@ship.zone/szci 7.1.6 → 7.1.7

package/bin/npm-prepare.js

@@ -0,0 +1,138 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import childProcess from 'node:child_process';
+
+import {
+  parseNpmCredentialEnvironment,
+  validateNpmRegistryUrl,
+} from '../ts/manager.npm/npmcredential.shared.js';
+
+const defaultRegistryUrl = 'registry.npmjs.org';
+
+const configError = () => new Error('Invalid @ship.zone/szci npm registry configuration.');
+
+/**
+ * @param {string} cwdArg
+ * @returns {string}
+ */
+export const readDefaultRegistryUrl = (cwdArg) => {
+  const configPath = path.join(cwdArg, '.smartconfig.json');
+  if (!fs.existsSync(configPath)) {
+    return defaultRegistryUrl;
+  }
+
+  let config;
+  try {
+    config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+  } catch {
+    throw configError();
+  }
+
+  const szciConfig = config?.['@ship.zone/szci'];
+  let configuredRegistry = defaultRegistryUrl;
+  if (szciConfig !== undefined) {
+    if (
+      !szciConfig ||
+      typeof szciConfig !== 'object' ||
+      Array.isArray(szciConfig)
+    ) {
+      throw configError();
+    }
+    if (Object.prototype.hasOwnProperty.call(szciConfig, 'npmRegistryUrl')) {
+      configuredRegistry = szciConfig.npmRegistryUrl;
+    }
+  }
+  if (typeof configuredRegistry !== 'string') {
+    throw configError();
+  }
+
+  try {
+    return validateNpmRegistryUrl(configuredRegistry);
+  } catch {
+    throw configError();
+  }
+};
+
+/**
+ * @param {{
+ *   environment?: Record<string, string | undefined>;
+ *   cwd?: string;
+ * }} [optionsArg]
+ */
+export const createNpmPreparePlan = (optionsArg = {}) => {
+  const environment = optionsArg.environment ?? process.env;
+  const cwd = optionsArg.cwd ?? process.cwd();
+  const npmCredentials = parseNpmCredentialEnvironment(environment);
+  if (npmCredentials.length === 0) {
+    throw new Error('No SZCI_TOKEN_NPM credentials were provided.');
+  }
+  const registryUrl = readDefaultRegistryUrl(cwd);
+
+  let npmrcFileString = '';
+  for (const npmCredential of npmCredentials) {
+    npmrcFileString += `//${npmCredential.registryUrl}/:_authToken="${npmCredential.token}"\n`;
+  }
+  npmrcFileString += `registry=https://${registryUrl}\n`;
+
+  return {
+    cwd,
+    npmCredentials,
+    npmrcFileString,
+    registryUrl,
+  };
+};
+
+/**
+ * @param {{
+ *   environment?: Record<string, string | undefined>;
+ *   cwd?: string;
+ *   homeDirectory?: string;
+ *   log?: (messageArg: string) => void;
+ *   writeFile?: (pathArg: string, contentArg: string) => void;
+ *   runNpm?: (commandArg: string, argsArg: string[]) => void;
+ * }} [optionsArg]
+ */
+export const runNpmPrepare = (optionsArg = {}) => {
+  const plan = createNpmPreparePlan(optionsArg);
+  const homeDirectory = optionsArg.homeDirectory ?? os.homedir();
+  const log = optionsArg.log ?? ((messageArg) => console.log(messageArg));
+  const writeFile = optionsArg.writeFile ??
+    ((pathArg, contentArg) => fs.writeFileSync(pathArg, contentArg));
+  const runNpm = optionsArg.runNpm ??
+    ((commandArg, argsArg) => {
+      const result = childProcess.spawnSync(commandArg, argsArg, {
+        stdio: 'inherit',
+        shell: false,
+      });
+      if (result.error) {
+        throw new Error('Failed to configure the npm cache.');
+      }
+      if (result.status !== 0) {
+        throw new Error('Failed to configure the npm cache.');
+      }
+    });
+
+  log('running >>npm prepare<<');
+  for (const npmCredential of plan.npmCredentials) {
+    log(`found token for ${npmCredential.registryUrl}`);
+    log(
+      npmCredential.tokenEncoding === 'plain'
+        ? 'npm token not base64 encoded.'
+        : 'npm token base64 encoded.',
+    );
+  }
+  log(`setting default npm registry to ${plan.registryUrl}`);
+  log('found one or more access tokens');
+
+  writeFile(path.join(homeDirectory, '.npmrc'), plan.npmrcFileString);
+  runNpm('npm', [
+    'config',
+    'set',
+    'cache',
+    path.join(plan.cwd, '.szci_cache'),
+    '--global',
+  ]);
+
+  return plan.npmCredentials;
+};

package/bin/szci-wrapper.js

@@ -145,5 +145,22 @@ function executeBinary() {
   }
 }
 
-// Execute
-executeBinary();
+const cliArguments = process.argv.slice(2);
+if (
+  cliArguments.length === 2 &&
+  cliArguments[0] === 'npm' &&
+  cliArguments[1] === 'prepare'
+) {
+  const runNodeNpmPrepare = async () => {
+    const { runNpmPrepare } = await import('./npm-prepare.js');
+    runNpmPrepare();
+  };
+  runNodeNpmPrepare().catch((error) => {
+    console.error(
+      error instanceof Error ? error.message : 'SZCI npm prepare failed.',
+    );
+    process.exitCode = 1;
+  });
+} else {
+  executeBinary();
+}

package/changelog.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 2026-07-28 - 7.1.7
+
+### Fixes
+
+- run `szci npm prepare` through the Node wrapper without starting a platform binary
+  - Keep npm credential validation shared between the Node and Deno paths.
+  - Allow cross-platform Docker builds to prepare npm authentication when Deno cannot execute under CPU emulation.
+  - Validate the configured default registry before logging or writing `.npmrc`.
+  - Require Node 14.13.1 or newer for the Node-native prepare path.
+
 ## 2026-07-28 - 7.1.6
 
 ### Fixes

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@ship.zone/szci",
-  "version": "7.1.6",
+  "version": "7.1.7",
   "exports": "./mod.ts",
   "nodeModulesDir": "auto",
   "tasks": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ship.zone/szci",
-  "version": "7.1.6",
+  "version": "7.1.7",
   "description": "Serve Zone CI - A tool to streamline Node.js and Docker workflows within CI environments, particularly GitLab CI, providing various CI/CD utilities. Powered by Deno with standalone executables.",
   "keywords": [
     "Node.js",
@@ -45,7 +45,7 @@
     "changelog.md"
   ],
   "engines": {
-    "node": ">=14.0.0"
+    "node": ">=14.13.1"
   },
   "os": [
     "darwin",

package/readme.md

@@ -118,6 +118,10 @@ szci npm prepare     # Generates ~/.npmrc from SZCI_TOKEN_NPM* env vars
 szci npm publish     # Full workflow: prepare → install → build → clean → npm publish
 ```
 
+`szci npm prepare` runs directly through the Node wrapper, so npm authentication
+setup remains available during cross-platform Docker builds where a Deno binary
+cannot execute under CPU emulation.
+
 The `publish` command supports multi-registry publishing. If `npmAccessLevel` is `public` and a Verdaccio registry is configured, it publishes to both npm and Verdaccio automatically.
 
 ### `szci node` — Node.js Version Management

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@ship.zone/szci',
-  version: '7.1.6',
+  version: '7.1.7',
   description: 'Serve Zone CI - A tool to streamline Node.js and Docker workflows within CI environments, particularly GitLab CI, providing various CI/CD utilities. Powered by Deno with standalone executables.'
 }

package/ts/manager.npm/index.ts

@@ -65,6 +65,7 @@ export class SzciNpmManager {
     if (npmCredentials.length === 0) {
       throw new Error('No SZCI_TOKEN_NPM credentials were provided.');
     }
+    const defaultRegistryUrl = validateNpmRegistryUrl(config.npmRegistryUrl);
 
     let npmrcFileString: string = '';
     for (const npmCredential of npmCredentials) {
@@ -78,7 +79,6 @@ export class SzciNpmManager {
       npmrcFileString += `//${npmCredential.registryUrl}/:_authToken="${npmCredential.token}"\n`;
     }
 
-    const defaultRegistryUrl = validateNpmRegistryUrl(config.npmRegistryUrl);
     logger.log('info', `setting default npm registry to ${defaultRegistryUrl}`);
     npmrcFileString += `registry=https://${defaultRegistryUrl}\n`;
     logger.log('info', 'found one or more access tokens');

package/ts/manager.npm/npmcredential.shared.js

@@ -0,0 +1,111 @@
+const invalidCredentialError = () =>
+  new Error(
+    'Invalid SZCI_TOKEN_NPM credential. Expected registry|token[|plain].',
+  );
+
+const registryUrlRegex = /^[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?(?::[0-9]{1,5})?$/;
+const base64Regex = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+const unsafeTokenRegex = /[\u0000-\u001f\u007f"\\]/;
+
+/**
+ * @param {string} registryUrlArg
+ * @returns {string}
+ */
+export const validateNpmRegistryUrl = (registryUrlArg) => {
+  if (
+    !registryUrlArg ||
+    registryUrlArg.length > 512 ||
+    !registryUrlRegex.test(registryUrlArg)
+  ) {
+    throw invalidCredentialError();
+  }
+  return registryUrlArg;
+};
+
+/**
+ * @param {string} npmEnvironmentValueArg
+ * @returns {{
+ *   registryUrl: string;
+ *   token: string;
+ *   tokenEncoding: 'base64' | 'plain';
+ * }}
+ */
+export const parseNpmCredential = (npmEnvironmentValueArg) => {
+  const fields = npmEnvironmentValueArg.split('|');
+  if (fields.length < 2 || fields.length > 3) {
+    throw invalidCredentialError();
+  }
+
+  const registryUrl = validateNpmRegistryUrl(fields[0]);
+  const encodedToken = fields[1];
+  const encodingMarker = fields[2];
+  if (
+    !encodedToken ||
+    (encodingMarker !== undefined && encodingMarker !== 'plain')
+  ) {
+    throw invalidCredentialError();
+  }
+
+  let token;
+  /** @type {'base64' | 'plain'} */
+  let tokenEncoding;
+  if (encodingMarker === 'plain') {
+    token = encodedToken;
+    tokenEncoding = 'plain';
+  } else {
+    if (!base64Regex.test(encodedToken)) {
+      throw invalidCredentialError();
+    }
+    const tokenBuffer = Buffer.from(encodedToken, 'base64');
+    if (tokenBuffer.toString('base64') !== encodedToken) {
+      throw invalidCredentialError();
+    }
+    try {
+      token = new TextDecoder('utf-8', { fatal: true }).decode(tokenBuffer);
+    } catch {
+      throw invalidCredentialError();
+    }
+    if (Buffer.from(token, 'utf8').toString('base64') !== encodedToken) {
+      throw invalidCredentialError();
+    }
+    tokenEncoding = 'base64';
+  }
+
+  if (
+    !token ||
+    token.length > 65536 ||
+    unsafeTokenRegex.test(token) ||
+    token.includes('${')
+  ) {
+    throw invalidCredentialError();
+  }
+
+  return {
+    registryUrl,
+    token,
+    tokenEncoding,
+  };
+};
+
+/**
+ * @param {Record<string, string | undefined>} environmentArg
+ * @returns {Array<{
+ *   registryUrl: string;
+ *   token: string;
+ *   tokenEncoding: 'base64' | 'plain';
+ * }>}
+ */
+export const parseNpmCredentialEnvironment = (environmentArg) => {
+  const credentialValues = Object.entries(environmentArg)
+    .filter(
+      ([environmentVariableNameArg, environmentVariableValueArg]) =>
+        environmentVariableNameArg.startsWith('SZCI_TOKEN_NPM') &&
+        environmentVariableValueArg !== undefined,
+    )
+    .sort(([environmentVariableNameA], [environmentVariableNameB]) =>
+      environmentVariableNameA.localeCompare(environmentVariableNameB)
+    )
+    .map(([, environmentVariableValueArg]) => environmentVariableValueArg);
+
+  return credentialValues.map((credentialValueArg) => parseNpmCredential(credentialValueArg));
+};

package/ts/manager.npm/npmcredential.ts

@@ -1,91 +1,23 @@
-import * as plugins from './mod.plugins.ts';
-
 export interface INpmCredential {
   registryUrl: string;
   token: string;
   tokenEncoding: 'base64' | 'plain';
 }
 
-const invalidCredentialError = () =>
-  new Error(
-    'Invalid SZCI_TOKEN_NPM credential. Expected registry|token[|plain].',
-  );
-
-const registryUrlRegex = /^[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?(?::[0-9]{1,5})?$/;
-const unsafeTokenRegex = /[\u0000-\u001f\u007f"\\]/;
+import {
+  parseNpmCredential as parseNpmCredentialShared,
+  parseNpmCredentialEnvironment as parseNpmCredentialEnvironmentShared,
+  validateNpmRegistryUrl as validateNpmRegistryUrlShared,
+} from './npmcredential.shared.js';
 
-export const validateNpmRegistryUrl = (registryUrlArg: string): string => {
-  if (
-    !registryUrlArg ||
-    registryUrlArg.length > 512 ||
-    !registryUrlRegex.test(registryUrlArg)
-  ) {
-    throw invalidCredentialError();
-  }
-  return registryUrlArg;
-};
+export const validateNpmRegistryUrl = (
+  registryUrlArg: string,
+): string => validateNpmRegistryUrlShared(registryUrlArg);
 
 export const parseNpmCredential = (
   npmEnvironmentValueArg: string,
-): INpmCredential => {
-  const fields = npmEnvironmentValueArg.split('|');
-  if (fields.length < 2 || fields.length > 3) {
-    throw invalidCredentialError();
-  }
-
-  const registryUrl = validateNpmRegistryUrl(fields[0]);
-  const encodedToken = fields[1];
-  const encodingMarker = fields[2];
-  if (
-    !encodedToken ||
-    (encodingMarker !== undefined && encodingMarker !== 'plain')
-  ) {
-    throw invalidCredentialError();
-  }
-
-  let token: string;
-  let tokenEncoding: INpmCredential['tokenEncoding'];
-  if (encodingMarker === 'plain') {
-    token = encodedToken;
-    tokenEncoding = 'plain';
-  } else {
-    if (!plugins.smartstring.base64.isBase64(encodedToken)) {
-      throw invalidCredentialError();
-    }
-    token = plugins.smartstring.base64.decode(encodedToken);
-    if (plugins.smartstring.base64.encode(token) !== encodedToken) {
-      throw invalidCredentialError();
-    }
-    tokenEncoding = 'base64';
-  }
-
-  if (
-    !token ||
-    token.length > 65536 ||
-    unsafeTokenRegex.test(token) ||
-    token.includes('${')
-  ) {
-    throw invalidCredentialError();
-  }
-
-  return {
-    registryUrl,
-    token,
-    tokenEncoding,
-  };
-};
+): INpmCredential => parseNpmCredentialShared(npmEnvironmentValueArg);
 
 export const parseNpmCredentialEnvironment = (
   environmentArg: Record<string, string>,
-): INpmCredential[] => {
-  const credentialValues = Object.entries(environmentArg)
-    .filter(([environmentVariableNameArg]) =>
-      environmentVariableNameArg.startsWith('SZCI_TOKEN_NPM')
-    )
-    .sort(([environmentVariableNameA], [environmentVariableNameB]) =>
-      environmentVariableNameA.localeCompare(environmentVariableNameB)
-    )
-    .map(([, environmentVariableValueArg]) => environmentVariableValueArg);
-
-  return credentialValues.map((credentialValueArg) => parseNpmCredential(credentialValueArg));
-};
+): INpmCredential[] => parseNpmCredentialEnvironmentShared(environmentArg);