@michaelthielemann/kestrel 1.4.0 → 1.4.1

package/README.md

@@ -36,7 +36,7 @@ static host. It is deliberately **not**:
 ## Features
 
 - **Runnable in one command** — `pnpm create kestrel` scaffolds a project that boots with a working
-  `/admin`, prompting for the admin password and writing its hash; `kestrel init` does the same to an
+  `/admin`, asking you to choose the admin password and writing its hash; `kestrel init` does the same to an
   existing project without clobbering it, and `kestrel doctor` names whatever is still missing.
 - **Collection-driven** — declare collections + fields in TypeScript; Kestrel derives the SQLite tables, a
   typed CRUD REST API, and the full admin UI. The schema **migrates itself** (additive in dev; explicit
@@ -66,7 +66,7 @@ pnpm create kestrel my-site
 cd my-site && pnpm install && pnpm dev
 ```
 
-It asks for an admin password and writes a project that runs as-is: `nuxt.config.ts` extending the
+It asks you to choose an admin password and writes a project that runs as-is: `nuxt.config.ts` extending the
 meta-layer, an `app.vue` that renders, a `.env` holding a fresh session secret and the scrypt hash of
 your password, and one example block. Sign in at <http://localhost:3000/admin>.
 

package/nuxt.config.ts

@@ -83,22 +83,25 @@ export default defineNuxtConfig({
   vite: {
     build: { rollupOptions: { onwarn } },
     optimizeDeps: {
-      // Nested "kestrel > dep" form: Vite resolves each dep from the `kestrel` PACKAGE's directory
-      // rather than the (consumer) project root. Under pnpm these are kestrel's transitive deps and
-      // are NOT hoisted into a consumer's top-level node_modules, so a bare specifier is
-      // "Unresolvable" from the consumer root. In-repo `kestrel` is not a resolvable package name, so
-      // Vite's nestedResolveBasedir falls back to the repo root where these deps ARE hoisted — same
-      // result. The runtime `import('@tiptap/...')` still reuses the pre-bundle (tryOptimizedResolve
-      // matches the "> dep" id + src dir).
+      // Nested "<pkg> > dep" form: Vite resolves each dep from THIS package's directory rather than from
+      // the consumer's project root. It has to be the published name — under pnpm these are kestrel's
+      // transitive deps and are not hoisted into a consumer's top-level node_modules, so resolving from
+      // the root finds nothing. An unresolvable prefix is swallowed (`resolvePackageData(…)?.dir ||
+      // basedir`), and the entry then degrades to a bare lookup from the root: fine in-repo and for a
+      // hoisted npm/yarn consumer, silently unbundled for a pnpm one — which is why a stale prefix shows
+      // up only in a consumer's terminal. In-repo the name is likewise unresolvable and that same
+      // fallback lands on the repo root, where the deps ARE hoisted. The runtime `import('@tiptap/...')`
+      // still reuses the pre-bundle (tryOptimizedResolve matches the "> dep" id + src dir).
+      // `test/package.test.ts` pins the prefix to package.json's `name`.
       include: [
-        'kestrel > @internationalized/date',
-        'kestrel > @tiptap/extension-highlight',
-        'kestrel > @tiptap/extension-subscript',
-        'kestrel > @tiptap/extension-superscript',
-        'kestrel > @tiptap/extension-text-align',
-        'kestrel > @tiptap/starter-kit',
-        'kestrel > @tiptap/vue-3',
-        'kestrel > reka-ui',
+        '@michaelthielemann/kestrel > @internationalized/date',
+        '@michaelthielemann/kestrel > @tiptap/extension-highlight',
+        '@michaelthielemann/kestrel > @tiptap/extension-subscript',
+        '@michaelthielemann/kestrel > @tiptap/extension-superscript',
+        '@michaelthielemann/kestrel > @tiptap/extension-text-align',
+        '@michaelthielemann/kestrel > @tiptap/starter-kit',
+        '@michaelthielemann/kestrel > @tiptap/vue-3',
+        '@michaelthielemann/kestrel > reka-ui',
       ],
     },
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michaelthielemann/kestrel",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "A slim, collection-driven Nuxt 4 CMS meta-layer with a runtime schema engine. Add `extends: ['@michaelthielemann/kestrel']`, define collections, and the database migrates itself.",
   "license": "Apache-2.0",
   "author": "Michael Thielemann <283621694+MichaelThielemann@users.noreply.github.com>",

package/scripts/hash-password.mjs

@@ -1,5 +1,6 @@
 import { createInterface } from 'node:readline'
 import { hashPassword } from './lib/password.mjs'
+import { Cancelled, promptPassword } from './lib/cli.mjs'
 
 // Not used at runtime: this prints a value an operator pastes into KESTREL_ADMIN_PASSWORD_HASH. Kept as a
 // standalone entry point because docs/consuming-kestrel.md tells consumers to run it straight out of
@@ -7,7 +8,18 @@ import { hashPassword } from './lib/password.mjs'
 const arg = process.argv[2]
 if (arg) {
   process.stdout.write(hashPassword(arg) + '\n')
+} else if (process.stdin.isTTY) {
+  // Only the hash may reach stdout — an operator pipes it straight into a secret store.
+  try {
+    process.stdout.write(hashPassword(await promptPassword({ output: process.stderr })) + '\n')
+  } catch (err) {
+    if (!(err instanceof Cancelled)) throw err
+    process.stderr.write('cancelled\n')
+    process.exitCode = 1
+  }
 } else {
+  // `terminal: false` keeps the piped form (`echo pw | node hash-password.mjs`) working; it is only safe
+  // because stdin is not a tty here, so there is no line discipline echoing the password onto a screen.
   const rl = createInterface({ input: process.stdin, terminal: false })
   process.stderr.write('Enter password, then press Enter:\n')
   rl.on('line', (line) => {

package/scripts/kestrel.mjs

@@ -2,7 +2,6 @@
 import { existsSync, mkdirSync, readFileSync } from 'node:fs'
 import { join, resolve, basename, relative } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { createInterface } from 'node:readline/promises'
 import { hashPassword, sessionSecret } from './lib/password.mjs'
 import { PACKAGE_NAME, diagnoseProject, mergeEnv, mergePackageJson, renderTemplate, targetName, toPackageName } from './lib/scaffold.mjs'
 import { Cancelled, MIN_PASSWORD_LENGTH, makePaint, out, parseArgs, promptPassword, readIf, readStdin, walk, write } from './lib/cli.mjs'
@@ -71,15 +70,12 @@ async function init(positional, flags) {
   out()
 
   if (password === undefined && !flags.yes && process.stdin.isTTY) {
-    const rl = createInterface({ input: process.stdin, output: process.stdout })
     try {
-      password = await promptPassword(rl, { warn: (m) => out(yellow(m)) })
+      password = await promptPassword({ warn: (m) => out(yellow(m)), note: (m) => out(dim(m)) })
     } catch (err) {
-      rl.close()
       if (err instanceof Cancelled) fail('cancelled')
       throw err
     }
-    rl.close()
     out()
   }
 
@@ -170,15 +166,14 @@ async function hashPasswordCommand(positional) {
   let password = positional[0]
   if (password === undefined) {
     if (process.stdin.isTTY) {
-      const rl = createInterface({ input: process.stdin, output: process.stdout })
+      // Only the hash may reach stdout — an operator redirects it straight into a secret store.
+      const ask = (m) => process.stderr.write(`${m}\n`)
       try {
-        password = await promptPassword(rl, { warn: (m) => out(yellow(m)) })
+        password = await promptPassword({ output: process.stderr, warn: (m) => ask(yellow(m)), note: (m) => ask(dim(m)) })
       } catch (err) {
-        rl.close()
         if (err instanceof Cancelled) fail('cancelled')
         throw err
       }
-      rl.close()
     } else password = await readStdin()
   }
   if (!password) fail('no password given')

package/scripts/lib/cli.mjs

@@ -1,5 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, chmodSync } from 'node:fs'
 import { dirname, join, relative } from 'node:path'
+import { createInterface } from 'node:readline/promises'
 
 export const MIN_PASSWORD_LENGTH = 8
 
@@ -65,44 +66,58 @@ export function walk(dir, base = dir) {
   return found
 }
 
-/**
- * Reads a line with the echo suppressed. readline echoes before we see the data event, so the fix is to
- * repaint the prompt over whatever was written — unconditionally, because a pasted secret arrives as one
- * chunk that ends in a newline and would otherwise be left on screen and in the scrollback.
- */
-async function askHidden(rl, question) {
-  const repaint = () => process.stdout.write(`\u001b[2K\u001b[200D${question}`)
-  process.stdin.on('data', repaint)
+/** Reads a line the interface is configured never to echo, so the prompt is ours to draw and to close. */
+async function askHidden(rl, question, write) {
+  write(question)
   try {
-    return (await rl.question(question)).trim()
+    return (await rl.question('')).trim()
   } finally {
-    process.stdin.off('data', repaint)
-    repaint()
-    process.stdout.write('\n')
+    write('\n')
   }
 }
 
 export class Cancelled extends Error {}
 
-/** Throws `Cancelled` on Ctrl-C / Ctrl-D so a caller can exit cleanly instead of on an AbortError stack. */
-export async function promptPassword(rl, { warn = out } = {}) {
-  for (;;) {
-    let first
-    try {
-      first = await askHidden(rl, 'Admin password: ')
-      if (first.length < MIN_PASSWORD_LENGTH) {
-        warn(`  at least ${MIN_PASSWORD_LENGTH} characters, please`)
-        continue
-      }
-      if (first !== (await askHidden(rl, 'Repeat password: '))) {
-        warn('  the two entries differ — try again')
-        continue
+/**
+ * Owns its readline interface, because the two options that keep the secret off the screen can only be
+ * set at construction: `output: null` makes readline write nothing at all, and `terminal: true` still
+ * gives it the keypress handling (backspace, Ctrl-C, Ctrl-D) that would otherwise fall to the tty's own
+ * echoing line discipline. Erasing readline's echo afterwards cannot match that — a pasted secret arrives
+ * as one chunk that is echoed AND newlined in a single write, stranding the cleartext on a line no
+ * repaint can still reach, and a redirected stdout leaves `terminal` false with nothing to suppress.
+ *
+ * Throws `Cancelled` on Ctrl-C / Ctrl-D so a caller can exit cleanly instead of on an AbortError stack.
+ */
+export async function promptPassword({
+  input = process.stdin,
+  output = process.stdout,
+  warn = (m) => output.write(`${m}\n`),
+  note = (m) => output.write(`${m}\n`),
+} = {}) {
+  const draw = (s) => output.write(s)
+  const rl = createInterface({ input, output: null, terminal: true })
+  note(`Choose a password for /admin — at least ${MIN_PASSWORD_LENGTH} characters, kept only as a scrypt hash.`)
+  try {
+    for (;;) {
+      let first
+      try {
+        first = await askHidden(rl, 'New admin password: ', draw)
+        if (first.length < MIN_PASSWORD_LENGTH) {
+          warn(`  too short — at least ${MIN_PASSWORD_LENGTH} characters`)
+          continue
+        }
+        if (first !== (await askHidden(rl, 'Repeat password: ', draw))) {
+          warn('  the two entries differ — try again')
+          continue
+        }
+      } catch (err) {
+        throw err?.code === 'ABORT_ERR' ? new Cancelled() : err
       }
-    } catch (err) {
-      throw err?.code === 'ABORT_ERR' ? new Cancelled() : err
+      if (first === undefined) throw new Cancelled()
+      return first
     }
-    if (first === undefined) throw new Cancelled()
-    return first
+  } finally {
+    rl.close()
   }
 }
 

package/templates/starter/README.md

@@ -8,7 +8,7 @@ pnpm install
 pnpm dev
 ```
 
-Admin: <http://localhost:3000/admin> — sign in with the password you chose during `kestrel init`.
+Admin: <http://localhost:3000/admin> — sign in with the password you chose while scaffolding.
 Forgot it? `pnpm hash-password` prints a fresh hash for `KESTREL_ADMIN_PASSWORD_HASH` in `.env`.
 
 ## What is here