sitevision-cli 1.0.0-beta.2 → 1.0.0-beta.21

package/dist/utils/sitevision-api.d.ts

@@ -13,6 +13,27 @@ import type { SigningCredentials, DeployConfig, ProductionDeployConfig, SigningR
  * Create Basic Auth header value
  */
 declare function createBasicAuth(username: string, password: string): string;
+type RequestAuth = {
+    username: string;
+    password: string;
+} | {
+    token: string;
+} | {
+    cookie: string;
+};
+type AuthKind = 'basic' | 'bearer' | 'cookie';
+/** Single source of the 401 message, worded for the auth kind actually used. */
+declare function unauthorizedMessage(kind: AuthKind): string;
+/** Pick cookie > bearer > basic based on what the deploy config carries. */
+declare function configAuth(config: {
+    username: string;
+    password?: string;
+    accessToken?: string;
+    sessionCookie?: string;
+}): {
+    auth: RequestAuth;
+    kind: AuthKind;
+};
 /**
  * Make an HTTP/HTTPS request
  */
@@ -20,10 +41,7 @@ export declare function makeRequest(url: string, options: {
     method: string;
     headers?: Record<string, string>;
     body?: Buffer;
-    auth?: {
-        username: string;
-        password: string;
-    };
+    auth?: RequestAuth;
     timeoutMs?: number;
 }): Promise<{
     statusCode: number;
@@ -45,6 +63,12 @@ export declare function summarizeErrorBody(body: Buffer, headers: Record<string,
  * the signing endpoint returns an error page with HTTP 200.
  */
 export declare function looksLikeZip(body: Buffer): boolean;
+/**
+ * A stale Sitevision session usually answers with a redirect to the login page
+ * or a 200 carrying an HTML login form — not a clean 401. Detect both so cookie
+ * auth can drop the dead session and re-login instead of showing a generic error.
+ */
+export declare function looksLikeAuthExpired(statusCode: number, body: Buffer, headers: Record<string, string>): boolean;
 /**
  * Sign an app via developer.sitevision.se
  *
@@ -85,4 +109,39 @@ export declare function createAddon(config: DeployConfig, appType: SimpleAppType
  * @param appType - The app type (web, widget, rest)
  */
 export declare function activateApp(executableId: string, config: DeployConfig, _appType: SimpleAppType): Promise<ActivationResponse>;
-export { createBasicAuth };
+/**
+ * A version uploaded to a custom module, as reported by the
+ * ActivateCustomModuleExecutable GET endpoint.
+ */
+export interface Executable {
+    id: string;
+    name: string;
+    appIdentifier: string;
+    appVersion: string;
+    active: boolean;
+}
+export interface ListExecutablesResponse {
+    success: boolean;
+    executables?: Executable[];
+    error?: string;
+    authExpired?: boolean;
+}
+/**
+ * List the executables (uploaded versions) of the configured addon.
+ */
+export declare function listExecutables(config: DeployConfig): Promise<ListExecutablesResponse>;
+export interface AddonNode {
+    id: string;
+    name: string;
+    type: string;
+    appType?: SimpleAppType;
+}
+/**
+ * List the addons (custom modules) in the site's Addon Repository.
+ */
+export declare function listAddons(config: DeployConfig): Promise<{
+    success: boolean;
+    addons?: AddonNode[];
+    error?: string;
+}>;
+export { createBasicAuth, configAuth, unauthorizedMessage };

package/dist/utils/sitevision-api.js

@@ -12,7 +12,7 @@ import fs from 'fs';
 import path from 'path';
 import https from 'https';
 import http from 'http';
-import { buildImportEndpointUrl, buildAddonEndpointUrl, } from './project-detection.js';
+import { buildImportEndpointUrl, buildAddonEndpointUrl, buildApiBaseUrl, } from './project-detection.js';
 // =============================================================================
 // CONSTANTS
 // =============================================================================
@@ -33,6 +33,30 @@ const RETRY_BASE_DELAY_MS = 1000;
 function createBasicAuth(username, password) {
     return `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`;
 }
+/** Single source of the 401 message, worded for the auth kind actually used. */
+function unauthorizedMessage(kind) {
+    switch (kind) {
+        case 'bearer':
+            return 'Unauthorized. The access token was rejected or has expired.';
+        case 'cookie':
+            return 'Unauthorized. The session cookie was rejected or has expired — log in again.';
+        default:
+            return 'Unauthorized. Check username and password.';
+    }
+}
+/** Pick cookie > bearer > basic based on what the deploy config carries. */
+function configAuth(config) {
+    if (config.sessionCookie) {
+        return { auth: { cookie: config.sessionCookie }, kind: 'cookie' };
+    }
+    if (config.accessToken) {
+        return { auth: { token: config.accessToken }, kind: 'bearer' };
+    }
+    return {
+        auth: { username: config.username, password: config.password ?? '' },
+        kind: 'basic',
+    };
+}
 /**
  * Generate a random boundary for multipart form data
  */
@@ -71,7 +95,18 @@ export function makeRequest(url, options) {
             ...options.headers,
         };
         if (options.auth) {
-            headers['Authorization'] = createBasicAuth(options.auth.username, options.auth.password);
+            if ('cookie' in options.auth) {
+                headers['Cookie'] = options.auth.cookie;
+                // Session-authenticated state-changing calls typically need this to
+                // pass Sitevision's CSRF guard, unlike Basic-auth requests.
+                headers['X-Requested-With'] ??= 'XMLHttpRequest';
+            }
+            else if ('token' in options.auth) {
+                headers['Authorization'] = `Bearer ${options.auth.token}`;
+            }
+            else {
+                headers['Authorization'] = createBasicAuth(options.auth.username, options.auth.password);
+            }
         }
         const requestOptions = {
             hostname: parsedUrl.hostname,
@@ -125,16 +160,36 @@ async function delay(ms) {
  */
 export function summarizeErrorBody(body, headers) {
     const contentType = headers['content-type'] ?? 'unknown';
-    const isText = contentType.includes('text') ||
+    const declaredText = contentType.includes('text') ||
         contentType.includes('json') ||
         contentType.includes('xml');
-    if (!isText) {
-        return `(${contentType}, ${body.length} bytes)`;
+    const text = body.toString('utf8');
+    // Show the body when the server declares it text OR the bytes decode to
+    // mostly-printable text. Sitevision sometimes returns a text/JSON error with
+    // a missing or non-text content-type, and hiding it obscures the real cause.
+    if (declaredText || isMostlyPrintable(text)) {
+        const collapsed = text.replaceAll(/\s+/g, ' ').trim();
+        const max = 300;
+        const summary = collapsed.length > max ? collapsed.slice(0, max) + '…' : collapsed;
+        if (summary.length > 0)
+            return summary;
     }
-    const text = body.toString('utf8').replaceAll(/\s+/g, ' ').trim();
-    const max = 300;
-    const summary = text.length > max ? text.slice(0, max) + '…' : text;
-    return summary.length > 0 ? summary : `(${contentType}, empty body)`;
+    return `(${contentType}, ${body.length} bytes)`;
+}
+/** Heuristic: a decoded string is text if <10% of chars are control/undecodable. */
+function isMostlyPrintable(text) {
+    if (text.length === 0)
+        return false;
+    let bad = 0;
+    for (const ch of text) {
+        const code = ch.codePointAt(0) ?? 0;
+        // Undecodable byte (replacement char), or a control char other than
+        // tab/newline/vertical-tab/form-feed/carriage-return.
+        if (code === 0xff_fd || code < 9 || (code > 13 && code < 32)) {
+            bad++;
+        }
+    }
+    return bad / text.length < 0.1;
 }
 /** ZIP local-file-header magic bytes: "PK\x03\x04". */
 const ZIP_MAGIC = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
@@ -145,6 +200,31 @@ const ZIP_MAGIC = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
 export function looksLikeZip(body) {
     return body.length >= 4 && body.subarray(0, 4).equals(ZIP_MAGIC);
 }
+/**
+ * A stale Sitevision session usually answers with a redirect to the login page
+ * or a 200 carrying an HTML login form — not a clean 401. Detect both so cookie
+ * auth can drop the dead session and re-login instead of showing a generic error.
+ */
+export function looksLikeAuthExpired(statusCode, body, headers) {
+    if (statusCode === 401)
+        return true;
+    if (statusCode >= 300 && statusCode < 400)
+        return true;
+    if (statusCode === 200) {
+        const contentType = headers['content-type'] ?? '';
+        if (contentType.includes('html'))
+            return true;
+        const head = body
+            .subarray(0, 64)
+            .toString('utf8')
+            .trimStart()
+            .toLowerCase();
+        if (head.startsWith('<!doctype html') || head.startsWith('<html')) {
+            return true;
+        }
+    }
+    return false;
+}
 // =============================================================================
 // SIGNING API
 // =============================================================================
@@ -211,7 +291,7 @@ export async function signApp(zipPath, credentials, outputPath) {
                 // Auth failures will not resolve on retry.
                 return {
                     success: false,
-                    error: 'Unauthorized. Check username and password.',
+                    error: unauthorizedMessage('basic'),
                 };
             }
             lastError = `Signing failed with status ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`;
@@ -256,9 +336,12 @@ export async function deployApp(zipPath, config, appType, force = false) {
     if (force) {
         url += '?force=true';
     }
-    // Create multipart form data
+    // The import endpoints read the archive from a multipart part named "data"
+    // (per the webAppImport/restAppImport docs, and confirmed against a live
+    // server). Signing uses "file" against a different endpoint.
     const boundary = generateBoundary();
-    const { body, contentType } = createMultipartFormData(zipPath, 'file', boundary);
+    const { body, contentType } = createMultipartFormData(zipPath, 'data', boundary);
+    const { auth, kind } = configAuth(config);
     try {
         const response = await makeRequest(url, {
             method: 'POST',
@@ -267,11 +350,25 @@ export async function deployApp(zipPath, config, appType, force = false) {
                 'Content-Length': String(body.length),
             },
             body,
-            auth: {
-                username: config.username,
-                password: config.password,
-            },
+            auth,
         });
+        if (response.statusCode === 401) {
+            return {
+                success: false,
+                error: unauthorizedMessage(kind),
+                authExpired: true,
+            };
+        }
+        // A cookie session fails without a clean 401: a redirect to login or a
+        // 200 carrying an HTML login page. Flag it so the caller re-authenticates.
+        if (kind === 'cookie' &&
+            looksLikeAuthExpired(response.statusCode, response.body, response.headers)) {
+            return {
+                success: false,
+                error: unauthorizedMessage('cookie'),
+                authExpired: true,
+            };
+        }
         if (response.statusCode === 200) {
             // Try to parse response for executable ID
             let executableId;
@@ -288,12 +385,6 @@ export async function deployApp(zipPath, config, appType, force = false) {
                 message: 'Deployment successful',
             };
         }
-        if (response.statusCode === 401) {
-            return {
-                success: false,
-                error: 'Unauthorized. Check username and password.',
-            };
-        }
         if (response.statusCode === 409) {
             return {
                 success: false,
@@ -358,6 +449,7 @@ export async function createAddon(config, appType) {
         name: config.addonName,
         category: 'Other',
     });
+    const { auth, kind } = configAuth(config);
     try {
         const response = await makeRequest(url, {
             method: 'POST',
@@ -366,10 +458,7 @@ export async function createAddon(config, appType) {
                 'Content-Length': String(Buffer.byteLength(body)),
             },
             body: Buffer.from(body),
-            auth: {
-                username: config.username,
-                password: config.password,
-            },
+            auth,
         });
         if (response.statusCode === 200 || response.statusCode === 201) {
             let addonId;
@@ -388,7 +477,8 @@ export async function createAddon(config, appType) {
         if (response.statusCode === 401) {
             return {
                 success: false,
-                error: 'Unauthorized. Check username and password.',
+                error: unauthorizedMessage(kind),
+                authExpired: true,
             };
         }
         if (response.statusCode === 409) {
@@ -422,6 +512,7 @@ export async function activateApp(executableId, config, _appType) {
     const body = JSON.stringify({
         executableId,
     });
+    const { auth, kind } = configAuth(config);
     try {
         const response = await makeRequest(url, {
             method: 'PUT',
@@ -430,10 +521,7 @@ export async function activateApp(executableId, config, _appType) {
                 'Content-Length': String(Buffer.byteLength(body)),
             },
             body: Buffer.from(body),
-            auth: {
-                username: config.username,
-                password: config.password,
-            },
+            auth,
         });
         if (response.statusCode === 200) {
             return { success: true };
@@ -441,7 +529,8 @@ export async function activateApp(executableId, config, _appType) {
         if (response.statusCode === 401) {
             return {
                 success: false,
-                error: 'Unauthorized. Check username and password.',
+                error: unauthorizedMessage(kind),
+                authExpired: true,
             };
         }
         return {
@@ -456,7 +545,80 @@ export async function activateApp(executableId, config, _appType) {
         };
     }
 }
+/**
+ * List the executables (uploaded versions) of the configured addon.
+ */
+export async function listExecutables(config) {
+    const protocol = config.useHTTP ? 'http' : 'https';
+    const url = `${protocol}://${config.domain}/rest-api/1/0/${encodeURIComponent(config.siteName)}/Addon%20Repository/${encodeURIComponent(config.addonName)}/activateCustomModuleExecutable`;
+    const { auth, kind } = configAuth(config);
+    try {
+        const response = await makeRequest(url, { method: 'GET', auth });
+        if (response.statusCode === 401) {
+            return {
+                success: false,
+                error: unauthorizedMessage(kind),
+                authExpired: true,
+            };
+        }
+        if (response.statusCode !== 200) {
+            return {
+                success: false,
+                error: `Listing versions failed with status ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`,
+            };
+        }
+        const data = JSON.parse(response.body.toString());
+        return { success: true, executables: data.executables ?? [] };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: `Listing versions failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
+const ADDON_TYPES = {
+    'sv:customModule': 'web',
+    'sv:marketplaceCustomModule': 'web',
+    'sv:widgetCustomModule': 'widget',
+    'sv:marketplaceWidgetCustomModule': 'widget',
+    'sv:headlessCustomModule': 'rest',
+    'sv:marketplaceHeadlessCustomModule': 'rest',
+    'sv:mcpServerCustomModule': 'mcp',
+};
+/**
+ * List the addons (custom modules) in the site's Addon Repository.
+ */
+export async function listAddons(config) {
+    const url = `${buildApiBaseUrl(config.domain, config.siteName, config.useHTTP)}/Addon%20Repository/nodes`;
+    const { auth, kind } = configAuth(config);
+    try {
+        const response = await makeRequest(url, { method: 'GET', auth });
+        if (response.statusCode === 401) {
+            return { success: false, error: unauthorizedMessage(kind) };
+        }
+        if (response.statusCode !== 200) {
+            return {
+                success: false,
+                error: `Listing addons failed with status ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`,
+            };
+        }
+        const nodes = JSON.parse(response.body.toString());
+        return {
+            success: true,
+            addons: nodes
+                .filter(node => Object.hasOwn(ADDON_TYPES, node.type))
+                .map(node => ({ ...node, appType: ADDON_TYPES[node.type] })),
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: `Listing addons failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
 // =============================================================================
 // HELPER EXPORTS
 // =============================================================================
-export { createBasicAuth };
+export { createBasicAuth, configAuth, unauthorizedMessage };

package/dist/utils/tasks.d.ts

@@ -0,0 +1,48 @@
+import type { ProjectInfo, SigningCredentials, DeployConfig } from '../types/index.js';
+export type TaskKind = 'dev' | 'watch' | 'build' | 'sign' | 'deploy' | 'activate' | 'install';
+export type TaskStatus = 'running' | 'success' | 'error' | 'stopped';
+export type LogLevel = 'info' | 'ok' | 'warn' | 'error';
+export interface LogLine {
+    time: number;
+    tag: string;
+    level: LogLevel;
+    text: string;
+}
+export interface Task {
+    id: number;
+    kind: TaskKind;
+    appRoot: string;
+    appName: string;
+    label: string;
+    status: TaskStatus;
+    phase: string;
+    startedAt: number;
+    endedAt?: number;
+    lines: LogLine[];
+    error?: string;
+    stop: () => void;
+}
+export declare function getTasks(): Task[];
+export declare function useTasks(): Task[];
+export declare function runningTasks(appRoot?: string): Task[];
+export declare function clearFinished(): void;
+export interface DeployOptions {
+    force?: boolean;
+    production?: boolean;
+    activate?: boolean;
+}
+export declare function startBuild(project: ProjectInfo): Task;
+export declare function startSign(project: ProjectInfo, credentials: SigningCredentials): Task;
+export declare function startDeploy(project: ProjectInfo, config: DeployConfig, options: DeployOptions): Task;
+export declare function startActivate(project: ProjectInfo, config: DeployConfig, executableId: string, versionLabel: string): Task;
+export declare function startInstall(project: ProjectInfo): Task;
+export interface DevOptions {
+    deploy: boolean;
+    signingCredentials?: SigningCredentials;
+    deployConfig?: DeployConfig;
+}
+/**
+ * Dev / watch loop: build on every source change, then optionally sign and
+ * deploy. Runs until `task.stop()`; the task stays in the registry meanwhile.
+ */
+export declare function startDev(project: ProjectInfo, options: DevOptions): Task;