@maka/meteor-sdk 0.2.5 → 0.2.7

package/README.md

@@ -94,7 +94,11 @@ await handle.stop(); // stops the proxy, then the app; no orphaned processes
 
 **No Mongo lifecycle management.** Unlike `meteor run`, `createAppRunner()`
 does not start or stop a `mongod` for you -- supply a running Mongo's
-connection string via `mongoUrl`.
+connection string via `mongoUrl`. For an app that doesn't use the `mongo`
+package at all, pass `mongoUrl: null` explicitly: no `MONGO_URL` is set
+for the app process. (An app that *does* load the `mongo` package will
+crash at startup without one -- the explicit `null` is how you take
+responsibility for that.)
 
 There is no separate `stdout`/`stderr` event -- all app log output is
 observable via `sdk.on("log", ...)` (see below).
@@ -191,6 +195,26 @@ regardless of whether it hangs, or set `METEOR_MODERN='{"watcher":false}'`
 to use the plain polling watcher instead, which doesn't exhibit either
 symptom.
 
+### `setConsoleOutput(enabled)`
+
+By default the tool's Console renders informational output to this
+process's stdout/stderr *and* emits it as `log` events. An embedder
+with its own progress UI (spinners, status lines) can call
+`sdk.setConsoleOutput(false)` to suppress the terminal rendering --
+newline-terminated Console writes landing between spinner redraws
+garble the terminal otherwise -- and paint the emitted events itself.
+Scoping it to a phase (off around a build, back on after) is the
+intended use; events keep flowing either way.
+
+### `setProgressDisplay(enabled)`
+
+The tool's own interactive progress bar (the classic `meteor run`
+"Building the application" bar) is disabled by default for embedders.
+`sdk.setProgressDisplay(true)` turns it back on for long build phases --
+it renders only when this process's stdout is a real TTY, and falls back
+to no display otherwise, so it's always safe to call. Turn it off again
+with `false` when your own UI takes over the terminal.
+
 ### Events
 
 ```js

package/isopackets/combined/npm/node_modules/meteor/babel-compiler/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-6k929wsbwx9",
+  "name": "package-new-f7zc3uwzqd",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/boilerplate-generator/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-2mclqghmngi",
+  "name": "package-new-11u4nyz3m9h",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/constraint-solver/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-icvdrmvpe98",
+  "name": "package-new-19xm9ai37ix",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ddp-client/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1l89kpenr14",
+  "name": "package-new-v6ef0vjx4rg",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ecmascript/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1a111eybcxg",
+  "name": "package-new-19jq08w84he",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ecmascript-runtime/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-4otzch89cvg",
+  "name": "package-new-2joq5lmn8iv",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ecmascript-runtime-client/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1j6yd8m9jmr",
+  "name": "package-new-1b0zb0554sz",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/ecmascript-runtime-server/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-u5yoxmo7e8",
+  "name": "package-new-1yhi9f1h0dr",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/fetch/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-gl6nw0kh6ad",
+  "name": "package-new-g0ym7mkawu",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/inter-process-messaging/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1s0oep6bdbh",
+  "name": "package-new-1qllbsq0y73",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/logging/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-3esnphw257u",
+  "name": "package-new-1v2yf9qqbze",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/logic-solver/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-aalglzldmd",
+  "name": "package-new-1o46fz1ku6f",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/meteor/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-170bck5w9fh",
+  "name": "package-new-1pc9xzx5fzs",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/modules/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-flkytgvx9c",
+  "name": "package-new-17beqs9hinb",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/modules-runtime/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-i7wq86jxilm",
+  "name": "package-new-n8k3j4ylx3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/npm-mongo/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1l34vs5ock9",
+  "name": "package-new-12nqeukaw3u",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/package-version-parser/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-5gfs3kuobru",
+  "name": "package-new-1t0jc7k23ytg",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/promise/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-17orohwcgko",
+  "name": "package-new-d6edvk3v9nl",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/react-fast-refresh/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-1srjvp9mfq6",
+  "name": "package-new-8e8v01oivjc",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/isopackets/combined/npm/node_modules/meteor/socket-stream-client/node_modules/.package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "package-new-18nqdduk0bm",
+  "name": "package-new-3efvozmolln",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maka/meteor-sdk",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "Programmatic Node API over the Meteor build tool (bundle/run/create/etc.) -- for driving Meteor's build system from plain Node code instead of shelling out to a meteor CLI (there isn't one anymore; see README.md). \"dependencies\" is generated by scripts/write-tool-package-json.js from scripts/dev-bundle-tool-package.js at the monorepo root -- do not hand-edit that field, edit that file and re-run the script instead.",
   "main": "src/index.js",
   "exports": {

package/src/console.js

@@ -52,6 +52,13 @@ function patch() {
     }
     Console[level] = function (...args) {
       emitter.emit("log", { level, args });
+      if (!terminalOutput) {
+        // The embedder has claimed the terminal (setConsoleOutput(false)):
+        // events still flow above, but the tool's own stdout/stderr
+        // rendering is suppressed so it can't collide with the
+        // embedder's spinners/progress UI.
+        return undefined;
+      }
       return original.apply(Console, args);
     };
   });
@@ -60,4 +67,44 @@ function patch() {
   return emitter;
 }
 
-module.exports = { setHeadlessEnv, patch, emitter };
+// Whether the tool's Console also renders to this process's
+// stdout/stderr (the default), in addition to emitting "log" events.
+// Embedders that render their own progress UI (spinners, status lines)
+// can turn this off -- newline-terminated Console writes landing between
+// spinner redraws otherwise garble the terminal -- and paint the emitted
+// events however they like. Toggle freely: scoping it to a phase (off
+// around a build, back on afterward) is the intended use.
+let terminalOutput = true;
+function setConsoleOutput(enabled) {
+  terminalOutput = !!enabled;
+}
+
+// Opt back in to the tool's own interactive progress bar (the classic
+// `meteor run` "Building web.browser [====   ]" display), which patch()
+// disables by default for embedders. Only actually renders a bar when
+// this process's stdout is a real TTY -- otherwise the tool falls back
+// to its no-op display on its own, so this is always safe to call.
+// The ordering below matters: setPretty()/enableProgressDisplay()
+// construct a fresh ProgressDisplay (which re-reads METEOR_HEADLESS,
+// set by setHeadlessEnv()), so setHeadless(false) must come last to
+// propagate onto the newly built display.
+function setProgressDisplay(enabled) {
+  const { Console } = require("../tools/console/console.js");
+  if (enabled) {
+    Console.setPretty(true);
+    Console.enableProgressDisplay(true);
+    Console.setHeadless(false);
+  } else {
+    Console.enableProgressDisplay(false);
+    Console.setPretty(false);
+    Console.setHeadless(true);
+  }
+}
+
+module.exports = {
+  setHeadlessEnv,
+  patch,
+  emitter,
+  setConsoleOutput,
+  setProgressDisplay,
+};

package/src/index.js

@@ -46,4 +46,14 @@ module.exports = {
     consoleAdapter.emitter.off(event, listener);
     return module.exports;
   },
+
+  // Suppress (false) or restore (true, the default) the tool Console's
+  // own terminal rendering. "log" events keep flowing either way --
+  // embedders with their own progress UI turn this off around a phase
+  // and paint the events themselves. See README.
+  setConsoleOutput: consoleAdapter.setConsoleOutput,
+
+  // Opt back in to the tool's own interactive progress bar (disabled by
+  // default for embedders); renders only when stdout is a TTY. See README.
+  setProgressDisplay: consoleAdapter.setProgressDisplay,
 };

package/src/run.js

@@ -27,10 +27,15 @@ async function createAppRunner(project, options) {
   assertInitialized();
 
   options = options || {};
-  if (!options.mongoUrl) {
+  // mongoUrl: null is a deliberate "this app doesn't use the mongo
+  // package" (no MONGO_URL is set for the app process); undefined still
+  // means the caller forgot.
+  if (options.mongoUrl === undefined) {
     throw new MeteorSdkError(
       "createAppRunner() requires options.mongoUrl -- meteor-sdk doesn't " +
-        "manage a mongod process for you (see README.md)"
+        "manage a mongod process for you (see README.md). Pass " +
+        "mongoUrl: null explicitly for an app that doesn't use the mongo " +
+        "package at all."
     );
   }
 
@@ -64,7 +69,10 @@ async function createAppRunner(project, options) {
     projectContext: project._projectContext,
     port: appPort,
     listenHost: options.appHost,
-    mongoUrl: options.mongoUrl,
+    // || undefined: a null mongoUrl must not reach the app's environment
+    // (env.MONGO_URL = null would be stringified to "null" by spawn;
+    // undefined-valued env keys are dropped instead).
+    mongoUrl: options.mongoUrl || undefined,
     oplogUrl: options.oplogUrl,
     rootUrl,
     proxy,

package/tools/isobuild/meteor-npm.js

@@ -731,6 +731,8 @@ var updateExistingNpmDirectory = async function (packageName, newPackageNpmDir,
     npmTree.dependencies[name] = { version };
   });
 
+  reconcileGitDependencies(npmTree, installedDependenciesTree);
+
   let minInstalledTree;
   try {
     minInstalledTree = minimizeDependencyTree(installedDependenciesTree);
@@ -838,6 +840,72 @@ var updateExistingNpmDirectory = async function (packageName, newPackageNpmDir,
                        npmDependencies);
 };
 
+// Git-URL dependencies could never satisfy the strict string comparison
+// in updateExistingNpmDirectory: Npm.depends declares the spec the
+// author wrote (e.g. "git+https://github.com/org/repo#v1.2.3") while
+// npm's lockfile records what it resolved (e.g.
+// "git+ssh://git@github.com/org/repo.git#<commit-sha>"). The result was
+// a FULL reinstall of the package's npm deps -- git clone included --
+// on every single build, and during `run` the .npm/package churn could
+// re-fire the file watcher, restarting the app in a loop ("ddp-server:
+// updating npm dependencies ..." flapping forever).
+//
+// Reconcile before comparing: a declared git dep is satisfied by an
+// installed copy from the same repository when the declared ref is
+// consistent with what's installed -- a commit-sha ref must prefix the
+// resolved sha, a "v1.2.3"/"1.2.3" tag must equal the installed
+// package's own version, and a symbolic ref (branch) is accepted as-is
+// (it can move upstream, but reinstalling every build is strictly
+// worse; pin by tag or sha for reproducibility). On a match the
+// declared version is rewritten to the installed resolved URL so the
+// strict subtree comparison passes; on a mismatch (e.g. the tag was
+// bumped) nothing is rewritten and the normal update runs.
+function parseGitUrl(url) {
+  if (typeof url !== "string") {
+    return null;
+  }
+  const m = url.match(
+    /^git\+(?:https?|ssh|git|file):\/\/(?:[^@/]+@)?([^#?]+?)(?:\.git)?(?:#(.*))?$/i
+  );
+  if (! m) {
+    return null;
+  }
+  return { repo: m[1].toLowerCase(), ref: m[2] || null };
+}
+
+function reconcileGitDependencies(npmTree, installedTree) {
+  _.each(npmTree.dependencies, (dep, name) => {
+    const declared = parseGitUrl(dep.version);
+    if (! declared) {
+      return;
+    }
+    const installed = installedTree.dependencies &&
+      installedTree.dependencies[name];
+    const resolved = installed && parseGitUrl(installed.resolved);
+    if (! resolved || resolved.repo !== declared.repo) {
+      return;
+    }
+    const ref = declared.ref;
+    let refSatisfied;
+    if (! ref) {
+      refSatisfied = true;
+    } else if (/^[0-9a-f]{7,40}$/i.test(ref)) {
+      refSatisfied = !! resolved.ref &&
+        resolved.ref.toLowerCase().startsWith(ref.toLowerCase());
+    } else if (/^v?\d+(\.\d+)*([-+.].*)?$/.test(ref)) {
+      refSatisfied = !! installed.version &&
+        ref.replace(/^v/, "") === installed.version;
+    } else {
+      refSatisfied = true;
+    }
+    if (refSatisfied) {
+      dep.version = minimizeDependencyTree({
+        dependencies: { [name]: installed },
+      }).dependencies[name].version;
+    }
+  });
+}
+
 function isSubtreeOf(subsetTree, supersetTree, predicate) {
   if (subsetTree === supersetTree) {
     return true;

package/tools/runners/mongo-download.js

@@ -197,6 +197,9 @@ exports.ensureMongod = async function () {
   var buffer = await httpHelpers.getUrlWithResuming({
     url: downloadInfo.url,
     encoding: null,
+    // The GitHub release-asset URL (linux x64) always 302s to a storage
+    // host; without this the redirect stub itself would be "extracted".
+    followRedirects: true,
   });
 
   files.mkdir_p(files.pathDirname(cacheDir));

package/tools/utils/http-helpers.js

@@ -126,9 +126,13 @@ Object.assign(exports, {
   // - Respects HTTP_PROXY/HTTPS_PROXY, sets a Meteor User-Agent, honors
   //   $CAFILE for a custom CA.
   //
-  // - Never follows redirects (fetch redirect: "manual"): redirects
-  //   don't segregate cookies/headers by origin, and callers like the
-  //   OAuth flow in auth.js depend on seeing the 302 themselves.
+  // - Never follows redirects by default (fetch redirect: "manual"):
+  //   redirects don't segregate cookies/headers by origin, and callers
+  //   like the OAuth flow in auth.js depend on seeing the 302
+  //   themselves. Credential-less GET downloads (e.g. a GitHub release
+  //   asset, which always 302s to a storage host) can opt in with
+  //   followRedirects: true (5 hops) or a hop count; session/auth
+  //   headers are dropped on any cross-origin hop.
   //
   // - Options: url (or a bare url string instead of the object), method,
   //   headers, qs (object appended to the url as a query string),
@@ -281,19 +285,57 @@ Object.assign(exports, {
         fetchBody = options.body;
       }
 
+      // Opt-in redirect following -- see the doc block. Only safe for
+      // requests whose body (if any) isn't a one-shot stream.
+      var maxRedirects = 0;
+      if (options.followRedirects === true) {
+        maxRedirects = 5;
+      } else if (typeof options.followRedirects === "number" &&
+                 options.followRedirects > 0) {
+        maxRedirects = options.followRedirects;
+      }
+
       var res;
       try {
-        armIdleTimer();
-        res = await undici.fetch(url, {
-          method: options.method || 'GET',
-          headers: headers,
-          body: fetchBody,
-          // See the redirect comment in this function's doc block.
-          redirect: 'manual',
-          signal: controller.signal,
-          dispatcher: buildDispatcher(url, undici),
-          ...(bodyStream ? { duplex: 'half' } : null),
-        });
+        var currentUrl = url;
+        var currentMethod = options.method || 'GET';
+        var currentHeaders = headers;
+        for (var hop = 0; ; hop++) {
+          armIdleTimer();
+          res = await undici.fetch(currentUrl, {
+            method: currentMethod,
+            headers: currentHeaders,
+            body: fetchBody,
+            // See the redirect comment in this function's doc block.
+            redirect: 'manual',
+            signal: controller.signal,
+            dispatcher: buildDispatcher(currentUrl, undici),
+            ...(bodyStream ? { duplex: 'half' } : null),
+          });
+
+          var redirectLocation = res.headers.get('location');
+          if (hop < maxRedirects && redirectLocation &&
+              [301, 302, 303, 307, 308].indexOf(res.status) !== -1) {
+            if (res.body) {
+              try { await res.body.cancel(); } catch (e) { /* best effort */ }
+            }
+            var nextUrl = new URL(redirectLocation, currentUrl).href;
+            if (new URL(nextUrl).origin !== new URL(url).origin) {
+              // Never leak Meteor-services credentials across origins.
+              currentHeaders = _.omit(currentHeaders,
+                'X-Meteor-Session', 'X-Meteor-Auth', 'Authorization', 'Cookie');
+            }
+            if (res.status === 303 ||
+                ((res.status === 301 || res.status === 302) &&
+                 currentMethod !== 'GET' && currentMethod !== 'HEAD')) {
+              currentMethod = 'GET';
+              fetchBody = undefined;
+            }
+            currentUrl = nextUrl;
+            continue;
+          }
+          break;
+        }
 
         // Response shape: the subset of the old request-package response
         // object our callers actually read.
@@ -310,7 +352,7 @@ Object.assign(exports, {
         var response = {
           statusCode: res.status,
           headers: headerObj,
-          request: { href: url },
+          request: { href: currentUrl },
         };
 
         // Stream the response body: to outputStream when given (body
@@ -493,6 +535,17 @@ Object.assign(exports, {
       const href = response.request.href;
       throw Error(`Could not get ${href}; server returned [${response.statusCode}]`);
     }
+    // A download must never silently accept a redirect body as the
+    // payload (a GitHub release URL 302s; un-gzipping the redirect stub
+    // yields "unexpected end of file"). Callers that expect a redirect
+    // should pass followRedirects.
+    if (response.statusCode >= 300 && response.statusCode < 400) {
+      const href = response.request.href;
+      throw Error(
+        `Could not get ${href}; server redirected [${response.statusCode}] ` +
+          `to ${response.headers.location || "(no Location)"} -- pass ` +
+          `followRedirects to follow it`);
+    }
 
     // Really end the stream if we got this far.
     outputStream.end(true);