sitevision-cli 0.4.0-beta.2 → 0.6.0-beta.0

package/dist/utils/sitevision-api.js

@@ -18,6 +18,12 @@ import { buildImportEndpointUrl, buildAddonEndpointUrl, } from './project-detect
 // =============================================================================
 const SIGNING_API_HOST = 'developer.sitevision.se';
 const SIGNING_API_PATH = '/rest-api/appsigner/signapp';
+/** Default per-request timeout. Generous because signing uploads a full zip. */
+const DEFAULT_TIMEOUT_MS = 120_000;
+/** Max attempts for transient failures (network errors, timeouts, 5xx). */
+const SIGN_MAX_ATTEMPTS = 3;
+/** Base backoff between retries; grows exponentially per attempt. */
+const RETRY_BASE_DELAY_MS = 1000;
 // =============================================================================
 // UTILITY FUNCTIONS
 // =============================================================================
@@ -56,7 +62,7 @@ function createMultipartFormData(filePath, fieldName, boundary) {
 /**
  * Make an HTTP/HTTPS request
  */
-function makeRequest(url, options) {
+export function makeRequest(url, options) {
     return new Promise((resolve, reject) => {
         const parsedUrl = new URL(url);
         const isHttps = parsedUrl.protocol === 'https:';
@@ -87,6 +93,10 @@ function makeRequest(url, options) {
                 });
             });
         });
+        // Abort hung connections instead of blocking the CLI indefinitely.
+        req.setTimeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS, () => {
+            req.destroy(new Error(`Request timed out after ${options.timeoutMs ?? DEFAULT_TIMEOUT_MS}ms`));
+        });
         req.on('error', reject);
         if (options.body) {
             req.write(options.body);
@@ -94,6 +104,47 @@ function makeRequest(url, options) {
         req.end();
     });
 }
+/**
+ * Whether an HTTP status is worth retrying (transient server-side failures).
+ */
+export function isRetryableStatus(statusCode) {
+    return statusCode === 408 || statusCode === 429 || statusCode >= 500;
+}
+/**
+ * Sleep helper for backoff between retries.
+ */
+async function delay(ms) {
+    return new Promise(resolve => {
+        setTimeout(resolve, ms);
+    });
+}
+/**
+ * Summarize a non-success response body for error messages.
+ * Avoids dumping raw bytes (e.g. an HTML error page or a binary blob) by
+ * trimming text bodies and labelling binary ones by their content type.
+ */
+export function summarizeErrorBody(body, headers) {
+    const contentType = headers['content-type'] ?? 'unknown';
+    const isText = contentType.includes('text') ||
+        contentType.includes('json') ||
+        contentType.includes('xml');
+    if (!isText) {
+        return `(${contentType}, ${body.length} bytes)`;
+    }
+    const text = body.toString('utf8').replaceAll(/\s+/g, ' ').trim();
+    const max = 300;
+    const summary = text.length > max ? text.slice(0, max) + '…' : text;
+    return summary.length > 0 ? summary : `(${contentType}, empty body)`;
+}
+/** ZIP local-file-header magic bytes: "PK\x03\x04". */
+const ZIP_MAGIC = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
+/**
+ * Check that a buffer begins with the ZIP magic bytes. Used to fail fast when
+ * the signing endpoint returns an error page with HTTP 200.
+ */
+export function looksLikeZip(body) {
+    return body.length >= 4 && body.subarray(0, 4).equals(ZIP_MAGIC);
+}
 // =============================================================================
 // SIGNING API
 // =============================================================================
@@ -120,48 +171,66 @@ export async function signApp(zipPath, credentials, outputPath) {
     // Create multipart form data
     const boundary = generateBoundary();
     const { body, contentType } = createMultipartFormData(zipPath, 'file', boundary);
-    try {
-        const response = await makeRequest(url, {
-            method: 'POST',
-            headers: {
-                'Content-Type': contentType,
-                'Content-Length': String(body.length),
-            },
-            body,
-            auth: {
-                username: credentials.username,
-                password: credentials.password,
-            },
-        });
-        if (response.statusCode === 200) {
-            // Write signed zip to output path
-            const outputDir = path.dirname(outputPath);
-            if (!fs.existsSync(outputDir)) {
-                fs.mkdirSync(outputDir, { recursive: true });
+    // Signing is idempotent (same input → same signed output), so transient
+    // failures (network errors, timeouts, 5xx) are safe to retry with backoff.
+    let lastError = 'Signing failed';
+    for (let attempt = 1; attempt <= SIGN_MAX_ATTEMPTS; attempt++) {
+        try {
+            const response = await makeRequest(url, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': contentType,
+                    'Content-Length': String(body.length),
+                },
+                body,
+                auth: {
+                    username: credentials.username,
+                    password: credentials.password,
+                },
+            });
+            if (response.statusCode === 200) {
+                // Guard against an error page returned with a 200 status.
+                if (!looksLikeZip(response.body)) {
+                    return {
+                        success: false,
+                        error: `Signing returned a non-zip response: ${summarizeErrorBody(response.body, response.headers)}`,
+                    };
+                }
+                // Write signed zip to output path
+                const outputDir = path.dirname(outputPath);
+                if (!fs.existsSync(outputDir)) {
+                    fs.mkdirSync(outputDir, { recursive: true });
+                }
+                fs.writeFileSync(outputPath, response.body);
+                return {
+                    success: true,
+                    signedFilePath: outputPath,
+                };
+            }
+            if (response.statusCode === 401) {
+                // Auth failures will not resolve on retry.
+                return {
+                    success: false,
+                    error: 'Unauthorized. Check username and password.',
+                };
+            }
+            lastError = `Signing failed with status ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`;
+            if (!isRetryableStatus(response.statusCode)) {
+                return { success: false, error: lastError };
             }
-            fs.writeFileSync(outputPath, response.body);
-            return {
-                success: true,
-                signedFilePath: outputPath,
-            };
         }
-        if (response.statusCode === 401) {
-            return {
-                success: false,
-                error: 'Unauthorized. Check username and password.',
-            };
+        catch (error) {
+            lastError = `Signing request failed: ${error instanceof Error ? error.message : String(error)}`;
+        }
+        // Back off before the next attempt (skip after the final attempt).
+        if (attempt < SIGN_MAX_ATTEMPTS) {
+            await delay(RETRY_BASE_DELAY_MS * 2 ** (attempt - 1));
         }
-        return {
-            success: false,
-            error: `Signing failed with status ${response.statusCode}: ${response.body.toString()}`,
-        };
-    }
-    catch (error) {
-        return {
-            success: false,
-            error: `Signing request failed: ${error instanceof Error ? error.message : String(error)}`,
-        };
     }
+    return {
+        success: false,
+        error: `${lastError} (after ${SIGN_MAX_ATTEMPTS} attempts)`,
+    };
 }
 // =============================================================================
 // DEPLOYMENT API
@@ -233,7 +302,7 @@ export async function deployApp(zipPath, config, appType, force = false) {
         }
         return {
             success: false,
-            error: `Deployment failed with status ${response.statusCode}: ${response.body.toString()}`,
+            error: `Deployment failed with status ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`,
         };
     }
     catch (error) {
@@ -330,7 +399,7 @@ export async function createAddon(config, appType) {
         }
         return {
             success: false,
-            error: `Create addon failed with status ${response.statusCode}: ${response.body.toString()}`,
+            error: `Create addon failed with status ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`,
         };
     }
     catch (error) {
@@ -377,7 +446,7 @@ export async function activateApp(executableId, config, _appType) {
         }
         return {
             success: false,
-            error: `Activation failed with status ${response.statusCode}: ${response.body.toString()}`,
+            error: `Activation failed with status ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`,
         };
     }
     catch (error) {

package/dist/utils/sitevision-scripts-runner.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Sitevision Scripts Runner
+ *
+ * Delegates the compile/build step to the official sitevision-scripts npm
+ * package when a project has no local webpack config of its own.
+ *
+ * Sitevision WebApp builds are tightly coupled to the platform runtime (a
+ * dual server/client multi-compiler, AMD externals for React and the sitevision
+ * api packages, an embedded ES5 server engine, and a precise addon zip layout).
+ * Rather than
+ * reproduce that contract — which lives in proprietary babel presets and an
+ * undocumented internal config — we shell out to the package's public CLI, which
+ * is the canonical, maintained source of that build pipeline.
+ *
+ * `sitevision-scripts build` runs build + zip + cleanup and writes the archive to
+ * `dist/<appId>.zip` — the exact path the CLI's own sign/deploy steps already use.
+ */
+/**
+ * Resolve the path to the sitevision-scripts CLI entry inside a project.
+ * Returns null if the package is not installed.
+ */
+export declare function getSitevisionScriptsBin(projectRoot: string): string | null;
+/**
+ * Whether the sitevision-scripts package is available in the project.
+ */
+export declare function hasSitevisionScripts(projectRoot: string): boolean;
+/**
+ * Path of the zip that `sitevision-scripts build` writes.
+ *
+ * IMPORTANT: this mirrors sitevision-scripts' own app-id convention
+ * (`APP_ID_PREFIX`/`APP_ID_SUFFIX` env vars + `dist/<appId>.zip`), which differs
+ * from the CLI's own `getZipPath` env vars (`SITEVISION_APP_ID_*`). For delegated
+ * builds the package is the one writing the file, so its convention is the source
+ * of truth — using `getZipPath` here would look for the wrong filename whenever a
+ * prefix/suffix is configured.
+ */
+export declare function getDelegatedZipPath(projectRoot: string, manifestId: string): string;
+/**
+ * Range of the sitevision-scripts package the CLI's build delegation has been
+ * validated against. The delegation depends on the package's CLI commands, its
+ * `dist/<appId>.zip` output, and the app-id convention — all stable within a
+ * major. A new major may change that contract, so we warn rather than assume.
+ *
+ * Bump these (and re-validate) when adopting a new sitevision-scripts major.
+ */
+export declare const SUPPORTED_SITEVISION_SCRIPTS_MIN = "8.0.0";
+/** Human-readable supported range, e.g. ">=8.0.0 <9.0.0". */
+export declare const SUPPORTED_SITEVISION_SCRIPTS_RANGE = ">=8.0.0 <9.0.0";
+export type SitevisionScriptsCompatStatus = 'ok' | 'too-old' | 'too-new' | 'not-installed' | 'unknown';
+export interface SitevisionScriptsCompat {
+    installed: string | null;
+    supportedRange: string;
+    status: SitevisionScriptsCompatStatus;
+    /** Populated for 'too-old'/'too-new' — a ready-to-display warning. */
+    warning?: string;
+}
+/**
+ * Read the installed sitevision-scripts version from the project, or null if it
+ * is not installed / unreadable.
+ */
+export declare function getSitevisionScriptsVersion(projectRoot: string): string | null;
+/**
+ * Check the project's installed sitevision-scripts against the supported range.
+ * Use the `warning` field to surface a message when the version has drifted.
+ */
+export declare function checkSitevisionScriptsCompatibility(projectRoot: string): SitevisionScriptsCompat;
+export interface SitevisionBuildResult {
+    success: boolean;
+    /** Combined stdout/stderr (tail-trimmed) for error reporting. */
+    output: string;
+    error?: string;
+}
+/**
+ * Run `sitevision-scripts build` (build + zip + cleanup) as a subprocess.
+ *
+ * The package's own webpack pipeline produces the deployable `dist/<appId>.zip`.
+ * Invoked via the current Node binary so it works cross-platform without relying
+ * on the `node_modules/.bin` shims or shell PATH resolution.
+ *
+ * @param projectRoot - Project root directory (used as cwd)
+ * @param onOutput - Optional callback for streaming output chunks
+ */
+export declare function runSitevisionScriptsBuild(projectRoot: string, onOutput?: (chunk: string) => void): Promise<SitevisionBuildResult>;

package/dist/utils/sitevision-scripts-runner.js

@@ -0,0 +1,187 @@
+/**
+ * Sitevision Scripts Runner
+ *
+ * Delegates the compile/build step to the official sitevision-scripts npm
+ * package when a project has no local webpack config of its own.
+ *
+ * Sitevision WebApp builds are tightly coupled to the platform runtime (a
+ * dual server/client multi-compiler, AMD externals for React and the sitevision
+ * api packages, an embedded ES5 server engine, and a precise addon zip layout).
+ * Rather than
+ * reproduce that contract — which lives in proprietary babel presets and an
+ * undocumented internal config — we shell out to the package's public CLI, which
+ * is the canonical, maintained source of that build pipeline.
+ *
+ * `sitevision-scripts build` runs build + zip + cleanup and writes the archive to
+ * `dist/<appId>.zip` — the exact path the CLI's own sign/deploy steps already use.
+ */
+import path from 'path';
+import fs from 'fs';
+import { spawn } from 'child_process';
+/**
+ * Resolve the path to the sitevision-scripts CLI entry inside a project.
+ * Returns null if the package is not installed.
+ */
+export function getSitevisionScriptsBin(projectRoot) {
+    const bin = path.join(projectRoot, 'node_modules', '@sitevision', 'sitevision-scripts', 'bin', 'sitevision-scripts.js');
+    return fs.existsSync(bin) ? bin : null;
+}
+/**
+ * Whether the sitevision-scripts package is available in the project.
+ */
+export function hasSitevisionScripts(projectRoot) {
+    return getSitevisionScriptsBin(projectRoot) !== null;
+}
+/**
+ * Path of the zip that `sitevision-scripts build` writes.
+ *
+ * IMPORTANT: this mirrors sitevision-scripts' own app-id convention
+ * (`APP_ID_PREFIX`/`APP_ID_SUFFIX` env vars + `dist/<appId>.zip`), which differs
+ * from the CLI's own `getZipPath` env vars (`SITEVISION_APP_ID_*`). For delegated
+ * builds the package is the one writing the file, so its convention is the source
+ * of truth — using `getZipPath` here would look for the wrong filename whenever a
+ * prefix/suffix is configured.
+ */
+export function getDelegatedZipPath(projectRoot, manifestId) {
+    const prefix = process.env['APP_ID_PREFIX'] ?? '';
+    const suffix = process.env['APP_ID_SUFFIX'] ?? '';
+    const appId = `${prefix}${manifestId}${suffix}`;
+    return path.join(projectRoot, 'dist', `${appId}.zip`);
+}
+// =============================================================================
+// VERSION COMPATIBILITY
+// =============================================================================
+/**
+ * Range of the sitevision-scripts package the CLI's build delegation has been
+ * validated against. The delegation depends on the package's CLI commands, its
+ * `dist/<appId>.zip` output, and the app-id convention — all stable within a
+ * major. A new major may change that contract, so we warn rather than assume.
+ *
+ * Bump these (and re-validate) when adopting a new sitevision-scripts major.
+ */
+export const SUPPORTED_SITEVISION_SCRIPTS_MIN = '8.0.0';
+const SUPPORTED_SITEVISION_SCRIPTS_MAX_EXCLUSIVE_MAJOR = 9;
+/** Human-readable supported range, e.g. ">=8.0.0 <9.0.0". */
+export const SUPPORTED_SITEVISION_SCRIPTS_RANGE = `>=${SUPPORTED_SITEVISION_SCRIPTS_MIN} <${SUPPORTED_SITEVISION_SCRIPTS_MAX_EXCLUSIVE_MAJOR}.0.0`;
+/**
+ * Read the installed sitevision-scripts version from the project, or null if it
+ * is not installed / unreadable.
+ */
+export function getSitevisionScriptsVersion(projectRoot) {
+    const packageJsonPath = path.join(projectRoot, 'node_modules', '@sitevision', 'sitevision-scripts', 'package.json');
+    try {
+        const parsed = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+        return parsed.version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Parse a semver string into [major, minor, patch], ignoring any prerelease
+ * suffix. Returns null if it does not look like a version.
+ */
+function parseVersion(version) {
+    const match = /^(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)/.exec(version);
+    if (!match?.groups) {
+        return null;
+    }
+    return [
+        Number(match.groups['major']),
+        Number(match.groups['minor']),
+        Number(match.groups['patch']),
+    ];
+}
+/**
+ * Compare two parsed versions: negative if a < b, 0 if equal, positive if a > b.
+ */
+function compareVersions(a, b) {
+    return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+}
+/**
+ * Check the project's installed sitevision-scripts against the supported range.
+ * Use the `warning` field to surface a message when the version has drifted.
+ */
+export function checkSitevisionScriptsCompatibility(projectRoot) {
+    const installed = getSitevisionScriptsVersion(projectRoot);
+    const supportedRange = SUPPORTED_SITEVISION_SCRIPTS_RANGE;
+    if (!installed) {
+        return {
+            installed: null,
+            supportedRange,
+            status: hasSitevisionScripts(projectRoot) ? 'unknown' : 'not-installed',
+        };
+    }
+    const parsed = parseVersion(installed);
+    if (!parsed) {
+        return { installed, supportedRange, status: 'unknown' };
+    }
+    if (compareVersions(parsed, parseVersion(SUPPORTED_SITEVISION_SCRIPTS_MIN)) < 0) {
+        return {
+            installed,
+            supportedRange,
+            status: 'too-old',
+            warning: `@sitevision/sitevision-scripts ${installed} is older than the supported range (${supportedRange}). Update it in your project: npm install @sitevision/sitevision-scripts@latest`,
+        };
+    }
+    if (parsed[0] >= SUPPORTED_SITEVISION_SCRIPTS_MAX_EXCLUSIVE_MAJOR) {
+        return {
+            installed,
+            supportedRange,
+            status: 'too-new',
+            warning: `@sitevision/sitevision-scripts ${installed} is newer than the range this CLI was validated against (${supportedRange}). The build may still work; update sitevision-cli if you hit problems.`,
+        };
+    }
+    return { installed, supportedRange, status: 'ok' };
+}
+/** Keep at most this many trailing characters of build output in memory. */
+const MAX_OUTPUT_CHARS = 50_000;
+/**
+ * Run `sitevision-scripts build` (build + zip + cleanup) as a subprocess.
+ *
+ * The package's own webpack pipeline produces the deployable `dist/<appId>.zip`.
+ * Invoked via the current Node binary so it works cross-platform without relying
+ * on the `node_modules/.bin` shims or shell PATH resolution.
+ *
+ * @param projectRoot - Project root directory (used as cwd)
+ * @param onOutput - Optional callback for streaming output chunks
+ */
+export async function runSitevisionScriptsBuild(projectRoot, onOutput) {
+    const bin = getSitevisionScriptsBin(projectRoot);
+    if (!bin) {
+        return {
+            success: false,
+            output: '',
+            error: '@sitevision/sitevision-scripts not found in project. Run npm install.',
+        };
+    }
+    return new Promise(resolve => {
+        let output = '';
+        const child = spawn(process.execPath, [bin, 'build'], {
+            cwd: projectRoot,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        const handleData = (data) => {
+            const text = data.toString();
+            output += text;
+            if (output.length > MAX_OUTPUT_CHARS) {
+                output = output.slice(-MAX_OUTPUT_CHARS);
+            }
+            onOutput?.(text);
+        };
+        child.stdout?.on('data', handleData);
+        child.stderr?.on('data', handleData);
+        child.on('error', error => {
+            resolve({ success: false, output, error: error.message });
+        });
+        child.on('close', code => {
+            resolve({
+                success: code === 0,
+                output,
+                error: code === 0
+                    ? undefined
+                    : `sitevision-scripts build exited with code ${code}`,
+            });
+        });
+    });
+}

package/dist/utils/webpack-runner.d.ts

@@ -5,6 +5,15 @@
  * Dynamically loads webpack from the target project's node_modules.
  */
 import type { BuildOptions, BuildResult } from '../types/index.js';
+/**
+ * Find the project's own webpack config, or null if it has none.
+ */
+export declare function findLocalWebpackConfig(projectRoot: string): string | null;
+/**
+ * Whether the project ships its own webpack config (in-house build path),
+ * as opposed to relying on the sitevision-scripts package.
+ */
+export declare function hasLocalWebpackConfig(projectRoot: string): boolean;
 export declare class WebpackRunner {
     private webpack;
     private config;

package/dist/utils/webpack-runner.js

@@ -9,6 +9,32 @@ import fs from 'fs';
 import { createRequire } from 'module';
 import { copyChunksToResources } from './zip.js';
 // =============================================================================
+// LOCAL CONFIG DETECTION
+// =============================================================================
+/**
+ * Standard locations for a project-local webpack config, highest priority first.
+ */
+function localWebpackConfigPaths(projectRoot) {
+    return [
+        path.join(projectRoot, 'webpack.config.js'),
+        path.join(projectRoot, 'webpack.config.mjs'),
+        path.join(projectRoot, 'config', 'webpack', 'webpack.config.js'),
+    ];
+}
+/**
+ * Find the project's own webpack config, or null if it has none.
+ */
+export function findLocalWebpackConfig(projectRoot) {
+    return (localWebpackConfigPaths(projectRoot).find(p => fs.existsSync(p)) ?? null);
+}
+/**
+ * Whether the project ships its own webpack config (in-house build path),
+ * as opposed to relying on the sitevision-scripts package.
+ */
+export function hasLocalWebpackConfig(projectRoot) {
+    return findLocalWebpackConfig(projectRoot) !== null;
+}
+// =============================================================================
 // WEBPACK RUNNER CLASS
 // =============================================================================
 export class WebpackRunner {
@@ -49,21 +75,10 @@ export class WebpackRunner {
      * Load webpack configuration from the project
      */
     async loadConfig() {
-        // Try to find webpack config in standard locations
-        // Project-specific configs take priority, fall back to @sitevision/sitevision-scripts
-        const configPaths = [
-            path.join(this.projectRoot, 'webpack.config.js'),
-            path.join(this.projectRoot, 'webpack.config.mjs'),
-            path.join(this.projectRoot, 'config', 'webpack', 'webpack.config.js'),
-            path.join(this.projectRoot, 'node_modules', '@sitevision', 'sitevision-scripts', 'config', 'webpack', 'webpack.config.js'),
-        ];
-        let configPath = null;
-        for (const p of configPaths) {
-            if (fs.existsSync(p)) {
-                configPath = p;
-                break;
-            }
-        }
+        // Only project-local webpack configs are consumed in-process. Projects
+        // without one are built by delegating to @sitevision/sitevision-scripts
+        // (see sitevision-scripts-runner), so there is no config fallback here.
+        const configPath = findLocalWebpackConfig(this.projectRoot);
         if (!configPath) {
             throw new Error('webpack.config.js not found. Make sure your project has a webpack configuration.');
         }

package/dist/utils/zip.d.ts

@@ -5,10 +5,17 @@
  * Also handles webpack chunk organization.
  */
 /**
- * Create a zip archive of a directory
+ * Create a zip archive of a directory.
  *
- * Uses the system `zip` command for cross-platform compatibility.
- * Falls back to a basic implementation if zip is not available.
+ * In-house, dependency-free implementation: walks the directory, deflates each
+ * file with Node's built-in zlib, and assembles a standard ZIP container (local
+ * file headers + central directory + end-of-central-directory record). This
+ * removes the previous reliance on the external `zip`/`tar`/PowerShell binaries
+ * and behaves identically across macOS, Linux, and Windows.
+ *
+ * Mirrors `zip -r <out> .` run from inside `sourceDir`: archive paths are
+ * relative to `sourceDir`, use forward slashes, and directory entries are
+ * emitted so empty directories are preserved.
  *
  * @param sourceDir - Directory to zip
  * @param outputPath - Path for the output zip file