sitevision-cli 0.4.0-beta.2 → 0.5.0-beta.0

package/dist/commands/build.js

@@ -2,8 +2,9 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import React from 'react';
 import { render, Box, Text, useInput } from 'ink';
 import { StatusIndicator } from '../components/StatusIndicator.js';
-import { WebpackRunner } from '../utils/webpack-runner.js';
-import { copyStaticToBuild, copySrcToBuild, cleanBuild, formatFileSize, createBuildZip, getZipSize, } from '../utils/zip.js';
+import { WebpackRunner, hasLocalWebpackConfig } from '../utils/webpack-runner.js';
+import { hasSitevisionScripts, runSitevisionScriptsBuild, getDelegatedZipPath, checkSitevisionScriptsCompatibility, } from '../utils/sitevision-scripts-runner.js';
+import { copyStaticToBuild, copySrcToBuild, cleanBuild, formatFileSize, createBuildZip, getZipSize, zipExists, } from '../utils/zip.js';
 import { isBundledApp, getAppType, getFullAppId, } from '../utils/project-detection.js';
 export function BuildScreen({ projectRoot, manifest, createZip = true, onBack, }) {
     const [state, setState] = React.useState({
@@ -25,8 +26,55 @@ export function BuildScreen({ projectRoot, manifest, createZip = true, onBack, }
                 setState({ status: 'cleaning', message: 'Cleaning build directory...' });
                 cleanBuild(projectRoot);
                 // Step 2: Build or copy files
+                if (isBundled && !hasLocalWebpackConfig(projectRoot)) {
+                    // No project-local webpack config: delegate the whole build to
+                    // @sitevision/sitevision-scripts, which compiles + zips to
+                    // dist/<appId>.zip (the path the CLI's sign/deploy already use).
+                    if (!hasSitevisionScripts(projectRoot)) {
+                        setState({
+                            status: 'error',
+                            error: 'No webpack.config.js found and @sitevision/sitevision-scripts is not installed. Run npm install.',
+                        });
+                        return;
+                    }
+                    // Warn if the installed sitevision-scripts is outside the range
+                    // the delegated build was validated against.
+                    const warning = checkSitevisionScriptsCompatibility(projectRoot).warning;
+                    setState({
+                        status: 'building',
+                        message: 'Building via sitevision-scripts...',
+                        warning,
+                    });
+                    const sitevisionResult = await runSitevisionScriptsBuild(projectRoot);
+                    if (!sitevisionResult.success) {
+                        setState({
+                            status: 'error',
+                            error: `${sitevisionResult.error}\n${sitevisionResult.output.slice(-1000)}`,
+                            warning,
+                        });
+                        return;
+                    }
+                    // sitevision-scripts already produced the zip; report it directly.
+                    const zipPath = getDelegatedZipPath(projectRoot, manifest.id);
+                    if (!zipExists(zipPath)) {
+                        setState({
+                            status: 'error',
+                            error: `Build reported success but no zip was found at ${zipPath}.`,
+                            warning,
+                        });
+                        return;
+                    }
+                    setState({
+                        status: 'success',
+                        message: 'Build complete',
+                        zipPath,
+                        zipSize: getZipSize(zipPath),
+                        warning,
+                    });
+                    return;
+                }
                 if (isBundled) {
-                    // Check if webpack is available
+                    // Project ships its own webpack config: build it in-process.
                     if (!WebpackRunner.isWebpackAvailable(projectRoot)) {
                         setState({
                             status: 'error',
@@ -122,7 +170,7 @@ export function BuildScreen({ projectRoot, manifest, createZip = true, onBack, }
                 return 'Build failed';
         }
     };
-    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(StatusIndicator, { status: getStatusIndicator(), label: getStatusLabel(), message: state.message }) }), state.status === 'success' && state.result?.stats && (_jsxs(Box, { flexDirection: "column", marginLeft: 2, children: [_jsxs(Text, { dimColor: true, children: ["Compiled in ", state.result.stats.time, "ms"] }), state.result.stats.assets &&
+    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(StatusIndicator, { status: getStatusIndicator(), label: getStatusLabel(), message: state.message }) }), state.warning && (_jsx(Box, { marginBottom: 1, children: _jsxs(Text, { color: "yellow", children: ["\u26A0 ", state.warning] }) })), state.status === 'success' && state.result?.stats && (_jsxs(Box, { flexDirection: "column", marginLeft: 2, children: [_jsxs(Text, { dimColor: true, children: ["Compiled in ", state.result.stats.time, "ms"] }), state.result.stats.assets &&
                         state.result.stats.assets.length > 0 && (_jsxs(Text, { dimColor: true, children: ["Assets: ", state.result.stats.assets.join(', ')] }))] })), state.status === 'success' && state.zipPath && (_jsxs(Box, { flexDirection: "column", marginLeft: 2, marginTop: 1, children: [_jsxs(Text, { color: "green", children: ["\u2713 Created: ", state.zipPath] }), state.zipSize !== undefined && (_jsxs(Text, { dimColor: true, children: [" Size: ", formatFileSize(state.zipSize)] }))] })), state.result?.warnings && state.result.warnings.length > 0 && (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsx(Text, { color: "yellow", children: "Warnings:" }), state.result.warnings.slice(0, 5).map((warning, i) => (_jsx(Text, { color: "yellow", dimColor: true, children: warning.substring(0, 200) }, i))), state.result.warnings.length > 5 && (_jsxs(Text, { color: "yellow", dimColor: true, children: ["...and ", state.result.warnings.length - 5, " more"] }))] })), state.status === 'error' && state.error && (_jsx(Box, { flexDirection: "column", marginTop: 1, children: _jsx(Text, { color: "red", children: state.error }) })), onBack && (state.status === 'success' || state.status === 'error') && (_jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "Press q or Esc to return to menu" }) }))] }));
 }
 export const buildCommand = {

package/dist/commands/dev.js

@@ -1,8 +1,11 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import fs from 'fs';
+import path from 'path';
 import React from 'react';
 import { render, Box, Text, useApp, useInput } from 'ink';
 import { StatusIndicator } from '../components/StatusIndicator.js';
-import { WebpackRunner } from '../utils/webpack-runner.js';
+import { WebpackRunner, hasLocalWebpackConfig } from '../utils/webpack-runner.js';
+import { hasSitevisionScripts, runSitevisionScriptsBuild, getDelegatedZipPath, checkSitevisionScriptsCompatibility, } from '../utils/sitevision-scripts-runner.js';
 import { promptPassword, promptYesNo } from '../utils/password-prompt.js';
 import { signApp, deployApp } from '../utils/sitevision-api.js';
 import { setDeployPassword } from '../utils/keychain.js';
@@ -26,23 +29,13 @@ export function DevScreen({ projectRoot, manifest, devProperties, signed, signin
         }
     });
     const webpackRunnerRef = React.useRef(null);
-    const handleBuildComplete = React.useCallback(async (result) => {
-        if (!result.success) {
-            setState(prev => ({
-                ...prev,
-                status: 'error',
-                message: result.errors?.join('\n') || 'Build failed',
-                error: result.errors?.join('\n'),
-            }));
-            return;
-        }
+    const watchersRef = React.useRef([]);
+    const debounceTimerRef = React.useRef(null);
+    const isBuildingRef = React.useRef(false);
+    const pendingRebuildRef = React.useRef(false);
+    // Sign (if needed) and deploy an already-built zip, updating UI state.
+    const signAndDeploy = React.useCallback(async (zipPath, buildTime) => {
         try {
-            // Copy static files
-            copyStaticToBuild(projectRoot);
-            // Create zip
-            const appId = getFullAppId(manifest.id);
-            await createBuildZip(projectRoot, appId);
-            const zipPath = getZipPath(projectRoot, manifest);
             let deployZipPath = zipPath;
             // Sign if needed
             if (signed && signingCredentials) {
@@ -94,7 +87,7 @@ export function DevScreen({ projectRoot, manifest, devProperties, signed, signin
                 status: 'ready',
                 message: 'Deployed. Watching for changes...',
                 buildCount: prev.buildCount + 1,
-                lastBuildTime: result.stats?.time,
+                lastBuildTime: buildTime,
                 error: undefined,
             }));
         }
@@ -107,14 +100,122 @@ export function DevScreen({ projectRoot, manifest, devProperties, signed, signin
             }));
         }
     }, [projectRoot, manifest, devProperties, signed, signingCredentials]);
+    // In-house webpack path: copy static, zip, then sign + deploy.
+    const handleBuildComplete = React.useCallback(async (result) => {
+        if (!result.success) {
+            setState(prev => ({
+                ...prev,
+                status: 'error',
+                message: result.errors?.join('\n') || 'Build failed',
+                error: result.errors?.join('\n'),
+            }));
+            return;
+        }
+        try {
+            copyStaticToBuild(projectRoot);
+            const appId = getFullAppId(manifest.id);
+            await createBuildZip(projectRoot, appId);
+            await signAndDeploy(getZipPath(projectRoot, manifest), result.stats?.time);
+        }
+        catch (error) {
+            setState(prev => ({
+                ...prev,
+                status: 'error',
+                message: error instanceof Error ? error.message : String(error),
+                error: error instanceof Error ? error.message : String(error),
+            }));
+        }
+    }, [projectRoot, manifest, signAndDeploy]);
+    // Delegated path: full `sitevision-scripts build` then sign + deploy.
+    // Coalesces overlapping triggers so a save mid-build queues one rebuild.
+    const runDelegatedBuild = React.useCallback(async () => {
+        if (isBuildingRef.current) {
+            pendingRebuildRef.current = true;
+            return;
+        }
+        isBuildingRef.current = true;
+        const buildOnce = async () => {
+            pendingRebuildRef.current = false;
+            setState(prev => ({
+                ...prev,
+                status: 'building',
+                message: 'Building via sitevision-scripts...',
+            }));
+            const result = await runSitevisionScriptsBuild(projectRoot);
+            if (result.success) {
+                await signAndDeploy(getDelegatedZipPath(projectRoot, manifest.id));
+            }
+            else {
+                setState(prev => ({
+                    ...prev,
+                    status: 'error',
+                    message: result.error ?? 'Build failed',
+                    error: `${result.error}\n${result.output.slice(-1000)}`,
+                }));
+            }
+            if (pendingRebuildRef.current) {
+                await buildOnce();
+            }
+        };
+        try {
+            await buildOnce();
+        }
+        finally {
+            isBuildingRef.current = false;
+        }
+    }, [projectRoot, manifest, signAndDeploy]);
+    // Watch source files and trigger a delegated rebuild (debounced).
+    const startFileWatcher = React.useCallback(() => {
+        const targets = [
+            'src',
+            'static',
+            'i18n',
+            'resource',
+            'config',
+            'manifest.json',
+        ]
+            .map(name => path.join(projectRoot, name))
+            .filter(target => fs.existsSync(target));
+        for (const target of targets) {
+            const isDir = fs.statSync(target).isDirectory();
+            const watcher = fs.watch(target, { recursive: isDir }, () => {
+                if (debounceTimerRef.current) {
+                    clearTimeout(debounceTimerRef.current);
+                }
+                debounceTimerRef.current = setTimeout(() => {
+                    void runDelegatedBuild();
+                }, 300);
+            });
+            watchersRef.current.push(watcher);
+        }
+    }, [projectRoot, runDelegatedBuild]);
     React.useEffect(() => {
         const isBundled = isBundledApp(manifest);
         async function startWatch() {
             try {
                 // Clean build directory
                 cleanBuild(projectRoot);
-                if (isBundled) {
-                    // Check if webpack is available
+                if (isBundled && !hasLocalWebpackConfig(projectRoot)) {
+                    // No local webpack config: delegate each build to
+                    // sitevision-scripts (full rebuild) and watch source files
+                    // ourselves, keeping the CLI's own sign + deploy flow.
+                    if (!hasSitevisionScripts(projectRoot)) {
+                        setState({
+                            status: 'error',
+                            message: 'No webpack.config.js found and @sitevision/sitevision-scripts is not installed. Run npm install.',
+                            buildCount: 0,
+                            webpackReady: false,
+                            error: 'No build pipeline available',
+                        });
+                        return;
+                    }
+                    const warning = checkSitevisionScriptsCompatibility(projectRoot).warning;
+                    setState(prev => ({ ...prev, webpackReady: true, warning }));
+                    startFileWatcher();
+                    await runDelegatedBuild();
+                }
+                else if (isBundled) {
+                    // Project ships its own webpack config: incremental in-process watch.
                     if (!WebpackRunner.isWebpackAvailable(projectRoot)) {
                         setState({
                             status: 'error',
@@ -175,14 +276,30 @@ export function DevScreen({ projectRoot, manifest, devProperties, signed, signin
             if (webpackRunnerRef.current) {
                 webpackRunnerRef.current.close().catch(() => { });
             }
+            if (debounceTimerRef.current) {
+                clearTimeout(debounceTimerRef.current);
+            }
+            for (const watcher of watchersRef.current) {
+                watcher.close();
+            }
+            watchersRef.current = [];
         };
-    }, [projectRoot, manifest, handleBuildComplete]);
+    }, [
+        projectRoot,
+        manifest,
+        handleBuildComplete,
+        runDelegatedBuild,
+        startFileWatcher,
+    ]);
     // Handle Ctrl+C
     React.useEffect(() => {
         const handleExit = () => {
             if (webpackRunnerRef.current) {
                 webpackRunnerRef.current.close().catch(() => { });
             }
+            for (const watcher of watchersRef.current) {
+                watcher.close();
+            }
             exit();
         };
         process.on('SIGINT', handleExit);
@@ -220,7 +337,7 @@ export function DevScreen({ projectRoot, manifest, devProperties, signed, signin
                 return 'Error';
         }
     };
-    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(StatusIndicator, { status: getStatusType(), label: getStatusLabel(), message: state.message }) }), state.buildCount > 0 && (_jsx(Box, { marginLeft: 2, marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: ["Builds: ", state.buildCount, state.lastBuildTime
+    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(StatusIndicator, { status: getStatusType(), label: getStatusLabel(), message: state.message }) }), state.warning && (_jsx(Box, { marginBottom: 1, children: _jsxs(Text, { color: "yellow", children: ["\u26A0 ", state.warning] }) })), state.buildCount > 0 && (_jsx(Box, { marginLeft: 2, marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: ["Builds: ", state.buildCount, state.lastBuildTime
                             ? ` | Last build: ${state.lastBuildTime}ms`
                             : '', signed ? ' | Signed mode' : ''] }) })), _jsx(Box, { marginLeft: 2, marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: [manifest.name, " v", manifest.version] }) }), devProperties && (_jsx(Box, { marginLeft: 2, marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: ["Target: ", devProperties.domain, "/", devProperties.siteName, "/", devProperties.addonName] }) })), state.status === 'error' && state.error && (_jsx(Box, { flexDirection: "column", marginTop: 1, children: _jsx(Text, { color: "red", children: state.error }) })), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [state.status === 'error' && onRetryCredentials && (_jsx(Text, { dimColor: true, children: "Press r to retry with new credentials" })), onBack ? (_jsx(Text, { dimColor: true, children: "Press q or Esc to return to menu (Ctrl+C to stop process)" })) : (_jsx(Text, { dimColor: true, children: "Press Ctrl+C to stop" }))] })] }));
 }

package/dist/components/InfoScreen.js

@@ -1,12 +1,14 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { Box, Text, useInput } from 'ink';
 import { getAppType } from '../utils/project-detection.js';
+import { checkSitevisionScriptsCompatibility } from '../utils/sitevision-scripts-runner.js';
 export function InfoScreen({ project, onBack }) {
     const appType = getAppType(project.manifest);
+    const scriptsCompat = checkSitevisionScriptsCompatibility(project.root);
     useInput((input, key) => {
         if (key.escape || input === 'q' || key.return) {
             onBack();
         }
     });
-    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Sitevision Project Information" }) }), _jsxs(Box, { flexDirection: "column", marginLeft: 2, children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Name: " }), _jsx(Text, { children: project.manifest.name })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "ID: " }), _jsx(Text, { children: project.manifest.id })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Version: " }), _jsx(Text, { children: project.manifest.version })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Type: " }), _jsx(Text, { color: "green", children: project.manifest.type }), _jsxs(Text, { dimColor: true, children: [" (", appType, ")"] })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Bundled: " }), _jsx(Text, { children: project.manifest.bundled ? 'Yes' : 'No' })] })] }), project.hasDevProperties && project.devProperties && (_jsxs(_Fragment, { children: [_jsx(Box, { marginTop: 1, marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Development Configuration" }) }), _jsxs(Box, { flexDirection: "column", marginLeft: 2, children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Domain: " }), _jsx(Text, { children: project.devProperties.domain })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Site: " }), _jsx(Text, { children: project.devProperties.siteName })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Addon: " }), _jsx(Text, { children: project.devProperties.addonName })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Username: " }), _jsx(Text, { children: project.devProperties.username })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Use HTTP: " }), _jsx(Text, { children: project.devProperties.useHTTPForDevDeploy ? 'Yes' : 'No' })] })] })] })), !project.hasDevProperties && (_jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "yellow", children: "\u26A0 No dev properties found. Run setup-dev-properties to configure." }) })), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { bold: true, children: "Project Root: " }), _jsx(Text, { dimColor: true, children: project.root })] }), _jsx(Box, { marginTop: 2, children: _jsx(Text, { dimColor: true, children: "Press Enter or ESC to return to menu" }) })] }));
+    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Sitevision Project Information" }) }), _jsxs(Box, { flexDirection: "column", marginLeft: 2, children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Name: " }), _jsx(Text, { children: project.manifest.name })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "ID: " }), _jsx(Text, { children: project.manifest.id })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Version: " }), _jsx(Text, { children: project.manifest.version })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Type: " }), _jsx(Text, { color: "green", children: project.manifest.type }), _jsxs(Text, { dimColor: true, children: [" (", appType, ")"] })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Bundled: " }), _jsx(Text, { children: project.manifest.bundled ? 'Yes' : 'No' })] })] }), _jsx(Box, { marginTop: 1, marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Build Tooling" }) }), _jsxs(Box, { flexDirection: "column", marginLeft: 2, children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, children: "sitevision-scripts: " }), _jsx(Text, { children: scriptsCompat.installed ?? 'not installed' }), _jsxs(Text, { dimColor: true, children: [" (supported ", scriptsCompat.supportedRange, ")"] })] }), scriptsCompat.warning && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: "yellow", children: ["\u26A0 ", scriptsCompat.warning] }) }))] }), project.hasDevProperties && project.devProperties && (_jsxs(_Fragment, { children: [_jsx(Box, { marginTop: 1, marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Development Configuration" }) }), _jsxs(Box, { flexDirection: "column", marginLeft: 2, children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Domain: " }), _jsx(Text, { children: project.devProperties.domain })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Site: " }), _jsx(Text, { children: project.devProperties.siteName })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Addon: " }), _jsx(Text, { children: project.devProperties.addonName })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Username: " }), _jsx(Text, { children: project.devProperties.username })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Use HTTP: " }), _jsx(Text, { children: project.devProperties.useHTTPForDevDeploy ? 'Yes' : 'No' })] })] })] })), !project.hasDevProperties && (_jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "yellow", children: "\u26A0 No dev properties found. Run setup-dev-properties to configure." }) })), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { bold: true, children: "Project Root: " }), _jsx(Text, { dimColor: true, children: project.root })] }), _jsx(Box, { marginTop: 2, children: _jsx(Text, { dimColor: true, children: "Press Enter or ESC to return to menu" }) })] }));
 }

package/dist/utils/process-runner.d.ts

@@ -20,11 +20,3 @@ export declare class ProcessRunner extends EventEmitter {
     kill(): void;
     getOutput(): ProcessOutput[];
 }
-/**
- * Run a sitevision-scripts command in the project directory
- */
-export declare function runSitevisionScript(scriptName: string, args?: string[], projectRoot?: string): ProcessRunner;
-/**
- * Run an NPM script
- */
-export declare function runNpmScript(scriptName: string, args?: string[], projectRoot?: string, customEnv?: Record<string, string>): ProcessRunner;

package/dist/utils/process-runner.js

@@ -72,18 +72,3 @@ export class ProcessRunner extends EventEmitter {
         return this.output;
     }
 }
-/**
- * Run a sitevision-scripts command in the project directory
- */
-export function runSitevisionScript(scriptName, args = [], projectRoot) {
-    // Check if sitevision-scripts is available locally
-    const runner = new ProcessRunner('npm', ['run', scriptName, '--', ...args], projectRoot);
-    return runner;
-}
-/**
- * Run an NPM script
- */
-export function runNpmScript(scriptName, args = [], projectRoot, customEnv) {
-    const runner = new ProcessRunner('npm', ['run', scriptName, ...args], projectRoot, false, customEnv);
-    return runner;
-}

package/dist/utils/sitevision-api.d.ts

@@ -13,6 +13,38 @@ import type { SigningCredentials, DeployConfig, ProductionDeployConfig, SigningR
  * Create Basic Auth header value
  */
 declare function createBasicAuth(username: string, password: string): string;
+/**
+ * Make an HTTP/HTTPS request
+ */
+export declare function makeRequest(url: string, options: {
+    method: string;
+    headers?: Record<string, string>;
+    body?: Buffer;
+    auth?: {
+        username: string;
+        password: string;
+    };
+    timeoutMs?: number;
+}): Promise<{
+    statusCode: number;
+    body: Buffer;
+    headers: Record<string, string>;
+}>;
+/**
+ * Whether an HTTP status is worth retrying (transient server-side failures).
+ */
+export declare function isRetryableStatus(statusCode: number): boolean;
+/**
+ * Summarize a non-success response body for error messages.
+ * Avoids dumping raw bytes (e.g. an HTML error page or a binary blob) by
+ * trimming text bodies and labelling binary ones by their content type.
+ */
+export declare function summarizeErrorBody(body: Buffer, headers: Record<string, string>): string;
+/**
+ * Check that a buffer begins with the ZIP magic bytes. Used to fail fast when
+ * the signing endpoint returns an error page with HTTP 200.
+ */
+export declare function looksLikeZip(body: Buffer): boolean;
 /**
  * Sign an app via developer.sitevision.se
  *

package/dist/utils/sitevision-api.js

@@ -18,6 +18,12 @@ import { buildImportEndpointUrl, buildAddonEndpointUrl, } from './project-detect
 // =============================================================================
 const SIGNING_API_HOST = 'developer.sitevision.se';
 const SIGNING_API_PATH = '/rest-api/appsigner/signapp';
+/** Default per-request timeout. Generous because signing uploads a full zip. */
+const DEFAULT_TIMEOUT_MS = 120_000;
+/** Max attempts for transient failures (network errors, timeouts, 5xx). */
+const SIGN_MAX_ATTEMPTS = 3;
+/** Base backoff between retries; grows exponentially per attempt. */
+const RETRY_BASE_DELAY_MS = 1000;
 // =============================================================================
 // UTILITY FUNCTIONS
 // =============================================================================
@@ -56,7 +62,7 @@ function createMultipartFormData(filePath, fieldName, boundary) {
 /**
  * Make an HTTP/HTTPS request
  */
-function makeRequest(url, options) {
+export function makeRequest(url, options) {
     return new Promise((resolve, reject) => {
         const parsedUrl = new URL(url);
         const isHttps = parsedUrl.protocol === 'https:';
@@ -87,6 +93,10 @@ function makeRequest(url, options) {
                 });
             });
         });
+        // Abort hung connections instead of blocking the CLI indefinitely.
+        req.setTimeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS, () => {
+            req.destroy(new Error(`Request timed out after ${options.timeoutMs ?? DEFAULT_TIMEOUT_MS}ms`));
+        });
         req.on('error', reject);
         if (options.body) {
             req.write(options.body);
@@ -94,6 +104,47 @@ function makeRequest(url, options) {
         req.end();
     });
 }
+/**
+ * Whether an HTTP status is worth retrying (transient server-side failures).
+ */
+export function isRetryableStatus(statusCode) {
+    return statusCode === 408 || statusCode === 429 || statusCode >= 500;
+}
+/**
+ * Sleep helper for backoff between retries.
+ */
+async function delay(ms) {
+    return new Promise(resolve => {
+        setTimeout(resolve, ms);
+    });
+}
+/**
+ * Summarize a non-success response body for error messages.
+ * Avoids dumping raw bytes (e.g. an HTML error page or a binary blob) by
+ * trimming text bodies and labelling binary ones by their content type.
+ */
+export function summarizeErrorBody(body, headers) {
+    const contentType = headers['content-type'] ?? 'unknown';
+    const isText = contentType.includes('text') ||
+        contentType.includes('json') ||
+        contentType.includes('xml');
+    if (!isText) {
+        return `(${contentType}, ${body.length} bytes)`;
+    }
+    const text = body.toString('utf8').replaceAll(/\s+/g, ' ').trim();
+    const max = 300;
+    const summary = text.length > max ? text.slice(0, max) + '…' : text;
+    return summary.length > 0 ? summary : `(${contentType}, empty body)`;
+}
+/** ZIP local-file-header magic bytes: "PK\x03\x04". */
+const ZIP_MAGIC = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
+/**
+ * Check that a buffer begins with the ZIP magic bytes. Used to fail fast when
+ * the signing endpoint returns an error page with HTTP 200.
+ */
+export function looksLikeZip(body) {
+    return body.length >= 4 && body.subarray(0, 4).equals(ZIP_MAGIC);
+}
 // =============================================================================
 // SIGNING API
 // =============================================================================
@@ -120,48 +171,66 @@ export async function signApp(zipPath, credentials, outputPath) {
     // Create multipart form data
     const boundary = generateBoundary();
     const { body, contentType } = createMultipartFormData(zipPath, 'file', boundary);
-    try {
-        const response = await makeRequest(url, {
-            method: 'POST',
-            headers: {
-                'Content-Type': contentType,
-                'Content-Length': String(body.length),
-            },
-            body,
-            auth: {
-                username: credentials.username,
-                password: credentials.password,
-            },
-        });
-        if (response.statusCode === 200) {
-            // Write signed zip to output path
-            const outputDir = path.dirname(outputPath);
-            if (!fs.existsSync(outputDir)) {
-                fs.mkdirSync(outputDir, { recursive: true });
+    // Signing is idempotent (same input → same signed output), so transient
+    // failures (network errors, timeouts, 5xx) are safe to retry with backoff.
+    let lastError = 'Signing failed';
+    for (let attempt = 1; attempt <= SIGN_MAX_ATTEMPTS; attempt++) {
+        try {
+            const response = await makeRequest(url, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': contentType,
+                    'Content-Length': String(body.length),
+                },
+                body,
+                auth: {
+                    username: credentials.username,
+                    password: credentials.password,
+                },
+            });
+            if (response.statusCode === 200) {
+                // Guard against an error page returned with a 200 status.
+                if (!looksLikeZip(response.body)) {
+                    return {
+                        success: false,
+                        error: `Signing returned a non-zip response: ${summarizeErrorBody(response.body, response.headers)}`,
+                    };
+                }
+                // Write signed zip to output path
+                const outputDir = path.dirname(outputPath);
+                if (!fs.existsSync(outputDir)) {
+                    fs.mkdirSync(outputDir, { recursive: true });
+                }
+                fs.writeFileSync(outputPath, response.body);
+                return {
+                    success: true,
+                    signedFilePath: outputPath,
+                };
+            }
+            if (response.statusCode === 401) {
+                // Auth failures will not resolve on retry.
+                return {
+                    success: false,
+                    error: 'Unauthorized. Check username and password.',
+                };
+            }
+            lastError = `Signing failed with status ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`;
+            if (!isRetryableStatus(response.statusCode)) {
+                return { success: false, error: lastError };
             }
-            fs.writeFileSync(outputPath, response.body);
-            return {
-                success: true,
-                signedFilePath: outputPath,
-            };
         }
-        if (response.statusCode === 401) {
-            return {
-                success: false,
-                error: 'Unauthorized. Check username and password.',
-            };
+        catch (error) {
+            lastError = `Signing request failed: ${error instanceof Error ? error.message : String(error)}`;
+        }
+        // Back off before the next attempt (skip after the final attempt).
+        if (attempt < SIGN_MAX_ATTEMPTS) {
+            await delay(RETRY_BASE_DELAY_MS * 2 ** (attempt - 1));
         }
-        return {
-            success: false,
-            error: `Signing failed with status ${response.statusCode}: ${response.body.toString()}`,
-        };
-    }
-    catch (error) {
-        return {
-            success: false,
-            error: `Signing request failed: ${error instanceof Error ? error.message : String(error)}`,
-        };
     }
+    return {
+        success: false,
+        error: `${lastError} (after ${SIGN_MAX_ATTEMPTS} attempts)`,
+    };
 }
 // =============================================================================
 // DEPLOYMENT API
@@ -233,7 +302,7 @@ export async function deployApp(zipPath, config, appType, force = false) {
         }
         return {
             success: false,
-            error: `Deployment failed with status ${response.statusCode}: ${response.body.toString()}`,
+            error: `Deployment failed with status ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`,
         };
     }
     catch (error) {
@@ -330,7 +399,7 @@ export async function createAddon(config, appType) {
         }
         return {
             success: false,
-            error: `Create addon failed with status ${response.statusCode}: ${response.body.toString()}`,
+            error: `Create addon failed with status ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`,
         };
     }
     catch (error) {
@@ -377,7 +446,7 @@ export async function activateApp(executableId, config, _appType) {
         }
         return {
             success: false,
-            error: `Activation failed with status ${response.statusCode}: ${response.body.toString()}`,
+            error: `Activation failed with status ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`,
         };
     }
     catch (error) {

package/dist/utils/sitevision-scripts-runner.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Sitevision Scripts Runner
+ *
+ * Delegates the compile/build step to the official sitevision-scripts npm
+ * package when a project has no local webpack config of its own.
+ *
+ * Sitevision WebApp builds are tightly coupled to the platform runtime (a
+ * dual server/client multi-compiler, AMD externals for React and the sitevision
+ * api packages, an embedded ES5 server engine, and a precise addon zip layout).
+ * Rather than
+ * reproduce that contract — which lives in proprietary babel presets and an
+ * undocumented internal config — we shell out to the package's public CLI, which
+ * is the canonical, maintained source of that build pipeline.
+ *
+ * `sitevision-scripts build` runs build + zip + cleanup and writes the archive to
+ * `dist/<appId>.zip` — the exact path the CLI's own sign/deploy steps already use.
+ */
+/**
+ * Resolve the path to the sitevision-scripts CLI entry inside a project.
+ * Returns null if the package is not installed.
+ */
+export declare function getSitevisionScriptsBin(projectRoot: string): string | null;
+/**
+ * Whether the sitevision-scripts package is available in the project.
+ */
+export declare function hasSitevisionScripts(projectRoot: string): boolean;
+/**
+ * Path of the zip that `sitevision-scripts build` writes.
+ *
+ * IMPORTANT: this mirrors sitevision-scripts' own app-id convention
+ * (`APP_ID_PREFIX`/`APP_ID_SUFFIX` env vars + `dist/<appId>.zip`), which differs
+ * from the CLI's own `getZipPath` env vars (`SITEVISION_APP_ID_*`). For delegated
+ * builds the package is the one writing the file, so its convention is the source
+ * of truth — using `getZipPath` here would look for the wrong filename whenever a
+ * prefix/suffix is configured.
+ */
+export declare function getDelegatedZipPath(projectRoot: string, manifestId: string): string;
+/**
+ * Range of the sitevision-scripts package the CLI's build delegation has been
+ * validated against. The delegation depends on the package's CLI commands, its
+ * `dist/<appId>.zip` output, and the app-id convention — all stable within a
+ * major. A new major may change that contract, so we warn rather than assume.
+ *
+ * Bump these (and re-validate) when adopting a new sitevision-scripts major.
+ */
+export declare const SUPPORTED_SITEVISION_SCRIPTS_MIN = "8.0.0";
+/** Human-readable supported range, e.g. ">=8.0.0 <9.0.0". */
+export declare const SUPPORTED_SITEVISION_SCRIPTS_RANGE = ">=8.0.0 <9.0.0";
+export type SitevisionScriptsCompatStatus = 'ok' | 'too-old' | 'too-new' | 'not-installed' | 'unknown';
+export interface SitevisionScriptsCompat {
+    installed: string | null;
+    supportedRange: string;
+    status: SitevisionScriptsCompatStatus;
+    /** Populated for 'too-old'/'too-new' — a ready-to-display warning. */
+    warning?: string;
+}
+/**
+ * Read the installed sitevision-scripts version from the project, or null if it
+ * is not installed / unreadable.
+ */
+export declare function getSitevisionScriptsVersion(projectRoot: string): string | null;
+/**
+ * Check the project's installed sitevision-scripts against the supported range.
+ * Use the `warning` field to surface a message when the version has drifted.
+ */
+export declare function checkSitevisionScriptsCompatibility(projectRoot: string): SitevisionScriptsCompat;
+export interface SitevisionBuildResult {
+    success: boolean;
+    /** Combined stdout/stderr (tail-trimmed) for error reporting. */
+    output: string;
+    error?: string;
+}
+/**
+ * Run `sitevision-scripts build` (build + zip + cleanup) as a subprocess.
+ *
+ * The package's own webpack pipeline produces the deployable `dist/<appId>.zip`.
+ * Invoked via the current Node binary so it works cross-platform without relying
+ * on the `node_modules/.bin` shims or shell PATH resolution.
+ *
+ * @param projectRoot - Project root directory (used as cwd)
+ * @param onOutput - Optional callback for streaming output chunks
+ */
+export declare function runSitevisionScriptsBuild(projectRoot: string, onOutput?: (chunk: string) => void): Promise<SitevisionBuildResult>;

package/dist/utils/sitevision-scripts-runner.js

@@ -0,0 +1,187 @@
+/**
+ * Sitevision Scripts Runner
+ *
+ * Delegates the compile/build step to the official sitevision-scripts npm
+ * package when a project has no local webpack config of its own.
+ *
+ * Sitevision WebApp builds are tightly coupled to the platform runtime (a
+ * dual server/client multi-compiler, AMD externals for React and the sitevision
+ * api packages, an embedded ES5 server engine, and a precise addon zip layout).
+ * Rather than
+ * reproduce that contract — which lives in proprietary babel presets and an
+ * undocumented internal config — we shell out to the package's public CLI, which
+ * is the canonical, maintained source of that build pipeline.
+ *
+ * `sitevision-scripts build` runs build + zip + cleanup and writes the archive to
+ * `dist/<appId>.zip` — the exact path the CLI's own sign/deploy steps already use.
+ */
+import path from 'path';
+import fs from 'fs';
+import { spawn } from 'child_process';
+/**
+ * Resolve the path to the sitevision-scripts CLI entry inside a project.
+ * Returns null if the package is not installed.
+ */
+export function getSitevisionScriptsBin(projectRoot) {
+    const bin = path.join(projectRoot, 'node_modules', '@sitevision', 'sitevision-scripts', 'bin', 'sitevision-scripts.js');
+    return fs.existsSync(bin) ? bin : null;
+}
+/**
+ * Whether the sitevision-scripts package is available in the project.
+ */
+export function hasSitevisionScripts(projectRoot) {
+    return getSitevisionScriptsBin(projectRoot) !== null;
+}
+/**
+ * Path of the zip that `sitevision-scripts build` writes.
+ *
+ * IMPORTANT: this mirrors sitevision-scripts' own app-id convention
+ * (`APP_ID_PREFIX`/`APP_ID_SUFFIX` env vars + `dist/<appId>.zip`), which differs
+ * from the CLI's own `getZipPath` env vars (`SITEVISION_APP_ID_*`). For delegated
+ * builds the package is the one writing the file, so its convention is the source
+ * of truth — using `getZipPath` here would look for the wrong filename whenever a
+ * prefix/suffix is configured.
+ */
+export function getDelegatedZipPath(projectRoot, manifestId) {
+    const prefix = process.env['APP_ID_PREFIX'] ?? '';
+    const suffix = process.env['APP_ID_SUFFIX'] ?? '';
+    const appId = `${prefix}${manifestId}${suffix}`;
+    return path.join(projectRoot, 'dist', `${appId}.zip`);
+}
+// =============================================================================
+// VERSION COMPATIBILITY
+// =============================================================================
+/**
+ * Range of the sitevision-scripts package the CLI's build delegation has been
+ * validated against. The delegation depends on the package's CLI commands, its
+ * `dist/<appId>.zip` output, and the app-id convention — all stable within a
+ * major. A new major may change that contract, so we warn rather than assume.
+ *
+ * Bump these (and re-validate) when adopting a new sitevision-scripts major.
+ */
+export const SUPPORTED_SITEVISION_SCRIPTS_MIN = '8.0.0';
+const SUPPORTED_SITEVISION_SCRIPTS_MAX_EXCLUSIVE_MAJOR = 9;
+/** Human-readable supported range, e.g. ">=8.0.0 <9.0.0". */
+export const SUPPORTED_SITEVISION_SCRIPTS_RANGE = `>=${SUPPORTED_SITEVISION_SCRIPTS_MIN} <${SUPPORTED_SITEVISION_SCRIPTS_MAX_EXCLUSIVE_MAJOR}.0.0`;
+/**
+ * Read the installed sitevision-scripts version from the project, or null if it
+ * is not installed / unreadable.
+ */
+export function getSitevisionScriptsVersion(projectRoot) {
+    const packageJsonPath = path.join(projectRoot, 'node_modules', '@sitevision', 'sitevision-scripts', 'package.json');
+    try {
+        const parsed = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+        return parsed.version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Parse a semver string into [major, minor, patch], ignoring any prerelease
+ * suffix. Returns null if it does not look like a version.
+ */
+function parseVersion(version) {
+    const match = /^(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)/.exec(version);
+    if (!match?.groups) {
+        return null;
+    }
+    return [
+        Number(match.groups['major']),
+        Number(match.groups['minor']),
+        Number(match.groups['patch']),
+    ];
+}
+/**
+ * Compare two parsed versions: negative if a < b, 0 if equal, positive if a > b.
+ */
+function compareVersions(a, b) {
+    return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+}
+/**
+ * Check the project's installed sitevision-scripts against the supported range.
+ * Use the `warning` field to surface a message when the version has drifted.
+ */
+export function checkSitevisionScriptsCompatibility(projectRoot) {
+    const installed = getSitevisionScriptsVersion(projectRoot);
+    const supportedRange = SUPPORTED_SITEVISION_SCRIPTS_RANGE;
+    if (!installed) {
+        return {
+            installed: null,
+            supportedRange,
+            status: hasSitevisionScripts(projectRoot) ? 'unknown' : 'not-installed',
+        };
+    }
+    const parsed = parseVersion(installed);
+    if (!parsed) {
+        return { installed, supportedRange, status: 'unknown' };
+    }
+    if (compareVersions(parsed, parseVersion(SUPPORTED_SITEVISION_SCRIPTS_MIN)) < 0) {
+        return {
+            installed,
+            supportedRange,
+            status: 'too-old',
+            warning: `@sitevision/sitevision-scripts ${installed} is older than the supported range (${supportedRange}). Update it in your project: npm install @sitevision/sitevision-scripts@latest`,
+        };
+    }
+    if (parsed[0] >= SUPPORTED_SITEVISION_SCRIPTS_MAX_EXCLUSIVE_MAJOR) {
+        return {
+            installed,
+            supportedRange,
+            status: 'too-new',
+            warning: `@sitevision/sitevision-scripts ${installed} is newer than the range this CLI was validated against (${supportedRange}). The build may still work; update sitevision-cli if you hit problems.`,
+        };
+    }
+    return { installed, supportedRange, status: 'ok' };
+}
+/** Keep at most this many trailing characters of build output in memory. */
+const MAX_OUTPUT_CHARS = 50_000;
+/**
+ * Run `sitevision-scripts build` (build + zip + cleanup) as a subprocess.
+ *
+ * The package's own webpack pipeline produces the deployable `dist/<appId>.zip`.
+ * Invoked via the current Node binary so it works cross-platform without relying
+ * on the `node_modules/.bin` shims or shell PATH resolution.
+ *
+ * @param projectRoot - Project root directory (used as cwd)
+ * @param onOutput - Optional callback for streaming output chunks
+ */
+export async function runSitevisionScriptsBuild(projectRoot, onOutput) {
+    const bin = getSitevisionScriptsBin(projectRoot);
+    if (!bin) {
+        return {
+            success: false,
+            output: '',
+            error: '@sitevision/sitevision-scripts not found in project. Run npm install.',
+        };
+    }
+    return new Promise(resolve => {
+        let output = '';
+        const child = spawn(process.execPath, [bin, 'build'], {
+            cwd: projectRoot,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        const handleData = (data) => {
+            const text = data.toString();
+            output += text;
+            if (output.length > MAX_OUTPUT_CHARS) {
+                output = output.slice(-MAX_OUTPUT_CHARS);
+            }
+            onOutput?.(text);
+        };
+        child.stdout?.on('data', handleData);
+        child.stderr?.on('data', handleData);
+        child.on('error', error => {
+            resolve({ success: false, output, error: error.message });
+        });
+        child.on('close', code => {
+            resolve({
+                success: code === 0,
+                output,
+                error: code === 0
+                    ? undefined
+                    : `sitevision-scripts build exited with code ${code}`,
+            });
+        });
+    });
+}

package/dist/utils/webpack-runner.d.ts

@@ -5,6 +5,15 @@
  * Dynamically loads webpack from the target project's node_modules.
  */
 import type { BuildOptions, BuildResult } from '../types/index.js';
+/**
+ * Find the project's own webpack config, or null if it has none.
+ */
+export declare function findLocalWebpackConfig(projectRoot: string): string | null;
+/**
+ * Whether the project ships its own webpack config (in-house build path),
+ * as opposed to relying on the sitevision-scripts package.
+ */
+export declare function hasLocalWebpackConfig(projectRoot: string): boolean;
 export declare class WebpackRunner {
     private webpack;
     private config;

package/dist/utils/webpack-runner.js

@@ -9,6 +9,32 @@ import fs from 'fs';
 import { createRequire } from 'module';
 import { copyChunksToResources } from './zip.js';
 // =============================================================================
+// LOCAL CONFIG DETECTION
+// =============================================================================
+/**
+ * Standard locations for a project-local webpack config, highest priority first.
+ */
+function localWebpackConfigPaths(projectRoot) {
+    return [
+        path.join(projectRoot, 'webpack.config.js'),
+        path.join(projectRoot, 'webpack.config.mjs'),
+        path.join(projectRoot, 'config', 'webpack', 'webpack.config.js'),
+    ];
+}
+/**
+ * Find the project's own webpack config, or null if it has none.
+ */
+export function findLocalWebpackConfig(projectRoot) {
+    return (localWebpackConfigPaths(projectRoot).find(p => fs.existsSync(p)) ?? null);
+}
+/**
+ * Whether the project ships its own webpack config (in-house build path),
+ * as opposed to relying on the sitevision-scripts package.
+ */
+export function hasLocalWebpackConfig(projectRoot) {
+    return findLocalWebpackConfig(projectRoot) !== null;
+}
+// =============================================================================
 // WEBPACK RUNNER CLASS
 // =============================================================================
 export class WebpackRunner {
@@ -49,21 +75,10 @@ export class WebpackRunner {
      * Load webpack configuration from the project
      */
     async loadConfig() {
-        // Try to find webpack config in standard locations
-        // Project-specific configs take priority, fall back to @sitevision/sitevision-scripts
-        const configPaths = [
-            path.join(this.projectRoot, 'webpack.config.js'),
-            path.join(this.projectRoot, 'webpack.config.mjs'),
-            path.join(this.projectRoot, 'config', 'webpack', 'webpack.config.js'),
-            path.join(this.projectRoot, 'node_modules', '@sitevision', 'sitevision-scripts', 'config', 'webpack', 'webpack.config.js'),
-        ];
-        let configPath = null;
-        for (const p of configPaths) {
-            if (fs.existsSync(p)) {
-                configPath = p;
-                break;
-            }
-        }
+        // Only project-local webpack configs are consumed in-process. Projects
+        // without one are built by delegating to @sitevision/sitevision-scripts
+        // (see sitevision-scripts-runner), so there is no config fallback here.
+        const configPath = findLocalWebpackConfig(this.projectRoot);
         if (!configPath) {
             throw new Error('webpack.config.js not found. Make sure your project has a webpack configuration.');
         }

package/dist/utils/zip.d.ts

@@ -5,10 +5,17 @@
  * Also handles webpack chunk organization.
  */
 /**
- * Create a zip archive of a directory
+ * Create a zip archive of a directory.
  *
- * Uses the system `zip` command for cross-platform compatibility.
- * Falls back to a basic implementation if zip is not available.
+ * In-house, dependency-free implementation: walks the directory, deflates each
+ * file with Node's built-in zlib, and assembles a standard ZIP container (local
+ * file headers + central directory + end-of-central-directory record). This
+ * removes the previous reliance on the external `zip`/`tar`/PowerShell binaries
+ * and behaves identically across macOS, Linux, and Windows.
+ *
+ * Mirrors `zip -r <out> .` run from inside `sourceDir`: archive paths are
+ * relative to `sourceDir`, use forward slashes, and directory entries are
+ * emitted so empty directories are preserved.
  *
  * @param sourceDir - Directory to zip
  * @param outputPath - Path for the output zip file

package/dist/utils/zip.js

@@ -6,16 +6,23 @@
  */
 import fs from 'fs';
 import path from 'path';
-import { spawn } from 'child_process';
+import zlib from 'zlib';
 import { ensureDistDir } from './project-detection.js';
 // =============================================================================
 // ZIP CREATION
 // =============================================================================
 /**
- * Create a zip archive of a directory
+ * Create a zip archive of a directory.
  *
- * Uses the system `zip` command for cross-platform compatibility.
- * Falls back to a basic implementation if zip is not available.
+ * In-house, dependency-free implementation: walks the directory, deflates each
+ * file with Node's built-in zlib, and assembles a standard ZIP container (local
+ * file headers + central directory + end-of-central-directory record). This
+ * removes the previous reliance on the external `zip`/`tar`/PowerShell binaries
+ * and behaves identically across macOS, Linux, and Windows.
+ *
+ * Mirrors `zip -r <out> .` run from inside `sourceDir`: archive paths are
+ * relative to `sourceDir`, use forward slashes, and directory entries are
+ * emitted so empty directories are preserved.
  *
  * @param sourceDir - Directory to zip
  * @param outputPath - Path for the output zip file
@@ -31,77 +38,182 @@ export async function createZip(sourceDir, outputPath) {
     if (fs.existsSync(outputPath)) {
         fs.unlinkSync(outputPath);
     }
-    return new Promise((resolve, reject) => {
-        // Try using system zip command (works on macOS, Linux, and Windows with Git Bash)
-        const zipProcess = spawn('zip', ['-r', outputPath, '.'], {
-            cwd: sourceDir,
-            stdio: ['ignore', 'pipe', 'pipe'],
-        });
-        let stderr = '';
-        zipProcess.stderr?.on('data', (data) => {
-            stderr += data.toString();
-        });
-        zipProcess.on('error', error => {
-            // If zip command not found, try alternative methods
-            if (error.code === 'ENOENT') {
-                // Fall back to tar on systems without zip
-                createZipWithTar(sourceDir, outputPath).then(resolve).catch(reject);
-            }
-            else {
-                reject(new Error(`Zip process error: ${error.message}`));
-            }
-        });
-        zipProcess.on('close', code => {
-            if (code === 0) {
-                resolve(outputPath);
+    const entries = collectZipEntries(sourceDir);
+    const buffer = await buildZipBuffer(entries);
+    fs.writeFileSync(outputPath, buffer);
+    return outputPath;
+}
+/**
+ * Recursively collect file and directory entries for the archive.
+ * Directories are emitted before their contents, matching `zip -r`.
+ */
+function collectZipEntries(sourceDir) {
+    const entries = [];
+    const walk = (dir, prefix) => {
+        const dirEntries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const entry of dirEntries) {
+            const absolutePath = path.join(dir, entry.name);
+            const archiveName = prefix + entry.name;
+            if (entry.isDirectory()) {
+                const stat = fs.statSync(absolutePath);
+                entries.push({
+                    name: archiveName + '/',
+                    isDirectory: true,
+                    mtime: stat.mtime,
+                });
+                walk(absolutePath, archiveName + '/');
             }
-            else {
-                reject(new Error(`Zip failed with code ${code}: ${stderr}`));
+            else if (entry.isFile()) {
+                const stat = fs.statSync(absolutePath);
+                entries.push({
+                    name: archiveName,
+                    isDirectory: false,
+                    absolutePath,
+                    mtime: stat.mtime,
+                });
             }
-        });
-    });
+            // Symlinks and special files are skipped (matches prior `zip` defaults
+            // closely enough for Sitevision build output, which has neither).
+        }
+    };
+    walk(sourceDir, '');
+    return entries;
 }
 /**
- * Fallback: Create zip using tar (converts to zip format)
- * This is a fallback for systems without the zip command.
+ * Assemble the full ZIP byte buffer from collected entries.
  */
-async function createZipWithTar(sourceDir, outputPath) {
-    // On Windows without zip, we might need to use PowerShell
-    const isWindows = process.platform === 'win32';
-    if (isWindows) {
-        return createZipWithPowerShell(sourceDir, outputPath);
+async function buildZipBuffer(entries) {
+    const localChunks = [];
+    const centralChunks = [];
+    let offset = 0;
+    for (const entry of entries) {
+        const nameBuffer = Buffer.from(entry.name, 'utf8');
+        const { dosTime, dosDate } = toDosDateTime(entry.mtime);
+        let rawData;
+        let compressed;
+        let method;
+        if (entry.isDirectory) {
+            rawData = Buffer.alloc(0);
+            compressed = Buffer.alloc(0);
+            method = 0; // stored
+        }
+        else {
+            rawData = fs.readFileSync(entry.absolutePath);
+            if (rawData.length === 0) {
+                compressed = Buffer.alloc(0);
+                method = 0; // stored (deflating empty data is wasteful)
+            }
+            else {
+                compressed = await deflateRaw(rawData);
+                method = 8; // deflate
+            }
+        }
+        const crc = crc32(rawData);
+        const localHeaderOffset = offset;
+        // Local file header (signature 0x04034b50)
+        const localHeader = Buffer.alloc(30);
+        localHeader.writeUInt32LE(0x04034b50, 0);
+        localHeader.writeUInt16LE(20, 4); // version needed to extract
+        localHeader.writeUInt16LE(0, 6); // general purpose flag
+        localHeader.writeUInt16LE(method, 8);
+        localHeader.writeUInt16LE(dosTime, 10);
+        localHeader.writeUInt16LE(dosDate, 12);
+        localHeader.writeUInt32LE(crc, 14);
+        localHeader.writeUInt32LE(compressed.length, 18);
+        localHeader.writeUInt32LE(rawData.length, 22);
+        localHeader.writeUInt16LE(nameBuffer.length, 26);
+        localHeader.writeUInt16LE(0, 28); // extra field length
+        localChunks.push(localHeader, nameBuffer, compressed);
+        offset += localHeader.length + nameBuffer.length + compressed.length;
+        // Central directory header (signature 0x02014b50)
+        const centralHeader = Buffer.alloc(46);
+        centralHeader.writeUInt32LE(0x02014b50, 0);
+        centralHeader.writeUInt16LE(20, 4); // version made by
+        centralHeader.writeUInt16LE(20, 6); // version needed
+        centralHeader.writeUInt16LE(0, 8); // general purpose flag
+        centralHeader.writeUInt16LE(method, 10);
+        centralHeader.writeUInt16LE(dosTime, 12);
+        centralHeader.writeUInt16LE(dosDate, 14);
+        centralHeader.writeUInt32LE(crc, 16);
+        centralHeader.writeUInt32LE(compressed.length, 20);
+        centralHeader.writeUInt32LE(rawData.length, 24);
+        centralHeader.writeUInt16LE(nameBuffer.length, 28);
+        centralHeader.writeUInt16LE(0, 30); // extra field length
+        centralHeader.writeUInt16LE(0, 32); // comment length
+        centralHeader.writeUInt16LE(0, 34); // disk number start
+        centralHeader.writeUInt16LE(0, 36); // internal attributes
+        // External attributes: directory vs file unix-ish mode in high bytes.
+        centralHeader.writeUInt32LE(entry.isDirectory ? 0x41ed0010 : 0x81a40000, 38);
+        centralHeader.writeUInt32LE(localHeaderOffset, 42);
+        centralChunks.push(centralHeader, nameBuffer);
     }
-    // On Unix without zip, this is unlikely but we'll throw an error
-    throw new Error('zip command not found. Please install zip: apt-get install zip (Linux) or brew install zip (macOS)');
+    const centralDirectory = Buffer.concat(centralChunks);
+    const centralDirectoryOffset = offset;
+    // End of central directory record (signature 0x06054b50)
+    const eocd = Buffer.alloc(22);
+    eocd.writeUInt32LE(0x06054b50, 0);
+    eocd.writeUInt16LE(0, 4); // disk number
+    eocd.writeUInt16LE(0, 6); // disk with central directory
+    eocd.writeUInt16LE(entries.length, 8); // entries on this disk
+    eocd.writeUInt16LE(entries.length, 10); // total entries
+    eocd.writeUInt32LE(centralDirectory.length, 12);
+    eocd.writeUInt32LE(centralDirectoryOffset, 16);
+    eocd.writeUInt16LE(0, 20); // comment length
+    return Buffer.concat([...localChunks, centralDirectory, eocd]);
 }
 /**
- * Create zip using PowerShell on Windows
+ * Deflate (raw, no zlib header) a buffer.
  */
-async function createZipWithPowerShell(sourceDir, outputPath) {
+async function deflateRaw(data) {
     return new Promise((resolve, reject) => {
-        const absoluteSourceDir = path.resolve(sourceDir);
-        const absoluteOutputPath = path.resolve(outputPath);
-        const command = `Compress-Archive -Path "${absoluteSourceDir}\\*" -DestinationPath "${absoluteOutputPath}" -Force`;
-        const psProcess = spawn('powershell', ['-Command', command], {
-            stdio: ['ignore', 'pipe', 'pipe'],
-        });
-        let stderr = '';
-        psProcess.stderr?.on('data', (data) => {
-            stderr += data.toString();
-        });
-        psProcess.on('error', error => {
-            reject(new Error(`PowerShell error: ${error.message}`));
-        });
-        psProcess.on('close', code => {
-            if (code === 0) {
-                resolve(absoluteOutputPath);
+        zlib.deflateRaw(data, (error, result) => {
+            if (error) {
+                reject(error);
             }
             else {
-                reject(new Error(`PowerShell zip failed with code ${code}: ${stderr}`));
+                resolve(result);
             }
         });
     });
 }
+/**
+ * Convert a Date to DOS date/time fields used by the ZIP format.
+ * ZIP timestamps only span 1980–2107 with 2-second resolution.
+ */
+function toDosDateTime(date) {
+    const year = date.getFullYear();
+    if (year < 1980) {
+        // Clamp to the ZIP epoch (1980-01-01 00:00:00).
+        return { dosTime: 0, dosDate: (1 << 5) | 1 };
+    }
+    const dosTime = (date.getHours() << 11) |
+        (date.getMinutes() << 5) |
+        Math.floor(date.getSeconds() / 2);
+    const dosDate = ((year - 1980) << 9) | ((date.getMonth() + 1) << 5) | date.getDate();
+    return { dosTime, dosDate };
+}
+// CRC-32 table (IEEE polynomial 0xEDB88320), built once and reused.
+const crc32Table = (() => {
+    const table = new Uint32Array(256);
+    for (let n = 0; n < 256; n++) {
+        let c = n;
+        for (let k = 0; k < 8; k++) {
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        }
+        table[n] = c >>> 0;
+    }
+    return table;
+})();
+/**
+ * Compute the CRC-32 checksum of a buffer.
+ */
+function crc32(data) {
+    let crc = 0xffffffff;
+    for (const byte of data) {
+        crc = crc32Table[(crc ^ byte) & 0xff] ^ (crc >>> 8);
+    }
+    return (crc ^ 0xffffffff) >>> 0;
+}
 /**
  * Create a zip of the build directory for deployment
  *

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sitevision-cli",
-	"version": "0.4.0-beta.2",
+	"version": "0.5.0-beta.0",
 	"license": "MIT",
 	"bin": {
 		"svc": "dist/cli.js"