nxds-cli 0.4.0 → 0.4.1

package/dist/index.js

@@ -178,17 +178,42 @@ function readJson(file) {
   }
 }
 
+// src/url.ts
+function httpUrl(value) {
+  const url = URL.canParse(value) ? new URL(value) : void 0;
+  return url?.protocol === "http:" || url?.protocol === "https:" ? url : void 0;
+}
+function assertRegistryUrl(flag, value, privateRegistryHint) {
+  const url = httpUrl(value);
+  if (!url) {
+    throw new UsageError(
+      `${flag} is not a valid http or https URL. ${privateRegistryHint}`
+    );
+  }
+  if (url.username || url.password || /[?#]/.test(value)) {
+    throw new UsageError(
+      `${flag} can't include a user name, password, query or fragment. nxds-cli sends no registry login, and it adds file paths to the URL. ${privateRegistryHint}`
+    );
+  }
+}
+
 // src/catalog.ts
 var SETUP = "setup";
 var DEFAULT_REGISTRY = "https://nxds.dev/r";
 var FETCH_TIMEOUT_MS = 3e4;
 var dispatcher = new EnvHttpProxyAgent();
 function isUrl(registry) {
-  return /^https?:\/\//.test(registry);
+  return /^\s*[a-z][a-z\d+.-]+:/i.test(registry);
 }
 function resolveRegistry(option) {
   if (!option) return DEFAULT_REGISTRY;
-  return isUrl(option) ? option.replace(/\/+$/, "") : path2.resolve(option);
+  if (!isUrl(option)) return path2.resolve(option);
+  assertRegistryUrl(
+    "--registry (or NXDS_REGISTRY_URL)",
+    option,
+    "For a private registry, download its latest.json and <version>.json files to a folder, and pass the folder with --registry."
+  );
+  return option.replace(/\/+$/, "");
 }
 function timeoutError(url, error) {
   if (!(error instanceof Error) || error.name !== "TimeoutError") return null;
@@ -244,7 +269,7 @@ async function fetchRelease(registry, version) {
   if (isNewerSchema(value)) {
     const release = version === "latest" ? "The latest nxds release" : `nxds ${version}`;
     throw new CliError(
-      `${release} needs a newer nxds-cli than ${"0.4.0"}. Run \`${CLI_COMMAND}\` to get the newest one.`
+      `${release} needs a newer nxds-cli than ${"0.4.1"}. Run \`${CLI_COMMAND}\` to get the newest one.`
     );
   }
   const invalid = (problems) => new CliError(
@@ -1615,7 +1640,16 @@ var DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";
 var DEFAULT_EXPORT_DIR = "nxds-design-system";
 var FETCH_TIMEOUT_MS2 = 6e4;
 var dispatcher2 = new EnvHttpProxyAgent2();
+function redactUrl(url) {
+  const redacted = httpUrl(url);
+  if (!redacted) return "<invalid URL>";
+  redacted.username = "";
+  redacted.password = "";
+  redacted.search = "";
+  return redacted.href;
+}
 async function download(url) {
+  const shown = redactUrl(url);
   let response;
   try {
     response = await fetch2(url, {
@@ -1624,14 +1658,14 @@ async function download(url) {
     });
   } catch (error) {
     const { message, cause } = error;
-    const reason = cause instanceof Error ? cause.message : message;
+    const reason = (cause instanceof Error ? cause.message : message).replaceAll(url, () => shown);
     throw new CliError(
-      `Could not reach ${url} (${reason}). Check your connection, or set HTTPS_PROXY if you are behind a proxy, then run the command again.`
+      `Could not reach ${shown} (${reason}). Check your connection, or set HTTPS_PROXY if you are behind a proxy, then run the command again.`
     );
   }
   if (!response.ok) {
     throw new CliError(
-      `${url} answered ${response.status}. Run the command again later.`
+      `${shown} answered ${response.status}. Run the command again later.`
     );
   }
   return Buffer.from(await response.arrayBuffer());
@@ -1640,6 +1674,11 @@ function packageUrl(registry) {
   return `${registry.replace(/\/+$/, "")}/${CLAUDE_DESIGN_PACKAGE.replace("/", "%2f")}`;
 }
 async function resolveTarball(registry, release) {
+  assertRegistryUrl(
+    "--npm-registry (or npm_config_registry)",
+    registry,
+    `For a private registry, unpack the tarball from \`npm pack ${CLAUDE_DESIGN_PACKAGE}\` and pass its package folder with --source.`
+  );
   const url = packageUrl(registry);
   const body = (await download(url)).toString("utf8");
   let packument;
@@ -1647,7 +1686,7 @@ async function resolveTarball(registry, release) {
     packument = JSON.parse(body);
   } catch {
     throw new CliError(
-      `${url} didn't answer with JSON. Check --npm-registry, or your proxy, then run the command again.`
+      `${redactUrl(url)} didn't answer with JSON. Check --npm-registry, or your proxy, then run the command again.`
     );
   }
   const version = packument["dist-tags"]?.[release] ?? release;
@@ -1664,13 +1703,13 @@ function checkIntegrity(bytes, integrity, tarball) {
   const expected = integrity.split(/\s+/).find((entry) => entry.startsWith("sha512-"));
   if (!expected) {
     throw new CliError(
-      `${tarball} has no sha512 integrity to check it against.`
+      `${redactUrl(tarball)} has no sha512 integrity to check it against.`
     );
   }
   const actual = `sha512-${createHash("sha512").update(bytes).digest("base64")}`;
   if (actual !== expected) {
     throw new CliError(
-      `${tarball} doesn't match its published integrity. Run the command again; if it keeps failing, report it.`
+      `${redactUrl(tarball)} doesn't match its published integrity. Run the command again; if it keeps failing, report it.`
     );
   }
 }
@@ -2233,12 +2272,13 @@ async function update(cwd, registry, options) {
 }
 
 // src/cli.ts
+function cwdOf(command) {
+  const { cwd } = command.optsWithGlobals();
+  return path13.resolve(cwd ?? process.cwd());
+}
 function context(command) {
-  const { cwd, registry } = command.optsWithGlobals();
-  return {
-    cwd: path13.resolve(cwd ?? process.cwd()),
-    registry: resolveRegistry(registry)
-  };
+  const { registry } = command.optsWithGlobals();
+  return { cwd: cwdOf(command), registry: resolveRegistry(registry) };
 }
 function installOptions(command) {
   const flags = command.opts();
@@ -2258,7 +2298,7 @@ function program(done, write) {
     // Errors are printed once, by `main`, as text or JSON.
     outputError: () => {
     }
-  }).exitOverride().name(CLI_COMMAND).description("Add nxds to your app.").version("0.4.0", "-v, --version", "print the version").helpOption("-h, --help", "show help").helpCommand("help [command]", "show help for a command").option("--json", "print machine-readable JSON").option("--cwd <path>", "run in another folder").addOption(
+  }).exitOverride().name(CLI_COMMAND).description("Add nxds to your app.").version("0.4.1", "-v, --version", "print the version").helpOption("-h, --help", "show help").helpCommand("help [command]", "show help for a command").option("--json", "print machine-readable JSON").option("--cwd <path>", "run in another folder").addOption(
     new Option(
       "--registry <url|path>",
       "where to get nxds releases (default: https://nxds.dev/r)"
@@ -2312,7 +2352,7 @@ Docs: https://nxds.dev/getting-started/install`
     done(await view(cwd, registry, item));
   });
   cli.command("info").description("show what the CLI detects in this app").action((_options, command) => {
-    done(info(context(command).cwd));
+    done(info(cwdOf(command)));
   });
   cli.command("diff").description("compare your nxds files with the latest release").argument("[items...]", "item names (default: every installed item)").action(async (items, _options, command) => {
     const { cwd, registry } = context(command);
@@ -2337,8 +2377,9 @@ Docs: https://nxds.dev/getting-started/install`
       `npm registry to download from (default: ${DEFAULT_NPM_REGISTRY})`
     ).env("npm_config_registry")
   ).action(async (_target, _options, command) => {
-    const { cwd } = context(command);
-    done(await exportClaudeDesign(cwd, command.opts()));
+    done(
+      await exportClaudeDesign(cwdOf(command), command.opts())
+    );
   });
   cli.command("doctor").description("check that nxds is wired up correctly").action(async (_options, command) => {
     const { cwd, registry } = context(command);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nxds-cli",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "type": "module",
   "description": "Install nxds components, blocks and setup into your app.",
   "keywords": [
@@ -45,8 +45,8 @@
     "@types/semver": "^7.8.0",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
-    "@nxds/catalog": "0.0.0",
-    "@nxds/claude-design": "0.6.0"
+    "@nxds/claude-design": "0.8.1",
+    "@nxds/catalog": "0.0.0"
   },
   "scripts": {
     "build": "tsup",