@rathnasgala/cli 1.1.15 → 1.1.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rathnasgala/cli",
-  "version": "1.1.15",
+  "version": "1.1.18",
   "type": "module",
   "files": [
     "src"

package/src/auth/profiles.js

@@ -122,6 +122,26 @@ export async function selectedProfile({ name, root = credentialDirectory() } = {
   return readProfile(selected, { root });
 }
 
+export async function authenticatedProfile({
+  name,
+  terminal,
+  root = credentialDirectory(),
+  reauthenticate = addProfile,
+} = {}) {
+  try {
+    return await selectedProfile({ name, root });
+  } catch (failure) {
+    if (!(failure instanceof ExpiredProfileError) || !terminal?.interactive) throw failure;
+    terminal.step(`Account profile ${failure.profileName} expired; signing in again`);
+    const refreshed = await reauthenticate({ terminal, root });
+    if (refreshed.metadata.name !== failure.profileName) {
+      throw new UsageError(`This repository uses account profile ${failure.profileName}, but you signed in as ${refreshed.metadata.name}. Sign in again with the matching account.`);
+    }
+    terminal.done(`Signed in again as ${failure.profileName}`);
+    return refreshed;
+  }
+}
+
 export async function activeProfile({ root = credentialDirectory() } = {}) {
   try {
     const value = (await readFile(path.join(root, 'active-profile'), 'utf8')).trim();
@@ -145,13 +165,18 @@ async function readProfile(name, { root }) {
   }
   const [gala, github] = await Promise.all([readCredential(paths.gala), readCredential(paths.github)]);
   if (gala == null || github == null) {
-    throw new UsageError(
-      `Account profile ${name} has expired; run \`npx --yes @rathnasgala/cli@latest auth add\` to sign in again.`
-    );
+    throw new ExpiredProfileError(name);
   }
   return { metadata, gala, github };
 }
 
+class ExpiredProfileError extends UsageError {
+  constructor(profileName) {
+    super(`Account profile ${profileName} has expired; run \`npx --yes @rathnasgala/cli@latest auth add\` to sign in again.`);
+    this.profileName = profileName;
+  }
+}
+
 async function setActiveProfile(name, { root }) {
   await mkdir(root, { recursive: true, mode: 0o700 });
   await atomicText(path.join(root, 'active-profile'), `${requireProfileName(name)}\n`);

package/src/commands/doctor.js

@@ -3,7 +3,7 @@ import path from 'node:path';
 
 import { galaApi } from '../api/gala.js';
 import { accountForCommand } from '../auth/checkout-profile.js';
-import { selectedProfile } from '../auth/profiles.js';
+import { authenticatedProfile } from '../auth/profiles.js';
 import { cliCommand } from '../cli/invocation.js';
 import { createGit } from '../git.js';
 
@@ -22,7 +22,7 @@ export async function doctor({ terminal, options, cwd = process.cwd() }) {
   let selected;
   checks.push(await checkCredential('Account profile', async () => {
     const account = await accountForCommand(options, root, { terminal });
-    selected = await selectedProfile({ name: account });
+    selected = await authenticatedProfile({ name: account, terminal });
     return ok(`${account}: Gala ${selected.metadata.gala.email} + GitHub @${selected.metadata.githubLogin}`);
   }));
 

package/src/commands/domain.js

@@ -1,8 +1,9 @@
 import path from 'node:path';
 
 import { galaApi } from '../api/gala.js';
+import { HttpError } from '../api/http.js';
 import { accountForCommand } from '../auth/checkout-profile.js';
-import { selectedProfile } from '../auth/profiles.js';
+import { authenticatedProfile } from '../auth/profiles.js';
 import { UsageError } from '../cli/args.js';
 import { cliCommand } from '../cli/invocation.js';
 import { customDomain } from '../domain.js';
@@ -24,7 +25,8 @@ export async function domain({ terminal, options, cwd = process.cwd() }) {
   if (action !== 'set' && value != null) throw new UsageError(`domain ${action} takes no hostname`);
 
   const account = await accountForCommand(options, root, { terminal });
-  const credential = (await selectedProfile({ name: account })).gala;
+  const profile = await authenticatedProfile({ name: account, terminal });
+  const credential = profile.gala;
   const api = galaApi({ baseUrl: credential.apiBaseUrl, token: credential.accessToken });
 
   if (action === 'status') {
@@ -41,13 +43,14 @@ export async function domain({ terminal, options, cwd = process.cwd() }) {
   if (action === 'set') {
     const checked = customDomain(value);
     if (checked.error) throw new UsageError(checked.error);
+    const site = await ownedSite(api, publication.siteId);
+    const owner = site.repository.split('/')[0];
     const change = await api.prepareTopologyChange(publication.siteId, {
       canonicalBaseUrl: `https://${checked.host}`,
       pathPrefix: '/',
     });
     terminal.done(`Reserved ${checked.host}`);
-    terminal.note(`Verify it in the repository owner’s GitHub account, then run: ${cliCommand('domain check')}`);
-    terminal.openUrl('https://docs.github.com/en/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages');
+    showVerificationSteps(terminal, checked.host, owner, profile.metadata.githubLogin);
     return change;
   }
 
@@ -81,7 +84,17 @@ export async function domain({ terminal, options, cwd = process.cwd() }) {
 
   if (action === 'check') {
     if (pending.cname && pending.state === 'PREPARED') {
-      const configured = await api.configureTopologyChange(publication.siteId, pending.changeId);
+      let configured;
+      try {
+        configured = await api.configureTopologyChange(publication.siteId, pending.changeId);
+      } catch (failure) {
+        if (!(failure instanceof HttpError)
+            || failure.code !== 'GITHUB_PAGES_DOMAIN_VERIFICATION_REQUIRED') throw failure;
+        const site = await ownedSite(api, publication.siteId);
+        const owner = site.repository.split('/')[0];
+        showVerificationSteps(terminal, pending.cname, owner, profile.metadata.githubLogin);
+        throw new Error(`GitHub has not verified ${pending.cname} for @${owner} yet. Complete the steps above, then retry.`);
+      }
       terminal.done(`GitHub verified ${configured.cname}`);
       terminal.note(dnsInstruction(configured.cname, await providerHost(api, publication.siteId)));
       terminal.note(`After DNS propagates, run: ${cliCommand('domain check')}`);
@@ -100,6 +113,16 @@ export async function domain({ terminal, options, cwd = process.cwd() }) {
   throw new UsageError(`Unsupported domain action: ${action}`);
 }
 
+function showVerificationSteps(terminal, host, owner, login) {
+  terminal.note(`GitHub owner @${owner} must verify ${host} once under Settings → Pages → Verified domains.`);
+  terminal.openUrl(owner.toLowerCase() === login.toLowerCase()
+    ? 'https://github.com/settings/pages'
+    : `https://github.com/organizations/${encodeURIComponent(owner)}/settings/pages`);
+  terminal.note(`Choose “Add a domain”, enter ${host}, and add GitHub’s TXT record at your DNS provider.`);
+  terminal.note(`The TXT record name will be _github-pages-challenge-${owner}.${host}; GitHub supplies its value.`);
+  terminal.note(`When GitHub shows “Verified”, run: ${cliCommand('domain check')}`);
+}
+
 async function ownedSite(api, siteId) {
   const sites = await api.listPublications();
   const site = Array.isArray(sites) ? sites.find((candidate) => candidate.siteId === siteId) : null;

package/src/commands/init.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 import { galaApi } from '../api/gala.js';
 import { githubApi } from '../api/github.js';
 import { accountForCommand, bindCheckoutProfile } from '../auth/checkout-profile.js';
-import { selectedProfile } from '../auth/profiles.js';
+import { authenticatedProfile } from '../auth/profiles.js';
 import { cloneRepository, createGit, populateEmptyRepository } from '../git.js';
 import { UsageError } from '../cli/args.js';
 import { CLI_INVOCATION, shellArgument } from '../cli/invocation.js';
@@ -45,7 +45,7 @@ export async function init({ terminal, options, cwd = process.cwd() }) {
 
   const destination = await inspectDestination(directory);
 
-  const profile = await selectedProfile({ name: options.value('account') });
+  const profile = await authenticatedProfile({ name: options.value('account'), terminal });
   const { gala, github, metadata } = profile;
   const account = metadata.name;
   terminal.step(`Account ${account}: Gala ${metadata.gala.email} + GitHub @${metadata.githubLogin}`);

package/src/commands/prism.js

@@ -3,7 +3,7 @@ import path from 'node:path';
 
 import { galaApi } from '../api/gala.js';
 import { accountForCommand } from '../auth/checkout-profile.js';
-import { selectedProfile } from '../auth/profiles.js';
+import { authenticatedProfile } from '../auth/profiles.js';
 import { UsageError } from '../cli/args.js';
 import { cliCommand } from '../cli/invocation.js';
 import { createGit } from '../git.js';
@@ -23,7 +23,7 @@ export async function prism({ terminal, options, cwd = process.cwd() }) {
     throw new UsageError('Run this inside a registered Gala publication, or pass --root.');
   }
   const account = await accountForCommand(options, root, { terminal });
-  const credential = (await selectedProfile({ name: account })).gala;
+  const credential = (await authenticatedProfile({ name: account, terminal })).gala;
   const api = galaApi({ baseUrl: credential.apiBaseUrl, token: credential.accessToken });
   const [action = 'status', ...args] = options.positional;
 

package/src/commands/publish.js

@@ -3,7 +3,7 @@ import path from 'node:path';
 import { checkContent } from '../content.js';
 import { createGit } from '../git.js';
 import { accountForCommand } from '../auth/checkout-profile.js';
-import { selectedProfile } from '../auth/profiles.js';
+import { authenticatedProfile } from '../auth/profiles.js';
 import { readPublication } from '../publication.js';
 
 /**
@@ -27,7 +27,7 @@ export async function publish({ terminal, options, cwd = process.cwd(), regenera
   const today = options.value('today');
 
   const account = await accountForCommand(options, root, { terminal });
-  const github = (await selectedProfile({ name: account })).github;
+  const github = (await authenticatedProfile({ name: account, terminal })).github;
   const git = createGit({ root, token: github.accessToken });
 
   terminal.step('Catching up with GitHub');

package/src/git.js

@@ -1,5 +1,8 @@
 import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
+import { parse } from 'yaml';
 
 /**
  * Git, authenticated as the writer's Gala credential rather than as the machine.
@@ -41,21 +44,21 @@ export function createGit({ root, token, spawnProcess = spawn } = {}) {
    * them. On failure every captured line is emitted, because that is exactly when git's text is
    * the most useful thing on screen.
    */
-  const run = (args, { allow = [0], capture = false } = {}) => new Promise((resolve, reject) => {
+  const run = (args, { allow = [0], capture = false, binary = false } = {}) => new Promise((resolve, reject) => {
     const child = spawnProcess('git', ['-C', cwd, ...credentialArguments(token), ...args], {
       cwd,
       shell: false,
       stdio: ['ignore', 'pipe', 'pipe'],
       env: environmentFor(token)
     });
-    let stdout = '';
+    const stdout = [];
     let stderr = '';
-    child.stdout?.on('data', (chunk) => { stdout += chunk; });
+    child.stdout?.on('data', (chunk) => { stdout.push(Buffer.from(chunk)); });
     child.stderr?.on('data', (chunk) => { stderr += chunk; });
     child.once('error', reject);
     child.once('exit', (code, signal) => {
       if (signal || !allow.includes(code)) {
-        const said = `${stdout}${stderr}`.trim();
+        const said = `${Buffer.concat(stdout).toString('utf8')}${stderr}`.trim();
         const failure = new Error(signal
           ? `git ${args[0]} stopped by ${signal}`
           : `git ${args[0]} exited with ${code}`);
@@ -63,7 +66,8 @@ export function createGit({ root, token, spawnProcess = spawn } = {}) {
         reject(failure);
         return;
       }
-      resolve(capture ? stdout.trim() : code);
+      const output = Buffer.concat(stdout);
+      resolve(capture ? (binary ? output : output.toString('utf8').trim()) : code);
     });
   });
 
@@ -105,9 +109,11 @@ export function createGit({ root, token, spawnProcess = spawn } = {}) {
      * makes the post-publish validation pass the sole local writer of any missing content ID.
      */
     async takeRemote() {
-      const unmerged = await run(['diff', '--name-only', '--diff-filter=U', '-z'], { capture: true });
-      const conflictedPaths = unmerged.split('\0').filter(Boolean);
+      const conflictedPaths = await unmergedPaths(run);
       if (conflictedPaths.length > 0) {
+        if (await reconcileManagedThemeConflict(run, cwd, conflictedPaths).catch(() => false)) {
+          return git.takeRemote();
+        }
         const failure = new Error('Git has unresolved conflicts. Gala left them untouched. Run git '
           + 'status, resolve or abort the operation it reports, then publish again.');
         failure.detail = `Conflicted files:\n${conflictedPaths.join('\n')}`;
@@ -116,6 +122,17 @@ export function createGit({ root, token, spawnProcess = spawn } = {}) {
       const branch = await git.branch();
       await run(['fetch', 'origin', branch]);
       await run(['rebase', '--autostash', `origin/${branch}`]);
+      const reappliedConflicts = await unmergedPaths(run);
+      if (reappliedConflicts.length > 0) {
+        if (await reconcileManagedThemeConflict(run, cwd, reappliedConflicts).catch(() => false)) {
+          return git.head();
+        }
+        const failure = new Error('Git updated from GitHub, but could not reapply your local work '
+          + 'without conflicts. Gala left every file untouched. Run git status, resolve the named '
+          + 'files, git add them, then publish again.');
+        failure.detail = `Conflicted files:\n${reappliedConflicts.join('\n')}`;
+        throw failure;
+      }
       return git.head();
     }
   };
@@ -123,6 +140,57 @@ export function createGit({ root, token, spawnProcess = spawn } = {}) {
   return git;
 }
 
+async function reconcileManagedThemeConflict(run, root, conflictedPaths) {
+  const manifestPath = '.gala/managed-files.json';
+  if (!conflictedPaths.includes(manifestPath)) return false;
+  let manifest;
+  try {
+    manifest = JSON.parse((await run(
+      ['show', `:3:${manifestPath}`], { capture: true, binary: true }
+    )).toString('utf8'));
+  } catch {
+    return false;
+  }
+  if (manifest?.schemaVersion !== 1 || typeof manifest.files !== 'object') return false;
+  const managedConflicts = conflictedPaths.filter((entry) => entry !== manifestPath
+    && entry !== 'site.config.yml');
+  if (managedConflicts.length + 2 !== conflictedPaths.length) return false;
+  for (const managed of managedConflicts) {
+    const expected = manifest.files[managed];
+    if (!/^[0-9a-f]{64}$/.test(expected ?? '')) return false;
+    const local = await run(['show', `:3:${managed}`], { capture: true, binary: true });
+    if (createHash('sha256').update(local).digest('hex') !== expected) return false;
+  }
+  const worktreeConfig = await readFile(path.join(root, 'site.config.yml'), 'utf8');
+  const resolvedConfig = selectStashedConflictSections(worktreeConfig);
+  let configuration;
+  try {
+    configuration = parse(resolvedConfig);
+  } catch {
+    return false;
+  }
+  if (configuration?.framework?.themePackage?.name !== manifest.themePackage?.name
+      || configuration?.framework?.themePackage?.version !== manifest.themePackage?.version) return false;
+  await run(['checkout', '--theirs', '--', manifestPath, ...managedConflicts]);
+  await writeFile(path.join(root, 'site.config.yml'), resolvedConfig);
+  await run(['add', '--', ...conflictedPaths]);
+  return (await unmergedPaths(run)).length === 0;
+}
+
+function selectStashedConflictSections(value) {
+  return value.replace(
+    /^<<<<<<< Updated upstream\n[\s\S]*?^=======\n([\s\S]*?)^>>>>>>> Stashed changes\n/gm,
+    '$1'
+  );
+}
+
+async function unmergedPaths(run) {
+  const unmerged = await run(
+    ['diff', '--name-only', '--diff-filter=U', '-z'], { capture: true }
+  );
+  return unmerged.split('\0').filter(Boolean);
+}
+
 export function cloneRepository({ url, target, token, spawnProcess = spawn }) {
   const resolved = path.resolve(target);
   return new Promise((resolve, reject) => {