@maka/meteor-sdk 0.2.4 → 0.2.6

package/README.md

@@ -94,7 +94,11 @@ await handle.stop(); // stops the proxy, then the app; no orphaned processes
 
 **No Mongo lifecycle management.** Unlike `meteor run`, `createAppRunner()`
 does not start or stop a `mongod` for you -- supply a running Mongo's
-connection string via `mongoUrl`.
+connection string via `mongoUrl`. For an app that doesn't use the `mongo`
+package at all, pass `mongoUrl: null` explicitly: no `MONGO_URL` is set
+for the app process. (An app that *does* load the `mongo` package will
+crash at startup without one -- the explicit `null` is how you take
+responsibility for that.)
 
 There is no separate `stdout`/`stderr` event -- all app log output is
 observable via `sdk.on("log", ...)` (see below).
@@ -191,6 +195,26 @@ regardless of whether it hangs, or set `METEOR_MODERN='{"watcher":false}'`
 to use the plain polling watcher instead, which doesn't exhibit either
 symptom.
 
+### `setConsoleOutput(enabled)`
+
+By default the tool's Console renders informational output to this
+process's stdout/stderr *and* emits it as `log` events. An embedder
+with its own progress UI (spinners, status lines) can call
+`sdk.setConsoleOutput(false)` to suppress the terminal rendering --
+newline-terminated Console writes landing between spinner redraws
+garble the terminal otherwise -- and paint the emitted events itself.
+Scoping it to a phase (off around a build, back on after) is the
+intended use; events keep flowing either way.
+
+### `setProgressDisplay(enabled)`
+
+The tool's own interactive progress bar (the classic `meteor run`
+"Building the application" bar) is disabled by default for embedders.
+`sdk.setProgressDisplay(true)` turns it back on for long build phases --
+it renders only when this process's stdout is a real TTY, and falls back
+to no display otherwise, so it's always safe to call. Turn it off again
+with `false` when your own UI takes over the terminal.
+
 ### Events
 
 ```js

package/isopackets/combined/npm/node_modules/meteor/babel-compiler/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1snkx7vjcuf",
+  "name": "package-new-19gk8ik1laok",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/boilerplate-generator/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-4u9fx8mbxny",
+  "name": "package-new-1cilc0ofj7n",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/constraint-solver/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-sm91z7t3z4o",
+  "name": "package-new-nmm4d6phk2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ddp-client/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-gsvm5rcc2iq",
+  "name": "package-new-1putse4drfa",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ecmascript/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-3gg4doz5i88",
+  "name": "package-new-3yr3ldqleqo",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ecmascript-runtime/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1nb1rwir7xu",
+  "name": "package-new-g0p3mjd9xem",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ecmascript-runtime-client/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1jo8olhxkjm",
+  "name": "package-new-6vlz23amok6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ecmascript-runtime-server/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-2ybexym7dno",
+  "name": "package-new-fjo86g7rsh",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/fetch/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-i9b1vaovh2j",
+  "name": "package-new-do0zmzqfdtv",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/inter-process-messaging/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-dymdsziwayf",
+  "name": "package-new-ni9wfpqalta",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/logging/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-ffz4udz1rzl",
+  "name": "package-new-xlb9mzz4j1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/logic-solver/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1gj1i1e8erq",
+  "name": "package-new-af7rda3rf3k",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/meteor/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1hynmr3gjvhf",
+  "name": "package-new-fkoxbzqrvrc",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/modules/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1ffagznc9qh",
+  "name": "package-new-cbf3elisryv",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/modules-runtime/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-e37v0zigxr6",
+  "name": "package-new-14j0m0s71m4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/npm-mongo/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-wfebwy06fwm",
+  "name": "package-new-wcdgdfqbzqi",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/package-version-parser/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-dbv0mrj9kh",
+  "name": "package-new-11b302e551qi",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/promise/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-4rd6cn8q4z7",
+  "name": "package-new-gddyphm3avb",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/react-fast-refresh/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-m44yzrtc8cq",
+  "name": "package-new-blaoyieb3zd",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/socket-stream-client/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-c4g2z219k47",
+  "name": "package-new-1c3i33z42bi",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maka/meteor-sdk",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Programmatic Node API over the Meteor build tool (bundle/run/create/etc.) -- for driving Meteor's build system from plain Node code instead of shelling out to a meteor CLI (there isn't one anymore; see README.md). \"dependencies\" is generated by scripts/write-tool-package-json.js from scripts/dev-bundle-tool-package.js at the monorepo root -- do not hand-edit that field, edit that file and re-run the script instead.",
   "main": "src/index.js",
   "exports": {

package/src/console.js

@@ -52,6 +52,13 @@ function patch() {
     }
     Console[level] = function (...args) {
       emitter.emit("log", { level, args });
+      if (!terminalOutput) {
+        // The embedder has claimed the terminal (setConsoleOutput(false)):
+        // events still flow above, but the tool's own stdout/stderr
+        // rendering is suppressed so it can't collide with the
+        // embedder's spinners/progress UI.
+        return undefined;
+      }
       return original.apply(Console, args);
     };
   });
@@ -60,4 +67,44 @@ function patch() {
   return emitter;
 }
 
-module.exports = { setHeadlessEnv, patch, emitter };
+// Whether the tool's Console also renders to this process's
+// stdout/stderr (the default), in addition to emitting "log" events.
+// Embedders that render their own progress UI (spinners, status lines)
+// can turn this off -- newline-terminated Console writes landing between
+// spinner redraws otherwise garble the terminal -- and paint the emitted
+// events however they like. Toggle freely: scoping it to a phase (off
+// around a build, back on afterward) is the intended use.
+let terminalOutput = true;
+function setConsoleOutput(enabled) {
+  terminalOutput = !!enabled;
+}
+
+// Opt back in to the tool's own interactive progress bar (the classic
+// `meteor run` "Building web.browser [====   ]" display), which patch()
+// disables by default for embedders. Only actually renders a bar when
+// this process's stdout is a real TTY -- otherwise the tool falls back
+// to its no-op display on its own, so this is always safe to call.
+// The ordering below matters: setPretty()/enableProgressDisplay()
+// construct a fresh ProgressDisplay (which re-reads METEOR_HEADLESS,
+// set by setHeadlessEnv()), so setHeadless(false) must come last to
+// propagate onto the newly built display.
+function setProgressDisplay(enabled) {
+  const { Console } = require("../tools/console/console.js");
+  if (enabled) {
+    Console.setPretty(true);
+    Console.enableProgressDisplay(true);
+    Console.setHeadless(false);
+  } else {
+    Console.enableProgressDisplay(false);
+    Console.setPretty(false);
+    Console.setHeadless(true);
+  }
+}
+
+module.exports = {
+  setHeadlessEnv,
+  patch,
+  emitter,
+  setConsoleOutput,
+  setProgressDisplay,
+};

package/src/index.js

@@ -46,4 +46,14 @@ module.exports = {
     consoleAdapter.emitter.off(event, listener);
     return module.exports;
   },
+
+  // Suppress (false) or restore (true, the default) the tool Console's
+  // own terminal rendering. "log" events keep flowing either way --
+  // embedders with their own progress UI turn this off around a phase
+  // and paint the events themselves. See README.
+  setConsoleOutput: consoleAdapter.setConsoleOutput,
+
+  // Opt back in to the tool's own interactive progress bar (disabled by
+  // default for embedders); renders only when stdout is a TTY. See README.
+  setProgressDisplay: consoleAdapter.setProgressDisplay,
 };

package/src/run.js

@@ -27,10 +27,15 @@ async function createAppRunner(project, options) {
   assertInitialized();
 
   options = options || {};
-  if (!options.mongoUrl) {
+  // mongoUrl: null is a deliberate "this app doesn't use the mongo
+  // package" (no MONGO_URL is set for the app process); undefined still
+  // means the caller forgot.
+  if (options.mongoUrl === undefined) {
     throw new MeteorSdkError(
       "createAppRunner() requires options.mongoUrl -- meteor-sdk doesn't " +
-        "manage a mongod process for you (see README.md)"
+        "manage a mongod process for you (see README.md). Pass " +
+        "mongoUrl: null explicitly for an app that doesn't use the mongo " +
+        "package at all."
     );
   }
 
@@ -64,7 +69,10 @@ async function createAppRunner(project, options) {
     projectContext: project._projectContext,
     port: appPort,
     listenHost: options.appHost,
-    mongoUrl: options.mongoUrl,
+    // || undefined: a null mongoUrl must not reach the app's environment
+    // (env.MONGO_URL = null would be stringified to "null" by spawn;
+    // undefined-valued env keys are dropped instead).
+    mongoUrl: options.mongoUrl || undefined,
     oplogUrl: options.oplogUrl,
     rootUrl,
     proxy,

package/tools/isobuild/meteor-npm.js

@@ -957,6 +957,36 @@ const npmUserConfigFile = files.pathJoin(
   "meteor-npm-userconfig"
 );
 
+// The npm major version of the system npm these installs spawn --
+// resolved once per process. Needed because npm 12 changed script
+// execution policy: install-time lifecycle scripts are SKIPPED unless
+// covered by allow-scripts, which silently breaks native-binding deps
+// (@meteorjs/swc-core's postinstall never runs -> no binding -> builds
+// fail much later). --dangerously-allow-all-scripts restores the
+// pre-npm-12 behavior for these tool-controlled installs (the deps come
+// from meteor's own package manifests, same trust model npm<=11 always
+// had) -- but the flag can't be passed unconditionally: npm 12 hard-errors
+// on flags it doesn't recognize, and vice versa older npms warn/err on
+// unknown ones, so it's gated on the detected major.
+let npmMajorVersionPromise = null;
+function getNpmMajorVersion(commandToRun, npmPath, isWindows, env) {
+  if (!npmMajorVersionPromise) {
+    npmMajorVersionPromise = new Promise(function (resolve) {
+      const versionArgs = isWindows
+        ? ['/c', npmPath, '--version']
+        : ['--version'];
+      require('child_process').execFile(
+        commandToRun, versionArgs, { env },
+        function (err, stdout) {
+          const major = err ? NaN : parseInt(String(stdout).trim(), 10);
+          resolve(Number.isNaN(major) ? 0 : major);
+        }
+      );
+    });
+  }
+  return npmMajorVersionPromise;
+}
+
 var runNpmCommand = meteorNpm.runNpmCommand =
 Profile("meteorNpm.runNpmCommand", async function (args, cwd) {
   import { getEnv } from "../utils/dev-bundle-env.js";
@@ -978,6 +1008,33 @@ Profile("meteorNpm.runNpmCommand", async function (args, cwd) {
   // http://nodejs.org/api/child_process.html#child_process_shell_requirements.
 
   let commandToRun = npmPath;
+
+  const env = await getEnv({devBundle: toolRootDir});
+  // Make sure we don't honor any user-provided configuration files.
+  env.npm_config_userconfig = npmUserConfigFile;
+
+  // npm 12 skips uncovered install scripts (see getNpmMajorVersion's
+  // comment); restore full script execution for the script-running
+  // subcommands only.
+  const npmMajor = await getNpmMajorVersion(
+    isWindows ? (process.env.ComSpec || "cmd.exe") : npmPath,
+    npmPath, isWindows, env
+  );
+  const runsScripts = ['install', 'i', 'ci', 'rebuild', 'update'].includes(args[0]);
+  if (npmMajor >= 12 && runsScripts) {
+    // Also restore git/tarball-URL dependency fetching: npm 12 defaults
+    // allow-git and allow-remote to "none", but core packages
+    // legitimately pin such deps (e.g. ddp-server's uWebSockets.js,
+    // which upstream only distributes via GitHub) -- EALLOWGIT broke
+    // every fresh machine's first build of ddp-server.
+    args = [
+      ...args,
+      '--dangerously-allow-all-scripts',
+      '--allow-git=all',
+      '--allow-remote=all',
+    ];
+  }
+
   if (isWindows) {
     args = ['/c', npmPath, ...args];
     commandToRun = process.env.ComSpec || "cmd.exe";
@@ -989,20 +1046,22 @@ Profile("meteorNpm.runNpmCommand", async function (args, cwd) {
                          args.join(' ') + ' ...\n');
   }
 
-  const env = await getEnv({devBundle: toolRootDir});
-
   const opts = {
     env: env,
-    maxBuffer: 10 * 1024 * 1024
+    maxBuffer: 10 * 1024 * 1024,
+    // stdin 'ignore', NOT the default open pipe: a child npm that decides
+    // to prompt (npm 12's interactive allow-scripts confirmation, auth
+    // prompts, ...) would otherwise block forever on a pipe nobody writes
+    // to -- observed as a hard hang (^C-immune) during a fresh machine's
+    // first `maka create` on an npm 12 box. With stdin closed, npm sees
+    // a non-interactive session and warns/skips instead of waiting.
+    stdio: ['ignore', 'pipe', 'pipe'],
   };
 
   if (cwd) {
     opts.cwd = files.convertToOSPath(cwd);
   }
 
-  // Make sure we don't honor any user-provided configuration files.
-  env.npm_config_userconfig = npmUserConfigFile;
-
   return new Promise(function (resolve) {
     require('child_process').execFile(
         commandToRun, args, opts, function (err, stdout, stderr) {

package/tools/runners/mongo-download.js

@@ -197,6 +197,9 @@ exports.ensureMongod = async function () {
   var buffer = await httpHelpers.getUrlWithResuming({
     url: downloadInfo.url,
     encoding: null,
+    // The GitHub release-asset URL (linux x64) always 302s to a storage
+    // host; without this the redirect stub itself would be "extracted".
+    followRedirects: true,
   });
 
   files.mkdir_p(files.pathDirname(cacheDir));

package/tools/utils/http-helpers.js

@@ -126,9 +126,13 @@ Object.assign(exports, {
   // - Respects HTTP_PROXY/HTTPS_PROXY, sets a Meteor User-Agent, honors
   //   $CAFILE for a custom CA.
   //
-  // - Never follows redirects (fetch redirect: "manual"): redirects
-  //   don't segregate cookies/headers by origin, and callers like the
-  //   OAuth flow in auth.js depend on seeing the 302 themselves.
+  // - Never follows redirects by default (fetch redirect: "manual"):
+  //   redirects don't segregate cookies/headers by origin, and callers
+  //   like the OAuth flow in auth.js depend on seeing the 302
+  //   themselves. Credential-less GET downloads (e.g. a GitHub release
+  //   asset, which always 302s to a storage host) can opt in with
+  //   followRedirects: true (5 hops) or a hop count; session/auth
+  //   headers are dropped on any cross-origin hop.
   //
   // - Options: url (or a bare url string instead of the object), method,
   //   headers, qs (object appended to the url as a query string),
@@ -281,19 +285,57 @@ Object.assign(exports, {
         fetchBody = options.body;
       }
 
+      // Opt-in redirect following -- see the doc block. Only safe for
+      // requests whose body (if any) isn't a one-shot stream.
+      var maxRedirects = 0;
+      if (options.followRedirects === true) {
+        maxRedirects = 5;
+      } else if (typeof options.followRedirects === "number" &&
+                 options.followRedirects > 0) {
+        maxRedirects = options.followRedirects;
+      }
+
       var res;
       try {
-        armIdleTimer();
-        res = await undici.fetch(url, {
-          method: options.method || 'GET',
-          headers: headers,
-          body: fetchBody,
-          // See the redirect comment in this function's doc block.
-          redirect: 'manual',
-          signal: controller.signal,
-          dispatcher: buildDispatcher(url, undici),
-          ...(bodyStream ? { duplex: 'half' } : null),
-        });
+        var currentUrl = url;
+        var currentMethod = options.method || 'GET';
+        var currentHeaders = headers;
+        for (var hop = 0; ; hop++) {
+          armIdleTimer();
+          res = await undici.fetch(currentUrl, {
+            method: currentMethod,
+            headers: currentHeaders,
+            body: fetchBody,
+            // See the redirect comment in this function's doc block.
+            redirect: 'manual',
+            signal: controller.signal,
+            dispatcher: buildDispatcher(currentUrl, undici),
+            ...(bodyStream ? { duplex: 'half' } : null),
+          });
+
+          var redirectLocation = res.headers.get('location');
+          if (hop < maxRedirects && redirectLocation &&
+              [301, 302, 303, 307, 308].indexOf(res.status) !== -1) {
+            if (res.body) {
+              try { await res.body.cancel(); } catch (e) { /* best effort */ }
+            }
+            var nextUrl = new URL(redirectLocation, currentUrl).href;
+            if (new URL(nextUrl).origin !== new URL(url).origin) {
+              // Never leak Meteor-services credentials across origins.
+              currentHeaders = _.omit(currentHeaders,
+                'X-Meteor-Session', 'X-Meteor-Auth', 'Authorization', 'Cookie');
+            }
+            if (res.status === 303 ||
+                ((res.status === 301 || res.status === 302) &&
+                 currentMethod !== 'GET' && currentMethod !== 'HEAD')) {
+              currentMethod = 'GET';
+              fetchBody = undefined;
+            }
+            currentUrl = nextUrl;
+            continue;
+          }
+          break;
+        }
 
         // Response shape: the subset of the old request-package response
         // object our callers actually read.
@@ -310,7 +352,7 @@ Object.assign(exports, {
         var response = {
           statusCode: res.status,
           headers: headerObj,
-          request: { href: url },
+          request: { href: currentUrl },
         };
 
         // Stream the response body: to outputStream when given (body
@@ -493,6 +535,17 @@ Object.assign(exports, {
       const href = response.request.href;
       throw Error(`Could not get ${href}; server returned [${response.statusCode}]`);
     }
+    // A download must never silently accept a redirect body as the
+    // payload (a GitHub release URL 302s; un-gzipping the redirect stub
+    // yields "unexpected end of file"). Callers that expect a redirect
+    // should pass followRedirects.
+    if (response.statusCode >= 300 && response.statusCode < 400) {
+      const href = response.request.href;
+      throw Error(
+        `Could not get ${href}; server redirected [${response.statusCode}] ` +
+          `to ${response.headers.location || "(no Location)"} -- pass ` +
+          `followRedirects to follow it`);
+    }
 
     // Really end the stream if we got this far.
     outputStream.end(true);