sitevision-cli 1.0.0-beta.20 → 1.0.0-beta.22

package/dist/shell/ConfigForm.d.ts

@@ -19,6 +19,7 @@ export interface ConfigTarget {
     base?: Partial<DevProperties>;
     environment?: string;
     workspace?: boolean;
+    workspaceRoot?: string;
 }
 /** Apply the form to disk and the keychain. Exported for the test. */
 export declare function saveConfig(project: ConfigTarget, values: Values, edited: Set<string>): void;

package/dist/shell/ConfigForm.js

@@ -1,7 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useEffect, useState } from 'react';
 import { Box, Text, useInput } from 'ink';
-import { getPackageJsonSyncChanges, normalizeDomain, readInheritedDevProperties, writeDevProperties, } from '../utils/project-detection.js';
+import { findDevPropertiesPath, getPackageJsonSyncChanges, hasPackageJson, IMPLICIT_VALUES, normalizeDomain, readAncestorDevProperties, readInheritedDevProperties, readWorkspaceDevProperties, updatePackageJson, writeDevProperties, } from '../utils/project-detection.js';
 import { setDeployPassword, deleteDeployPassword, getOAuth2ClientSecret, setOAuth2ClientSecret, deleteOAuth2ClientSecret, getSigningPassword, setSigningPassword, deleteSigningPassword, } from '../utils/keychain.js';
 import { DEFAULT_SCOPES, discoverOAuth2Config } from '../utils/oauth2-auth.js';
 import { ACCENT } from './Frame.js';
@@ -185,6 +185,41 @@ function storedSecret(project, key) {
     }
     return Boolean(dev.signingUsername && getSigningPassword(dev.signingUsername));
 }
+const errorText = (error) => error instanceof Error ? error.message : String(error);
+const sameValue = (key, a, b) => JSON.stringify(a === '' || a === undefined ? IMPLICIT_VALUES[key] : a) ===
+    JSON.stringify(b === '' || b === undefined ? IMPLICIT_VALUES[key] : b);
+/**
+ * App mode writes the app's complete file. Workspace mode never creates an
+ * app's .dev_properties.json: changes go to the root file, and the addon name
+ * to the app's package.json. An app that already has its own file keeps it.
+ */
+function writeConfigFile(project, file) {
+    const { workspaceRoot } = project;
+    if (!workspaceRoot ||
+        project.workspace ||
+        findDevPropertiesPath(project.root)) {
+        writeDevProperties(project.root, file, {
+            complete: !workspaceRoot && !project.workspace,
+        });
+        return;
+    }
+    const before = (project.base ?? project.devProperties ?? {});
+    const after = file;
+    const root = readWorkspaceDevProperties(workspaceRoot);
+    for (const key of new Set([...Object.keys(before), ...Object.keys(after)])) {
+        if (sameValue(key, after[key], before[key]))
+            continue;
+        if (key === 'addonName') {
+            updatePackageJson(project.root, packageJson => {
+                packageJson['addonName'] = after[key] || undefined;
+            });
+        }
+        else {
+            root[key] = after[key];
+        }
+    }
+    writeDevProperties(workspaceRoot, root);
+}
 /** Apply the form to disk and the keychain. Exported for the test. */
 export function saveConfig(project, values, edited) {
     const method = values['authMethod'];
@@ -228,7 +263,7 @@ export function saveConfig(project, values, edited) {
         base.certificateName = next.certificateName;
         base.baseEnvironment = next.baseEnvironment;
         base.production = next.production;
-        writeDevProperties(project.root, withEnvironmentOverride(base, env, {
+        writeConfigFile(project, withEnvironmentOverride(base, env, {
             domain: next.domain,
             siteName: next.siteName,
             addonName: next.addonName,
@@ -240,7 +275,7 @@ export function saveConfig(project, values, edited) {
         }));
     }
     else {
-        writeDevProperties(project.root, {
+        writeConfigFile(project, {
             ...next,
             environments: project.base?.environments ?? project.devProperties?.environments,
         });
@@ -293,15 +328,21 @@ export function ConfigForm({ project, active, width, height, pickAddon, onSaved,
     const fields = visibleFields(method, project.workspace, envMode);
     const current = fields[Math.min(cursor, fields.length - 1)];
     const inherited = readInheritedDevProperties(project.root);
-    const changes = project.devProperties && !project.workspace
-        ? getPackageJsonSyncChanges(project.root, project.devProperties)
-        : [];
+    const ancestors = readAncestorDevProperties(project.root);
+    const changes = getPackageJsonSyncChanges(project.root);
+    const packageJsonExists = hasPackageJson(project.root);
     // Write one field to disk (and the keychain for secrets) right away.
     const commit = (key, value, label = current.label) => {
         const clean = key === 'domain' ? normalizeDomain(value) : value;
         const next = { ...values, [key]: clean };
         setValues(next);
-        saveConfig(project, next, new Set([key]));
+        try {
+            saveConfig(project, next, new Set([key]));
+        }
+        catch (error) {
+            setNote(t('Not saved: {error}', { error: errorText(error) }));
+            return;
+        }
         setNote(clean === value
             ? t('Saved {label}.', { label: t(label) })
             : t('Saved {label} as {value} — a domain is a host only.', {
@@ -328,7 +369,13 @@ export function ConfigForm({ project, active, width, height, pickAddon, onSaved,
                     tokenEndpoint: values['tokenEndpoint'] || found.tokenEndpoint,
                 };
                 setValues(next);
-                saveConfig(project, next, new Set());
+                try {
+                    saveConfig(project, next, new Set());
+                }
+                catch (error) {
+                    setNote(t('Not saved: {error}', { error: errorText(error) }));
+                    return;
+                }
                 onSaved();
                 setNote(t('Endpoints filled from the site OpenID config.'));
             }
@@ -359,8 +406,12 @@ export function ConfigForm({ project, active, width, height, pickAddon, onSaved,
             }
             else if (key.return) {
                 setEditing(false);
-                if (draft !== values[current.key])
+                // A secret row always starts empty, so Enter on an empty one means
+                // "remove the stored secret", not "no change".
+                if (draft !== values[current.key] ||
+                    (current.kind === 'secret' && storedSecret(project, current.key))) {
                     commit(current.key, draft);
+                }
             }
             else if (choices.length > 0) {
                 const step = key.leftArrow || key.upArrow
@@ -434,16 +485,22 @@ export function ConfigForm({ project, active, width, height, pickAddon, onSaved,
                 color: overridden ? 'yellow' : undefined,
             };
         }
-        const inheritedValue = [
+        const inOAuth2 = [
             'clientId',
             'authorizationEndpoint',
             'tokenEndpoint',
-        ].includes(f.key)
+        ].includes(f.key);
+        const inheritedValue = inOAuth2
             ? inherited['oauth2']?.[f.key]
             : inherited[f.key];
         if (inheritedValue !== undefined &&
             JSON.stringify(inheritedValue) === JSON.stringify(value)) {
-            return { text: t('↑ root') };
+            // A parent .dev_properties.json outranks package.json when it has the key.
+            return {
+                text: Object.hasOwn(ancestors, inOAuth2 ? 'oauth2' : f.key)
+                    ? t('↑ root')
+                    : 'package.json',
+            };
         }
         return { text: (values[f.key] ?? '') ? t('local') : '' };
     };
@@ -491,9 +548,11 @@ export function ConfigForm({ project, active, width, height, pickAddon, onSaved,
     }
     return (_jsxs(Box, { flexDirection: "column", paddingX: 1, overflow: "hidden", height: height, children: [_jsx(Box, { height: 1, flexShrink: 0, children: _jsxs(Text, { dimColor: true, wrap: "truncate", children: [('  ' + t('FIELD')).padEnd(24), t('VALUE').padEnd(valueWidth), t('SOURCE')] }) }), rows, project.workspace && (_jsx(Box, { marginTop: 1, flexShrink: 0, children: _jsx(Text, { dimColor: true, children: t("Shared by every app below {root}. An app's own value wins.", {
                         root: project.root,
-                    }) }) })), !project.workspace && (_jsxs(Box, { marginTop: 1, flexDirection: "column", flexShrink: 0, children: [_jsxs(Text, { bold: true, dimColor: true, children: [t('PACKAGE.JSON SYNC'), ' ', _jsx(Text, { color: changes.length > 0 ? 'yellow' : 'green', children: changes.length === 0
-                                    ? t('in sync')
-                                    : changes.length === 1
-                                        ? t('1 diff · y to apply')
-                                        : t('{n} diffs · y to apply', { n: changes.length }) })] }), changes.map(c => (_jsxs(Text, { wrap: "truncate", children: [_jsx(Text, { color: c.from === undefined ? 'green' : 'yellow', children: c.from === undefined ? '+ ' : '~ ' }), c.key, ":", ' ', c.from !== undefined && _jsxs(Text, { dimColor: true, children: [c.from, " \u2192 "] }), c.to] }, c.key)))] })), _jsx(Box, { flexGrow: 1 }), _jsx(Box, { flexDirection: "column", borderStyle: "single", borderDimColor: true, borderLeft: false, borderRight: false, borderBottom: false, children: _jsxs(Text, { wrap: "wrap", children: [_jsx(Text, { bold: true, color: ACCENT, children: t(current.label) }), _jsxs(Text, { dimColor: true, children: [" \u00B7 ", t(current.help)] })] }) }), _jsx(Text, { color: "yellow", children: note })] }));
+                    }) }) })), _jsxs(Box, { marginTop: 1, flexDirection: "column", flexShrink: 0, children: [_jsxs(Text, { bold: true, dimColor: true, children: [t('PACKAGE.JSON SYNC'), ' ', _jsx(Text, { color: changes.length > 0 || !packageJsonExists ? 'yellow' : 'green', children: !packageJsonExists
+                                    ? t('no workspace package.json · y to set up')
+                                    : changes.length === 0
+                                        ? t('in sync')
+                                        : changes.length === 1
+                                            ? t('1 diff · y to apply')
+                                            : t('{n} diffs · y to apply', { n: changes.length }) })] }), changes.map(c => (_jsxs(Text, { wrap: "truncate", children: [_jsx(Text, { color: c.from === undefined ? 'green' : 'yellow', children: c.from === undefined ? '+ ' : '~ ' }), c.key, ": ", c.from !== undefined && _jsxs(Text, { dimColor: true, children: [c.from, " \u2192 "] }), c.to] }, c.key)))] }), _jsx(Box, { flexGrow: 1 }), _jsx(Box, { flexDirection: "column", borderStyle: "single", borderDimColor: true, borderLeft: false, borderRight: false, borderBottom: false, children: _jsxs(Text, { wrap: "wrap", children: [_jsx(Text, { bold: true, color: ACCENT, children: t(current.label) }), _jsxs(Text, { dimColor: true, children: [" \u00B7 ", t(current.help)] })] }) }), _jsx(Text, { color: "yellow", children: note })] }));
 }

package/dist/shell/Frame.js

@@ -25,9 +25,7 @@ export function typeGlyph(manifest) {
     return type ? TYPE_GLYPH[type] : '???';
 }
 export function appStatus(project) {
-    const sync = project.devProperties
-        ? getPackageJsonSyncChanges(project.root, project.devProperties).length
-        : 0;
+    const sync = getPackageJsonSyncChanges(project.root).length;
     return {
         deps: project.hasNodeModules,
         config: Boolean(project.devProperties),

package/dist/shell/Shell.js

@@ -3,7 +3,7 @@ import path from 'node:path';
 import { useCallback, useEffect, useMemo, useReducer, useState } from 'react';
 import { Box, Text, useApp, useInput, useStdout } from 'ink';
 import Spinner from 'ink-spinner';
-import { detectProject, appTypeOf, localizedText, readWorkspaceDevProperties, readSvcConfig, writeSvcConfig, writeDevProperties, } from '../utils/project-detection.js';
+import { detectProject, appTypeOf, localizedText, readWorkspaceDevProperties, readSvcConfig, writeSvcConfig, writeDevProperties, syncDevPropertiesToPackageJson, } from '../utils/project-detection.js';
 import { appGroup, configIncomplete, needsOnboarding, } from '../utils/workspace.js';
 import { listAddons, listExecutables, } from '../utils/sitevision-api.js';
 import { useTasks, runningTasks, startActivate, getTasks, } from '../utils/tasks.js';
@@ -157,10 +157,7 @@ export function Shell({ apps: initialApps, workspaceRoot, version, minimal = fal
                 : rawProject.devProperties);
             if (!base)
                 return;
-            writeDevProperties(targetRoot, {
-                ...base,
-                environments: { ...base.environments, [clean]: {} },
-            });
+            writeDevProperties(targetRoot, { ...base, environments: { ...base.environments, [clean]: {} } }, { complete: !workspaceRoot });
             reload();
             setEnvChoice(clean);
             writeSvcConfig(configRoot, { environment: clean });
@@ -327,9 +324,20 @@ export function Shell({ apps: initialApps, workspaceRoot, version, minimal = fal
             return;
         }
         if (settings && focus === 'content') {
-            // Settings pane: the form owns everything but q and Tab/Esc above.
+            // Settings pane: the form owns everything but q, y and Tab/Esc above.
             if (input === 'q')
                 quit();
+            else if (input === 'y') {
+                try {
+                    if (syncDevPropertiesToPackageJson(workspaceRoot)) {
+                        reload();
+                        notify(t('package.json updated'), 'ok');
+                    }
+                }
+                catch (error) {
+                    notify(error instanceof Error ? error.message : String(error), 'error');
+                }
+            }
             return;
         }
         if (tab === 'versions') {
@@ -386,6 +394,7 @@ export function Shell({ apps: initialApps, workspaceRoot, version, minimal = fal
             ? h([
                 ['↑↓', 'field'],
                 ['Enter', 'edit'],
+                ['y', 'sync'],
                 ['Esc', 'back'],
                 ['q', 'quit'],
             ])
@@ -490,6 +499,7 @@ export function Shell({ apps: initialApps, workspaceRoot, version, minimal = fal
                     devProperties: project.devProperties,
                     base: rawProject.devProperties,
                     environment: env,
+                    workspaceRoot,
                 }, active: formActive, width: narrow ? columns : columns - sidebar, height: contentHeight, pickAddon: pickAddon, onSaved: () => {
                     reload();
                     notify(t('config saved'), 'ok');

package/dist/shell/Tabs.js

@@ -1,7 +1,7 @@
 import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import { Box, Text } from 'ink';
 import Spinner from 'ink-spinner';
-import { appTypeOf, getPackageJsonSyncChanges, localizedText, } from '../utils/project-detection.js';
+import { appTypeOf, getPackageJsonSyncChanges, readAncestorDevProperties, localizedText, } from '../utils/project-detection.js';
 import { checkSitevisionScriptsCompatibility } from '../utils/sitevision-scripts-runner.js';
 import { ACCENT, elapsed } from './Frame.js';
 import { t } from '../utils/i18n.js';
@@ -39,9 +39,14 @@ function time(ms, seconds = false) {
 export function Overview({ project, tasks, height, }) {
     const dev = project.devProperties;
     const inherited = new Set(project.inheritedKeys);
-    const src = (key) => (inherited.has(key) ? t('↑ root') : undefined);
+    const ancestors = readAncestorDevProperties(project.root);
+    const src = (key) => inherited.has(key)
+        ? Object.hasOwn(ancestors, key)
+            ? t('↑ root')
+            : 'package.json'
+        : undefined;
     const notSet = t('not set');
-    const sync = dev ? getPackageJsonSyncChanges(project.root, dev).length : 0;
+    const sync = getPackageJsonSyncChanges(project.root).length;
     const scripts = checkSitevisionScriptsCompatibility(project.root);
     const recent = tasks
         .filter(task => task.appRoot === project.root && task.status !== 'running')

package/dist/utils/i18n.js

@@ -187,6 +187,8 @@ const sv = {
     SOURCE: 'KÄLLA',
     "Shared by every app below {root}. An app's own value wins.": 'Delas av alla appar under {root}. Appens eget värde vinner.',
     'PACKAGE.JSON SYNC': 'PACKAGE.JSON-SYNK',
+    'no workspace package.json · y to set up': 'ingen package.json i arbetsytan · y för att skapa',
+    'Not saved: {error}': 'Inte sparat: {error}',
     '←→ choose · Enter confirm · Esc cancel': '←→ välj · Enter bekräfta · Esc avbryt',
     'Enter save · Esc cancel': 'Enter spara · Esc avbryt',
     '↑↓ field · Enter edit · ^O pick addon': '↑↓ fält · Enter redigera · ^O välj tillägg',

package/dist/utils/project-detection.d.ts

@@ -30,7 +30,14 @@ export declare function normalizeDomain(value: string): string;
  * app's would be. Used to edit shared config from the shell.
  */
 export declare function readWorkspaceDevProperties(root: string): Partial<DevProperties>;
-/** Dev properties inherited from ancestor directories only (no own file). */
+/** Ancestor directories' .dev_properties.json merged, nearest wins (no own file). */
+export declare function readAncestorDevProperties(root: string): Partial<DevProperties>;
+/** Shared defaults from package.json: the workspace root's first, the app's on top. */
+export declare function readPackageDefaultsChain(root: string): Partial<DevProperties>;
+/**
+ * Everything an app's own .dev_properties.json sits on top of: package.json
+ * defaults (root, then app), then ancestor .dev_properties.json files.
+ */
 export declare function readInheritedDevProperties(root: string): Partial<DevProperties>;
 /**
  * Get the full app ID including any prefix/suffix from environment
@@ -125,7 +132,9 @@ export declare function readDevProperties(projectRoot: string): DevProperties |
  * `accessToken` and `sessionCookie` are held in the OS keychain / resolved at
  * runtime instead.
  */
-export declare function writeDevProperties(projectRoot: string, properties: DevProperties): void;
+export declare function writeDevProperties(projectRoot: string, properties: DevProperties, { complete }?: {
+    complete?: boolean;
+}): void;
 /**
  * CLI preferences stored in .svcconfig at the project root. Unknown keys are
  * preserved on write so hand-edited entries survive.
@@ -137,22 +146,35 @@ export interface SvcConfig {
 }
 export declare function readSvcConfig(projectRoot: string): SvcConfig;
 export declare function writeSvcConfig(projectRoot: string, updates: SvcConfig): void;
+/**
+ * Values tied to the person running svc. They stay in .dev_properties.json and
+ * never go into package.json.
+ */
+export declare const USER_KEYS: string[];
 export interface PackageJsonSyncChange {
     key: string;
     from?: string;
     to: string;
 }
+/** The shared defaults one directory's package.json provides. */
+export declare function readPackageDefaults(dir: string): Partial<DevProperties>;
+/** What an unset field means, so spelling out the default is not a change. */
+export declare const IMPLICIT_VALUES: Record<string, unknown>;
+/** What syncing this directory would change in its package.json. */
+export declare function getPackageJsonSyncChanges(dir: string): PackageJsonSyncChange[];
+export declare function hasPackageJson(dir: string): boolean;
 /**
- * Which of the shared fields package.json is missing or disagrees on, relative
- * to the given dev properties. Reads package.json from disk — an earlier
- * `npm install` in the same session may have rewritten it.
+ * Copy the pending shared values from .dev_properties.json into package.json,
+ * creating package.json when the directory has none. Throws if it cannot be
+ * read or written.
  */
-export declare function getPackageJsonSyncChanges(projectRoot: string, properties: DevProperties): PackageJsonSyncChange[];
+export declare function syncDevPropertiesToPackageJson(dir: string): boolean;
 /**
- * Copy the shared fields from dev properties into package.json, preserving the
- * file's existing indentation and trailing newline.
+ * Edit package.json in place, keeping its indentation and trailing newline. A
+ * missing file is created; an unreadable or invalid one throws, so the caller
+ * can warn instead of dropping the change silently.
  */
-export declare function syncDevPropertiesToPackageJson(projectRoot: string, properties: DevProperties): boolean;
+export declare function updatePackageJson(dir: string, mutate: (packageJson: Record<string, unknown>) => void): void;
 /**
  * Move a plaintext password from .dev_properties.json into the OS keychain and
  * strip it from the file. Returns true if the password was migrated.

package/dist/utils/project-detection.js

@@ -123,14 +123,32 @@ export function readWorkspaceDevProperties(root) {
     }
     return merged;
 }
-/** Dev properties inherited from ancestor directories only (no own file). */
-export function readInheritedDevProperties(root) {
+/** Ancestor directories' .dev_properties.json merged, nearest wins (no own file). */
+export function readAncestorDevProperties(root) {
     let merged = {};
     for (const dir of ancestorDirs(root)) {
         merged = { ...merged, ...readDevPropertiesFile(dir) };
     }
     return merged;
 }
+/** Shared defaults from package.json: the workspace root's first, the app's on top. */
+export function readPackageDefaultsChain(root) {
+    let merged = {};
+    for (const dir of [...ancestorDirs(root), root]) {
+        merged = { ...merged, ...readPackageDefaults(dir) };
+    }
+    return merged;
+}
+/**
+ * Everything an app's own .dev_properties.json sits on top of: package.json
+ * defaults (root, then app), then ancestor .dev_properties.json files.
+ */
+export function readInheritedDevProperties(root) {
+    return {
+        ...readPackageDefaultsChain(root),
+        ...readAncestorDevProperties(root),
+    };
+}
 /**
  * Get app ID configuration from environment or defaults
  */
@@ -427,7 +445,9 @@ export function readDevProperties(projectRoot) {
  * `accessToken` and `sessionCookie` are held in the OS keychain / resolved at
  * runtime instead.
  */
-export function writeDevProperties(projectRoot, properties) {
+export function writeDevProperties(projectRoot, properties, 
+// App mode: write every value, so plain sitevision-scripts finds them all.
+{ complete = false } = {}) {
     const devPropertiesPath = findDevPropertiesPath(projectRoot) ||
         getDefaultDevPropertiesPath(projectRoot);
     const { password: _password, accessToken: _accessToken, sessionCookie: _sessionCookie, environmentName: _environmentName, productionEnvironment: _productionEnvironment, ...persisted } = properties;
@@ -435,7 +455,9 @@ export function writeDevProperties(projectRoot, properties) {
     // at the workspace root instead of being copied into every app. An empty
     // string means "unset", so it is dropped rather than written as an override
     // that would shadow the inherited value.
-    const inherited = readInheritedDevProperties(projectRoot);
+    const inherited = complete
+        ? {}
+        : readInheritedDevProperties(projectRoot);
     const own = Object.fromEntries(Object.entries(persisted).filter(([key, value]) => value !== '' &&
         (!Object.hasOwn(inherited, key) ||
             JSON.stringify(inherited[key]) !== JSON.stringify(value))));
@@ -457,13 +479,24 @@ export function writeSvcConfig(projectRoot, updates) {
 // PACKAGE.JSON SYNC
 // =============================================================================
 /**
- * Fields duplicated between .dev_properties.json and package.json, where
- * sitevision-scripts reads them under different names.
- */
-const PACKAGE_JSON_SYNC_KEYS = [
-    { packageKey: 'developmentDomain', devKey: 'domain' },
-    { packageKey: 'siteName', devKey: 'siteName' },
-    { packageKey: 'addonName', devKey: 'addonName' },
+ * Values tied to the person running svc. They stay in .dev_properties.json and
+ * never go into package.json.
+ */
+export const USER_KEYS = ['username', 'signingUsername', 'certificateName'];
+// Shared values package.json can hold: three top-level fields, the rest under "svc".
+const PACKAGE_TOP_KEYS = {
+    domain: 'developmentDomain',
+    siteName: 'siteName',
+    addonName: 'addonName',
+};
+const PACKAGE_SVC_KEYS = [
+    'authMethod',
+    'oauth2',
+    'sessionLoginUrl',
+    'useHTTPForDevDeploy',
+    'baseEnvironment',
+    'production',
+    'environments',
 ];
 function readPackageJson(projectRoot) {
     try {
@@ -473,59 +506,122 @@ function readPackageJson(projectRoot) {
         return null;
     }
 }
+/** The shared defaults one directory's package.json provides. */
+export function readPackageDefaults(dir) {
+    const packageJson = readPackageJson(dir);
+    if (!packageJson)
+        return {};
+    const defaults = {};
+    for (const [devKey, packageKey] of Object.entries(PACKAGE_TOP_KEYS)) {
+        const value = packageJson[packageKey];
+        if (typeof value === 'string' && value !== '')
+            defaults[devKey] = value;
+    }
+    const svc = packageJson['svc'];
+    for (const key of PACKAGE_SVC_KEYS) {
+        if (svc?.[key] !== undefined)
+            defaults[key] = svc[key];
+    }
+    if (typeof defaults['domain'] === 'string') {
+        defaults['domain'] = normalizeDomain(defaults['domain']);
+    }
+    return defaults;
+}
 /**
- * Which of the shared fields package.json is missing or disagrees on, relative
- * to the given dev properties. Reads package.json from disk — an earlier
- * `npm install` in the same session may have rewritten it.
+ * Shared values in this directory's own .dev_properties.json that package.json
+ * does not already provide, here or further up. User values never qualify.
  */
-export function getPackageJsonSyncChanges(projectRoot, properties) {
-    const packageJson = readPackageJson(projectRoot);
-    if (!packageJson)
+function pendingSync(dir) {
+    const own = readDevPropertiesFile(dir);
+    if (!own)
         return [];
-    const changes = [];
-    for (const { packageKey, devKey } of PACKAGE_JSON_SYNC_KEYS) {
-        const to = properties[devKey];
-        if (typeof to !== 'string' || to === '')
-            continue;
-        const from = packageJson[packageKey];
-        if (from !== to) {
-            changes.push(from === undefined
-                ? { key: packageKey, to }
-                : { key: packageKey, from, to });
+    const defaults = readPackageDefaultsChain(dir);
+    const pending = [];
+    for (const key of [...Object.keys(PACKAGE_TOP_KEYS), ...PACKAGE_SVC_KEYS]) {
+        let value = own[key];
+        if (key === 'environments' && value) {
+            value = Object.fromEntries(Object.entries(value).map(([name, override]) => [
+                name,
+                Object.fromEntries(Object.entries(override).filter(([field]) => !USER_KEYS.includes(field))),
+            ]));
         }
+        if (value === undefined || value === '')
+            continue;
+        if (JSON.stringify(value) ===
+            JSON.stringify(defaults[key] ?? IMPLICIT_VALUES[key]))
+            continue;
+        pending.push({ key, value });
     }
-    return changes;
+    return pending;
+}
+/** What an unset field means, so spelling out the default is not a change. */
+export const IMPLICIT_VALUES = {
+    authMethod: 'basic',
+    useHTTPForDevDeploy: false,
+    production: false,
+};
+const packageLabel = (key) => PACKAGE_TOP_KEYS[key] ?? `svc.${key}`;
+const display = (value) => typeof value === 'string' ? value : JSON.stringify(value);
+/** What syncing this directory would change in its package.json. */
+export function getPackageJsonSyncChanges(dir) {
+    const current = readPackageDefaults(dir);
+    return pendingSync(dir).map(({ key, value }) => current[key] === undefined
+        ? { key: packageLabel(key), to: display(value) }
+        : {
+            key: packageLabel(key),
+            from: display(current[key]),
+            to: display(value),
+        });
+}
+export function hasPackageJson(dir) {
+    return fs.existsSync(path.join(dir, 'package.json'));
+}
+/**
+ * Copy the pending shared values from .dev_properties.json into package.json,
+ * creating package.json when the directory has none. Throws if it cannot be
+ * read or written.
+ */
+export function syncDevPropertiesToPackageJson(dir) {
+    const pending = pendingSync(dir);
+    if (pending.length === 0 && hasPackageJson(dir))
+        return false;
+    updatePackageJson(dir, packageJson => {
+        for (const { key, value } of pending) {
+            const topKey = PACKAGE_TOP_KEYS[key];
+            if (topKey) {
+                packageJson[topKey] = value;
+            }
+            else {
+                packageJson['svc'] = {
+                    ...packageJson['svc'],
+                    [key]: value,
+                };
+            }
+        }
+    });
+    return true;
 }
 /**
- * Copy the shared fields from dev properties into package.json, preserving the
- * file's existing indentation and trailing newline.
+ * Edit package.json in place, keeping its indentation and trailing newline. A
+ * missing file is created; an unreadable or invalid one throws, so the caller
+ * can warn instead of dropping the change silently.
  */
-export function syncDevPropertiesToPackageJson(projectRoot, properties) {
-    const packageJsonPath = path.join(projectRoot, 'package.json');
-    let raw;
+export function updatePackageJson(dir, mutate) {
+    const packageJsonPath = path.join(dir, 'package.json');
+    // A new file is private, so a workspace root is never published by accident.
+    let raw = '{\n\t"private": true\n}\n';
     try {
-        raw = fs.readFileSync(packageJsonPath, 'utf-8');
-    }
-    catch {
-        return false;
-    }
-    let packageJson;
-    try {
-        packageJson = JSON.parse(raw);
-    }
-    catch {
-        return false;
+        if (hasPackageJson(dir))
+            raw = fs.readFileSync(packageJsonPath, 'utf-8');
+        const packageJson = JSON.parse(raw);
+        mutate(packageJson);
+        const indent = /^(?<indent>[\t ]+)/m.exec(raw)?.groups?.['indent'] ?? '\t';
+        const newline = raw.endsWith('\n') ? '\n' : '';
+        fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, indent) + newline);
     }
-    for (const { packageKey, devKey } of PACKAGE_JSON_SYNC_KEYS) {
-        const value = properties[devKey];
-        if (typeof value === 'string' && value !== '') {
-            packageJson[packageKey] = value;
-        }
+    catch (error) {
+        throw new Error(`Could not update ${packageJsonPath}: ${error instanceof Error ? error.message : String(error)}`);
     }
-    const indent = /^(?<indent>[\t ]+)/m.exec(raw)?.groups?.['indent'] ?? '\t';
-    const newline = raw.endsWith('\n') ? '\n' : '';
-    fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, indent) + newline);
-    return true;
 }
 /**
  * Move a plaintext password from .dev_properties.json into the OS keychain and
@@ -542,8 +638,22 @@ export function migrateLegacyPassword(project) {
         return false;
     if (!setDeployPassword(domain, username, password))
         return false;
-    // writeDevProperties strips `password` defensively; keep the in-memory value.
-    writeDevProperties(project.root, project.devProperties);
+    // Remove only the password, from whichever file holds it; every other value
+    // stays as written.
+    for (const dir of [project.root, ...ancestorDirs(project.root)]) {
+        const file = findDevPropertiesPath(dir);
+        if (!file)
+            continue;
+        try {
+            const { password: stored, ...rest } = JSON.parse(fs.readFileSync(file, 'utf8'));
+            if (stored !== undefined) {
+                fs.writeFileSync(file, JSON.stringify(rest, null, 2));
+            }
+        }
+        catch {
+            // Unreadable file: nothing to migrate there.
+        }
+    }
     project.hasLegacyPassword = false;
     return true;
 }

package/dist/utils/sitevision-api.js

@@ -509,9 +509,8 @@ export async function createAddon(config, appType) {
 export async function activateApp(executableId, config, _appType) {
     const protocol = config.useHTTP ? 'http' : 'https';
     const url = `${protocol}://${config.domain}/rest-api/1/0/${encodeURIComponent(config.siteName)}/Addon%20Repository/${encodeURIComponent(config.addonName)}/activateCustomModuleExecutable`;
-    const body = JSON.stringify({
-        executableId,
-    });
+    // Property name per the ActivateCustomModuleExecutable PUT docs.
+    const body = JSON.stringify({ customModuleExecutableId: executableId });
     const { auth, kind } = configAuth(config);
     try {
         const response = await makeRequest(url, {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sitevision-cli",
-	"version": "1.0.0-beta.20",
+	"version": "1.0.0-beta.22",
 	"license": "MIT",
 	"bin": {
 		"svc": "dist/cli.js"

package/readme.md

@@ -1,233 +1,139 @@
 # Sitevision CLI
 
-This CLI was largely built on the back of the [sitevision-scripts](https://github.com/sitevision/sitevision-scripts) project.
-However, these scripts have some limitations:
-
-- Clunky for use with environments requiring signed packages
-- Clunkly management of credentials and unsecure handling of credentials
-- No type safety
-
-## Features
-
-- **Interactive Menu** - Full-screen TUI with arrow key navigation
-- **Project Detection** - Automatically detects Sitevision projects
-- **Two Modes** - Interactive menu OR direct command execution
-- **Automatic Setup** - Guided setup for dev properties and signing credentials
-- **Secure Credentials** - Passwords live in the OS keychain (macOS Keychain / Windows Credential Manager / Linux libsecret), never on disk
+`svc` builds, signs and deploys Sitevision apps (WebApp, Widget, RESTApp,
+MCPServer) from a full-screen terminal shell or as plain commands.
+
+- **One shell for one app or a whole repo.** Run it inside an app, or at the
+  root of a repo with many apps and switch between them. Dev and watch keep
+  running in the background.
+- **Three ways to authenticate deploys:** username and password, OAuth2 (PKCE,
+  works with SSO), or a captured browser session for SAML-only sites.
+- **No secrets on disk.** Passwords, tokens and cookies live in the OS keychain.
+- **Environments.** dev, test and prod in one config; production deploys use
+  the signed zip, confirm and activate.
+- **Shared config in git.** Site and auth settings for the whole team live in
+  `package.json`, once at the repo root; your username stays in a local
+  `.dev_properties.json`. Compatible with plain sitevision-scripts.
+- **Builds the way Sitevision does.** Bundled apps without their own webpack
+  config are built by `@sitevision/sitevision-scripts`.
+- English and Swedish UI.
+
+📖 **[User guide](docs/user-guide.md)** · **[Användarguide (svenska)](docs/anvandarguide.md)**
 
 ## Install
 
-```bash
-npm install --global sitevision-cli
-```
-
-## Usage
-
-The CLI must be run inside a Sitevision project directory (containing a `manifest.json`).
-
-### Interactive shell
-
-Run `svc` with no arguments to open the full-screen shell. It works in two
-places:
-
-- **Inside an app** (a directory with `manifest.json`): single-app mode.
-- **At the root of a repo** that contains apps in subfolders such as
-  `webapps/*`, `restapps/*` or `widgets/*`: workspace mode, with every app in
-  the left navigator and per-app status dots (dependencies, config,
-  package.json sync, signing).
-
-The right pane has four tabs: **Overview**, **Config** (the whole
-`.dev_properties.json` as one form, plus signing and keychain secrets; `Tab`
-moves between fields, `Enter` saves, `Ctrl+O` on the addon field picks an
-addon from the site's Addon Repository), **Versions** (the versions uploaded
-to the site, `a` activates one) and **Log** (streaming build and deploy
-output). Dev and watch keep running in the background while you navigate
-between apps.
-
-Single-letter keys drive everything; the bottom bar shows the ones that apply.
-`/` opens the command palette with every action, `Tab` switches between the
-navigator and the content pane, `1`–`4` pick a tab, `q` quits.
-
-| Key             | Action                                                            |
-| --------------- | ----------------------------------------------------------------- |
-| `d` / `w`       | Dev (build, sign, deploy on change) / Watch (build and sign only) |
-| `b` / `s`       | Build / Sign                                                      |
-| `p` / `P`       | Deploy to dev / force deploy                                      |
-| `a`             | Versions tab: list and activate remote versions                   |
-| `e` / `y` / `l` | Edit dev properties / apply package.json sync / log in            |
-| `K`             | Stop the running task for the selected app                        |
-
-### Settings
-
-`,` (or "Settings" in the palette) opens the global preferences, stored in
-`~/.config/sitevision-cli/config.json`: the UI language (English or Swedish,
-which also picks the manifest name language) and whether the intro animation
-plays. In workspace mode the same screen has a row that jumps to the shared
-workspace config.
-
-### Environments
-
-The top-level fields of `.dev_properties.json` are one environment, called
-**dev** unless `baseEnvironment` says otherwise (a repo that only has a
-production site can set `"baseEnvironment": "prod"`). Add more under
-`environments`, overriding only what differs:
-
-```json
-{
-	"domain": "acme-use.sitevision-cloud.se",
-	"siteName": "Intranet",
-	"username": "me@acme.se",
-	"environments": {
-		"test": {"domain": "acme-tse.sitevision-cloud.se"},
-		"prod": {"domain": "acme.sitevision-cloud.se", "authMethod": "oauth2"}
-	}
-}
-```
-
-`E` cycles the active environment (also "Switch environment" and "Add
-environment" in the palette); the choice is remembered in `.svcconfig`. The
-top bar shows a badge, green for dev, yellow for others, red for production.
-Versions, deploy, login state and the Config tab all follow the active
-environment; on a non-dev environment the Config tab edits that environment's
-overrides. Override names containing `prod`, or any environment with `"production":
-true`, are production: deploy needs the signed zip, confirms, and activates,
-and dev or watch refuse to run against them. The base environment is never
-production by name, only by the flag, so a prod-only repo keeps its dev loop.
-Both settings have rows in the Config tab under ENVIRONMENT.
-
-### Shared configuration in a workspace
-
-`.dev_properties.json` is resolved by merging every ancestor directory's file
-(up to the repo root) under the app's own file, nearest wins. Put the shared
-fields (`domain`, `siteName`, `username`, `authMethod`, `oauth2`,
-`signingUsername`, ...) once at the repo root and keep only `addonName` in each
-app. The Config tab marks inherited values with `↑ root`, and saving an app's
-config never copies inherited values into the app file. Keychain entries are
-keyed by domain and username, so one login covers every app on the site.
-
-### Direct Commands
-
-You can also run commands directly:
-
-#### Development
-
-```bash
-# Start development server with watch mode
-svc dev
-
-# Start development server with automatic signing
-svc dev --signed
-```
-
-#### Building
+Requires Node.js 22+.
 
 ```bash
-# Build the application for production
-svc build
-```
-
-#### Signing
-
-```bash
-# Sign the app for production deployment
-svc sign
+npm install --global sitevision-cli
 ```
 
-#### Deployment
+## Quick start
 
 ```bash
-# Deploy to development server
-svc deploy
-
-# Force deploy (overwrite existing)
-svc deploy --force
-
-# Deploy to production (requires signed app)
-svc deploy --production
+cd my-repo          # or cd into a single app
+svc
 ```
 
-#### Setup
+1. Pick an app in the navigator and press `Enter`. (In a new repo the shell
+   opens on **Workspace settings** first.)
+2. Press `2` for the **Config** tab and fill in domain, site name, addon name,
+   username and auth method. Each field saves on `Enter`.
+3. Press `i` to install dependencies if needed, then `d` to start dev: build on
+   every change and deploy. Output is in the **Log** tab (`4`).
+
+For production: switch environment with `E`, press `b` to build, `s` to sign
+and `p` to deploy and activate.
+
+## The shell
+
+| Key             | Action                                              |
+| --------------- | --------------------------------------------------- |
+| `d` / `w`       | Dev (build + deploy on change) / Watch (build only) |
+| `b` / `s`       | Build / Sign                                        |
+| `p` / `P`       | Deploy / force deploy to the active environment     |
+| `a`             | Versions: list and activate uploaded versions       |
+| `E`             | Switch environment                                  |
+| `e` / `y` / `i` | Config tab / sync `package.json` / `npm install`    |
+| `l`             | Log in again                                        |
+| `K`             | Stop running tasks                                  |
+| `1`–`4`         | Overview · Config · Versions · Log                  |
+| `/`             | Command palette                                     |
+| `,`             | Settings (language, intro animation)                |
+| `Tab` / `Esc`   | Switch pane / back                                  |
+| `q`             | Quit                                                |
+
+In the navigator, typing filters the app list; action keys work once `Enter` or
+`Tab` has moved focus to the content pane. The bottom bar always shows the keys
+that apply. `svc --minimal` gives a compact layout for small panes.
+
+## Commands
 
 ```bash
-# Configure signing credentials
-svc setup-signing
+svc                                   # interactive shell
+svc build                             # build to dist/<id>.zip
+svc sign                              # sign to dist/<id>-signed.zip
+svc deploy [--force]                  # deploy the zip
+svc deploy --production [--activate]  # deploy the signed zip
+svc dev [--signed]                    # build + deploy on change
+svc watch [--signed]                  # build on change, no deploy
+svc info                              # project information
 ```
 
-#### Project Info
-
-```bash
-# Show project information and configuration
-svc info
-```
+Direct commands use the base environment. `--token` and `--cookie` pass an
+OAuth2 token or session cookie for one run.
 
 ## Configuration
 
-### Development Properties (`.dev_properties.json`)
-
-Create this file in your project root for deployment configuration:
-
-```json
-{
-	"domain": "your-site.sitevision.se",
-	"siteName": "YourSite",
-	"addonName": "your-addon",
-	"username": "your-email@example.com",
-	"useHTTPForDevDeploy": false,
-	"signingUsername": "your-developer-account@example.com",
-	"certificateName": "optional-certificate-name"
-}
-```
-
-### Keeping `package.json` in sync
-
-`sitevision-scripts` reads `developmentDomain`, `siteName` and `addonName`
-from `package.json`, which duplicates three fields of
-`.dev_properties.json`. When they disagree — or when a fresh setup has just
-written `.dev_properties.json` — `svc` shows the differences and offers to
-update `package.json` from `.dev_properties.json`. Nothing is written without
-confirmation, and `.dev_properties.json` is always the source of truth for
-the copy. Existing indentation and unrelated fields are left alone.
-
-After answering, `svc` offers to remember the choice in a `.svcconfig` file
-in the project root:
+`.dev_properties.json` is your local config and the main source; keep it out of
+git. Shared values are committed in `package.json` and act as defaults
+underneath it:
 
 ```json
 {
-	"syncPackageJson": true
+	"developmentDomain": "acme-use.sitevision-cloud.se",
+	"siteName": "Intranet",
+	"addonName": "my-addon",
+	"svc": {
+		"authMethod": "oauth2",
+		"environments": {"prod": {"domain": "acme.sitevision-cloud.se"}}
+	}
 }
 ```
 
-With `true`, `svc` updates `package.json` automatically without asking; with
-`false`, the check is skipped entirely. Delete the key (or the file) to be
-asked again. The file contains no secrets, so it is safe to commit.
+`username`, `signingUsername` and `certificateName` are user-specific and only
+live in `.dev_properties.json`. `y` copies shared values from
+`.dev_properties.json` into `package.json`. In a workspace, shared values go in
+the root `package.json` and each app's `package.json` only needs `addonName`.
 
-### Password storage
+## Authentication in short
 
-Passwords are stored in the OS-native secret store (macOS Keychain, Windows
-Credential Manager, Linux libsecret) under the `sitevision-cli` service —
-never in `.dev_properties.json`. Run `svc` and complete the setup form (or
-enter the password when prompted at deploy/sign time and toggle "save to
-keychain") to populate it.
+There are two separate credentials:
 
-If an existing `.dev_properties.json` contains a plaintext `password` field,
-the CLI offers to migrate it to the keychain on next launch and strip the
-field from the file. The migration prompt only appears in interactive mode
-(plain `svc`) — if you only ever invoke commands directly (`svc deploy`,
-`svc dev`), run `svc` once to migrate.
+- **Deploy**: your account on the site. `authMethod` is `basic` (password),
+  `oauth2` (browser login against the site's OAuth2 provider, refreshed
+  silently afterwards) or `cookie` (log in with SSO in a Chrome window, the
+  session is captured).
+- **Signing**: your developer.sitevision.se account, always username and
+  password.
 
-For CI / headless use, set `SITEVISION_DEPLOY_PASSWORD` and/or
-`SITEVISION_SIGNING_PASSWORD` — these take precedence over the keychain and
-are never written anywhere.
+Everything secret goes in the OS keychain under `sitevision-cli`. For CI, set
+`SITEVISION_DEPLOY_PASSWORD`, `SITEVISION_SIGNING_PASSWORD`,
+`SITEVISION_ACCESS_TOKEN` or `SITEVISION_SESSION_COOKIE`.
 
-### Signing Credentials
+OAuth2 needs a client registered on the site with the redirect URI
+`http://127.0.0.1:8137/callback`. The [user guide](docs/user-guide.md#5-authentication)
+covers the setup, the pitfalls, and which method works with which command.
 
-Signing credentials are used to sign apps via developer.sitevision.se:
+## Development
 
-- `signingUsername` - Your developer.sitevision.se account
-- `certificateName` - Optional, if you have multiple certificates
+```bash
+npm install
+npm run build   # tsc → dist/
+npm test        # prettier, xo, ava
+```
 
-The signing password is prompted on first use, with an option to save it to
-the OS keychain for future runs.
+Releasing: see [RELEASING.md](RELEASING.md).
 
 ## License