promise<string>} Short-lived LPM token
- */
-export async function exchangeOidcToken(packageName, options = {}) {
-	const oidcJwt = await requestGitHubOidcJwt()
-	const data = await exchangeJwtWithServer(oidcJwt, {
-		scope: options.scope || "publish",
-		packageName,
-	})
-	return data.token
-}
-
-/**
- * Exchange a GitLab CI OIDC JWT for a short-lived LPM token.
- *
- * @param {string} [packageName] - Required for publish scope, optional for read
- * @param {{ scope?: "read"|"publish" }} [options]
- * @returns {Promise<string>} Short-lived LPM token
- */
-export async function exchangeGitLabOidcToken(packageName, options = {}) {
-	const oidcJwt = process.env.LPM_GITLAB_OIDC_TOKEN
-	if (!oidcJwt) {
-		throw new Error(
-			"LPM_GITLAB_OIDC_TOKEN is not set. " +
-				"Add id_tokens: LPM_GITLAB_OIDC_TOKEN: { aud: https://lpm.dev } to your .gitlab-ci.yml",
-		)
-	}
-
-	const data = await exchangeJwtWithServer(oidcJwt, {
-		scope: options.scope || "publish",
-		packageName,
-	})
-	return data.token
-}
-
-/**
- * Detect CI environment and exchange OIDC token for a read-only install token.
- * Works with both GitHub Actions and GitLab CI.
- *
- * @returns {Promise<string>} Short-lived read-only LPM token
- * @throws {Error} If not in a supported CI environment or exchange fails
- */
-export async function exchangeOidcInstallToken() {
-	if (isGitHubActionsWithOidc()) {
-		return exchangeOidcToken(null, { scope: "read" })
-	}
-	if (isGitLabCiWithOidc()) {
-		return exchangeGitLabOidcToken(null, { scope: "read" })
-	}
-	throw new Error(
-		"OIDC is not available. This command requires a CI environment with OIDC support " +
-			"(GitHub Actions with `id-token: write` or GitLab CI with `id_tokens` configured).",
-	)
-}