@ship.zone/szci 7.1.5 → 7.1.7

package/bin/npm-prepare.js

@@ -0,0 +1,138 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import childProcess from 'node:child_process';
+
+import {
+  parseNpmCredentialEnvironment,
+  validateNpmRegistryUrl,
+} from '../ts/manager.npm/npmcredential.shared.js';
+
+const defaultRegistryUrl = 'registry.npmjs.org';
+
+const configError = () => new Error('Invalid @ship.zone/szci npm registry configuration.');
+
+/**
+ * @param {string} cwdArg
+ * @returns {string}
+ */
+export const readDefaultRegistryUrl = (cwdArg) => {
+  const configPath = path.join(cwdArg, '.smartconfig.json');
+  if (!fs.existsSync(configPath)) {
+    return defaultRegistryUrl;
+  }
+
+  let config;
+  try {
+    config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+  } catch {
+    throw configError();
+  }
+
+  const szciConfig = config?.['@ship.zone/szci'];
+  let configuredRegistry = defaultRegistryUrl;
+  if (szciConfig !== undefined) {
+    if (
+      !szciConfig ||
+      typeof szciConfig !== 'object' ||
+      Array.isArray(szciConfig)
+    ) {
+      throw configError();
+    }
+    if (Object.prototype.hasOwnProperty.call(szciConfig, 'npmRegistryUrl')) {
+      configuredRegistry = szciConfig.npmRegistryUrl;
+    }
+  }
+  if (typeof configuredRegistry !== 'string') {
+    throw configError();
+  }
+
+  try {
+    return validateNpmRegistryUrl(configuredRegistry);
+  } catch {
+    throw configError();
+  }
+};
+
+/**
+ * @param {{
+ *   environment?: Record<string, string | undefined>;
+ *   cwd?: string;
+ * }} [optionsArg]
+ */
+export const createNpmPreparePlan = (optionsArg = {}) => {
+  const environment = optionsArg.environment ?? process.env;
+  const cwd = optionsArg.cwd ?? process.cwd();
+  const npmCredentials = parseNpmCredentialEnvironment(environment);
+  if (npmCredentials.length === 0) {
+    throw new Error('No SZCI_TOKEN_NPM credentials were provided.');
+  }
+  const registryUrl = readDefaultRegistryUrl(cwd);
+
+  let npmrcFileString = '';
+  for (const npmCredential of npmCredentials) {
+    npmrcFileString += `//${npmCredential.registryUrl}/:_authToken="${npmCredential.token}"\n`;
+  }
+  npmrcFileString += `registry=https://${registryUrl}\n`;
+
+  return {
+    cwd,
+    npmCredentials,
+    npmrcFileString,
+    registryUrl,
+  };
+};
+
+/**
+ * @param {{
+ *   environment?: Record<string, string | undefined>;
+ *   cwd?: string;
+ *   homeDirectory?: string;
+ *   log?: (messageArg: string) => void;
+ *   writeFile?: (pathArg: string, contentArg: string) => void;
+ *   runNpm?: (commandArg: string, argsArg: string[]) => void;
+ * }} [optionsArg]
+ */
+export const runNpmPrepare = (optionsArg = {}) => {
+  const plan = createNpmPreparePlan(optionsArg);
+  const homeDirectory = optionsArg.homeDirectory ?? os.homedir();
+  const log = optionsArg.log ?? ((messageArg) => console.log(messageArg));
+  const writeFile = optionsArg.writeFile ??
+    ((pathArg, contentArg) => fs.writeFileSync(pathArg, contentArg));
+  const runNpm = optionsArg.runNpm ??
+    ((commandArg, argsArg) => {
+      const result = childProcess.spawnSync(commandArg, argsArg, {
+        stdio: 'inherit',
+        shell: false,
+      });
+      if (result.error) {
+        throw new Error('Failed to configure the npm cache.');
+      }
+      if (result.status !== 0) {
+        throw new Error('Failed to configure the npm cache.');
+      }
+    });
+
+  log('running >>npm prepare<<');
+  for (const npmCredential of plan.npmCredentials) {
+    log(`found token for ${npmCredential.registryUrl}`);
+    log(
+      npmCredential.tokenEncoding === 'plain'
+        ? 'npm token not base64 encoded.'
+        : 'npm token base64 encoded.',
+    );
+  }
+  log(`setting default npm registry to ${plan.registryUrl}`);
+  log('found one or more access tokens');
+
+  writeFile(path.join(homeDirectory, '.npmrc'), plan.npmrcFileString);
+  runNpm('npm', [
+    'config',
+    'set',
+    'cache',
+    path.join(plan.cwd, '.szci_cache'),
+    '--global',
+  ]);
+
+  return plan.npmCredentials;
+};

package/bin/szci-wrapper.js

@@ -145,5 +145,22 @@ function executeBinary() {
   }
 }
 
-// Execute
-executeBinary();
+const cliArguments = process.argv.slice(2);
+if (
+  cliArguments.length === 2 &&
+  cliArguments[0] === 'npm' &&
+  cliArguments[1] === 'prepare'
+) {
+  const runNodeNpmPrepare = async () => {
+    const { runNpmPrepare } = await import('./npm-prepare.js');
+    runNpmPrepare();
+  };
+  runNodeNpmPrepare().catch((error) => {
+    console.error(
+      error instanceof Error ? error.message : 'SZCI npm prepare failed.',
+    );
+    process.exitCode = 1;
+  });
+} else {
+  executeBinary();
+}

package/changelog.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 2026-07-28 - 7.1.7
+
+### Fixes
+
+- run `szci npm prepare` through the Node wrapper without starting a platform binary
+  - Keep npm credential validation shared between the Node and Deno paths.
+  - Allow cross-platform Docker builds to prepare npm authentication when Deno cannot execute under CPU emulation.
+  - Validate the configured default registry before logging or writing `.npmrc`.
+  - Require Node 14.13.1 or newer for the Node-native prepare path.
+
+## 2026-07-28 - 7.1.6
+
+### Fixes
+
+- validate npm credentials before publishing (npm)
+  - Validate all SZCI_TOKEN_NPM values before logging or writing .npmrc
+  - Reject malformed registry, encoding, or token values without exposing credential input
+  - Await credential preparation and reuse the validated registry list during npm publish
+- remove duplicate pending npm credential fix entries (changelog)
+  - Consolidate repeated pending fix bullets under the existing npm credential validation entry.
+
 ## 2026-07-28 - 7.1.5
 
 ### Fixes

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@ship.zone/szci",
-  "version": "7.1.5",
+  "version": "7.1.7",
   "exports": "./mod.ts",
   "nodeModulesDir": "auto",
   "tasks": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ship.zone/szci",
-  "version": "7.1.5",
+  "version": "7.1.7",
   "description": "Serve Zone CI - A tool to streamline Node.js and Docker workflows within CI environments, particularly GitLab CI, providing various CI/CD utilities. Powered by Deno with standalone executables.",
   "keywords": [
     "Node.js",
@@ -45,7 +45,7 @@
     "changelog.md"
   ],
   "engines": {
-    "node": ">=14.0.0"
+    "node": ">=14.13.1"
   },
   "os": [
     "darwin",

package/readme.md

@@ -118,6 +118,10 @@ szci npm prepare     # Generates ~/.npmrc from SZCI_TOKEN_NPM* env vars
 szci npm publish     # Full workflow: prepare → install → build → clean → npm publish
 ```
 
+`szci npm prepare` runs directly through the Node wrapper, so npm authentication
+setup remains available during cross-platform Docker builds where a Deno binary
+cannot execute under CPU emulation.
+
 The `publish` command supports multi-registry publishing. If `npmAccessLevel` is `public` and a Verdaccio registry is configured, it publishes to both npm and Verdaccio automatically.
 
 ### `szci node` — Node.js Version Management
@@ -199,6 +203,9 @@ SZCI_TOKEN_NPM_1="registry.npmjs.org|dGhlLXRva2VuLWhlcmU="
 SZCI_TOKEN_NPM_2="verdaccio.example.com|the-token-here|plain"
 ```
 
+SZCI validates every configured npm credential before writing `.npmrc`. Malformed
+registry, encoding, or token values fail without logging the credential.
+
 ### SSH Keys
 
 Pipe-delimited format: `host|privKeyBase64|pubKeyBase64`

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@ship.zone/szci',
-  version: '7.1.5',
+  version: '7.1.7',
   description: 'Serve Zone CI - A tool to streamline Node.js and Docker workflows within CI environments, particularly GitLab CI, providing various CI/CD utilities. Powered by Deno with standalone executables.'
 }

package/ts/manager.npm/index.ts

@@ -4,6 +4,11 @@ import * as paths from '../szci.paths.ts';
 import { logger } from '../szci.logging.ts';
 import { bash, bashNoError, nvmAvailable } from '../szci.bash.ts';
 import { Szci } from '../szci.classes.szci.ts';
+import {
+  type INpmCredential,
+  parseNpmCredentialEnvironment,
+  validateNpmRegistryUrl,
+} from './npmcredential.ts';
 
 export class SzciNpmManager {
   public szciRef: Szci;
@@ -42,7 +47,7 @@ export class SzciNpmManager {
     } else {
       logger.log(
         'info',
-        `>>szci npm ...<< cli arguments invalid... Please read the documentation.`
+        `>>szci npm ...<< cli arguments invalid... Please read the documentation.`,
       );
       Deno.exit(1);
     }
@@ -51,66 +56,55 @@ export class SzciNpmManager {
   /**
    * authenticates npm with token from env var
    */
-  public async prepare() {
+  public async prepare(): Promise<INpmCredential[]> {
     logger.log('info', 'running >>npm prepare<<');
     const config = this.szciRef.szciConfig.getConfig();
-    let npmrcFileString: string = '';
-    await plugins.smartobject.forEachMinimatch(
+    const npmCredentials = parseNpmCredentialEnvironment(
       Deno.env.toObject(),
-      'SZCI_TOKEN_NPM*',
-      (npmEnvArg: string) => {
-        if (!npmEnvArg) {
-          logger.log('note','found empty token...');
-          return;
-        }
-        const npmRegistryUrl = npmEnvArg.split('|')[0];
-        logger.log('ok', `found token for ${npmRegistryUrl}`);
-        let npmToken = npmEnvArg.split('|')[1];
-        if (npmEnvArg.split('|')[2] && npmEnvArg.split('|')[2] === 'plain') {
-          logger.log('ok', 'npm token not base64 encoded.');
-        } else {
-          logger.log('ok', 'npm token base64 encoded.');
-          npmToken = plugins.smartstring.base64.decode(npmToken);
-        }
-        npmrcFileString += `//${npmRegistryUrl}/:_authToken="${npmToken}"\n`;
-      }
     );
-    logger.log('info', `setting default npm registry to ${config.npmRegistryUrl}`);
-    npmrcFileString += `registry=https://${config.npmRegistryUrl}\n`;
+    if (npmCredentials.length === 0) {
+      throw new Error('No SZCI_TOKEN_NPM credentials were provided.');
+    }
+    const defaultRegistryUrl = validateNpmRegistryUrl(config.npmRegistryUrl);
 
-    // final check
-    if (npmrcFileString.length > 0) {
-      logger.log('info', 'found one or more access tokens');
-    } else {
-      logger.log('error', 'no access token found! Exiting!');
-      Deno.exit(1);
+    let npmrcFileString: string = '';
+    for (const npmCredential of npmCredentials) {
+      logger.log('ok', `found token for ${npmCredential.registryUrl}`);
+      logger.log(
+        'ok',
+        npmCredential.tokenEncoding === 'plain'
+          ? 'npm token not base64 encoded.'
+          : 'npm token base64 encoded.',
+      );
+      npmrcFileString += `//${npmCredential.registryUrl}/:_authToken="${npmCredential.token}"\n`;
     }
 
+    logger.log('info', `setting default npm registry to ${defaultRegistryUrl}`);
+    npmrcFileString += `registry=https://${defaultRegistryUrl}\n`;
+    logger.log('info', 'found one or more access tokens');
+
     // lets save it to disk
     plugins.smartfile.memory.toFsSync(npmrcFileString, '/root/.npmrc');
 
     // lets set the cache directory
     await bash(`npm config set cache ${paths.SzciCacheDir}  --global `);
 
-    return;
+    return npmCredentials;
   }
 
   /**
    * publish a package to npm
    */
   public async publish() {
-    const buildPublishCommand = async () => {
+    const buildPublishCommand = async (
+      npmCredentialsArg: INpmCredential[],
+    ) => {
       let npmAccessCliString = ``;
       let npmRegistryCliString = ``;
       let publishVerdaccioAsWell = false;
       const config = this.szciRef.szciConfig.getConfig();
-      const availableRegistries: string[] = [];
-      await plugins.smartobject.forEachMinimatch(
-        Deno.env.toObject(),
-        'SZCI_TOKEN_NPM*',
-        (npmEnvArg: string) => {
-          availableRegistries.push(npmEnvArg.split('|')[0]);
-        }
+      const availableRegistries = npmCredentialsArg.map(
+        (npmCredentialArg) => npmCredentialArg.registryUrl,
       );
 
       // -> configure package access level
@@ -140,13 +134,14 @@ export class SzciNpmManager {
         if (verdaccioRegistry) {
           logger.log(
             'info',
-            `package is public and verdaccio registry is specified. Also publishing to Verdaccio!`
+            `package is public and verdaccio registry is specified. Also publishing to Verdaccio!`,
           );
-          publishCommand = `${publishCommand} && npm publish ${npmAccessCliString} --registry=https://${verdaccioRegistry}`;
+          publishCommand =
+            `${publishCommand} && npm publish ${npmAccessCliString} --registry=https://${verdaccioRegistry}`;
         } else {
           logger.log(
             'error',
-            `This package should also be published to Verdaccio, however there is no Verdaccio registry data available!`
+            `This package should also be published to Verdaccio, however there is no Verdaccio registry data available!`,
           );
         }
       }
@@ -155,7 +150,7 @@ export class SzciNpmManager {
 
     // -> preparing
     logger.log('info', `now preparing environment:`);
-    this.prepare();
+    const npmCredentials = await this.prepare();
     await bash(`npm -v`);
     await bash(`pnpm -v`);
 
@@ -173,7 +168,7 @@ export class SzciNpmManager {
 
     // -> publish it
     logger.log('info', `now invoking npm to publish the package!`);
-    await bash(await buildPublishCommand());
+    await bash(await buildPublishCommand(npmCredentials));
     logger.log('success', `Package was successfully published!`);
   }
 

package/ts/manager.npm/npmcredential.shared.js

@@ -0,0 +1,111 @@
+const invalidCredentialError = () =>
+  new Error(
+    'Invalid SZCI_TOKEN_NPM credential. Expected registry|token[|plain].',
+  );
+
+const registryUrlRegex = /^[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?(?::[0-9]{1,5})?$/;
+const base64Regex = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+const unsafeTokenRegex = /[\u0000-\u001f\u007f"\\]/;
+
+/**
+ * @param {string} registryUrlArg
+ * @returns {string}
+ */
+export const validateNpmRegistryUrl = (registryUrlArg) => {
+  if (
+    !registryUrlArg ||
+    registryUrlArg.length > 512 ||
+    !registryUrlRegex.test(registryUrlArg)
+  ) {
+    throw invalidCredentialError();
+  }
+  return registryUrlArg;
+};
+
+/**
+ * @param {string} npmEnvironmentValueArg
+ * @returns {{
+ *   registryUrl: string;
+ *   token: string;
+ *   tokenEncoding: 'base64' | 'plain';
+ * }}
+ */
+export const parseNpmCredential = (npmEnvironmentValueArg) => {
+  const fields = npmEnvironmentValueArg.split('|');
+  if (fields.length < 2 || fields.length > 3) {
+    throw invalidCredentialError();
+  }
+
+  const registryUrl = validateNpmRegistryUrl(fields[0]);
+  const encodedToken = fields[1];
+  const encodingMarker = fields[2];
+  if (
+    !encodedToken ||
+    (encodingMarker !== undefined && encodingMarker !== 'plain')
+  ) {
+    throw invalidCredentialError();
+  }
+
+  let token;
+  /** @type {'base64' | 'plain'} */
+  let tokenEncoding;
+  if (encodingMarker === 'plain') {
+    token = encodedToken;
+    tokenEncoding = 'plain';
+  } else {
+    if (!base64Regex.test(encodedToken)) {
+      throw invalidCredentialError();
+    }
+    const tokenBuffer = Buffer.from(encodedToken, 'base64');
+    if (tokenBuffer.toString('base64') !== encodedToken) {
+      throw invalidCredentialError();
+    }
+    try {
+      token = new TextDecoder('utf-8', { fatal: true }).decode(tokenBuffer);
+    } catch {
+      throw invalidCredentialError();
+    }
+    if (Buffer.from(token, 'utf8').toString('base64') !== encodedToken) {
+      throw invalidCredentialError();
+    }
+    tokenEncoding = 'base64';
+  }
+
+  if (
+    !token ||
+    token.length > 65536 ||
+    unsafeTokenRegex.test(token) ||
+    token.includes('${')
+  ) {
+    throw invalidCredentialError();
+  }
+
+  return {
+    registryUrl,
+    token,
+    tokenEncoding,
+  };
+};
+
+/**
+ * @param {Record<string, string | undefined>} environmentArg
+ * @returns {Array<{
+ *   registryUrl: string;
+ *   token: string;
+ *   tokenEncoding: 'base64' | 'plain';
+ * }>}
+ */
+export const parseNpmCredentialEnvironment = (environmentArg) => {
+  const credentialValues = Object.entries(environmentArg)
+    .filter(
+      ([environmentVariableNameArg, environmentVariableValueArg]) =>
+        environmentVariableNameArg.startsWith('SZCI_TOKEN_NPM') &&
+        environmentVariableValueArg !== undefined,
+    )
+    .sort(([environmentVariableNameA], [environmentVariableNameB]) =>
+      environmentVariableNameA.localeCompare(environmentVariableNameB)
+    )
+    .map(([, environmentVariableValueArg]) => environmentVariableValueArg);
+
+  return credentialValues.map((credentialValueArg) => parseNpmCredential(credentialValueArg));
+};

package/ts/manager.npm/npmcredential.ts

@@ -0,0 +1,23 @@
+export interface INpmCredential {
+  registryUrl: string;
+  token: string;
+  tokenEncoding: 'base64' | 'plain';
+}
+
+import {
+  parseNpmCredential as parseNpmCredentialShared,
+  parseNpmCredentialEnvironment as parseNpmCredentialEnvironmentShared,
+  validateNpmRegistryUrl as validateNpmRegistryUrlShared,
+} from './npmcredential.shared.js';
+
+export const validateNpmRegistryUrl = (
+  registryUrlArg: string,
+): string => validateNpmRegistryUrlShared(registryUrlArg);
+
+export const parseNpmCredential = (
+  npmEnvironmentValueArg: string,
+): INpmCredential => parseNpmCredentialShared(npmEnvironmentValueArg);
+
+export const parseNpmCredentialEnvironment = (
+  environmentArg: Record<string, string>,
+): INpmCredential[] => parseNpmCredentialEnvironmentShared(environmentArg);