gt 2.21.4 → 2.22.0

package/dist/utils/credentials.js

@@ -1,71 +1,280 @@
-import { logger } from "../console/logger.js";
-import { logErrorAndExit } from "../console/logging.js";
-import apiRequest from "./fetch.js";
-import chalk from "chalk";
+import { randomUUID } from "node:crypto";
 import path from "node:path";
 import fs from "node:fs";
+import { createDiagnosticMessage, formatDiagnosticErrorDetails } from "generaltranslation/internal";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import dotenv from "dotenv";
 //#region src/utils/credentials.ts
-async function retrieveCredentials(settings, keyType) {
-	const { sessionId } = await generateCredentialsSession(settings.baseUrl, keyType);
-	const urlToOpen = `${settings.dashboardUrl}/cli/wizard/${sessionId}`;
-	await import("open").then((open) => open.default(urlToOpen, { wait: false }));
-	logger.message(`${chalk.dim(`If the browser window didn't open automatically, please open the following link:`)}\n\n${chalk.cyan(urlToOpen)}`);
-	const spinner = logger.createSpinner("dots");
-	spinner.start("Waiting for response from dashboard...");
-	const credentials = await new Promise((resolve) => {
-		const interval = setInterval(async () => {
-			try {
-				const res = await apiRequest(settings.baseUrl, `/cli/wizard/${sessionId}`, { method: "GET" });
-				if (res.status === 200) {
-					resolve(await res.json());
-					clearInterval(interval);
-					clearTimeout(timeout);
-					apiRequest(settings.baseUrl, `/cli/wizard/${sessionId}`, { method: "DELETE" });
-				}
-			} catch (err) {
-				console.error(err);
-			}
-		}, 2e3);
-		const timeout = setTimeout(() => {
-			spinner.stop("Timed out");
-			clearInterval(interval);
-			logErrorAndExit("Timed out waiting for response from dashboard");
-		}, 1e3 * 60 * 60);
+const execFileAsync = promisify(execFile);
+const unsafeCredentialsEnvError = createDiagnosticMessage({
+	whatHappened: "Cannot safely update .env.local",
+	reassurance: "The existing .env.local file was not changed",
+	fix: "Move multiline values away from project/key assignments or set the development credentials manually, then retry"
+});
+function unwritableEnvFileError(envFile) {
+	return createDiagnosticMessage({
+		whatHappened: `${envFile} is not a regular file`,
+		reassurance: "Nothing was changed",
+		fix: "Replace it with a regular file or a symlink to one, or set the development credentials manually, then retry"
+	});
+}
+function trackedEnvFileError(file) {
+	return createDiagnosticMessage({
+		whatHappened: `${file} is tracked by Git`,
+		why: "development credentials saved there would be committed",
+		reassurance: "Nothing was changed",
+		fix: `Run \`git rm --cached ${path.basename(file)}\` in ${path.dirname(file)} and add the file to .gitignore, then retry`
+	});
+}
+function unignoredEnvFileError(file) {
+	return createDiagnosticMessage({
+		whatHappened: `${file} is not ignored by Git`,
+		why: "development credentials saved there could be committed",
+		reassurance: "Nothing was changed",
+		fix: `Add the file to a .gitignore that applies to ${path.dirname(file)}, then retry`
+	});
+}
+function unignoredEnvFileReferentError(envFile, referent) {
+	return createDiagnosticMessage({
+		whatHappened: `${envFile} links to ${referent}, which Git does not ignore`,
+		why: "development credentials saved there could be committed",
+		reassurance: "Nothing was changed",
+		fix: `Add ${referent} to a .gitignore in its repository or set the development credentials manually, then retry`
+	});
+}
+function gitUnavailableError(file, error) {
+	return createDiagnosticMessage({
+		whatHappened: `Could not run Git to verify that ${file} is untracked and ignored`,
+		reassurance: "Nothing was changed",
+		fix: "Install Git or make it available on PATH, then retry",
+		details: formatDiagnosticErrorDetails(error)
+	});
+}
+function gitOverrideError(file, names) {
+	return createDiagnosticMessage({
+		whatHappened: `Git repository overrides are set in the environment: ${names.join(", ")}`,
+		why: `they could point the untracked and ignore checks for ${file} at a different repository or index`,
+		reassurance: "Nothing was changed",
+		fix: "Unset them (for example, run outside a Git hook), then retry"
+	});
+}
+function gitCheckFailedError(file, stderr) {
+	return createDiagnosticMessage({
+		whatHappened: `Git could not check whether ${file} is untracked and ignored`,
+		reassurance: "Nothing was changed",
+		fix: "Fix the reported Git problem, then retry",
+		details: stderr.trim()
 	});
-	spinner.stop("Received credentials");
-	return credentials;
 }
-async function generateCredentialsSession(url, keyType) {
-	const res = await apiRequest(url, "/cli/wizard/session", { body: { keyType } });
-	if (!res.ok) logErrorAndExit("Failed to generate credentials session");
-	return await res.json();
+const FRAMEWORK_ENV_PREFIXES = {
+	"next-pages": "NEXT_PUBLIC_",
+	vite: "VITE_",
+	gatsby: "GATSBY_",
+	react: "REACT_APP_",
+	redwood: "REDWOOD_ENV_"
+};
+/** Names of the runtime variables init writes for this framework. */
+function getDevelopmentEnvNames(framework) {
+	const prefix = (framework && FRAMEWORK_ENV_PREFIXES[framework]) ?? "";
+	return {
+		projectId: `${prefix}GT_PROJECT_ID`,
+		devApiKey: `${prefix}GT_DEV_API_KEY`
+	};
+}
+/**
+* Whether the project already has a runtime key: the framework's development
+* key, or an explicit production key for server runtimes (gt-next, gt-node).
+* Browser frameworks only read their prefixed key, so there `settings.apiKey`
+* is tooling auth alone. `settings.projectId` already resolves every
+* framework prefix. Login is checked separately.
+*/
+function areCredentialsSet(settings, framework) {
+	const { devApiKey } = getDevelopmentEnvNames(framework);
+	const browserOnly = Boolean(framework && FRAMEWORK_ENV_PREFIXES[framework]);
+	return Boolean(settings.projectId && (process.env[devApiKey] || !browserOnly && settings.apiKey));
+}
+function assignedName(line) {
+	return /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line)?.[1];
+}
+/**
+* dotenv continues a quoted value onto later lines until its closing quote.
+* Replacing such a line would orphan the continuation, even when a later
+* duplicate hides the multiline value from dotenv's effective values.
+*/
+function opensMultilineValue(line) {
+	const value = line.slice(line.indexOf("=") + 1).trim();
+	const quote = value[0];
+	return [
+		"\"",
+		"'",
+		"`"
+	].includes(quote) && !value.slice(1).replaceAll(`\\${quote}`, "").includes(quote);
+}
+function upsertEnvAssignment(content, name, value) {
+	const assignsName = (line) => assignedName(line) === name;
+	const lines = content.split("\n");
+	const first = lines.findIndex(assignsName);
+	if (first === -1) return `${content}${content && !content.endsWith("\n") ? "\n" : ""}${name}=${value}\n`;
+	return lines.map((line, index) => index === first ? `${name}=${value}` : line).filter((line, index) => index === first || !assignsName(line)).join("\n");
+}
+/**
+* Where .env.local content lives and its mode. Follows an existing symlink so
+* its referent is replaced, never the link itself; anything but a regular
+* file (dangling link, directory) fails before any write.
+*/
+async function resolveEnvFile(envFile) {
+	const entry = await fs.promises.lstat(envFile).catch((error) => {
+		if (error.code === "ENOENT") return void 0;
+		throw error;
+	});
+	if (!entry) return void 0;
+	const stat = await fs.promises.stat(envFile).catch((error) => {
+		if (error.code === "ENOENT") return void 0;
+		throw error;
+	});
+	if (!stat?.isFile()) throw new Error(unwritableEnvFileError(envFile));
+	return {
+		target: entry.isSymbolicLink() ? await fs.promises.realpath(envFile) : envFile,
+		mode: stat.mode & 511
+	};
+}
+const GIT_LOCATION_OVERRIDES = [
+	"GIT_DIR",
+	"GIT_WORK_TREE",
+	"GIT_INDEX_FILE",
+	"GIT_COMMON_DIR",
+	"GIT_CEILING_DIRECTORIES"
+];
+/**
+* How Git in the file's own repository treats the path, using Git's real
+* index and effective ignore rules (comments, negations, nested .gitignore,
+* excludes). Only a Git-confirmed non-repository counts as no repository;
+* a missing binary, a repository override, or any other Git error fails
+* closed.
+*/
+async function inspectGitExposure(file) {
+	const overrides = GIT_LOCATION_OVERRIDES.filter((name) => process.env[name] !== void 0);
+	if (overrides.length > 0) throw new Error(gitOverrideError(file, overrides));
+	const cwd = path.dirname(file);
+	const run = async (args) => {
+		try {
+			await execFileAsync("git", args, {
+				cwd,
+				encoding: "utf8",
+				windowsHide: true,
+				env: {
+					...process.env,
+					LC_ALL: "C"
+				}
+			});
+			return {
+				code: 0,
+				stderr: ""
+			};
+		} catch (error) {
+			const { code, stderr } = error;
+			if (typeof code !== "number") throw new Error(gitUnavailableError(file, error));
+			return {
+				code,
+				stderr: typeof stderr === "string" ? stderr : ""
+			};
+		}
+	};
+	const toplevel = await run(["rev-parse", "--show-toplevel"]);
+	if (toplevel.code === 128 && /not a git repository/i.test(toplevel.stderr)) return "no-repository";
+	if (toplevel.code !== 0) throw new Error(gitCheckFailedError(file, toplevel.stderr));
+	const tracked = await run([
+		"ls-files",
+		"--error-unmatch",
+		"--",
+		file
+	]);
+	if (tracked.code === 0) return "tracked";
+	if (tracked.code !== 1) throw new Error(gitCheckFailedError(file, tracked.stderr));
+	const ignored = await run([
+		"check-ignore",
+		"-q",
+		"--",
+		file
+	]);
+	if (ignored.code === 0) return "ignored";
+	if (ignored.code === 1) return "unignored";
+	throw new Error(gitCheckFailedError(file, ignored.stderr));
+}
+/**
+* Everything that must hold before credentials may be saved to .env.local,
+* so callers can fail before minting a key: the path is a regular file (or a
+* link to one) or absent, and neither it nor a link's referent is tracked by
+* Git. A referent inside any worktree must already be ignored there; only
+* .env.local itself gets an ignore rule added, by setCredentials.
+*/
+async function inspectCredentialsEnvFile(cwd = process.cwd()) {
+	const envFile = path.resolve(cwd, ".env.local");
+	const existing = await resolveEnvFile(envFile);
+	const exposure = await inspectGitExposure(envFile);
+	if (exposure === "tracked") throw new Error(trackedEnvFileError(envFile));
+	if (existing && existing.target !== envFile) {
+		const referentExposure = await inspectGitExposure(existing.target);
+		if (referentExposure === "tracked") throw new Error(trackedEnvFileError(existing.target));
+		if (referentExposure === "unignored") throw new Error(unignoredEnvFileReferentError(envFile, existing.target));
+	}
+	return {
+		envFile,
+		existing,
+		exposure
+	};
+}
+async function appendGitignoreRule(cwd) {
+	const gitignoreFile = path.join(cwd, ".gitignore");
+	const content = await fs.promises.readFile(gitignoreFile, "utf8").catch((error) => {
+		if (error.code === "ENOENT") return "";
+		throw error;
+	});
+	const separator = content && !content.endsWith("\n") ? "\n" : "";
+	await fs.promises.appendFile(gitignoreFile, `${separator}.env.local\n`, "utf8");
 }
-function areCredentialsSet() {
-	return process.env.GT_PROJECT_ID && (process.env.GT_API_KEY || process.env.GT_DEV_API_KEY);
+async function writeEnvFileAtomically(target, content, mode) {
+	const temporaryPath = path.join(path.dirname(target), `.env.local.${randomUUID()}.tmp`);
+	try {
+		await fs.promises.writeFile(temporaryPath, content, {
+			encoding: "utf8",
+			flag: "wx",
+			mode
+		});
+		await fs.promises.chmod(temporaryPath, mode);
+		await fs.promises.rename(temporaryPath, target);
+	} catch (error) {
+		await fs.promises.rm(temporaryPath, { force: true });
+		throw error;
+	}
 }
 async function setCredentials(credentials, framework, cwd = process.cwd()) {
-	const envFile = path.join(cwd, ".env.local");
-	let envContent = "";
-	if (!fs.existsSync(envFile)) {
-		await fs.promises.writeFile(envFile, "", "utf8");
+	const { envFile, existing: existingEnvFile, exposure } = await inspectCredentialsEnvFile(cwd);
+	if (exposure === "unignored") {
+		await appendGitignoreRule(cwd);
+		if (await inspectGitExposure(envFile) !== "ignored") throw new Error(unignoredEnvFileError(envFile));
+	} else if (exposure === "no-repository") {
 		const gitignoreFile = path.join(cwd, ".gitignore");
-		if (fs.existsSync(gitignoreFile)) {
-			if (!(await fs.promises.readFile(gitignoreFile, "utf8")).includes(".env.local")) await fs.promises.appendFile(gitignoreFile, "\n.env.local\n", "utf8");
-		} else await fs.promises.writeFile(gitignoreFile, ".env.local\n", "utf8");
-	} else envContent = await fs.promises.readFile(envFile, "utf8");
-	let prefix = "";
-	if (framework === "next-pages") prefix = "NEXT_PUBLIC_";
-	else if (framework === "vite") prefix = "VITE_";
-	else if (framework === "gatsby") prefix = "GATSBY_";
-	else if (framework === "react") prefix = "REACT_APP_";
-	else if (framework === "redwood") prefix = "REDWOOD_ENV_";
-	envContent += `\n${prefix}GT_PROJECT_ID=${credentials.projectId}\n`;
-	for (const apiKey of credentials.apiKeys) if (apiKey.type === "development") envContent += `${prefix || ""}GT_DEV_API_KEY=${apiKey.key}\n`;
-	else envContent += `GT_API_KEY=${apiKey.key}\n`;
-	envContent = envContent.replace(/\n{3,}/g, "\n\n").trim() + "\n";
-	await fs.promises.writeFile(envFile, envContent, "utf8");
+		if (!fs.existsSync(gitignoreFile) || (await fs.promises.readFile(gitignoreFile, "utf8")).trimEnd().split(/\r?\n/).at(-1) !== ".env.local") await appendGitignoreRule(cwd);
+	}
+	let envContent = existingEnvFile ? await fs.promises.readFile(existingEnvFile.target, "utf8") : "";
+	const names = getDevelopmentEnvNames(framework);
+	const targetNames = Object.values(names);
+	const targetOpensMultiline = envContent.split("\n").some((line) => targetNames.includes(assignedName(line) ?? "") && opensMultilineValue(line));
+	const original = dotenv.parse(envContent);
+	const expected = {
+		...original,
+		[names.projectId]: credentials.projectId,
+		[names.devApiKey]: credentials.apiKey
+	};
+	envContent = upsertEnvAssignment(envContent, names.projectId, credentials.projectId);
+	envContent = upsertEnvAssignment(envContent, names.devApiKey, credentials.apiKey);
+	const updated = dotenv.parse(envContent);
+	if (targetOpensMultiline || targetNames.some((name) => original[name]?.includes("\n")) || Object.keys(updated).length !== Object.keys(expected).length || Object.entries(expected).some(([name, value]) => updated[name] !== value)) throw new Error(unsafeCredentialsEnvError);
+	await writeEnvFileAtomically(existingEnvFile?.target ?? envFile, envContent, existingEnvFile?.mode ?? 384);
 }
 //#endregion
-export { areCredentialsSet, generateCredentialsSession, retrieveCredentials, setCredentials };
+export { areCredentialsSet, getDevelopmentEnvNames, inspectCredentialsEnvFile, setCredentials };
 
 //# sourceMappingURL=credentials.js.map

package/dist/utils/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","names":[],"sources":["../../src/utils/credentials.ts"],"sourcesContent":["import { logErrorAndExit } from '../console/logging.js';\nimport { logger } from '../console/logger.js';\nimport path from 'node:path';\nimport fs from 'node:fs';\nimport { Settings, SupportedFrameworks } from '../types/index.js';\nimport chalk from 'chalk';\nimport apiRequest from './fetch.js';\n// Type for credentials returned from the dashboard\ntype Credentials = {\n  apiKeys: ApiKey[];\n  projectId: string;\n};\n\ntype ApiKey = {\n  key: string;\n  type: 'development' | 'production';\n};\n\n// Fetches project ID and API key by opening the dashboard in the browser\nexport async function retrieveCredentials(\n  settings: Settings,\n  keyType: 'development' | 'production' | 'all'\n): Promise<Credentials> {\n  // Generate a session ID\n  const { sessionId } = await generateCredentialsSession(\n    settings.baseUrl,\n    keyType\n  );\n\n  const urlToOpen = `${settings.dashboardUrl}/cli/wizard/${sessionId}`;\n  await import('open').then((open) =>\n    open.default(urlToOpen, {\n      wait: false,\n    })\n  );\n\n  logger.message(\n    `${chalk.dim(\n      `If the browser window didn't open automatically, please open the following link:`\n    )}\\n\\n${chalk.cyan(urlToOpen)}`\n  );\n\n  const spinner = logger.createSpinner('dots');\n  spinner.start('Waiting for response from dashboard...');\n\n  const credentials = await new Promise<Credentials>((resolve) => {\n    const interval = setInterval(async () => {\n      // Ping the dashboard to see if the credentials are set\n      try {\n        const res = await apiRequest(\n          settings.baseUrl,\n          `/cli/wizard/${sessionId}`,\n          {\n            method: 'GET',\n          }\n        );\n        if (res.status === 200) {\n          const data = await res.json();\n          resolve(data as Credentials);\n          clearInterval(interval);\n          clearTimeout(timeout);\n          apiRequest(settings.baseUrl, `/cli/wizard/${sessionId}`, {\n            method: 'DELETE',\n          });\n        }\n      } catch (err) {\n        console.error(err);\n      }\n    }, 2000);\n    // timeout after 1 hour\n    const timeout = setTimeout(\n      () => {\n        spinner.stop('Timed out');\n        clearInterval(interval);\n        logErrorAndExit('Timed out waiting for response from dashboard');\n      },\n      1000 * 60 * 60\n    );\n  });\n  spinner.stop('Received credentials');\n  return credentials;\n}\n\nexport async function generateCredentialsSession(\n  url: string,\n  keyType: 'development' | 'production' | 'all'\n): Promise<{\n  sessionId: string;\n}> {\n  const res = await apiRequest(url, '/cli/wizard/session', {\n    body: { keyType },\n  });\n  if (!res.ok) {\n    logErrorAndExit('Failed to generate credentials session');\n  }\n  return await res.json();\n}\n\n// Checks if the credentials are set in the environment variables\nexport function areCredentialsSet() {\n  return (\n    process.env.GT_PROJECT_ID &&\n    (process.env.GT_API_KEY || process.env.GT_DEV_API_KEY)\n  );\n}\n\n// Sets the credentials in .env.local file\nexport async function setCredentials(\n  credentials: Credentials,\n  framework?: SupportedFrameworks,\n  cwd: string = process.cwd()\n) {\n  const envFile = path.join(cwd, '.env.local');\n  let envContent = '';\n\n  // Check if .env.local exists, create it if it doesn't\n  if (!fs.existsSync(envFile)) {\n    // File doesn't exist, create it\n    await fs.promises.writeFile(envFile, '', 'utf8');\n\n    // Add .env.local to .gitignore if it exists\n    const gitignoreFile = path.join(cwd, '.gitignore');\n    if (fs.existsSync(gitignoreFile)) {\n      const gitignoreContent = await fs.promises.readFile(\n        gitignoreFile,\n        'utf8'\n      );\n      if (!gitignoreContent.includes('.env.local')) {\n        await fs.promises.appendFile(gitignoreFile, '\\n.env.local\\n', 'utf8');\n      }\n    } else {\n      // Create .gitignore file with .env.local\n      await fs.promises.writeFile(gitignoreFile, '.env.local\\n', 'utf8');\n    }\n  } else {\n    // Read existing content\n    envContent = await fs.promises.readFile(envFile, 'utf8');\n  }\n\n  // Always append the credentials to the file\n  let prefix = '';\n  if (framework === 'next-pages') {\n    prefix = 'NEXT_PUBLIC_';\n  } else if (framework === 'vite') {\n    prefix = 'VITE_';\n  } else if (framework === 'gatsby') {\n    prefix = 'GATSBY_';\n  } else if (framework === 'react') {\n    prefix = 'REACT_APP_';\n  } else if (framework === 'redwood') {\n    prefix = 'REDWOOD_ENV_';\n  }\n\n  envContent += `\\n${prefix}GT_PROJECT_ID=${credentials.projectId}\\n`;\n\n  for (const apiKey of credentials.apiKeys) {\n    if (apiKey.type === 'development') {\n      envContent += `${prefix || ''}GT_DEV_API_KEY=${apiKey.key}\\n`;\n    } else {\n      envContent += `GT_API_KEY=${apiKey.key}\\n`;\n    }\n  }\n\n  // Ensure we don't have excessive newlines\n  envContent = envContent.replace(/\\n{3,}/g, '\\n\\n').trim() + '\\n';\n\n  // Write the updated content back to the file\n  await fs.promises.writeFile(envFile, envContent, 'utf8');\n}\n"],"mappings":";;;;;;;AAmBA,eAAsB,oBACpB,UACA,SACsB;CAEtB,MAAM,EAAE,cAAc,MAAM,2BAC1B,SAAS,SACT,QACD;CAED,MAAM,YAAY,GAAG,SAAS,aAAa,cAAc;AACzD,OAAM,OAAO,QAAQ,MAAM,SACzB,KAAK,QAAQ,WAAW,EACtB,MAAM,OACP,CAAC,CACH;AAED,QAAO,QACL,GAAG,MAAM,IACP,mFACD,CAAC,MAAM,MAAM,KAAK,UAAU,GAC9B;CAED,MAAM,UAAU,OAAO,cAAc,OAAO;AAC5C,SAAQ,MAAM,yCAAyC;CAEvD,MAAM,cAAc,MAAM,IAAI,SAAsB,YAAY;EAC9D,MAAM,WAAW,YAAY,YAAY;AAEvC,OAAI;IACF,MAAM,MAAM,MAAM,WAChB,SAAS,SACT,eAAe,aACf,EACE,QAAQ,OACT,CACF;AACD,QAAI,IAAI,WAAW,KAAK;AAEtB,aAAQ,MADW,IAAI,MAAM,CACD;AAC5B,mBAAc,SAAS;AACvB,kBAAa,QAAQ;AACrB,gBAAW,SAAS,SAAS,eAAe,aAAa,EACvD,QAAQ,UACT,CAAC;;YAEG,KAAK;AACZ,YAAQ,MAAM,IAAI;;KAEnB,IAAK;EAER,MAAM,UAAU,iBACR;AACJ,WAAQ,KAAK,YAAY;AACzB,iBAAc,SAAS;AACvB,mBAAgB,gDAAgD;KAElE,MAAO,KAAK,GACb;GACD;AACF,SAAQ,KAAK,uBAAuB;AACpC,QAAO;;AAGT,eAAsB,2BACpB,KACA,SAGC;CACD,MAAM,MAAM,MAAM,WAAW,KAAK,uBAAuB,EACvD,MAAM,EAAE,SAAS,EAClB,CAAC;AACF,KAAI,CAAC,IAAI,GACP,iBAAgB,yCAAyC;AAE3D,QAAO,MAAM,IAAI,MAAM;;AAIzB,SAAgB,oBAAoB;AAClC,QACE,QAAQ,IAAI,kBACX,QAAQ,IAAI,cAAc,QAAQ,IAAI;;AAK3C,eAAsB,eACpB,aACA,WACA,MAAc,QAAQ,KAAK,EAC3B;CACA,MAAM,UAAU,KAAK,KAAK,KAAK,aAAa;CAC5C,IAAI,aAAa;AAGjB,KAAI,CAAC,GAAG,WAAW,QAAQ,EAAE;AAE3B,QAAM,GAAG,SAAS,UAAU,SAAS,IAAI,OAAO;EAGhD,MAAM,gBAAgB,KAAK,KAAK,KAAK,aAAa;AAClD,MAAI,GAAG,WAAW,cAAc;OAK1B,EAAC,MAJ0B,GAAG,SAAS,SACzC,eACA,OACD,EACqB,SAAS,aAAa,CAC1C,OAAM,GAAG,SAAS,WAAW,eAAe,kBAAkB,OAAO;QAIvE,OAAM,GAAG,SAAS,UAAU,eAAe,gBAAgB,OAAO;OAIpE,cAAa,MAAM,GAAG,SAAS,SAAS,SAAS,OAAO;CAI1D,IAAI,SAAS;AACb,KAAI,cAAc,aAChB,UAAS;UACA,cAAc,OACvB,UAAS;UACA,cAAc,SACvB,UAAS;UACA,cAAc,QACvB,UAAS;UACA,cAAc,UACvB,UAAS;AAGX,eAAc,KAAK,OAAO,gBAAgB,YAAY,UAAU;AAEhE,MAAK,MAAM,UAAU,YAAY,QAC/B,KAAI,OAAO,SAAS,cAClB,eAAc,GAAG,UAAU,GAAG,iBAAiB,OAAO,IAAI;KAE1D,eAAc,cAAc,OAAO,IAAI;AAK3C,cAAa,WAAW,QAAQ,WAAW,OAAO,CAAC,MAAM,GAAG;AAG5D,OAAM,GAAG,SAAS,UAAU,SAAS,YAAY,OAAO"}
+{"version":3,"file":"credentials.js","names":[],"sources":["../../src/utils/credentials.ts"],"sourcesContent":["import { execFile } from 'node:child_process';\nimport { randomUUID } from 'node:crypto';\nimport path from 'node:path';\nimport fs from 'node:fs';\nimport { promisify } from 'node:util';\nimport dotenv from 'dotenv';\nimport { Settings, SupportedFrameworks } from '../types/index.js';\nimport {\n  createDiagnosticMessage,\n  formatDiagnosticErrorDetails,\n} from 'generaltranslation/internal';\n\nconst execFileAsync = promisify(execFile);\n\nconst unsafeCredentialsEnvError = createDiagnosticMessage({\n  whatHappened: 'Cannot safely update .env.local',\n  reassurance: 'The existing .env.local file was not changed',\n  fix: 'Move multiline values away from project/key assignments or set the development credentials manually, then retry',\n});\n\nfunction unwritableEnvFileError(envFile: string): string {\n  return createDiagnosticMessage({\n    whatHappened: `${envFile} is not a regular file`,\n    reassurance: 'Nothing was changed',\n    fix: 'Replace it with a regular file or a symlink to one, or set the development credentials manually, then retry',\n  });\n}\n\nfunction trackedEnvFileError(file: string): string {\n  return createDiagnosticMessage({\n    whatHappened: `${file} is tracked by Git`,\n    why: 'development credentials saved there would be committed',\n    reassurance: 'Nothing was changed',\n    fix: `Run \\`git rm --cached ${path.basename(file)}\\` in ${path.dirname(file)} and add the file to .gitignore, then retry`,\n  });\n}\n\nfunction unignoredEnvFileError(file: string): string {\n  return createDiagnosticMessage({\n    whatHappened: `${file} is not ignored by Git`,\n    why: 'development credentials saved there could be committed',\n    reassurance: 'Nothing was changed',\n    fix: `Add the file to a .gitignore that applies to ${path.dirname(file)}, then retry`,\n  });\n}\n\nfunction unignoredEnvFileReferentError(envFile: string, referent: string) {\n  return createDiagnosticMessage({\n    whatHappened: `${envFile} links to ${referent}, which Git does not ignore`,\n    why: 'development credentials saved there could be committed',\n    reassurance: 'Nothing was changed',\n    fix: `Add ${referent} to a .gitignore in its repository or set the development credentials manually, then retry`,\n  });\n}\n\nfunction gitUnavailableError(file: string, error: unknown): string {\n  return createDiagnosticMessage({\n    whatHappened: `Could not run Git to verify that ${file} is untracked and ignored`,\n    reassurance: 'Nothing was changed',\n    fix: 'Install Git or make it available on PATH, then retry',\n    details: formatDiagnosticErrorDetails(error),\n  });\n}\n\nfunction gitOverrideError(file: string, names: string[]): string {\n  return createDiagnosticMessage({\n    whatHappened: `Git repository overrides are set in the environment: ${names.join(', ')}`,\n    why: `they could point the untracked and ignore checks for ${file} at a different repository or index`,\n    reassurance: 'Nothing was changed',\n    fix: 'Unset them (for example, run outside a Git hook), then retry',\n  });\n}\n\nfunction gitCheckFailedError(file: string, stderr: string): string {\n  return createDiagnosticMessage({\n    whatHappened: `Git could not check whether ${file} is untracked and ignored`,\n    reassurance: 'Nothing was changed',\n    fix: 'Fix the reported Git problem, then retry',\n    details: stderr.trim(),\n  });\n}\n\nexport type Credentials = { apiKey: string; projectId: string };\n\n// Client-side frameworks only expose variables carrying their public prefix.\nconst FRAMEWORK_ENV_PREFIXES: Partial<\n  Record<NonNullable<SupportedFrameworks>, string>\n> = {\n  'next-pages': 'NEXT_PUBLIC_',\n  vite: 'VITE_',\n  gatsby: 'GATSBY_',\n  react: 'REACT_APP_',\n  redwood: 'REDWOOD_ENV_',\n};\n\n/** Names of the runtime variables init writes for this framework. */\nexport function getDevelopmentEnvNames(framework?: SupportedFrameworks) {\n  const prefix = (framework && FRAMEWORK_ENV_PREFIXES[framework]) ?? '';\n  return {\n    projectId: `${prefix}GT_PROJECT_ID`,\n    devApiKey: `${prefix}GT_DEV_API_KEY`,\n  };\n}\n\n/**\n * Whether the project already has a runtime key: the framework's development\n * key, or an explicit production key for server runtimes (gt-next, gt-node).\n * Browser frameworks only read their prefixed key, so there `settings.apiKey`\n * is tooling auth alone. `settings.projectId` already resolves every\n * framework prefix. Login is checked separately.\n */\nexport function areCredentialsSet(\n  settings: Pick<Settings, 'projectId' | 'apiKey'>,\n  framework?: SupportedFrameworks\n): boolean {\n  const { devApiKey } = getDevelopmentEnvNames(framework);\n  const browserOnly = Boolean(framework && FRAMEWORK_ENV_PREFIXES[framework]);\n  return Boolean(\n    settings.projectId &&\n    (process.env[devApiKey] || (!browserOnly && settings.apiKey))\n  );\n}\n\nfunction assignedName(line: string): string | undefined {\n  return /^\\s*(?:export\\s+)?([A-Za-z_][A-Za-z0-9_]*)\\s*=/.exec(line)?.[1];\n}\n\n/**\n * dotenv continues a quoted value onto later lines until its closing quote.\n * Replacing such a line would orphan the continuation, even when a later\n * duplicate hides the multiline value from dotenv's effective values.\n */\nfunction opensMultilineValue(line: string): boolean {\n  const value = line.slice(line.indexOf('=') + 1).trim();\n  const quote = value[0];\n  return (\n    ['\"', \"'\", '`'].includes(quote) &&\n    !value.slice(1).replaceAll(`\\\\${quote}`, '').includes(quote)\n  );\n}\n\nfunction upsertEnvAssignment(\n  content: string,\n  name: string,\n  value: string\n): string {\n  const assignsName = (line: string) => assignedName(line) === name;\n  const lines = content.split('\\n');\n  const first = lines.findIndex(assignsName);\n  if (first === -1) {\n    const separator = content && !content.endsWith('\\n') ? '\\n' : '';\n    return `${content}${separator}${name}=${value}\\n`;\n  }\n  // Replace the first assignment in place and drop stale duplicates.\n  return lines\n    .map((line, index) => (index === first ? `${name}=${value}` : line))\n    .filter((line, index) => index === first || !assignsName(line))\n    .join('\\n');\n}\n\n/**\n * Where .env.local content lives and its mode. Follows an existing symlink so\n * its referent is replaced, never the link itself; anything but a regular\n * file (dangling link, directory) fails before any write.\n */\nasync function resolveEnvFile(\n  envFile: string\n): Promise<{ target: string; mode: number } | undefined> {\n  const entry = await fs.promises.lstat(envFile).catch((error) => {\n    if (error.code === 'ENOENT') return undefined;\n    throw error;\n  });\n  if (!entry) return undefined;\n  // stat follows the link and fails on a dangling one.\n  const stat = await fs.promises.stat(envFile).catch((error) => {\n    if (error.code === 'ENOENT') return undefined;\n    throw error;\n  });\n  if (!stat?.isFile()) throw new Error(unwritableEnvFileError(envFile));\n  return {\n    target: entry.isSymbolicLink()\n      ? await fs.promises.realpath(envFile)\n      : envFile,\n    mode: stat.mode & 0o777,\n  };\n}\n\ntype GitExposure = 'no-repository' | 'tracked' | 'ignored' | 'unignored';\n\n// Git honors these over discovering the repository from the working\n// directory, so an inherited value could select another repository, hide this\n// one, or substitute an empty index. Configuration variables stay in effect.\nconst GIT_LOCATION_OVERRIDES = [\n  'GIT_DIR',\n  'GIT_WORK_TREE',\n  'GIT_INDEX_FILE',\n  'GIT_COMMON_DIR',\n  'GIT_CEILING_DIRECTORIES',\n];\n\n/**\n * How Git in the file's own repository treats the path, using Git's real\n * index and effective ignore rules (comments, negations, nested .gitignore,\n * excludes). Only a Git-confirmed non-repository counts as no repository;\n * a missing binary, a repository override, or any other Git error fails\n * closed.\n */\nasync function inspectGitExposure(file: string): Promise<GitExposure> {\n  const overrides = GIT_LOCATION_OVERRIDES.filter(\n    (name) => process.env[name] !== undefined\n  );\n  if (overrides.length > 0) throw new Error(gitOverrideError(file, overrides));\n  const cwd = path.dirname(file);\n  const run = async (args: string[]) => {\n    try {\n      await execFileAsync('git', args, {\n        cwd,\n        encoding: 'utf8',\n        windowsHide: true,\n        // The no-repository check reads Git's untranslated message.\n        env: { ...process.env, LC_ALL: 'C' },\n      });\n      return { code: 0, stderr: '' };\n    } catch (error) {\n      const { code, stderr } = error as { code?: unknown; stderr?: unknown };\n      if (typeof code !== 'number')\n        throw new Error(gitUnavailableError(file, error));\n      return { code, stderr: typeof stderr === 'string' ? stderr : '' };\n    }\n  };\n\n  const toplevel = await run(['rev-parse', '--show-toplevel']);\n  if (toplevel.code === 128 && /not a git repository/i.test(toplevel.stderr)) {\n    return 'no-repository';\n  }\n  if (toplevel.code !== 0) {\n    throw new Error(gitCheckFailedError(file, toplevel.stderr));\n  }\n  // check-ignore ignores tracked files, so the index is consulted first.\n  const tracked = await run(['ls-files', '--error-unmatch', '--', file]);\n  if (tracked.code === 0) return 'tracked';\n  if (tracked.code !== 1)\n    throw new Error(gitCheckFailedError(file, tracked.stderr));\n  const ignored = await run(['check-ignore', '-q', '--', file]);\n  if (ignored.code === 0) return 'ignored';\n  if (ignored.code === 1) return 'unignored';\n  throw new Error(gitCheckFailedError(file, ignored.stderr));\n}\n\ntype CredentialsEnvFile = {\n  envFile: string;\n  existing: Awaited<ReturnType<typeof resolveEnvFile>>;\n  exposure: GitExposure;\n};\n\n/**\n * Everything that must hold before credentials may be saved to .env.local,\n * so callers can fail before minting a key: the path is a regular file (or a\n * link to one) or absent, and neither it nor a link's referent is tracked by\n * Git. A referent inside any worktree must already be ignored there; only\n * .env.local itself gets an ignore rule added, by setCredentials.\n */\nexport async function inspectCredentialsEnvFile(\n  cwd: string = process.cwd()\n): Promise<CredentialsEnvFile> {\n  const envFile = path.resolve(cwd, '.env.local');\n  const existing = await resolveEnvFile(envFile);\n  const exposure = await inspectGitExposure(envFile);\n  if (exposure === 'tracked') throw new Error(trackedEnvFileError(envFile));\n  if (existing && existing.target !== envFile) {\n    const referentExposure = await inspectGitExposure(existing.target);\n    if (referentExposure === 'tracked') {\n      throw new Error(trackedEnvFileError(existing.target));\n    }\n    if (referentExposure === 'unignored') {\n      throw new Error(unignoredEnvFileReferentError(envFile, existing.target));\n    }\n  }\n  return { envFile, existing, exposure };\n}\n\nasync function appendGitignoreRule(cwd: string): Promise<void> {\n  const gitignoreFile = path.join(cwd, '.gitignore');\n  const content = await fs.promises\n    .readFile(gitignoreFile, 'utf8')\n    .catch((error) => {\n      if (error.code === 'ENOENT') return '';\n      throw error;\n    });\n  const separator = content && !content.endsWith('\\n') ? '\\n' : '';\n  await fs.promises.appendFile(\n    gitignoreFile,\n    `${separator}.env.local\\n`,\n    'utf8'\n  );\n}\n\n// Same-directory temporary file and rename, as in auth/credentialStore.ts:\n// a failed write never truncates the existing file.\nasync function writeEnvFileAtomically(\n  target: string,\n  content: string,\n  mode: number\n): Promise<void> {\n  const temporaryPath = path.join(\n    path.dirname(target),\n    `.env.local.${randomUUID()}.tmp`\n  );\n  try {\n    await fs.promises.writeFile(temporaryPath, content, {\n      encoding: 'utf8',\n      flag: 'wx',\n      mode,\n    });\n    await fs.promises.chmod(temporaryPath, mode);\n    await fs.promises.rename(temporaryPath, target);\n  } catch (error) {\n    await fs.promises.rm(temporaryPath, { force: true });\n    throw error;\n  }\n}\n\n// Sets the credentials in .env.local file\nexport async function setCredentials(\n  credentials: Credentials,\n  framework?: SupportedFrameworks,\n  cwd: string = process.cwd()\n) {\n  const {\n    envFile,\n    existing: existingEnvFile,\n    exposure,\n  } = await inspectCredentialsEnvFile(cwd);\n\n  if (exposure === 'unignored') {\n    // A rule appended to the same-directory .gitignore is the last match at\n    // the deepest level, so it wins over earlier negations; verify anyway.\n    await appendGitignoreRule(cwd);\n    if ((await inspectGitExposure(envFile)) !== 'ignored') {\n      throw new Error(unignoredEnvFileError(envFile));\n    }\n  } else if (exposure === 'no-repository') {\n    // Without a repository there are no effective rules to consult, so this\n    // is unverified: seed a .gitignore so a later `git init` ignores the file.\n    const gitignoreFile = path.join(cwd, '.gitignore');\n    if (\n      !fs.existsSync(gitignoreFile) ||\n      (await fs.promises.readFile(gitignoreFile, 'utf8'))\n        .trimEnd()\n        .split(/\\r?\\n/)\n        .at(-1) !== '.env.local'\n    ) {\n      await appendGitignoreRule(cwd);\n    }\n  }\n\n  let envContent = existingEnvFile\n    ? await fs.promises.readFile(existingEnvFile.target, 'utf8')\n    : '';\n\n  // Only the hot-reload key: the CLI itself acts as the signed-in user, and\n  // CI keys are created deliberately rather than dropped into .env.local.\n  // Other lines, comments, and any GT_API_KEY are left untouched.\n  const names = getDevelopmentEnvNames(framework);\n  const targetNames = Object.values(names);\n  const targetOpensMultiline = envContent\n    .split('\\n')\n    .some(\n      (line) =>\n        targetNames.includes(assignedName(line) ?? '') &&\n        opensMultilineValue(line)\n    );\n  const original = dotenv.parse(envContent);\n  const expected = {\n    ...original,\n    [names.projectId]: credentials.projectId,\n    [names.devApiKey]: credentials.apiKey,\n  };\n  envContent = upsertEnvAssignment(\n    envContent,\n    names.projectId,\n    credentials.projectId\n  );\n  envContent = upsertEnvAssignment(\n    envContent,\n    names.devApiKey,\n    credentials.apiKey\n  );\n\n  const updated = dotenv.parse(envContent);\n  if (\n    targetOpensMultiline ||\n    targetNames.some((name) => original[name]?.includes('\\n')) ||\n    Object.keys(updated).length !== Object.keys(expected).length ||\n    Object.entries(expected).some(([name, value]) => updated[name] !== value)\n  ) {\n    throw new Error(unsafeCredentialsEnvError);\n  }\n\n  await writeEnvFileAtomically(\n    existingEnvFile?.target ?? envFile,\n    envContent,\n    existingEnvFile?.mode ?? 0o600\n  );\n}\n"],"mappings":";;;;;;;;AAYA,MAAM,gBAAgB,UAAU,SAAS;AAEzC,MAAM,4BAA4B,wBAAwB;CACxD,cAAc;CACd,aAAa;CACb,KAAK;CACN,CAAC;AAEF,SAAS,uBAAuB,SAAyB;AACvD,QAAO,wBAAwB;EAC7B,cAAc,GAAG,QAAQ;EACzB,aAAa;EACb,KAAK;EACN,CAAC;;AAGJ,SAAS,oBAAoB,MAAsB;AACjD,QAAO,wBAAwB;EAC7B,cAAc,GAAG,KAAK;EACtB,KAAK;EACL,aAAa;EACb,KAAK,yBAAyB,KAAK,SAAS,KAAK,CAAC,QAAQ,KAAK,QAAQ,KAAK,CAAC;EAC9E,CAAC;;AAGJ,SAAS,sBAAsB,MAAsB;AACnD,QAAO,wBAAwB;EAC7B,cAAc,GAAG,KAAK;EACtB,KAAK;EACL,aAAa;EACb,KAAK,gDAAgD,KAAK,QAAQ,KAAK,CAAC;EACzE,CAAC;;AAGJ,SAAS,8BAA8B,SAAiB,UAAkB;AACxE,QAAO,wBAAwB;EAC7B,cAAc,GAAG,QAAQ,YAAY,SAAS;EAC9C,KAAK;EACL,aAAa;EACb,KAAK,OAAO,SAAS;EACtB,CAAC;;AAGJ,SAAS,oBAAoB,MAAc,OAAwB;AACjE,QAAO,wBAAwB;EAC7B,cAAc,oCAAoC,KAAK;EACvD,aAAa;EACb,KAAK;EACL,SAAS,6BAA6B,MAAM;EAC7C,CAAC;;AAGJ,SAAS,iBAAiB,MAAc,OAAyB;AAC/D,QAAO,wBAAwB;EAC7B,cAAc,wDAAwD,MAAM,KAAK,KAAK;EACtF,KAAK,wDAAwD,KAAK;EAClE,aAAa;EACb,KAAK;EACN,CAAC;;AAGJ,SAAS,oBAAoB,MAAc,QAAwB;AACjE,QAAO,wBAAwB;EAC7B,cAAc,+BAA+B,KAAK;EAClD,aAAa;EACb,KAAK;EACL,SAAS,OAAO,MAAM;EACvB,CAAC;;AAMJ,MAAM,yBAEF;CACF,cAAc;CACd,MAAM;CACN,QAAQ;CACR,OAAO;CACP,SAAS;CACV;;AAGD,SAAgB,uBAAuB,WAAiC;CACtE,MAAM,UAAU,aAAa,uBAAuB,eAAe;AACnE,QAAO;EACL,WAAW,GAAG,OAAO;EACrB,WAAW,GAAG,OAAO;EACtB;;;;;;;;;AAUH,SAAgB,kBACd,UACA,WACS;CACT,MAAM,EAAE,cAAc,uBAAuB,UAAU;CACvD,MAAM,cAAc,QAAQ,aAAa,uBAAuB,WAAW;AAC3E,QAAO,QACL,SAAS,cACR,QAAQ,IAAI,cAAe,CAAC,eAAe,SAAS,QACtD;;AAGH,SAAS,aAAa,MAAkC;AACtD,QAAO,iDAAiD,KAAK,KAAK,GAAG;;;;;;;AAQvE,SAAS,oBAAoB,MAAuB;CAClD,MAAM,QAAQ,KAAK,MAAM,KAAK,QAAQ,IAAI,GAAG,EAAE,CAAC,MAAM;CACtD,MAAM,QAAQ,MAAM;AACpB,QACE;EAAC;EAAK;EAAK;EAAI,CAAC,SAAS,MAAM,IAC/B,CAAC,MAAM,MAAM,EAAE,CAAC,WAAW,KAAK,SAAS,GAAG,CAAC,SAAS,MAAM;;AAIhE,SAAS,oBACP,SACA,MACA,OACQ;CACR,MAAM,eAAe,SAAiB,aAAa,KAAK,KAAK;CAC7D,MAAM,QAAQ,QAAQ,MAAM,KAAK;CACjC,MAAM,QAAQ,MAAM,UAAU,YAAY;AAC1C,KAAI,UAAU,GAEZ,QAAO,GAAG,UADQ,WAAW,CAAC,QAAQ,SAAS,KAAK,GAAG,OAAO,KAC9B,KAAK,GAAG,MAAM;AAGhD,QAAO,MACJ,KAAK,MAAM,UAAW,UAAU,QAAQ,GAAG,KAAK,GAAG,UAAU,KAAM,CACnE,QAAQ,MAAM,UAAU,UAAU,SAAS,CAAC,YAAY,KAAK,CAAC,CAC9D,KAAK,KAAK;;;;;;;AAQf,eAAe,eACb,SACuD;CACvD,MAAM,QAAQ,MAAM,GAAG,SAAS,MAAM,QAAQ,CAAC,OAAO,UAAU;AAC9D,MAAI,MAAM,SAAS,SAAU,QAAO,KAAA;AACpC,QAAM;GACN;AACF,KAAI,CAAC,MAAO,QAAO,KAAA;CAEnB,MAAM,OAAO,MAAM,GAAG,SAAS,KAAK,QAAQ,CAAC,OAAO,UAAU;AAC5D,MAAI,MAAM,SAAS,SAAU,QAAO,KAAA;AACpC,QAAM;GACN;AACF,KAAI,CAAC,MAAM,QAAQ,CAAE,OAAM,IAAI,MAAM,uBAAuB,QAAQ,CAAC;AACrE,QAAO;EACL,QAAQ,MAAM,gBAAgB,GAC1B,MAAM,GAAG,SAAS,SAAS,QAAQ,GACnC;EACJ,MAAM,KAAK,OAAO;EACnB;;AAQH,MAAM,yBAAyB;CAC7B;CACA;CACA;CACA;CACA;CACD;;;;;;;;AASD,eAAe,mBAAmB,MAAoC;CACpE,MAAM,YAAY,uBAAuB,QACtC,SAAS,QAAQ,IAAI,UAAU,KAAA,EACjC;AACD,KAAI,UAAU,SAAS,EAAG,OAAM,IAAI,MAAM,iBAAiB,MAAM,UAAU,CAAC;CAC5E,MAAM,MAAM,KAAK,QAAQ,KAAK;CAC9B,MAAM,MAAM,OAAO,SAAmB;AACpC,MAAI;AACF,SAAM,cAAc,OAAO,MAAM;IAC/B;IACA,UAAU;IACV,aAAa;IAEb,KAAK;KAAE,GAAG,QAAQ;KAAK,QAAQ;KAAK;IACrC,CAAC;AACF,UAAO;IAAE,MAAM;IAAG,QAAQ;IAAI;WACvB,OAAO;GACd,MAAM,EAAE,MAAM,WAAW;AACzB,OAAI,OAAO,SAAS,SAClB,OAAM,IAAI,MAAM,oBAAoB,MAAM,MAAM,CAAC;AACnD,UAAO;IAAE;IAAM,QAAQ,OAAO,WAAW,WAAW,SAAS;IAAI;;;CAIrE,MAAM,WAAW,MAAM,IAAI,CAAC,aAAa,kBAAkB,CAAC;AAC5D,KAAI,SAAS,SAAS,OAAO,wBAAwB,KAAK,SAAS,OAAO,CACxE,QAAO;AAET,KAAI,SAAS,SAAS,EACpB,OAAM,IAAI,MAAM,oBAAoB,MAAM,SAAS,OAAO,CAAC;CAG7D,MAAM,UAAU,MAAM,IAAI;EAAC;EAAY;EAAmB;EAAM;EAAK,CAAC;AACtE,KAAI,QAAQ,SAAS,EAAG,QAAO;AAC/B,KAAI,QAAQ,SAAS,EACnB,OAAM,IAAI,MAAM,oBAAoB,MAAM,QAAQ,OAAO,CAAC;CAC5D,MAAM,UAAU,MAAM,IAAI;EAAC;EAAgB;EAAM;EAAM;EAAK,CAAC;AAC7D,KAAI,QAAQ,SAAS,EAAG,QAAO;AAC/B,KAAI,QAAQ,SAAS,EAAG,QAAO;AAC/B,OAAM,IAAI,MAAM,oBAAoB,MAAM,QAAQ,OAAO,CAAC;;;;;;;;;AAgB5D,eAAsB,0BACpB,MAAc,QAAQ,KAAK,EACE;CAC7B,MAAM,UAAU,KAAK,QAAQ,KAAK,aAAa;CAC/C,MAAM,WAAW,MAAM,eAAe,QAAQ;CAC9C,MAAM,WAAW,MAAM,mBAAmB,QAAQ;AAClD,KAAI,aAAa,UAAW,OAAM,IAAI,MAAM,oBAAoB,QAAQ,CAAC;AACzE,KAAI,YAAY,SAAS,WAAW,SAAS;EAC3C,MAAM,mBAAmB,MAAM,mBAAmB,SAAS,OAAO;AAClE,MAAI,qBAAqB,UACvB,OAAM,IAAI,MAAM,oBAAoB,SAAS,OAAO,CAAC;AAEvD,MAAI,qBAAqB,YACvB,OAAM,IAAI,MAAM,8BAA8B,SAAS,SAAS,OAAO,CAAC;;AAG5E,QAAO;EAAE;EAAS;EAAU;EAAU;;AAGxC,eAAe,oBAAoB,KAA4B;CAC7D,MAAM,gBAAgB,KAAK,KAAK,KAAK,aAAa;CAClD,MAAM,UAAU,MAAM,GAAG,SACtB,SAAS,eAAe,OAAO,CAC/B,OAAO,UAAU;AAChB,MAAI,MAAM,SAAS,SAAU,QAAO;AACpC,QAAM;GACN;CACJ,MAAM,YAAY,WAAW,CAAC,QAAQ,SAAS,KAAK,GAAG,OAAO;AAC9D,OAAM,GAAG,SAAS,WAChB,eACA,GAAG,UAAU,eACb,OACD;;AAKH,eAAe,uBACb,QACA,SACA,MACe;CACf,MAAM,gBAAgB,KAAK,KACzB,KAAK,QAAQ,OAAO,EACpB,cAAc,YAAY,CAAC,MAC5B;AACD,KAAI;AACF,QAAM,GAAG,SAAS,UAAU,eAAe,SAAS;GAClD,UAAU;GACV,MAAM;GACN;GACD,CAAC;AACF,QAAM,GAAG,SAAS,MAAM,eAAe,KAAK;AAC5C,QAAM,GAAG,SAAS,OAAO,eAAe,OAAO;UACxC,OAAO;AACd,QAAM,GAAG,SAAS,GAAG,eAAe,EAAE,OAAO,MAAM,CAAC;AACpD,QAAM;;;AAKV,eAAsB,eACpB,aACA,WACA,MAAc,QAAQ,KAAK,EAC3B;CACA,MAAM,EACJ,SACA,UAAU,iBACV,aACE,MAAM,0BAA0B,IAAI;AAExC,KAAI,aAAa,aAAa;AAG5B,QAAM,oBAAoB,IAAI;AAC9B,MAAK,MAAM,mBAAmB,QAAQ,KAAM,UAC1C,OAAM,IAAI,MAAM,sBAAsB,QAAQ,CAAC;YAExC,aAAa,iBAAiB;EAGvC,MAAM,gBAAgB,KAAK,KAAK,KAAK,aAAa;AAClD,MACE,CAAC,GAAG,WAAW,cAAc,KAC5B,MAAM,GAAG,SAAS,SAAS,eAAe,OAAO,EAC/C,SAAS,CACT,MAAM,QAAQ,CACd,GAAG,GAAG,KAAK,aAEd,OAAM,oBAAoB,IAAI;;CAIlC,IAAI,aAAa,kBACb,MAAM,GAAG,SAAS,SAAS,gBAAgB,QAAQ,OAAO,GAC1D;CAKJ,MAAM,QAAQ,uBAAuB,UAAU;CAC/C,MAAM,cAAc,OAAO,OAAO,MAAM;CACxC,MAAM,uBAAuB,WAC1B,MAAM,KAAK,CACX,MACE,SACC,YAAY,SAAS,aAAa,KAAK,IAAI,GAAG,IAC9C,oBAAoB,KAAK,CAC5B;CACH,MAAM,WAAW,OAAO,MAAM,WAAW;CACzC,MAAM,WAAW;EACf,GAAG;GACF,MAAM,YAAY,YAAY;GAC9B,MAAM,YAAY,YAAY;EAChC;AACD,cAAa,oBACX,YACA,MAAM,WACN,YAAY,UACb;AACD,cAAa,oBACX,YACA,MAAM,WACN,YAAY,OACb;CAED,MAAM,UAAU,OAAO,MAAM,WAAW;AACxC,KACE,wBACA,YAAY,MAAM,SAAS,SAAS,OAAO,SAAS,KAAK,CAAC,IAC1D,OAAO,KAAK,QAAQ,CAAC,WAAW,OAAO,KAAK,SAAS,CAAC,UACtD,OAAO,QAAQ,SAAS,CAAC,MAAM,CAAC,MAAM,WAAW,QAAQ,UAAU,MAAM,CAEzE,OAAM,IAAI,MAAM,0BAA0B;AAG5C,OAAM,uBACJ,iBAAiB,UAAU,SAC3B,YACA,iBAAiB,QAAQ,IAC1B"}

package/dist/utils/loadEnv.d.ts

@@ -0,0 +1,2 @@
+/** Load executable startup env files without contaminating command stdout. */
+export declare function loadEnv(): void;

package/dist/utils/loadEnv.js

@@ -0,0 +1,24 @@
+import dotenv from "dotenv";
+//#region src/utils/loadEnv.ts
+/** Load executable startup env files without contaminating command stdout. */
+function loadEnv() {
+	const log = console.log;
+	console.log = console.error;
+	try {
+		dotenv.config({ path: ".env" });
+		dotenv.config({
+			path: ".env.local",
+			override: true
+		});
+		dotenv.config({
+			path: ".env.production",
+			override: true
+		});
+	} finally {
+		console.log = log;
+	}
+}
+//#endregion
+export { loadEnv };
+
+//# sourceMappingURL=loadEnv.js.map

package/dist/utils/loadEnv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadEnv.js","names":[],"sources":["../../src/utils/loadEnv.ts"],"sourcesContent":["import dotenv from 'dotenv';\n\n/** Load executable startup env files without contaminating command stdout. */\nexport function loadEnv(): void {\n  /* eslint-disable no-console -- dotenv 16's vault warnings bypass quiet via console.log. */\n  const log = console.log;\n  // Keep this override synchronous; remove it when dotenv supports stderr diagnostics.\n  console.log = console.error;\n  try {\n    dotenv.config({ path: '.env' });\n    dotenv.config({ path: '.env.local', override: true });\n    dotenv.config({ path: '.env.production', override: true });\n  } finally {\n    console.log = log;\n  }\n  /* eslint-enable no-console */\n}\n"],"mappings":";;;AAGA,SAAgB,UAAgB;CAE9B,MAAM,MAAM,QAAQ;AAEpB,SAAQ,MAAM,QAAQ;AACtB,KAAI;AACF,SAAO,OAAO,EAAE,MAAM,QAAQ,CAAC;AAC/B,SAAO,OAAO;GAAE,MAAM;GAAc,UAAU;GAAM,CAAC;AACrD,SAAO,OAAO;GAAE,MAAM;GAAmB,UAAU;GAAM,CAAC;WAClD;AACR,UAAQ,MAAM"}

package/dist/utils/localizeStaticUrls.js

@@ -3,6 +3,7 @@ import { parseMdxForRoundTrip, restoreAnchorIds } from "./mdxAnchorSyntax.js";
 import * as fs$1 from "fs";
 import { parse } from "@babel/parser";
 import micromatch from "micromatch";
+import * as path$1 from "path";
 import { unified } from "unified";
 import remarkMdx from "remark-mdx";
 import remarkFrontmatter from "remark-frontmatter";
@@ -18,6 +19,28 @@ const { isMatch } = micromatch;
 * locale prefix were added. Extend deliberately.
 */
 const LOCALIZABLE_URL_ATTRIBUTES = new Set(["href"]);
+const PAGE_EXTENSIONS = [".mdx", ".md"];
+const INDEX_PAGE = "index";
+/**
+* The page file a root-relative docs URL points to, relative to the working
+* directory like file mapping keys: `/a/b#x` -> `a/b.mdx`, `a/b.md`, or
+* `a/b/index.mdx`.
+*/
+function findPage(url) {
+	const base = url.split(/[?#]/)[0].replace(/^\/+|\/+$/g, "");
+	return PAGE_EXTENSIONS.flatMap((ext) => [`${base}${ext}`, path$1.join(base, `${INDEX_PAGE}${ext}`)]).find((page) => fs$1.existsSync(page));
+}
+/**
+* Whether a URL points to a source page with no translation on disk, either at
+* its mapped output path or at the localized URL. URLs with no source page,
+* such as pages generated from an OpenAPI spec, are not missing a translation.
+*/
+function translationMissing(url, localizedUrl, localizedFiles) {
+	const sourcePage = findPage(url);
+	if (!sourcePage) return false;
+	const mappedPage = localizedFiles[sourcePage];
+	return !(mappedPage && fs$1.existsSync(mappedPage)) && !findPage(localizedUrl);
+}
 /**
 * Localize URL string literals that live inside an MDX expression's raw source.
 *
@@ -110,6 +133,8 @@ function localizeUrlsInExpressionSource(source, transformUrl, rootStringIsUrl =
 async function localizeStaticUrls(settings, targetLocales, includeFiles) {
 	if (!settings.files || Object.keys(settings.files.placeholderPaths).length === 1 && settings.files.placeholderPaths.gt) return;
 	const { resolvedPaths: sourceFiles } = settings.files;
+	const localizeOptions = settings.options?.experimentalLocalizeStaticUrls;
+	const skipUntranslatedPages = typeof localizeOptions === "object" && localizeOptions.skipUntranslatedPages === true;
 	const locales = targetLocales || settings.locales;
 	const fileMapping = createFileMapping(sourceFiles, settings.files.placeholderPaths, settings.files.transformPaths ?? {}, settings.files.transformFormats ?? {}, settings.locales, settings.defaultLocale);
 	const processPromises = [];
@@ -127,10 +152,10 @@ async function localizeStaticUrls(settings, targetLocales, includeFiles) {
 		}
 	}
 	const mappingPromises = Object.entries(fileMapping).filter(([locale]) => locales.includes(locale)).map(async ([locale, filesMap]) => {
-		const targetFiles = Object.values(filesMap).filter((p) => (p.endsWith(".md") || p.endsWith(".mdx")) && (!includeFiles || includeFiles.has(p)));
+		const targetFiles = Object.values(filesMap).filter((p) => PAGE_EXTENSIONS.some((ext) => p.endsWith(ext)) && (!includeFiles || includeFiles.has(p)));
 		await Promise.all(targetFiles.map(async (filePath) => {
 			if (!fs$1.existsSync(filePath)) return;
-			const result = localizeStaticUrlsForFile(await fs$1.promises.readFile(filePath, "utf8"), settings.defaultLocale, locale, settings.options?.experimentalHideDefaultLocale || false, settings.options?.docsUrlPattern, settings.options?.excludeStaticUrls, settings.options?.baseDomain);
+			const result = localizeStaticUrlsForFile(await fs$1.promises.readFile(filePath, "utf8"), settings.defaultLocale, locale, settings.options?.experimentalHideDefaultLocale || false, settings.options?.docsUrlPattern, settings.options?.excludeStaticUrls, settings.options?.baseDomain, skipUntranslatedPages ? filesMap : void 0);
 			if (result.hasChanges) await fs$1.promises.writeFile(filePath, result.content);
 		}));
 	});
@@ -200,7 +225,7 @@ function transformUrlPath(originalUrl, patternHead, targetLocale, defaultLocale,
 /**
 * AST-based transformation for MDX files using remark-mdx
 */
-function transformMdxUrls(mdxContent, defaultLocale, targetLocale, hideDefaultLocale, pattern = "/[locale]", exclude = [], baseDomain) {
+function transformMdxUrls(mdxContent, defaultLocale, targetLocale, hideDefaultLocale, pattern = "/[locale]", exclude = [], baseDomain, localizedFiles) {
 	const transformedUrls = [];
 	if (!pattern.startsWith("/")) pattern = "/" + pattern;
 	const patternHead = pattern.split("[locale]")[0];
@@ -238,8 +263,10 @@ function transformMdxUrls(mdxContent, defaultLocale, targetLocale, hideDefaultLo
 		}
 		if (!shouldProcessUrl(originalUrl, patternHead, targetLocale, defaultLocale, baseDomain)) return null;
 		if (baseDomain && shouldProcessAbsoluteUrl(originalUrl, baseDomain)) {
-			const transformedPath = transformUrlPath(originalUrl.substring(baseDomain.length), patternHead, targetLocale, defaultLocale, hideDefaultLocale);
+			const afterDomain = originalUrl.substring(baseDomain.length);
+			const transformedPath = transformUrlPath(afterDomain, patternHead, targetLocale, defaultLocale, hideDefaultLocale);
 			if (!transformedPath) return null;
+			if (localizedFiles && translationMissing(afterDomain, transformedPath, localizedFiles)) return null;
 			transformedUrls.push({
 				originalPath: originalUrl,
 				newPath: transformedPath,
@@ -251,6 +278,7 @@ function transformMdxUrls(mdxContent, defaultLocale, targetLocale, hideDefaultLo
 		const newUrl = transformUrlPath(originalUrl, patternHead, targetLocale, defaultLocale, hideDefaultLocale);
 		if (!newUrl) return null;
 		if (isUrlExcluded(originalUrl, exclude, defaultLocale)) return null;
+		if (localizedFiles && translationMissing(originalUrl, newUrl, localizedFiles)) return null;
 		transformedUrls.push({
 			originalPath: originalUrl,
 			newPath: newUrl,
@@ -345,8 +373,8 @@ function transformMdxUrls(mdxContent, defaultLocale, targetLocale, hideDefaultLo
 		transformedUrls
 	};
 }
-function localizeStaticUrlsForFile(file, defaultLocale, targetLocale, hideDefaultLocale, pattern = "/[locale]", exclude = [], baseDomain) {
-	return transformMdxUrls(file, defaultLocale, targetLocale, hideDefaultLocale, pattern, exclude, baseDomain || "");
+function localizeStaticUrlsForFile(file, defaultLocale, targetLocale, hideDefaultLocale, pattern = "/[locale]", exclude = [], baseDomain, localizedFiles) {
+	return transformMdxUrls(file, defaultLocale, targetLocale, hideDefaultLocale, pattern, exclude, baseDomain || "", localizedFiles);
 }
 function checkIfPathMatchesPattern(originalUrlArray, patternHeadArray) {
 	for (let i = 0; i < patternHeadArray.length; i++) if (patternHeadArray[i] !== originalUrlArray?.[i]) return false;