@ship.zone/szci 7.1.4 → 7.1.6

package/bin/szci-wrapper.js

@@ -9,7 +9,7 @@ import { spawn } from 'child_process';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
 import { existsSync } from 'fs';
-import { platform, arch } from 'os';
+import { arch, platform } from 'os';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -25,12 +25,12 @@ function getBinaryName() {
   const platformMap = {
     'darwin': 'macos',
     'linux': 'linux',
-    'win32': 'windows'
+    'win32': 'windows',
   };
 
   const archMap = {
     'x64': 'x64',
-    'arm64': 'arm64'
+    'arm64': 'arm64',
   };
 
   const mappedPlatform = platformMap[plat];
@@ -61,12 +61,10 @@ function executeBinary() {
 
   const denoSourcePath = join(__dirname, '..', 'mod.ts');
   const denoConfigPath = join(__dirname, '..', 'deno.json');
-  const command = existsSync(binaryPath) ? binaryPath : 'deno';
-  const args = existsSync(binaryPath)
-    ? process.argv.slice(2)
-    : ['run', '--allow-all', '--config', denoConfigPath, denoSourcePath, ...process.argv.slice(2)];
+  const binaryExists = existsSync(binaryPath);
+  const sourceFallbackExists = existsSync(denoSourcePath) && existsSync(denoConfigPath);
 
-  if (!existsSync(binaryPath) && !existsSync(denoSourcePath)) {
+  if (!binaryExists && !sourceFallbackExists) {
     console.error(`Error: Binary not found at ${binaryPath}`);
     console.error(`Error: Deno source fallback not found at ${denoSourcePath}`);
     console.error('Try reinstalling the package:');
@@ -75,35 +73,76 @@ function executeBinary() {
     process.exit(1);
   }
 
-  // Spawn the binary or the Deno source fallback with all arguments passed through.
-  const child = spawn(command, args, {
-    stdio: 'inherit',
-    shell: false
-  });
+  let activeChild;
+  const spawnCommand = (command, args, isStandaloneBinary) => {
+    const child = spawn(command, args, {
+      stdio: 'inherit',
+      shell: false,
+    });
+    activeChild = child;
 
-  // Handle child process events
-  child.on('error', (err) => {
-    console.error(`Error executing szci: ${err.message}`);
-    process.exit(1);
-  });
+    child.on('error', (err) => {
+      console.error(`Error executing szci: ${err.message}`);
+      process.exit(1);
+    });
 
-  child.on('exit', (code, signal) => {
-    if (signal) {
-      process.kill(process.pid, signal);
-    } else {
-      process.exit(code || 0);
-    }
-  });
+    child.on('exit', (code, signal) => {
+      if (
+        isStandaloneBinary &&
+        signal === 'SIGILL' &&
+        sourceFallbackExists
+      ) {
+        console.warn(
+          'SZCI standalone binary exited with SIGILL; retrying with the packaged Deno source fallback.',
+        );
+        spawnCommand(
+          'deno',
+          [
+            'run',
+            '--allow-all',
+            '--config',
+            denoConfigPath,
+            denoSourcePath,
+            ...process.argv.slice(2),
+          ],
+          false,
+        );
+        return;
+      }
+      if (signal) {
+        process.kill(process.pid, signal);
+      } else {
+        process.exit(code || 0);
+      }
+    });
+  };
 
   // Forward signals to child process
   const signals = ['SIGINT', 'SIGTERM', 'SIGHUP'];
-  signals.forEach(signal => {
+  signals.forEach((signal) => {
     process.on(signal, () => {
-      if (!child.killed) {
-        child.kill(signal);
+      if (activeChild && !activeChild.killed) {
+        activeChild.kill(signal);
       }
     });
   });
+
+  if (binaryExists) {
+    spawnCommand(binaryPath, process.argv.slice(2), true);
+  } else {
+    spawnCommand(
+      'deno',
+      [
+        'run',
+        '--allow-all',
+        '--config',
+        denoConfigPath,
+        denoSourcePath,
+        ...process.argv.slice(2),
+      ],
+      false,
+    );
+  }
 }
 
 // Execute

package/changelog.md

@@ -1,7 +1,23 @@
 # Changelog
 
-## Pending
+## 2026-07-28 - 7.1.6
 
+### Fixes
+
+- validate npm credentials before publishing (npm)
+  - Validate all SZCI_TOKEN_NPM values before logging or writing .npmrc
+  - Reject malformed registry, encoding, or token values without exposing credential input
+  - Await credential preparation and reuse the validated registry list during npm publish
+- remove duplicate pending npm credential fix entries (changelog)
+  - Consolidate repeated pending fix bullets under the existing npm credential validation entry.
+
+## 2026-07-28 - 7.1.5
+
+### Fixes
+
+- retry the packaged Deno source when the standalone binary exits with `SIGILL`
+  - Keeps the normal standalone path on supported CPUs.
+  - Recovers ARM64 CI environments that reject an incompatible executable instruction.
 
 ## 2026-05-20 - 7.1.4
 

package/deno.json

@@ -1,14 +1,14 @@
 {
   "name": "@ship.zone/szci",
-  "version": "7.1.4",
+  "version": "7.1.6",
   "exports": "./mod.ts",
   "nodeModulesDir": "auto",
   "tasks": {
     "dev": "deno run --allow-all mod.ts",
     "compile": "deno task compile:all",
     "compile:all": "bash scripts/compile-all.sh",
-    "test": "deno test --allow-all test/",
-    "test:watch": "deno test --allow-all --watch test/",
+    "test": "deno test --allow-all test/*.ts",
+    "test:watch": "deno test --allow-all --watch test/*.ts",
     "check": "deno check mod.ts",
     "fmt": "deno fmt",
     "lint": "deno lint"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ship.zone/szci",
-  "version": "7.1.4",
+  "version": "7.1.6",
   "description": "Serve Zone CI - A tool to streamline Node.js and Docker workflows within CI environments, particularly GitLab CI, providing various CI/CD utilities. Powered by Deno with standalone executables.",
   "keywords": [
     "Node.js",

package/readme.md

@@ -52,6 +52,10 @@ curl -sSL https://code.foss.global/ship.zone/szci/raw/branch/main/install.sh | s
 npm install -g @ship.zone/szci
 ```
 
+The normal pre-compiled path does not require a runtime. If a standalone executable terminates with
+`SIGILL`, the npm wrapper automatically retries the packaged source and requires `deno` to be
+available on `PATH`.
+
 ### From Source
 
 ```sh
@@ -128,7 +132,7 @@ szci node install 21        # Any specific version
 Uses NVM under the hood (auto-detected at `/usr/local/nvm/nvm.sh` or `~/.nvm/nvm.sh`). After installing, it:
 1. Sets the installed version as `nvm alias default`
 2. Upgrades npm to latest
-3. Installs any global tools listed in `npmextra.json` → `npmGlobalTools`
+3. Installs any global tools listed in `.smartconfig.json` → `npmGlobalTools`
 
 ### `szci ssh` — SSH Key Deployment
 
@@ -148,7 +152,7 @@ Pushes all branches and tags to a GitHub mirror. Requires `SZCI_GIT_GITHUBTOKEN`
 
 ## ⚙️ Configuration
 
-### `npmextra.json`
+### `.smartconfig.json`
 
 Place this in your project root to configure szci behavior:
 
@@ -195,6 +199,9 @@ SZCI_TOKEN_NPM_1="registry.npmjs.org|dGhlLXRva2VuLWhlcmU="
 SZCI_TOKEN_NPM_2="verdaccio.example.com|the-token-here|plain"
 ```
 
+SZCI validates every configured npm credential before writing `.npmrc`. Malformed
+registry, encoding, or token values fail without logging the credential.
+
 ### SSH Keys
 
 Pipe-delimited format: `host|privKeyBase64|pubKeyBase64`
@@ -371,7 +378,7 @@ deno task lint
 
 ## License and Legal Information
 
-This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [LICENSE](./LICENSE) file.
+This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [license](./license) file.
 
 **Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@ship.zone/szci',
-  version: '7.1.3',
+  version: '7.1.6',
   description: 'Serve Zone CI - A tool to streamline Node.js and Docker workflows within CI environments, particularly GitLab CI, providing various CI/CD utilities. Powered by Deno with standalone executables.'
 }

package/ts/manager.nodejs/index.ts

@@ -30,7 +30,7 @@ export class SzciNodeJsManager {
     } else {
       logger.log(
         'error',
-        `>>szci node ...<< cli arguments invalid... Please read the documentation.`
+        `>>szci node ...<< cli arguments invalid... Please read the documentation.`,
       );
       Deno.exit(1);
     }

package/ts/manager.npm/index.ts

@@ -4,6 +4,11 @@ import * as paths from '../szci.paths.ts';
 import { logger } from '../szci.logging.ts';
 import { bash, bashNoError, nvmAvailable } from '../szci.bash.ts';
 import { Szci } from '../szci.classes.szci.ts';
+import {
+  type INpmCredential,
+  parseNpmCredentialEnvironment,
+  validateNpmRegistryUrl,
+} from './npmcredential.ts';
 
 export class SzciNpmManager {
   public szciRef: Szci;
@@ -42,7 +47,7 @@ export class SzciNpmManager {
     } else {
       logger.log(
         'info',
-        `>>szci npm ...<< cli arguments invalid... Please read the documentation.`
+        `>>szci npm ...<< cli arguments invalid... Please read the documentation.`,
       );
       Deno.exit(1);
     }
@@ -51,66 +56,55 @@ export class SzciNpmManager {
   /**
    * authenticates npm with token from env var
    */
-  public async prepare() {
+  public async prepare(): Promise<INpmCredential[]> {
     logger.log('info', 'running >>npm prepare<<');
     const config = this.szciRef.szciConfig.getConfig();
-    let npmrcFileString: string = '';
-    await plugins.smartobject.forEachMinimatch(
+    const npmCredentials = parseNpmCredentialEnvironment(
       Deno.env.toObject(),
-      'SZCI_TOKEN_NPM*',
-      (npmEnvArg: string) => {
-        if (!npmEnvArg) {
-          logger.log('note','found empty token...');
-          return;
-        }
-        const npmRegistryUrl = npmEnvArg.split('|')[0];
-        logger.log('ok', `found token for ${npmRegistryUrl}`);
-        let npmToken = npmEnvArg.split('|')[1];
-        if (npmEnvArg.split('|')[2] && npmEnvArg.split('|')[2] === 'plain') {
-          logger.log('ok', 'npm token not base64 encoded.');
-        } else {
-          logger.log('ok', 'npm token base64 encoded.');
-          npmToken = plugins.smartstring.base64.decode(npmToken);
-        }
-        npmrcFileString += `//${npmRegistryUrl}/:_authToken="${npmToken}"\n`;
-      }
     );
-    logger.log('info', `setting default npm registry to ${config.npmRegistryUrl}`);
-    npmrcFileString += `registry=https://${config.npmRegistryUrl}\n`;
+    if (npmCredentials.length === 0) {
+      throw new Error('No SZCI_TOKEN_NPM credentials were provided.');
+    }
 
-    // final check
-    if (npmrcFileString.length > 0) {
-      logger.log('info', 'found one or more access tokens');
-    } else {
-      logger.log('error', 'no access token found! Exiting!');
-      Deno.exit(1);
+    let npmrcFileString: string = '';
+    for (const npmCredential of npmCredentials) {
+      logger.log('ok', `found token for ${npmCredential.registryUrl}`);
+      logger.log(
+        'ok',
+        npmCredential.tokenEncoding === 'plain'
+          ? 'npm token not base64 encoded.'
+          : 'npm token base64 encoded.',
+      );
+      npmrcFileString += `//${npmCredential.registryUrl}/:_authToken="${npmCredential.token}"\n`;
     }
 
+    const defaultRegistryUrl = validateNpmRegistryUrl(config.npmRegistryUrl);
+    logger.log('info', `setting default npm registry to ${defaultRegistryUrl}`);
+    npmrcFileString += `registry=https://${defaultRegistryUrl}\n`;
+    logger.log('info', 'found one or more access tokens');
+
     // lets save it to disk
     plugins.smartfile.memory.toFsSync(npmrcFileString, '/root/.npmrc');
 
     // lets set the cache directory
     await bash(`npm config set cache ${paths.SzciCacheDir}  --global `);
 
-    return;
+    return npmCredentials;
   }
 
   /**
    * publish a package to npm
    */
   public async publish() {
-    const buildPublishCommand = async () => {
+    const buildPublishCommand = async (
+      npmCredentialsArg: INpmCredential[],
+    ) => {
       let npmAccessCliString = ``;
       let npmRegistryCliString = ``;
       let publishVerdaccioAsWell = false;
       const config = this.szciRef.szciConfig.getConfig();
-      const availableRegistries: string[] = [];
-      await plugins.smartobject.forEachMinimatch(
-        Deno.env.toObject(),
-        'SZCI_TOKEN_NPM*',
-        (npmEnvArg: string) => {
-          availableRegistries.push(npmEnvArg.split('|')[0]);
-        }
+      const availableRegistries = npmCredentialsArg.map(
+        (npmCredentialArg) => npmCredentialArg.registryUrl,
       );
 
       // -> configure package access level
@@ -140,13 +134,14 @@ export class SzciNpmManager {
         if (verdaccioRegistry) {
           logger.log(
             'info',
-            `package is public and verdaccio registry is specified. Also publishing to Verdaccio!`
+            `package is public and verdaccio registry is specified. Also publishing to Verdaccio!`,
           );
-          publishCommand = `${publishCommand} && npm publish ${npmAccessCliString} --registry=https://${verdaccioRegistry}`;
+          publishCommand =
+            `${publishCommand} && npm publish ${npmAccessCliString} --registry=https://${verdaccioRegistry}`;
         } else {
           logger.log(
             'error',
-            `This package should also be published to Verdaccio, however there is no Verdaccio registry data available!`
+            `This package should also be published to Verdaccio, however there is no Verdaccio registry data available!`,
           );
         }
       }
@@ -155,7 +150,7 @@ export class SzciNpmManager {
 
     // -> preparing
     logger.log('info', `now preparing environment:`);
-    this.prepare();
+    const npmCredentials = await this.prepare();
     await bash(`npm -v`);
     await bash(`pnpm -v`);
 
@@ -173,7 +168,7 @@ export class SzciNpmManager {
 
     // -> publish it
     logger.log('info', `now invoking npm to publish the package!`);
-    await bash(await buildPublishCommand());
+    await bash(await buildPublishCommand(npmCredentials));
     logger.log('success', `Package was successfully published!`);
   }
 

package/ts/manager.npm/npmcredential.ts

@@ -0,0 +1,91 @@
+import * as plugins from './mod.plugins.ts';
+
+export interface INpmCredential {
+  registryUrl: string;
+  token: string;
+  tokenEncoding: 'base64' | 'plain';
+}
+
+const invalidCredentialError = () =>
+  new Error(
+    'Invalid SZCI_TOKEN_NPM credential. Expected registry|token[|plain].',
+  );
+
+const registryUrlRegex = /^[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?(?::[0-9]{1,5})?$/;
+const unsafeTokenRegex = /[\u0000-\u001f\u007f"\\]/;
+
+export const validateNpmRegistryUrl = (registryUrlArg: string): string => {
+  if (
+    !registryUrlArg ||
+    registryUrlArg.length > 512 ||
+    !registryUrlRegex.test(registryUrlArg)
+  ) {
+    throw invalidCredentialError();
+  }
+  return registryUrlArg;
+};
+
+export const parseNpmCredential = (
+  npmEnvironmentValueArg: string,
+): INpmCredential => {
+  const fields = npmEnvironmentValueArg.split('|');
+  if (fields.length < 2 || fields.length > 3) {
+    throw invalidCredentialError();
+  }
+
+  const registryUrl = validateNpmRegistryUrl(fields[0]);
+  const encodedToken = fields[1];
+  const encodingMarker = fields[2];
+  if (
+    !encodedToken ||
+    (encodingMarker !== undefined && encodingMarker !== 'plain')
+  ) {
+    throw invalidCredentialError();
+  }
+
+  let token: string;
+  let tokenEncoding: INpmCredential['tokenEncoding'];
+  if (encodingMarker === 'plain') {
+    token = encodedToken;
+    tokenEncoding = 'plain';
+  } else {
+    if (!plugins.smartstring.base64.isBase64(encodedToken)) {
+      throw invalidCredentialError();
+    }
+    token = plugins.smartstring.base64.decode(encodedToken);
+    if (plugins.smartstring.base64.encode(token) !== encodedToken) {
+      throw invalidCredentialError();
+    }
+    tokenEncoding = 'base64';
+  }
+
+  if (
+    !token ||
+    token.length > 65536 ||
+    unsafeTokenRegex.test(token) ||
+    token.includes('${')
+  ) {
+    throw invalidCredentialError();
+  }
+
+  return {
+    registryUrl,
+    token,
+    tokenEncoding,
+  };
+};
+
+export const parseNpmCredentialEnvironment = (
+  environmentArg: Record<string, string>,
+): INpmCredential[] => {
+  const credentialValues = Object.entries(environmentArg)
+    .filter(([environmentVariableNameArg]) =>
+      environmentVariableNameArg.startsWith('SZCI_TOKEN_NPM')
+    )
+    .sort(([environmentVariableNameA], [environmentVariableNameB]) =>
+      environmentVariableNameA.localeCompare(environmentVariableNameB)
+    )
+    .map(([, environmentVariableValueArg]) => environmentVariableValueArg);
+
+  return credentialValues.map((credentialValueArg) => parseNpmCredential(credentialValueArg));
+};

package/ts/szci.classes.szciconfig.ts

@@ -44,7 +44,7 @@ export class SzciConfig {
     this.szciQenv = new plugins.qenv.Qenv(
       paths.SzciProjectDir,
       paths.SzciProjectNogitDir,
-      false
+      false,
     );
 
     this.configObject = {
@@ -54,7 +54,10 @@ export class SzciConfig {
       npmRegistryUrl: 'registry.npmjs.org',
       urlCloudly: await this.szciQenv.getEnvVarOnDemand('SZCI_URL_CLOUDLY'),
     };
-    this.configObject = this.szciSmartconfig.dataFor<ISzciOptions>('@ship.zone/szci', this.configObject);
+    this.configObject = this.szciSmartconfig.dataFor<ISzciOptions>(
+      '@ship.zone/szci',
+      this.configObject,
+    );
   }
 
   public getConfig(): ISzciOptions {

package/ts/szci.plugins.ts

@@ -36,10 +36,10 @@ export {
   projectinfo,
   qenv,
   smartanalytics,
-  smartfile,
-  smartgit,
   smartcli,
   smartconfig,
+  smartfile,
+  smartgit,
   smartlog,
   smartlogDestinationLocal,
   smartobject,
@@ -56,4 +56,3 @@ export {
 import * as tsclass from '@tsclass/tsclass';
 
 export { tsclass };
-