sitevision-cli 1.0.0-beta.0 → 1.0.0-beta.10

package/dist/utils/jsonc.js

@@ -0,0 +1,74 @@
+/**
+ * JSONC helpers.
+ *
+ * Sitevision's own manifest documentation shows manifest.json with line and
+ * block comments (e.g. `"name": { // Multilingual-manifest requires SV 10.1`),
+ * so real-world manifests copied from the docs contain them. Strict JSON.parse
+ * rejects those, so we strip comments before parsing.
+ */
+/**
+ * Remove line comments (//...) and block comments from a JSON string, leaving
+ * everything inside string literals untouched (so values like
+ * `"https://example.com"` survive).
+ */
+export function stripJsonComments(input) {
+    let result = '';
+    let inString = false;
+    let inLineComment = false;
+    let inBlockComment = false;
+    for (let i = 0; i < input.length; i++) {
+        const char = input[i];
+        const next = input[i + 1];
+        if (inLineComment) {
+            if (char === '\n') {
+                inLineComment = false;
+                result += char;
+            }
+            continue;
+        }
+        if (inBlockComment) {
+            if (char === '*' && next === '/') {
+                inBlockComment = false;
+                i++;
+            }
+            continue;
+        }
+        if (inString) {
+            result += char;
+            // Copy escaped characters verbatim so an escaped quote (\") does not
+            // end the string early.
+            if (char === '\\') {
+                result += next ?? '';
+                i++;
+            }
+            else if (char === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (char === '"') {
+            inString = true;
+            result += char;
+            continue;
+        }
+        if (char === '/' && next === '/') {
+            inLineComment = true;
+            i++;
+            continue;
+        }
+        if (char === '/' && next === '*') {
+            inBlockComment = true;
+            i++;
+            continue;
+        }
+        result += char;
+    }
+    return result;
+}
+/**
+ * Parse a JSON string that may contain comments (JSONC). Throws the underlying
+ * SyntaxError if the content is invalid even after comments are removed.
+ */
+export function parseJsonc(input) {
+    return JSON.parse(stripJsonComments(input));
+}

package/dist/utils/keychain.d.ts

@@ -4,3 +4,12 @@ export declare function deleteDeployPassword(domain: string, username: string):
 export declare function getSigningPassword(username: string): string | null;
 export declare function setSigningPassword(username: string, password: string): boolean;
 export declare function deleteSigningPassword(username: string): void;
+export declare function getOAuth2RefreshToken(domain: string, clientId: string): string | null;
+export declare function setOAuth2RefreshToken(domain: string, clientId: string, token: string): boolean;
+export declare function deleteOAuth2RefreshToken(domain: string, clientId: string): void;
+export declare function getOAuth2ClientSecret(domain: string, clientId: string): string | null;
+export declare function setOAuth2ClientSecret(domain: string, clientId: string, secret: string): boolean;
+export declare function deleteOAuth2ClientSecret(domain: string, clientId: string): void;
+export declare function getSessionCookie(domain: string, username: string): string | null;
+export declare function setSessionCookie(domain: string, username: string, cookie: string): boolean;
+export declare function deleteSessionCookie(domain: string, username: string): void;

package/dist/utils/keychain.js

@@ -6,6 +6,15 @@ function deployAccount(domain, username) {
 function signingAccount(username) {
     return `signing:${username}`;
 }
+function oauthRefreshAccount(domain, clientId) {
+    return `oauth2-refresh:${clientId}@${domain}`;
+}
+function oauthSecretAccount(domain, clientId) {
+    return `oauth2-secret:${clientId}@${domain}`;
+}
+function sessionCookieAccount(domain, username) {
+    return `session:${username}@${domain}`;
+}
 function safeGet(account) {
     try {
         return new Entry(SERVICE, account).getPassword();
@@ -61,3 +70,48 @@ export function deleteSigningPassword(username) {
         return;
     safeDelete(signingAccount(username));
 }
+export function getOAuth2RefreshToken(domain, clientId) {
+    if (!domain || !clientId)
+        return null;
+    return safeGet(oauthRefreshAccount(domain, clientId));
+}
+export function setOAuth2RefreshToken(domain, clientId, token) {
+    if (!domain || !clientId || !token)
+        return false;
+    return safeSet(oauthRefreshAccount(domain, clientId), token);
+}
+export function deleteOAuth2RefreshToken(domain, clientId) {
+    if (!domain || !clientId)
+        return;
+    safeDelete(oauthRefreshAccount(domain, clientId));
+}
+export function getOAuth2ClientSecret(domain, clientId) {
+    if (!domain || !clientId)
+        return null;
+    return safeGet(oauthSecretAccount(domain, clientId));
+}
+export function setOAuth2ClientSecret(domain, clientId, secret) {
+    if (!domain || !clientId || !secret)
+        return false;
+    return safeSet(oauthSecretAccount(domain, clientId), secret);
+}
+export function deleteOAuth2ClientSecret(domain, clientId) {
+    if (!domain || !clientId)
+        return;
+    safeDelete(oauthSecretAccount(domain, clientId));
+}
+export function getSessionCookie(domain, username) {
+    if (!domain || !username)
+        return null;
+    return safeGet(sessionCookieAccount(domain, username));
+}
+export function setSessionCookie(domain, username, cookie) {
+    if (!domain || !username || !cookie)
+        return false;
+    return safeSet(sessionCookieAccount(domain, username), cookie);
+}
+export function deleteSessionCookie(domain, username) {
+    if (!domain || !username)
+        return;
+    safeDelete(sessionCookieAccount(domain, username));
+}

package/dist/utils/oauth2-auth.d.ts

@@ -0,0 +1,27 @@
+import type { DevProperties } from '../types/index.js';
+/** Default loopback port. Fixed so a single redirect URI can be whitelisted. */
+export declare const DEFAULT_REDIRECT_PORT = 8137;
+/** RFC 7636 S256 pair. Exported for testing the challenge derivation. */
+export declare function createPkcePair(): {
+    verifier: string;
+    challenge: string;
+};
+export declare function openBrowser(url: string): void;
+/**
+ * Start an interactive OAuth2 login. Returns the authorize URL to open and a
+ * `complete()` that awaits the loopback redirect, exchanges the code, stores the
+ * refresh token, and resolves the access token. UI-agnostic, so an Ink screen
+ * can drive it without owning the terminal.
+ */
+export declare function beginOAuth2Login(dev: DevProperties): {
+    authUrl: string;
+    complete: () => Promise<string | null>;
+    cancel: () => void;
+} | null;
+/**
+ * Silently resolve an access token by refreshing the keychain refresh token.
+ * Returns null when there's no refresh token or it's expired/revoked (in which
+ * case the stale token is dropped). Interactive login lives in `beginOAuth2Login`,
+ * driven by the Ink login screen — the access token is never persisted.
+ */
+export declare function resolveOAuth2AccessToken(dev: DevProperties): Promise<string | null>;

package/dist/utils/oauth2-auth.js

@@ -0,0 +1,172 @@
+import http from 'http';
+import crypto from 'crypto';
+import { spawn } from 'child_process';
+import { makeRequest } from './sitevision-api.js';
+import { getOAuth2RefreshToken, setOAuth2RefreshToken, deleteOAuth2RefreshToken, getOAuth2ClientSecret, } from './keychain.js';
+/** Default loopback port. Fixed so a single redirect URI can be whitelisted. */
+export const DEFAULT_REDIRECT_PORT = 8137;
+/** Seconds to wait for the user to finish logging in before giving up. */
+const LOGIN_TIMEOUT_MS = 300_000;
+function base64url(buffer) {
+    return buffer
+        .toString('base64')
+        .replaceAll('+', '-')
+        .replaceAll('/', '_')
+        .replaceAll('=', '');
+}
+/** RFC 7636 S256 pair. Exported for testing the challenge derivation. */
+export function createPkcePair() {
+    const verifier = base64url(crypto.randomBytes(32));
+    const challenge = base64url(crypto.createHash('sha256').update(verifier).digest());
+    return { verifier, challenge };
+}
+function hasOAuth2Config(config) {
+    return Boolean(config?.authorizationEndpoint && config.tokenEndpoint && config.clientId);
+}
+async function postToken(config, params, secret) {
+    const body = Buffer.from(new URLSearchParams(params).toString());
+    try {
+        const response = await makeRequest(config.tokenEndpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'Content-Length': String(body.length),
+            },
+            body,
+            // client_secret_basic when confidential; public+PKCE clients omit it.
+            auth: secret ? { username: config.clientId, password: secret } : undefined,
+        });
+        if (response.statusCode !== 200)
+            return null;
+        return JSON.parse(response.body.toString());
+    }
+    catch {
+        return null;
+    }
+}
+export function openBrowser(url) {
+    const isWin = process.platform === 'win32';
+    const cmd = process.platform === 'darwin' ? 'open' : isWin ? 'cmd' : 'xdg-open';
+    const args = isWin ? ['/c', 'start', '', url] : [url];
+    try {
+        spawn(cmd, args, { stdio: 'ignore', detached: true }).unref();
+    }
+    catch {
+        // Fall back to the printed URL.
+    }
+}
+/**
+ * Serve the loopback redirect once. Returns the awaited code and a `close()`
+ * that shuts the server down (freeing the port) if the login is cancelled — so
+ * a retry doesn't hit an EADDRINUSE on the fixed redirect port.
+ */
+function startLoopback(port, state) {
+    let finish;
+    let settled = false;
+    const code = new Promise(resolve => {
+        finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            server.close();
+            resolve(value);
+        };
+    });
+    const server = http.createServer((req, res) => {
+        const url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
+        if (url.pathname !== '/callback') {
+            res.writeHead(404).end();
+            return;
+        }
+        const ok = url.searchParams.get('state') === state;
+        const authCode = url.searchParams.get('code');
+        const message = ok && authCode
+            ? 'Login complete. You can close this window and return to the terminal.'
+            : 'Login failed. Check the terminal.';
+        res.writeHead(200, { 'Content-Type': 'text/html' });
+        res.end(`<!doctype html><meta charset="utf-8"><p>${message}</p>`);
+        finish(ok ? authCode : null);
+    });
+    const timer = setTimeout(() => finish(null), LOGIN_TIMEOUT_MS);
+    server.on('error', () => finish(null));
+    server.listen(port, '127.0.0.1');
+    return { code, close: () => finish(null) };
+}
+/**
+ * Start an interactive OAuth2 login. Returns the authorize URL to open and a
+ * `complete()` that awaits the loopback redirect, exchanges the code, stores the
+ * refresh token, and resolves the access token. UI-agnostic, so an Ink screen
+ * can drive it without owning the terminal.
+ */
+export function beginOAuth2Login(dev) {
+    const config = dev.oauth2;
+    if (!hasOAuth2Config(config))
+        return null;
+    const { domain } = dev;
+    const secret = getOAuth2ClientSecret(domain, config.clientId) ?? undefined;
+    const port = config.redirectPort ?? DEFAULT_REDIRECT_PORT;
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    const { verifier, challenge } = createPkcePair();
+    const state = base64url(crypto.randomBytes(16));
+    const url = new URL(config.authorizationEndpoint);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('client_id', config.clientId);
+    url.searchParams.set('redirect_uri', redirectUri);
+    url.searchParams.set('state', state);
+    url.searchParams.set('code_challenge', challenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    if (config.scopes?.length) {
+        url.searchParams.set('scope', config.scopes.join(' '));
+    }
+    const loopback = startLoopback(port, state);
+    const complete = async () => {
+        const code = await loopback.code;
+        if (!code)
+            return null;
+        const tokens = await postToken(config, {
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: redirectUri,
+            client_id: config.clientId,
+            code_verifier: verifier,
+        }, secret);
+        if (!tokens?.access_token)
+            return null;
+        if (tokens.refresh_token) {
+            setOAuth2RefreshToken(domain, config.clientId, tokens.refresh_token);
+        }
+        return tokens.access_token;
+    };
+    return { authUrl: url.href, complete, cancel: loopback.close };
+}
+/**
+ * Silently resolve an access token by refreshing the keychain refresh token.
+ * Returns null when there's no refresh token or it's expired/revoked (in which
+ * case the stale token is dropped). Interactive login lives in `beginOAuth2Login`,
+ * driven by the Ink login screen — the access token is never persisted.
+ */
+export async function resolveOAuth2AccessToken(dev) {
+    const config = dev.oauth2;
+    if (!hasOAuth2Config(config))
+        return null;
+    const { domain } = dev;
+    const secret = getOAuth2ClientSecret(domain, config.clientId) ?? undefined;
+    const storedRefresh = getOAuth2RefreshToken(domain, config.clientId);
+    if (!storedRefresh)
+        return null;
+    const tokens = await postToken(config, {
+        grant_type: 'refresh_token',
+        refresh_token: storedRefresh,
+        client_id: config.clientId,
+    }, secret);
+    if (tokens?.access_token) {
+        if (tokens.refresh_token) {
+            setOAuth2RefreshToken(domain, config.clientId, tokens.refresh_token);
+        }
+        return tokens.access_token;
+    }
+    // Stale/expired refresh token — drop it so the next run logs in fresh.
+    deleteOAuth2RefreshToken(domain, config.clientId);
+    return null;
+}

package/dist/utils/password-prompt.d.ts

@@ -3,6 +3,11 @@
  * Pressing Enter (empty answer) returns `defaultYes` (default: false).
  */
 export declare function promptYesNo(prompt: string, defaultYes?: boolean): Promise<boolean>;
+/**
+ * Wait for the user to press Enter (or Ctrl+C). Used to hand control to an
+ * external browser and resume once the user says they're done.
+ */
+export declare function promptEnter(prompt: string): Promise<void>;
 /**
  * Prompt for password input with masked display
  */

package/dist/utils/password-prompt.js

@@ -29,6 +29,34 @@ export function promptYesNo(prompt, defaultYes = false) {
         stdin.on('data', onData);
     });
 }
+/**
+ * Wait for the user to press Enter (or Ctrl+C). Used to hand control to an
+ * external browser and resume once the user says they're done.
+ */
+export function promptEnter(prompt) {
+    return new Promise(resolve => {
+        process.stdout.write(prompt);
+        const stdin = process.stdin;
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.setEncoding('utf8');
+        const onData = (data) => {
+            const char = data[0] || '';
+            const charCode = char.charCodeAt(0);
+            if (charCode === 3) {
+                process.exit();
+            }
+            if (char === '' || charCode === 13 || charCode === 10) {
+                stdin.setRawMode(false);
+                stdin.removeListener('data', onData);
+                stdin.pause();
+                process.stdout.write('\n');
+                resolve();
+            }
+        };
+        stdin.on('data', onData);
+    });
+}
 /**
  * Prompt for password input with masked display
  */

package/dist/utils/project-detection.d.ts

@@ -1,5 +1,15 @@
-import type { SitevisionManifest, DevProperties, ProjectInfo, ProjectPaths, SimpleAppType, ApiEndpoints } from '../types/index.js';
+import type { SitevisionManifest, DevProperties, ProjectInfo, ProjectPaths, SimpleAppType, ApiEndpoints, LocalizedString } from '../types/index.js';
 export type { SitevisionManifest, DevProperties, ProjectInfo, } from '../types/index.js';
+/**
+ * Resolve a manifest text field that may be a plain string or a localized
+ * object (e.g. `{sv: 'Namn', en: 'Name'}`) to a single display string.
+ *
+ * Preference order: Swedish, then English, then any available language. Returns
+ * an empty string for missing/empty values. This guards the UI from rendering a
+ * raw object as a React child, which Sitevision's localized manifests would
+ * otherwise trigger.
+ */
+export declare function localizedText(value: LocalizedString | undefined, preferred?: string): string;
 /**
  * Get standard project paths for a given root directory
  */
@@ -51,6 +61,22 @@ export declare function buildAddonEndpointUrl(domain: string, siteName: string,
  * Build the import endpoint URL
  */
 export declare function buildImportEndpointUrl(domain: string, siteName: string, addonName: string, appType: SimpleAppType, useHTTP?: boolean): string;
+/**
+ * Thrown when a manifest.json is present but cannot be parsed. Kept distinct from
+ * a plain "no project here" (null) so the CLI can tell the user their manifest is
+ * malformed instead of the misleading "Not a Sitevision project".
+ */
+export declare class ManifestParseError extends Error {
+    constructor(manifestPath: string, cause: unknown);
+}
+/**
+ * Read manifest.json from its supported locations (root, static/, src/).
+ * Throws ManifestParseError on malformed JSON.
+ */
+export declare function readManifest(cwd: string): {
+    manifestPath: string;
+    manifest: SitevisionManifest;
+} | null;
 /**
  * Detect if the current directory is a Sitevision project
  */
@@ -72,10 +98,37 @@ export declare function isBundledApp(manifest: SitevisionManifest): boolean;
  */
 export declare function readDevProperties(projectRoot: string): DevProperties | null;
 /**
- * Write dev properties to file. The `password` field is never persisted —
- * it is held in the OS keychain instead.
+ * Write dev properties to file. Secrets are never persisted — `password`,
+ * `accessToken` and `sessionCookie` are held in the OS keychain / resolved at
+ * runtime instead.
  */
 export declare function writeDevProperties(projectRoot: string, properties: DevProperties): void;
+/**
+ * CLI preferences stored in .svcconfig at the project root. Unknown keys are
+ * preserved on write so hand-edited entries survive.
+ */
+export interface SvcConfig {
+    syncPackageJson?: boolean;
+    [key: string]: unknown;
+}
+export declare function readSvcConfig(projectRoot: string): SvcConfig;
+export declare function writeSvcConfig(projectRoot: string, updates: SvcConfig): void;
+export interface PackageJsonSyncChange {
+    key: string;
+    from?: string;
+    to: string;
+}
+/**
+ * Which of the shared fields package.json is missing or disagrees on, relative
+ * to the given dev properties. Reads package.json from disk — an earlier
+ * `npm install` in the same session may have rewritten it.
+ */
+export declare function getPackageJsonSyncChanges(projectRoot: string, properties: DevProperties): PackageJsonSyncChange[];
+/**
+ * Copy the shared fields from dev properties into package.json, preserving the
+ * file's existing indentation and trailing newline.
+ */
+export declare function syncDevPropertiesToPackageJson(projectRoot: string, properties: DevProperties): boolean;
 /**
  * Move a plaintext password from .dev_properties.json into the OS keychain and
  * strip it from the file. Returns true if the password was migrated.