@o3co/create-auth-provider 0.5.0 → 0.5.1

package/dist/__tests__/index.test.mjs

@@ -1,8 +1,49 @@
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { join, posix, win32 } from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { isValidDirName, isValidProjectName, main, scaffold } from "../index.mjs";
+import { shouldCopyTemplateEntry } from "../internal/template-filter.mjs";
+// Both POSIX and Windows separators are exercised explicitly so the suite
+// validates the separator-relative segment logic regardless of the host
+// platform. (`path.sep` is the production default; tests pass it explicitly.)
+const platforms = [
+    {
+        name: "POSIX-style paths",
+        sep: posix.sep,
+        installRoot: "/Users/x/.npm/_npx/abc/node_modules/@o3co/create-auth-provider/templates/standalone",
+        localRoot: "/repo/templates/standalone",
+    },
+    {
+        name: "Windows-style paths",
+        sep: win32.sep,
+        installRoot: "C:\\Users\\x\\AppData\\Roaming\\npm-cache\\_npx\\abc\\node_modules\\@o3co\\create-auth-provider\\templates\\standalone",
+        localRoot: "C:\\repo\\templates\\standalone",
+    },
+];
+describe.each(platforms)("shouldCopyTemplateEntry on $name", ({ sep, installRoot, localRoot }) => {
+    const joinSegments = (base, ...rest) => [base, ...rest].join(sep);
+    it("includes the template root itself", () => {
+        expect(shouldCopyTemplateEntry(installRoot, installRoot, sep)).toBe(true);
+    });
+    it("includes a file directly under the template root even when ancestor path contains 'node_modules'", () => {
+        // Regression for v0.5.0 npx install bug: when the package is installed
+        // at .../node_modules/@o3co/create-auth-provider/..., the previous filter
+        // checked every segment of the absolute source path and excluded
+        // everything, so cpSync copied no files.
+        expect(shouldCopyTemplateEntry(joinSegments(installRoot, "package.json"), installRoot, sep)).toBe(true);
+    });
+    it("includes nested template files even when ancestor path contains 'node_modules' or 'dist'", () => {
+        expect(shouldCopyTemplateEntry(joinSegments(installRoot, "src", "app.mts"), installRoot, sep)).toBe(true);
+        expect(shouldCopyTemplateEntry(joinSegments(installRoot, "config", "application.conf"), installRoot, sep)).toBe(true);
+    });
+    it("excludes node_modules subdirectories that live INSIDE the template root", () => {
+        expect(shouldCopyTemplateEntry(joinSegments(localRoot, "node_modules", "foo", "index.js"), localRoot, sep)).toBe(false);
+    });
+    it("excludes dist subdirectories that live INSIDE the template root", () => {
+        expect(shouldCopyTemplateEntry(joinSegments(localRoot, "dist", "index.mjs"), localRoot, sep)).toBe(false);
+    });
+});
 describe("scaffold", () => {
     let tempDir;
     beforeEach(() => {

package/dist/__tests__/published-package.test.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=published-package.test.d.mts.map

package/dist/__tests__/published-package.test.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"published-package.test.d.mts","sourceRoot":"","sources":["../../src/__tests__/published-package.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/published-package.test.mjs

@@ -0,0 +1,73 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const CREATE_APP_DIR = resolve(__dirname, "../..");
+describe("published-package install context (e2e)", () => {
+    let workspace;
+    let tarballPath;
+    beforeAll(() => {
+        workspace = mkdtempSync(join(tmpdir(), "create-auth-provider-e2e-"));
+        // Isolate npm's cache to a per-run directory so a polluted developer
+        // `~/.npm/_cacache/` (e.g. root-owned files left by a sudo install) cannot
+        // fail the test with EPERM. The prepack hook only needs to read the
+        // workspace, but `npm pack` itself touches the cache regardless.
+        const npmCache = join(workspace, "npm-cache");
+        // `npm pack` runs the `prepack` script (rimraf dist + copy-templates + tsc),
+        // so this exercises the same artifact npm publishes to the registry.
+        const stdout = execFileSync("npm", ["pack", "--pack-destination", workspace, "--json"], {
+            cwd: CREATE_APP_DIR,
+            encoding: "utf-8",
+            env: { ...process.env, npm_config_cache: npmCache },
+        });
+        const [packed] = JSON.parse(stdout);
+        tarballPath = join(workspace, packed.filename);
+    }, 120_000);
+    afterAll(() => {
+        if (workspace)
+            rmSync(workspace, { recursive: true, force: true });
+    });
+    it("scaffolds successfully when installed under a path containing 'node_modules'", () => {
+        // Regression for v0.5.0 npx bug: simulate the actual install layout
+        // (~/.npm/_npx/<hash>/node_modules/@o3co/create-auth-provider/) so the
+        // cpSync filter sees an absolute source path whose ancestors include
+        // 'node_modules'. Before the fix, the filter excluded every file and
+        // `cpSync` left the target directory empty.
+        const installRoot = join(workspace, "node_modules", "@o3co", "create-auth-provider");
+        mkdirSync(installRoot, { recursive: true });
+        execFileSync("tar", ["-xzf", tarballPath, "--strip-components=1", "-C", installRoot]);
+        const projectCwd = join(workspace, "scaffold-cwd");
+        mkdirSync(projectCwd);
+        execFileSync("node", [join(installRoot, "dist", "cli.mjs"), "my-test-project"], {
+            cwd: projectCwd,
+            encoding: "utf-8",
+        });
+        const targetDir = join(projectCwd, "my-test-project");
+        expect(existsSync(targetDir)).toBe(true);
+        expect(existsSync(join(targetDir, "package.json"))).toBe(true);
+        expect(existsSync(join(targetDir, "src", "app.mts"))).toBe(true);
+        expect(existsSync(join(targetDir, "config", "application.conf"))).toBe(true);
+        const pkg = JSON.parse(readFileSync(join(targetDir, "package.json"), "utf-8"));
+        expect(pkg.name).toBe("my-test-project");
+        for (const section of ["dependencies", "devDependencies", "peerDependencies"]) {
+            const deps = pkg[section];
+            if (!deps)
+                continue;
+            for (const [, version] of Object.entries(deps)) {
+                expect(version).not.toBe("workspace:*");
+            }
+        }
+    }, 30_000);
+});

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AAkCA,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,OAIjD,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,KAAG,OAI7C,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,WAAW,MAAM,EAAE,aAAa,MAAM,KAAG,IA0CjE,CAAC;AAsDF,eAAO,MAAM,IAAI,QAAO,IA+CvB,CAAC"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,OAIjD,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,KAAG,OAI7C,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,WAAW,MAAM,EAAE,aAAa,MAAM,KAAG,IAsCjE,CAAC;AAsDF,eAAO,MAAM,IAAI,QAAO,IA+CvB,CAAC"}

package/dist/index.mjs

@@ -14,8 +14,9 @@
  * limitations under the License.
  */
 import { cpSync, existsSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, resolve, sep } from "node:path";
+import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { shouldCopyTemplateEntry } from "./internal/template-filter.mjs";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const TEMPLATES_DIR = resolve(__dirname, "../templates/standalone");
 const getPackageVersions = () => {
@@ -47,13 +48,9 @@ export const scaffold = (targetDir, projectName) => {
         throw new Error(`Template directory not found at ${TEMPLATES_DIR}. If developing locally, run the prebuild script first.`);
     }
     // Copy template to target
-    const EXCLUDED_DIRS = new Set(["node_modules", "dist"]);
     cpSync(TEMPLATES_DIR, targetDir, {
         recursive: true,
-        filter: (source) => {
-            const segments = source.split(sep);
-            return !segments.some((s) => EXCLUDED_DIRS.has(s));
-        },
+        filter: (source) => shouldCopyTemplateEntry(source, TEMPLATES_DIR),
     });
     // Rewrite package.json
     const pkgPath = resolve(targetDir, "package.json");

package/dist/internal/template-filter.d.mts

@@ -0,0 +1,17 @@
+/**
+ * Decide whether `cpSync` should copy a given source path.
+ *
+ * Only segments INSIDE `templateRoot` are checked against EXCLUDED_DIRS — the
+ * install-prefix path above the root (e.g. `~/.npm/_npx/<hash>/node_modules/...`
+ * when the package is run via `npx`) is ignored. Otherwise the filter would
+ * reject every file whenever the package itself happens to live under a
+ * `node_modules` directory (which is the v0.5.0 npx regression this fixes).
+ *
+ * The `pathSep` parameter exists so unit tests can exercise both POSIX and
+ * Windows separators regardless of the host platform; production callers omit
+ * it and pick up `path.sep` of the running platform. DO NOT change this to a
+ * hardcoded `"/"` — `cpSync` passes back-slash-delimited absolute paths on
+ * Windows, so segment splitting must follow the platform separator.
+ */
+export declare const shouldCopyTemplateEntry: (source: string, templateRoot: string, pathSep?: string) => boolean;
+//# sourceMappingURL=template-filter.d.mts.map

package/dist/internal/template-filter.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-filter.d.mts","sourceRoot":"","sources":["../../src/internal/template-filter.mts"],"names":[],"mappings":"AAuBA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,GACnC,QAAQ,MAAM,EACd,cAAc,MAAM,EACpB,UAAS,MAAY,KACnB,OAMF,CAAC"}

package/dist/internal/template-filter.mjs

@@ -0,0 +1,45 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+//
+// INTERNAL — not exposed via the package's `exports` map. Reachable only from
+// other files in this package (and its tests). See package.json `exports`.
+//
+import { sep } from "node:path";
+const EXCLUDED_DIRS = new Set(["node_modules", "dist"]);
+/**
+ * Decide whether `cpSync` should copy a given source path.
+ *
+ * Only segments INSIDE `templateRoot` are checked against EXCLUDED_DIRS — the
+ * install-prefix path above the root (e.g. `~/.npm/_npx/<hash>/node_modules/...`
+ * when the package is run via `npx`) is ignored. Otherwise the filter would
+ * reject every file whenever the package itself happens to live under a
+ * `node_modules` directory (which is the v0.5.0 npx regression this fixes).
+ *
+ * The `pathSep` parameter exists so unit tests can exercise both POSIX and
+ * Windows separators regardless of the host platform; production callers omit
+ * it and pick up `path.sep` of the running platform. DO NOT change this to a
+ * hardcoded `"/"` — `cpSync` passes back-slash-delimited absolute paths on
+ * Windows, so segment splitting must follow the platform separator.
+ */
+export const shouldCopyTemplateEntry = (source, templateRoot, pathSep = sep) => {
+    if (source === templateRoot)
+        return true;
+    const prefix = templateRoot.endsWith(pathSep) ? templateRoot : `${templateRoot}${pathSep}`;
+    if (!source.startsWith(prefix))
+        return true;
+    const rel = source.slice(prefix.length);
+    return !rel.split(pathSep).some((s) => EXCLUDED_DIRS.has(s));
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/create-auth-provider",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Scaffold a new o3co/auth.provider project from the standalone template",
   "license": "Apache-2.0",
   "type": "module",

package/templates/standalone/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@o3co/auth-provider-standalone",
-	"version": "0.5.0",
+	"version": "0.5.1",
 	"private": true,
 	"license": "Apache-2.0",
 	"packageManager": "pnpm@10.29.3",

package/templates/versions.json

@@ -1,10 +1,10 @@
 {
-	"@o3co/auth-provider-core": "0.5.0",
-	"@o3co/auth-provider-federation-google": "0.5.0",
-	"@o3co/auth-provider-federation-github": "0.5.0",
-	"@o3co/auth-provider-oauth": "0.5.0",
-	"@o3co/auth-provider-oauth-token-exchange": "0.5.0",
-	"@o3co/auth-provider-session": "0.5.0",
-	"@o3co/auth-provider-foundation": "0.5.0",
-	"@o3co/auth-provider-redis": "0.5.0"
+	"@o3co/auth-provider-core": "0.5.1",
+	"@o3co/auth-provider-federation-google": "0.5.1",
+	"@o3co/auth-provider-federation-github": "0.5.1",
+	"@o3co/auth-provider-oauth": "0.5.1",
+	"@o3co/auth-provider-oauth-token-exchange": "0.5.1",
+	"@o3co/auth-provider-session": "0.5.1",
+	"@o3co/auth-provider-foundation": "0.5.1",
+	"@o3co/auth-provider-redis": "0.5.1"
 }