repofence 0.1.5 → 0.1.7

package/README.md

@@ -126,6 +126,33 @@ After running `init`, open any project in Cursor and type `/repofence.help` in t
 | `--dry-run` | Show what would be done without making changes |
 | `--verbose` | Enable verbose logging |
 
+## HTTP API (backend in this repo)
+
+The same repository includes the **Repofence API** under `backend/`. Canonical entry: **`backend/server.ts`**.
+
+| Script | Purpose |
+|--------|---------|
+| `npm run backend` | Run API locally with `ts-node` (port `3002` or `PORT`) |
+| `npm run build:backend` | Compile API to `backend-dist/` |
+| `npm run backend:start` | Run compiled API: `node backend-dist/server.js` |
+| `npm start` | Same as API server (`backend-dist/server.js`) — matches **Railway** default |
+| `npm run start:cli` | Run compiled CLI entry (`dist/cli.js`) locally |
+
+Deploy (e.g. **Railway**): see [`backend/README.md`](backend/README.md) and root **`railway.json`**.
+
+## Publishing the CLI (npm)
+
+Step-by-step: **[docs/RELEASE.md](docs/RELEASE.md)** (`npm version`, `npm publish`). The published package only includes **`dist/`**; the HTTP API in `backend/` is deployed separately.
+
+## Environment variables
+
+| Variable | Description |
+|----------|-------------|
+| `REPOFENCE_API_BASE_URL` | API host for the CLI (`auth`, `init`). Default normalizes to `…/api`. |
+| `REPOFENCE_MOCK` | Set to `1` for mock API responses (no network). |
+| `REPOFENCE_PACK_ID` | Pack id for `repofence init` (default: `core`). |
+| `REPOFENCE_PUBLIC_KEY` | Optional. PEM or base64 public key to verify signed packs. If unset, the CLI uses its built-in public key. |
+
 ## Requirements
 
 - Node.js 18 or higher

package/dist/commands/init.js

@@ -144,8 +144,10 @@ async function initCommand(cwd, options) {
             process.exit(1);
         }
         const client = new api_client_1.ApiClient();
+        const resolvedBase = (0, api_client_1.getResolvedApiBaseUrl)();
         if (verbose) {
-            console.log(chalk_1.default.cyan(`[debug] REPOFENCE_API_BASE_URL=${process.env.REPOFENCE_API_BASE_URL || '(default)'}`));
+            console.log(chalk_1.default.cyan(`[debug] REPOFENCE_API_BASE_URL(raw)=${process.env.REPOFENCE_API_BASE_URL || '(unset)'}`));
+            console.log(chalk_1.default.cyan(`[debug] resolved API base=${resolvedBase}`));
             console.log(chalk_1.default.cyan(`[debug] REPOFENCE_PACK_ID=${packId}`));
         }
         let pack = null;
@@ -154,8 +156,7 @@ async function initCommand(cwd, options) {
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            const baseUrl = process.env.REPOFENCE_API_BASE_URL || '(default: https://api.repofence.com)';
-            console.error(chalk_1.default.red(`❌ Error al descargar pack "${packId}" (${baseUrl}): ${message}`));
+            console.error(chalk_1.default.red(`❌ Error al descargar pack "${packId}" (${resolvedBase}): ${message}`));
             throw error;
         }
         const isValid = await (0, pack_manager_1.validateSignature)(pack);

package/dist/core/api-client.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiClient = exports.ApiClientError = void 0;
+exports.normalizeApiBaseUrl = normalizeApiBaseUrl;
+exports.getResolvedApiBaseUrl = getResolvedApiBaseUrl;
 class ApiClientError extends Error {
     constructor(message, status, code, details) {
         super(message);
@@ -30,9 +32,28 @@ const DEMO_PACK = {
 const notImplemented = () => {
     throw new Error('API client no implementado. Usa REPOFENCE_MOCK=1 para datos dummy.');
 };
+/**
+ * Production hosts expose routes under `/api/v1/...`.
+ * Accept either `https://host` or `https://host/api` — paths in this client stay `/v1/...`.
+ */
+function normalizeApiBaseUrl(raw) {
+    const trimmed = raw.replace(/\/+$/, '');
+    if (!trimmed) {
+        return 'https://api.repofence.com/api';
+    }
+    if (trimmed.endsWith('/api')) {
+        return trimmed;
+    }
+    return `${trimmed}/api`;
+}
+/** Base URL used for all HTTP calls (env + default + `/api` segment). */
+function getResolvedApiBaseUrl(override) {
+    const raw = override ?? process.env.REPOFENCE_API_BASE_URL ?? 'https://api.repofence.com';
+    return normalizeApiBaseUrl(raw);
+}
 class ApiClient {
     constructor(baseUrl) {
-        this.baseUrl = baseUrl || process.env.REPOFENCE_API_BASE_URL || 'https://api.repofence.com';
+        this.baseUrl = getResolvedApiBaseUrl(baseUrl);
     }
     async request(path, init) {
         // Ensure we don't drop the /api segment if path starts with "/"

package/dist/core/pack-manager.js

@@ -9,6 +9,7 @@ const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const crypto_1 = __importDefault(require("crypto"));
 const tar_1 = __importDefault(require("tar"));
+const pack_public_key_1 = require("./pack-public-key");
 const defaultCommandsDir = () => process.env.REPOFENCE_COMMANDS_DIR || path_1.default.join(os_1.default.homedir(), '.cursor', 'commands');
 const commandsDir = (baseDir) => baseDir || defaultCommandsDir();
 const manifestPath = (baseDir) => path_1.default.join(commandsDir(baseDir), '.repofence-manifest.json');
@@ -151,13 +152,10 @@ const validateSignature = async (_pack) => {
     const payloadToVerify = pack.archiveHash
         ? `${pack.manifestHash}:${pack.archiveHash}`
         : pack.manifestHash;
-    const publicKeyEnv = process.env.REPOFENCE_PUBLIC_KEY;
-    if (!publicKeyEnv) {
-        throw new Error('Falta REPOFENCE_PUBLIC_KEY para validar la firma del pack.');
-    }
-    const publicKeyPem = publicKeyEnv.includes('BEGIN')
-        ? publicKeyEnv
-        : Buffer.from(publicKeyEnv, 'base64').toString('utf8');
+    const rawKey = process.env.REPOFENCE_PUBLIC_KEY?.trim() || pack_public_key_1.EMBEDDED_PACK_PUBLIC_KEY_PEM;
+    const publicKeyPem = rawKey.includes('BEGIN')
+        ? rawKey
+        : Buffer.from(rawKey, 'base64').toString('utf8');
     try {
         const keyObject = crypto_1.default.createPublicKey(publicKeyPem);
         const isValid = crypto_1.default.verify(null, Buffer.from(payloadToVerify), keyObject, Buffer.from(pack.signature, 'base64'));

package/dist/core/pack-public-key.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EMBEDDED_PACK_PUBLIC_KEY_PEM = void 0;
+/**
+ * Default Ed25519 public key for verifying signed packs from the Repofence API.
+ * Keep in sync with `public_key.pem` at the repo root (pair to backend REPOFENCE_SIGNING_KEY).
+ * Override with env REPOFENCE_PUBLIC_KEY for testing or key rotation.
+ */
+exports.EMBEDDED_PACK_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUNvd0JRWURLMlZ3QXlFQUpUZnhjN2JhVzg1dzdyM3V4YllOdWFaUk1vZTFlMmxjdmEybDdNTzBpYWs9Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo=
+-----END PUBLIC KEY-----
+`;
+//# sourceMappingURL=pack-public-key.js.map

package/package.json

@@ -1,17 +1,26 @@
 {
   "name": "repofence",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Repofence CLI (packs + backend auth)",
   "main": "dist/cli.js",
   "bin": {
     "repofence": "./dist/cli.js"
   },
+  "files": [
+    "dist/**/*.js",
+    "dist/templates/**/*.md"
+  ],
   "scripts": {
     "build": "tsc && npm run copy-templates && npm run add-shebang",
+    "build:backend": "tsc -p backend/tsconfig.json",
+    "build:all": "npm run build && npm run build:backend",
     "copy-templates": "node scripts/copy-templates.js",
     "add-shebang": "node scripts/add-shebang.js",
-    "start": "node dist/cli.js",
-    "dev": "ts-node src/cli.ts"
+    "start": "node backend-dist/server.js",
+    "start:cli": "node dist/cli.js",
+    "dev": "ts-node src/cli.ts",
+    "backend": "ts-node backend/server.ts",
+    "backend:start": "node backend-dist/server.js"
   },
   "keywords": [
     "sdd",
@@ -24,7 +33,7 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.705.0",
     "@aws-sdk/s3-request-presigner": "^3.705.0",
-    "chalk": "^5.6.2",
+    "chalk": "^4.1.2",
     "commander": "^11.1.0",
     "dotenv": "^16.4.5",
     "open": "^11.0.0",