@onesub/cli 0.1.41 → 0.1.43

package/dist/__tests__/templates.test.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The `onesub init` templates must scaffold a project on a current server.
+ *
+ * ## Why this test exists
+ *
+ * `templates/package.json` pinned `@onesub/server: ^0.7.0` while the published server
+ * was on `0.27.0`. A caret range on a `0.x` version admits only patches — `^0.7.0`
+ * resolves to `0.7.x` — so every `onesub init` scaffolded a project **twenty minors
+ * behind**, missing the log formatter, the conditional webhook mount and the webhook
+ * authentication requirement. It had been that way since the express
+ * peerDependencies move.
+ *
+ * Nothing caught it, and that is the interesting part. Changesets bumps *workspace*
+ * versions; this file is copied template content, not a workspace, so no release step
+ * touches it. `docs:check` validates links and catalogues, not dependency ranges. The
+ * only mechanism was remembering — and twenty releases is a fair sample of how well
+ * that works.
+ *
+ * So the fix is not just the bump. Releasing a server minor now has to bump this pin
+ * too, and this test is what says so, at the release that introduces the drift rather
+ * than a year later.
+ */
+export {};
+//# sourceMappingURL=templates.test.d.ts.map

package/dist/__tests__/templates.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/templates.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG"}

package/dist/__tests__/templates.test.js

@@ -0,0 +1,107 @@
+/**
+ * The `onesub init` templates must scaffold a project on a current server.
+ *
+ * ## Why this test exists
+ *
+ * `templates/package.json` pinned `@onesub/server: ^0.7.0` while the published server
+ * was on `0.27.0`. A caret range on a `0.x` version admits only patches — `^0.7.0`
+ * resolves to `0.7.x` — so every `onesub init` scaffolded a project **twenty minors
+ * behind**, missing the log formatter, the conditional webhook mount and the webhook
+ * authentication requirement. It had been that way since the express
+ * peerDependencies move.
+ *
+ * Nothing caught it, and that is the interesting part. Changesets bumps *workspace*
+ * versions; this file is copied template content, not a workspace, so no release step
+ * touches it. `docs:check` validates links and catalogues, not dependency ranges. The
+ * only mechanism was remembering — and twenty releases is a fair sample of how well
+ * that works.
+ *
+ * So the fix is not just the bump. Releasing a server minor now has to bump this pin
+ * too, and this test is what says so, at the release that introduces the drift rather
+ * than a year later.
+ */
+import { describe, expect, it } from 'vitest';
+import { readFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+const CLI = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
+const REPO = dirname(dirname(CLI));
+function readJson(...parts) {
+    return JSON.parse(readFileSync(join(...parts), 'utf8'));
+}
+/**
+ * Does a caret range admit this version?
+ *
+ * Hand-rolled rather than pulling in `semver`, because the CLI has no runtime
+ * dependency on it and adding one to satisfy a test is the wrong trade. Only the
+ * shapes this repo actually writes are handled: `^x.y.z` and an exact version. A
+ * range this cannot parse throws rather than silently passing — a test that quietly
+ * approves an unrecognised pin is worse than no test.
+ */
+function caretAdmits(range, version) {
+    const v = version.split('.').map(Number);
+    if (v.length !== 3 || v.some(Number.isNaN))
+        throw new Error(`unparseable version: ${version}`);
+    if (/^\d+\.\d+\.\d+$/.test(range))
+        return range === version;
+    const m = /^\^(\d+)\.(\d+)\.(\d+)$/.exec(range);
+    if (!m)
+        throw new Error(`unhandled range shape, teach this test about it: ${range}`);
+    const [lo0, lo1, lo2] = [Number(m[1]), Number(m[2]), Number(m[3])];
+    const [hi0, hi1, hi2] = v;
+    // Below the floor is out, whatever the majors do.
+    if (hi0 < lo0)
+        return false;
+    if (hi0 === lo0 && (hi1 < lo1 || (hi1 === lo1 && hi2 < lo2)))
+        return false;
+    // npm treats a 0.x caret as minor-locked: ^0.7.0 is >=0.7.0 <0.8.0. That is the
+    // whole reason the pin went stale, so it is the case worth being explicit about.
+    if (lo0 === 0)
+        return hi0 === 0 && hi1 === lo1;
+    return hi0 === lo0;
+}
+describe('caretAdmits', () => {
+    // The helper decides whether the assertion below means anything, so it is tested
+    // before it is trusted.
+    it('locks a 0.x caret to its minor', () => {
+        expect(caretAdmits('^0.7.0', '0.7.5')).toBe(true);
+        expect(caretAdmits('^0.7.0', '0.8.0')).toBe(false);
+        expect(caretAdmits('^0.7.0', '0.27.0')).toBe(false);
+        expect(caretAdmits('^0.27.0', '0.27.1')).toBe(true);
+    });
+    it('allows minors on a stable major', () => {
+        expect(caretAdmits('^5.2.1', '5.9.0')).toBe(true);
+        expect(caretAdmits('^5.2.1', '6.0.0')).toBe(false);
+        expect(caretAdmits('^5.2.1', '5.2.0')).toBe(false);
+    });
+    it('matches an exact pin exactly', () => {
+        expect(caretAdmits('0.27.0', '0.27.0')).toBe(true);
+        expect(caretAdmits('0.27.0', '0.27.1')).toBe(false);
+    });
+    it('refuses to guess at a range shape it does not know', () => {
+        expect(() => caretAdmits('>=0.27 <1', '0.27.0')).toThrow(/unhandled range shape/);
+        expect(() => caretAdmits('~0.27.0', '0.27.0')).toThrow(/unhandled range shape/);
+    });
+});
+describe('onesub init templates', () => {
+    const serverVersion = readJson(REPO, 'packages/server/package.json').version;
+    it('scaffolds a project that can install the current server', () => {
+        const range = readJson(CLI, 'templates/package.json')
+            .dependencies['@onesub/server'];
+        expect(range).toBeDefined();
+        expect(caretAdmits(range, serverVersion), `templates/package.json pins @onesub/server ${range}, which cannot install ` +
+            `${serverVersion}. On a 0.x version a caret admits only patches, so bump the ` +
+            `pin in the same change as the server release.`).toBe(true);
+    });
+    it('keeps every template the CLI copies present', () => {
+        // A missing template makes `onesub init` produce a half-scaffolded project, and
+        // the failure surfaces at the user rather than here.
+        const src = readFileSync(join(CLI, 'src/index.ts'), 'utf8');
+        const declared = [...src.matchAll(/\{\s*src:\s*'([^']+)'/g)].map((m) => m[1]);
+        expect(declared.length).toBeGreaterThan(3);
+        for (const file of declared) {
+            expect(() => readFileSync(join(CLI, 'templates', file), 'utf8')).not.toThrow();
+        }
+    });
+});
+//# sourceMappingURL=templates.test.js.map

package/dist/__tests__/templates.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.test.js","sourceRoot":"","sources":["../../src/__tests__/templates.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAEnC,SAAS,QAAQ,CAAI,GAAG,KAAe;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,MAAM,CAAC,CAAM,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,KAAa,EAAE,OAAe;IACjD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;IAE/F,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,KAAK,OAAO,CAAC;IAE5D,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,KAAK,EAAE,CAAC,CAAC;IACrF,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAA6B,CAAC;IAEtD,kDAAkD;IAClD,IAAI,GAAG,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAE3E,gFAAgF;IAChF,iFAAiF;IACjF,IAAI,GAAG,KAAK,CAAC;QAAE,OAAO,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC;IAC/C,OAAO,GAAG,KAAK,GAAG,CAAC;AACrB,CAAC;AAED,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,iFAAiF;IACjF,wBAAwB;IACxB,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAClF,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,MAAM,aAAa,GAAG,QAAQ,CAAsB,IAAI,EAAE,8BAA8B,CAAC,CAAC,OAAO,CAAC;IAElG,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,KAAK,GAAG,QAAQ,CAA2C,GAAG,EAAE,wBAAwB,CAAC;aAC5F,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAElC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5B,MAAM,CACJ,WAAW,CAAC,KAAM,EAAE,aAAa,CAAC,EAClC,8CAA8C,KAAK,yBAAyB;YAC1E,GAAG,aAAa,8DAA8D;YAC9E,+CAA+C,CAClD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,gFAAgF;QAChF,qDAAqD;QACrD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QAE/E,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onesub/cli",
-  "version": "0.1.41",
+  "version": "0.1.43",
   "description": "CLI scaffolding for onesub — `npx onesub init` bootstraps a server + Expo app.",
   "main": "dist/index.js",
   "type": "module",
@@ -35,8 +35,8 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@onesub/server": "0.26.0",
-    "@onesub/shared": "0.15.1",
+    "@onesub/server": "0.27.0",
+    "@onesub/shared": "0.16.0",
     "express": "^5.2.1"
   },
   "devDependencies": {

package/templates/.env.example

@@ -7,8 +7,12 @@ APPLE_SHARED_SECRET=your_shared_secret
 # Service account JSON from Google Cloud Console (single-line)
 GOOGLE_PACKAGE_NAME=com.yourapp.id
 GOOGLE_SERVICE_ACCOUNT_KEY={"type":"service_account","project_id":"..."}
-# Optional: push endpoint URL for Pub/Sub JWT verification
+# REQUIRED IN PRODUCTION: the Pub/Sub push endpoint URL, verified as the OIDC `aud`.
+# Without it the Google webhook cannot attribute a request to Google and answers 401
+# when NODE_ENV=production. Leave it unset for local development.
 # GOOGLE_PUSH_AUDIENCE=https://api.yourapp.com/onesub/webhook/google
+# Restricts push tokens to your Pub/Sub service account; set it with the audience.
+# GOOGLE_PUSH_SERVICE_ACCOUNT_EMAIL=push@your-project.iam.gserviceaccount.com
 
 # ── Database ────────────────────────────────────────────
 # Uncomment for Postgres; leave unset for in-memory (dev only)

package/templates/package.json

@@ -8,7 +8,7 @@
     "start": "tsx server.ts"
   },
   "dependencies": {
-    "@onesub/server": "^0.7.0",
+    "@onesub/server": "^0.27.0",
     "dotenv": "^16.4.5",
     "express": "^5.2.1",
     "pg": "^8.13.0"

package/templates/server.ts

@@ -28,7 +28,10 @@ app.use(
       ? {
           packageName: process.env.GOOGLE_PACKAGE_NAME,
           serviceAccountKey: process.env.GOOGLE_SERVICE_ACCOUNT_KEY,
+          // Required in production: without it the RTDN webhook cannot attribute a
+          // request to Google and refuses it. See docs/SECURITY.md.
           pushAudience: process.env.GOOGLE_PUSH_AUDIENCE,
+          pushServiceAccountEmail: process.env.GOOGLE_PUSH_SERVICE_ACCOUNT_EMAIL,
         }
       : undefined,
     database: { url: dbUrl ?? '' },