@oktis-works/cms 0.1.13 → 0.2.0

package/dist/guards.js

@@ -0,0 +1,159 @@
+// @oktis-works/cms - Guardas de segurança da CLI
+//
+// A CLI não abre porta nenhuma: a superfície de rede dela é ZERO. O risco
+// real é ela rodar DENTRO de um container comprometido — aí `okcms update`
+// vira um executor de `bun add` (scripts de pós-install de terceiros) dentro
+// da rede do banco, com o `.env` na mão. Estas funções transformam essa
+// análise em checagens executáveis.
+//
+// Regras:
+//   1. comandos destrutivos/deploy recusam rodar em container (--force escapa);
+//   2. o tráfego de rede da CLI é limitado ao registry npm oficial;
+//   3. nenhum compose de produção monta /var/run/docker.sock;
+//   4. segredos nunca aparecem em log/stdout.
+import { existsSync, readFileSync } from 'node:fs';
+/** Marca `OKCMS_IN_CONTAINER=1` também detecta o caso de CLI montada à mão. */
+const CONTAINER_ENV = 'OKCMS_IN_CONTAINER';
+function readCgroup(exists) {
+    const path = '/proc/1/cgroup';
+    if (!exists(path))
+        return null;
+    try {
+        return readFileSync(path, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+export function isInContainer(probe = {}) {
+    const exists = probe.exists ?? existsSync;
+    const env = probe.env ?? process.env;
+    if (env[CONTAINER_ENV] === '1' || env[CONTAINER_ENV] === 'true')
+        return true;
+    // Marcadores canônicos de runtime
+    if (exists('/.dockerenv'))
+        return true;
+    if (exists('/run/.containerenv'))
+        return true; // podman
+    const cgroup = probe.cgroup !== undefined ? probe.cgroup : readCgroup(exists);
+    if (cgroup && /docker|lxc|kubepods|containerd|podman|cri-o|nomad/i.test(cgroup)) {
+        return true;
+    }
+    // /proc/self/cgroup do processo (quando /proc/1/cgroup não é legível)
+    if (!cgroup) {
+        const own = probe.cgroup === undefined ? readCgroupWeird(exists) : null;
+        if (own && /docker|lxc|kubepods|containerd|podman/i.test(own))
+            return true;
+    }
+    return false;
+}
+function readCgroupWeird(exists) {
+    const path = '/proc/self/cgroup';
+    if (!exists(path))
+        return null;
+    try {
+        return readFileSync(path, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Bloqueia comandos que alteram estado fora do host quando a CLI roda dentro
+ * de um container. `force` (=`--force`) é o escape consciente — registrado em
+ * log para auditoria.
+ */
+export function assertHostOnly(command, opts = {}) {
+    if (opts.force)
+        return { ok: true, message: '' };
+    if (!isInContainer(opts.probe ?? {}))
+        return { ok: true, message: '' };
+    return {
+        ok: false,
+        message: `${command} recusou rodar dentro de um container.\n` +
+            `  A CLI de deploy/config só executa no HOST — dentro do container ela viraria\n` +
+            `  um executor de \`bun add\` na rede do banco com o .env exposto.\n` +
+            `  Rode no host: \`docker exec -it <container-do-host> ${command}\` ou use --force.`,
+    };
+}
+// ---------------------------------------------------------------------------
+// 2. Allowlist de rede
+// ---------------------------------------------------------------------------
+/** Único destino que a CLI fala sem configuração explícita. */
+export const DEFAULT_REGISTRY = 'https://registry.npmjs.org';
+export function registryAllowlist(env = process.env) {
+    const extra = env['OKCMS_NPM_REGISTRY'];
+    return extra ? [DEFAULT_REGISTRY, extra] : [DEFAULT_REGISTRY];
+}
+export function isUrlAllowed(url, allowlist = registryAllowlist()) {
+    return allowlist.some((base) => url === base || url.startsWith(`${base}/`));
+}
+export function assertUrlAllowed(url, allowlist = registryAllowlist()) {
+    if (isUrlAllowed(url, allowlist))
+        return { ok: true, message: '' };
+    return {
+        ok: false,
+        message: `URL fora da allowlist da CLI: ${redact(url)}\n  Permitido: ${allowlist.join(', ')}`,
+    };
+}
+// ---------------------------------------------------------------------------
+// 3. Compose: socket do Docker é escalação de privilégio
+// ---------------------------------------------------------------------------
+const SOCKET_MOUNT = /docker\.sock/i;
+/** true se algum serviço monta o socket do Docker (via short ou long syntax). */
+export function hasDockerSocketMount(composeText) {
+    return SOCKET_MOUNT.test(composeText);
+}
+export function assertNoDockerSocket(composeText) {
+    if (!hasDockerSocketMount(composeText))
+        return { ok: true, message: '' };
+    return {
+        ok: false,
+        message: 'O compose monta /var/run/docker.sock num container de aplicação.\n' +
+            '  Isso é escalação direta para root do host: qualquer RCE na app vira root.\n' +
+            '  Remova o bind mount; se um serviço precisa do daemon, use um proxy dedicado.',
+    };
+}
+// ---------------------------------------------------------------------------
+// 4. Redação de segredos em log
+// ---------------------------------------------------------------------------
+const SENSITIVE_KEY = /(PASS|PASSWORD|SECRET|TOKEN|API_?KEY|PRIVATE_?KEY|CREDENTIAL|DSN|DATABASE_URL|JWT)/i;
+/** URIs com credencial: `postgres://user:senha@host` → `postgres://user:***@host`. */
+function redactUrls(text) {
+    return text.replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^:/\s@]+):([^/\s@]+)@/gi, (_all, scheme, user) => `${scheme}${user}:***@`);
+}
+/** `KEY=valor` sensível → `KEY=***`. */
+function redactAssignments(text) {
+    return text.replace(/^[ \t]*([A-Za-z_][A-Za-z0-9_]*)([ \t]*=[ \t]*)(.*)$/gm, (line, key, sep, value) => {
+        if (!SENSITIVE_KEY.test(key))
+            return line;
+        if (!value || value === '***')
+            return `${key}${sep}***`;
+        return `${key}${sep}***`;
+    });
+}
+/**
+ * Aplica redação a QUALQUER texto de log da CLI. Chamado pelas mensagens de
+ * erro de `update`/`config` para nunca vazar senha em CI ou em issue de suporte.
+ */
+export function redact(text) {
+    return redactAssignments(redactUrls(text));
+}
+/** true se o valor parece um segredo de verdade (não vazio, não placeholder). */
+export function looksLikeSecret(value) {
+    const trimmed = value.trim();
+    if (trimmed.length < 8)
+        return false;
+    return !/^(change-?me|dev-?secret|placeholder|example|changeme)/i.test(trimmed);
+}
+/** Gera um segredo forte (JWT_SECRET / cookie key) sem dependência externa. */
+export function generateSecret(length = 48) {
+    // import dinâmico barato: só roda quando realmente precisamos gerar
+    const bytes = new Uint8Array(length);
+    globalThis.crypto.getRandomValues(bytes);
+    let out = '';
+    for (const byte of bytes)
+        out += byte.toString(16).padStart(2, '0');
+    return out;
+}
+//# sourceMappingURL=guards.js.map

package/dist/guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../src/guards.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,EAAE;AACF,0EAA0E;AAC1E,2EAA2E;AAC3E,6EAA6E;AAC7E,wEAAwE;AACxE,oCAAoC;AACpC,EAAE;AACF,UAAU;AACV,gFAAgF;AAChF,oEAAoE;AACpE,8DAA8D;AAC9D,8CAA8C;AAE9C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAcnD,+EAA+E;AAC/E,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAE3C,SAAS,UAAU,CAAC,MAA8B;IAChD,MAAM,IAAI,GAAG,gBAAgB,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAwB,EAAE;IACtD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,UAAU,CAAC;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAErC,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAE7E,kCAAkC;IAClC,IAAI,MAAM,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,MAAM,CAAC,oBAAoB,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,SAAS;IAExD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9E,IAAI,MAAM,IAAI,oDAAoD,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,IAAI,GAAG,IAAI,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,MAA8B;IACrD,MAAM,IAAI,GAAG,mBAAmB,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,OAAoD,EAAE;IAEtD,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACjD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAEvE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EACL,GAAG,OAAO,0CAA0C;YACpD,iFAAiF;YACjF,qEAAqE;YACrE,yDAAyD,OAAO,oBAAoB;KACvF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAE7D,MAAM,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,MAAM,KAAK,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,YAAsB,iBAAiB,EAAE;IACjF,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,YAAsB,iBAAiB,EAAE;IAEzC,IAAI,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,iCAAiC,MAAM,CAAC,GAAG,CAAC,kBAAkB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KAC9F,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E,MAAM,YAAY,GAAG,eAAe,CAAC;AAErC,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EACL,oEAAoE;YACpE,+EAA+E;YAC/E,gFAAgF;KACnF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E,MAAM,aAAa,GAAG,qFAAqF,CAAC;AAE5G,sFAAsF;AACtF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,OAAO,CACjB,qDAAqD,EACrD,CAAC,IAAI,EAAE,MAAc,EAAE,IAAY,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,OAAO,CAChE,CAAC;AACJ,CAAC;AAED,wCAAwC;AACxC,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,OAAO,CACjB,uDAAuD,EACvD,CAAC,IAAI,EAAE,GAAW,EAAE,GAAW,EAAE,KAAa,EAAE,EAAE;QAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,GAAG,GAAG,GAAG,GAAG,KAAK,CAAC;QACxD,OAAO,GAAG,GAAG,GAAG,GAAG,KAAK,CAAC;IAC3B,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,CAAC,yDAAyD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,MAAM,GAAG,EAAE;IACxC,oEAAoE;IACpE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAyCpD;AAED,wBAAgB,YAAY,IAAI,MAAM,CAgBrC"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAkDpD;AAED,wBAAgB,YAAY,IAAI,MAAM,CAgBrC"}

package/dist/parser.js

@@ -9,11 +9,17 @@ export function parseArgs(argv) {
     let i = isFlag ? 0 : 1;
     while (i < sliced.length) {
         const arg = sliced[i];
+        const cmd = commands.find((c) => c.name === command);
         if (arg.startsWith('--')) {
             const key = arg.slice(2);
+            const repeatable = cmd?.options.find((o) => o.name === key)?.repeatable === true;
             const next = sliced[i + 1];
             if (next && !next.startsWith('--')) {
-                options[key] = next;
+                // repetível acumula em linhas; senão a 2ª ocorrência engolia a 1ª
+                options[key] =
+                    repeatable && options[key] !== undefined && options[key] !== 'true'
+                        ? `${options[key]}\n${next}`
+                        : next;
                 i += 2;
             }
             else {
@@ -23,12 +29,15 @@ export function parseArgs(argv) {
         }
         else if (arg.startsWith('-')) {
             const alias = arg.slice(1);
-            const cmd = commands.find((c) => c.name === command);
             const opt = cmd?.options.find((o) => o.alias === alias);
             const key = opt?.name ?? alias;
+            const repeatable = opt?.repeatable === true;
             const next = sliced[i + 1];
             if (next && !next.startsWith('-')) {
-                options[key] = next;
+                options[key] =
+                    repeatable && options[key] !== undefined && options[key] !== 'true'
+                        ? `${options[key]}\n${next}`
+                        : next;
                 i += 2;
             }
             else {

package/dist/parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"parser.js","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAQzC,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAkB,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAE3C,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;gBACpB,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;gBACtB,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,GAAG,EAAE,IAAI,IAAI,KAAK,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;gBACpB,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;gBACtB,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACf,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,KAAK,GAAa,CAAC,WAAW,EAAE,EAAE,EAAE,kCAAkC,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAE/F,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1D,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,KAAK,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAEhD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAQzC,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAkB,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAE3C,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACrD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,UAAU,GAAG,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,UAAU,KAAK,IAAI,CAAC;YACjF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,kEAAkE;gBAClE,OAAO,CAAC,GAAG,CAAC;oBACV,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM;wBACjE,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;wBAC5B,CAAC,CAAC,IAAI,CAAC;gBACX,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;gBACtB,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,GAAG,EAAE,IAAI,IAAI,KAAK,CAAC;YAC/B,MAAM,UAAU,GAAG,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC;oBACV,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM;wBACjE,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;wBAC5B,CAAC,CAAC,IAAI,CAAC;gBACX,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;gBACtB,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACf,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,KAAK,GAAa,CAAC,WAAW,EAAE,EAAE,EAAE,kCAAkC,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAE/F,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1D,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,KAAK,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAEhD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/project-config.js

@@ -14,8 +14,8 @@ export function defaultProjectConfig(name = 'my-okcms-site') {
         activeTheme: process.env['ACTIVE_THEME'] ?? '',
         ports: {
             api: Number(process.env['PORT'] ?? 3000),
-            admin: Number(process.env['ADMIN_PORT'] ?? 3001),
-            web: Number(process.env['WEB_PORT'] ?? 3002),
+            admin: Number(process.env['ADMIN_PORT'] ?? 3011),
+            web: Number(process.env['WEB_PORT'] ?? 3001),
         },
     };
 }

package/dist/prompt.d.ts

@@ -0,0 +1,81 @@
+import type { Readable, Writable } from 'node:stream';
+export interface PromptIO {
+    input: Readable;
+    output: Writable;
+    /** true somente quando há terminal nos DOIS lados (TTY de verdade). */
+    isTTY: boolean;
+}
+export declare function defaultIO(): PromptIO;
+export declare const style: {
+    bold: (text: string) => string;
+    dim: (text: string) => string;
+    red: (text: string) => string;
+    green: (text: string) => string;
+    yellow: (text: string) => string;
+    blue: (text: string) => string;
+    cyan: (text: string) => string;
+    gray: (text: string) => string;
+};
+/** Símbolos canônicos — mesmos glifos já usados pelos comandos da CLI. */
+export declare const symbol: {
+    readonly ask: "?";
+    readonly ok: "✓";
+    readonly fail: "✗";
+    readonly arrow: "→";
+    readonly bullet: "•";
+    readonly warn: "⚠";
+};
+export interface SelectChoice<T> {
+    value: T;
+    label: string;
+    /** Contexto curto alinhado à direita da opção. */
+    hint?: string;
+}
+export interface SelectOptions<T> {
+    /** Default no Enter E valor devolvido em modo não-interativo. */
+    defaultValue?: T;
+    /** Mensagem quando não há TTY nem default. */
+    nonInteractiveError?: string;
+}
+export interface InputOptions {
+    default?: string;
+    /** Mensagem de erro para re-perguntar; null/undefined aceita. */
+    validate?: (value: string) => string | null | undefined;
+    /** Preview do valor atual (ex.: máscara `••••` para segredos). */
+    placeholder?: string;
+}
+export declare class Prompt {
+    private readonly io;
+    private readonly input;
+    private closed;
+    constructor(io?: Partial<PromptIO>);
+    get interactive(): boolean;
+    write(text: string): void;
+    /** Título de seção do wizard. */
+    heading(text: string): void;
+    info(text: string): void;
+    success(text: string): void;
+    warn(text: string): void;
+    error(text: string): void;
+    /**
+     * Menu numerado. Em modo não-interativo devolve `defaultValue`; sem default
+     * lança erro — assim um CI nunca aciona um deploy por acidente.
+     */
+    select<T>(title: string, choices: Array<SelectChoice<T>>, opts?: SelectOptions<T>): Promise<T>;
+    /** Confirmação Y/n. Não-interativo → `defaultValue`. */
+    confirm(title: string, opts?: {
+        defaultValue?: boolean;
+    }): Promise<boolean>;
+    /** Texto livre com validação, repetindo até aceitar. */
+    ask(title: string, opts?: InputOptions): Promise<string>;
+    /** Segredo: sem eco no TTY (mostra `*`), default via Enter. */
+    secret(title: string, opts?: InputOptions): Promise<string>;
+    /** Lê uma linha cruta (também usada pelos testes). */
+    askLine(question: string): Promise<string | null>;
+    close(): void;
+}
+export declare function select<T>(title: string, choices: Array<SelectChoice<T>>, opts?: SelectOptions<T>, io?: Partial<PromptIO>): Promise<T>;
+export declare function confirm(title: string, opts?: {
+    defaultValue?: boolean;
+}, io?: Partial<PromptIO>): Promise<boolean>;
+//# sourceMappingURL=prompt.d.ts.map

package/dist/prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../src/prompt.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAWtD,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,QAAQ,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB,uEAAuE;IACvE,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,wBAAgB,SAAS,IAAI,QAAQ,CAIpC;AAcD,eAAO,MAAM,KAAK;iBALiC,MAAM,KAAK,MAAM;gBAAjB,MAAM,KAAK,MAAM;gBAAjB,MAAM,KAAK,MAAM;kBAAjB,MAAM,KAAK,MAAM;mBAAjB,MAAM,KAAK,MAAM;iBAAjB,MAAM,KAAK,MAAM;iBAAjB,MAAM,KAAK,MAAM;iBAAjB,MAAM,KAAK,MAAM;CAcnE,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,MAAM;;;;;;;CAOT,CAAC;AAmKX,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC;IACT,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,iEAAiE;IACjE,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,8CAA8C;IAC9C,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACxD,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAW;IAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,OAAO,CAAC,MAAM,CAAS;gBAEX,EAAE,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC;IAOlC,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIzB,iCAAiC;IACjC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI3B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIxB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI3B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIxB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIzB;;;OAGG;IACG,MAAM,CAAC,CAAC,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAC/B,IAAI,GAAE,aAAa,CAAC,CAAC,CAAM,GAC1B,OAAO,CAAC,CAAC,CAAC;IAoDb,wDAAwD;IAClD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAsBrF,wDAAwD;IAClD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;IA2BlE,+DAA+D;IACzD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;IA+BrE,sDAAsD;IAChD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAMvD,KAAK,IAAI,IAAI;CAUd;AAMD,wBAAsB,MAAM,CAAC,CAAC,EAC5B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAC/B,IAAI,GAAE,aAAa,CAAC,CAAC,CAAM,EAC3B,EAAE,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,GACrB,OAAO,CAAC,CAAC,CAAC,CAOZ;AAED,wBAAsB,OAAO,CAC3B,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,EACrC,EAAE,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,GACrB,OAAO,CAAC,OAAO,CAAC,CAOlB"}