ninepm 0.0.1 → 0.24.1

package/dist/manifest.d.ts

@@ -0,0 +1,4 @@
+import type { FileManifestEntry } from "./cli-types.js";
+export declare function buildFileManifest(rootDirectory: string): Promise<FileManifestEntry[]>;
+export declare function readManifestFile(rootDirectory: string, manifestPath: string): Promise<Uint8Array>;
+export declare function validateManifest(files: FileManifestEntry[]): FileManifestEntry[];

package/dist/manifest.js

@@ -0,0 +1,134 @@
+// AUTO-GENERATED by scripts/generate-cli-package.mjs from the in-repo CLI source -- do not edit.
+// Edit src/cli or src/shared instead; this is regenerated on typecheck/test/build/pack.
+import { createHash } from "node:crypto";
+import { lstat, readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+const DEFAULT_IGNORES = new Set([
+    ".git",
+    "node_modules",
+    ".wrangler",
+    "dist",
+    "dist-test",
+]);
+// Local-secret files hold API keys, DB creds, and tokens and must never be
+// uploaded as deployable assets. Covers dotenv (`.env`, `.env.*`) and Wrangler
+// dev vars (`.dev.vars`, `.dev.vars.*`), while keeping committed templates
+// (`.env.example`, `.env.sample`, `.env.template`).
+function isLocalSecretFile(name) {
+    return ((/^\.env(\.|$)/.test(name) || /^\.dev\.vars(\.|$)/.test(name)) &&
+        !/\.(example|sample|template)$/.test(name));
+}
+function isIgnoredEntry(name) {
+    return DEFAULT_IGNORES.has(name) || isLocalSecretFile(name);
+}
+export async function buildFileManifest(rootDirectory) {
+    const root = path.resolve(rootDirectory);
+    // Reject a symlinked deploy root: walkFiles' readdir would follow it and
+    // publish the target's files under normal relative paths, so the per-entry
+    // symlink skip below is not enough on its own. A link like `dist ->
+    // ../../secrets` must fail loudly rather than silently exfiltrate its target.
+    if ((await lstat(root)).isSymbolicLink()) {
+        throw new Error(`Deploy path is a symlink: ${rootDirectory}. Pass the real target directory instead.`);
+    }
+    const files = await walkFiles(root);
+    const manifest = [];
+    for (const absolutePath of files) {
+        const bytes = await readFile(absolutePath);
+        const relativePath = normalizeManifestPath(path.relative(root, absolutePath));
+        manifest.push({
+            path: relativePath,
+            size: bytes.byteLength,
+            sha256: createHash("sha256").update(bytes).digest("hex"),
+            contentType: contentTypeForPath(relativePath),
+        });
+    }
+    return manifest.sort((left, right) => left.path.localeCompare(right.path));
+}
+export async function readManifestFile(rootDirectory, manifestPath) {
+    const root = path.resolve(rootDirectory);
+    const absolutePath = path.resolve(root, manifestPath);
+    if (!absolutePath.startsWith(root + path.sep) && absolutePath !== root) {
+        throw new Error(`Manifest path escapes root directory: ${manifestPath}`);
+    }
+    return readFile(absolutePath);
+}
+export function validateManifest(files) {
+    const seen = new Set();
+    return files.map((file) => {
+        if (!file.path || file.path.startsWith("/") || file.path.includes("..")) {
+            throw new Error(`Invalid manifest path: ${file.path}`);
+        }
+        if (seen.has(file.path)) {
+            throw new Error(`Duplicate manifest path: ${file.path}`);
+        }
+        seen.add(file.path);
+        if (!Number.isInteger(file.size) || file.size < 0) {
+            throw new Error(`Invalid size for ${file.path}`);
+        }
+        if (!/^[a-f0-9]{64}$/.test(file.sha256)) {
+            throw new Error(`Invalid sha256 for ${file.path}`);
+        }
+        return {
+            path: file.path,
+            size: file.size,
+            sha256: file.sha256,
+            contentType: file.contentType || contentTypeForPath(file.path),
+        };
+    });
+}
+async function walkFiles(directory) {
+    const entries = await readdir(directory);
+    const files = [];
+    for (const entry of entries) {
+        if (isIgnoredEntry(entry)) {
+            continue;
+        }
+        const absolutePath = path.join(directory, entry);
+        // lstat, not stat: never follow symlinks. A symlink inside the deploy
+        // directory (e.g. `config -> ../../.env`, `key -> ~/.ssh/id_ed25519`) would
+        // otherwise be read and published as a public asset, escaping both the root
+        // and the local-secret name filter. Skipping symlinks also avoids cyclic
+        // recursion.
+        const details = await lstat(absolutePath);
+        if (details.isSymbolicLink()) {
+            continue;
+        }
+        if (details.isDirectory()) {
+            files.push(...(await walkFiles(absolutePath)));
+            continue;
+        }
+        if (details.isFile()) {
+            files.push(absolutePath);
+        }
+    }
+    return files;
+}
+function normalizeManifestPath(value) {
+    return value.split(path.sep).join("/");
+}
+function contentTypeForPath(filePath) {
+    const extension = path.extname(filePath).toLowerCase();
+    switch (extension) {
+        case ".html":
+            return "text/html; charset=utf-8";
+        case ".css":
+            return "text/css; charset=utf-8";
+        case ".js":
+        case ".mjs":
+        case ".ts":
+            return "text/javascript; charset=utf-8";
+        case ".json":
+            return "application/json; charset=utf-8";
+        case ".svg":
+            return "image/svg+xml";
+        case ".png":
+            return "image/png";
+        case ".jpg":
+        case ".jpeg":
+            return "image/jpeg";
+        case ".webp":
+            return "image/webp";
+        default:
+            return "application/octet-stream";
+    }
+}

package/package.json

@@ -1,12 +1,39 @@
 {
   "name": "ninepm",
-  "version": "0.0.1",
-  "description": "Placeholder for the 9pm.ai deploy CLI. The real CLI ships under this name soon.",
-  "homepage": "https://9pm.ai",
+  "version": "0.24.1",
+  "description": "CLI for deploying built apps to 9pm.ai.",
+  "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",
-  "keywords": [
-    "9pm",
-    "deploy",
-    "cli"
-  ]
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "9pm": "./dist/index.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE.md"
+  ],
+  "scripts": {
+    "generate": "node ../../scripts/generate-cli-package.mjs",
+    "prebuild": "node ../../scripts/generate-cli-package.mjs",
+    "build": "tsc -p tsconfig.json",
+    "pretypecheck": "node ../../scripts/generate-cli-package.mjs",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "prepack": "npm run build"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "devDependencies": {
+    "@types/node": "^24.10.1",
+    "typescript": "^5.9.3"
+  }
 }