sitevision-cli 1.0.0-beta.31 → 1.0.0-beta.33

package/dist/utils/create-app.js

@@ -0,0 +1,226 @@
+/**
+ * New apps are scaffolded by Sitevision's own tool. svc runs it as a task and
+ * answers its questions through a socket (see source/scaffold); when the tool no
+ * longer asks through inquirer the run is reported as unmanaged, and the caller
+ * hands it the real terminal instead.
+ */
+import fs from 'node:fs';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import readline from 'node:readline';
+import { spawn } from 'node:child_process';
+import { stripVTControlCharacters } from 'node:util';
+import { t } from './i18n.js';
+import { ProcessRunner } from './process-runner.js';
+import { createTask, setPhase } from './tasks.js';
+import { detectProject, findDevPropertiesPath, migrateLegacyPassword, readInheritedDevProperties, readManifest, updatePackageJson, writeManifestField, } from './project-detection.js';
+export const CREATE_COMMAND = [
+    'npx',
+    '--yes',
+    '@sitevision/create-sitevision-app',
+];
+/** A folder name that is also a usable package name and manifest id. */
+export const validAppName = (name) => /^[\da-z][\w\-.]*$/i.test(name);
+/** The closest conventional name: "Min nya app!" and "MinNyaApp" become "min-nya-app". */
+export function suggestAppName(name) {
+    return name
+        .trim()
+        .normalize('NFKD')
+        .replaceAll(/[\u0300-\u036F]/g, '')
+        .replaceAll(/(?<=[\da-z])(?=[A-Z])/g, '-')
+        .toLowerCase()
+        .replaceAll(/\s+/g, '-')
+        .replaceAll(/[^\w\-.]/g, '')
+        .replace(/^[^\da-z]+/i, '');
+}
+/** What is wrong with a typed app name, said so the fix is obvious. */
+export function appNameProblem(typed) {
+    const name = typed.trim();
+    if (!name)
+        return t('Type a name for the app, for example my-new-app.');
+    if (validAppName(name))
+        return undefined;
+    const suggestion = suggestAppName(name);
+    const tryThis = suggestion
+        ? ' ' + t('Try "{suggestion}".', { suggestion })
+        : '';
+    if (/\s/.test(name) && validAppName(name.replaceAll(/\s+/g, '-')))
+        return t("An app name can't have spaces.") + tryThis;
+    const bad = [...new Set(name.replaceAll(/[\s\w\-.]/g, ''))].join(' ');
+    if (bad) {
+        return (t("An app name can't contain {chars}: it becomes the folder, the package name and the app id.", {
+            chars: bad,
+        }) + tryThis);
+    }
+    return t('Start the name with a letter or a digit.') + tryThis;
+}
+/** A valid name that could be better; the user may keep it. */
+export function appNameAdvice(typed) {
+    const name = typed.trim();
+    if (!validAppName(name) || name === name.toLowerCase())
+        return undefined;
+    return t('Lowercase is safer: npm expects it, and "{name}" and "{lower}" are one folder on macOS and Windows but two on Linux. Try "{suggestion}", or press Enter again to keep "{name}".', { name, lower: name.toLowerCase(), suggestion: suggestAppName(name) });
+}
+export const isEmptyOrMissing = (dir) => !fs.existsSync(dir) || fs.readdirSync(dir).length === 0;
+/** Listen for the stub's questions. `null` from `ask` means the user cancelled. */
+export async function servePrompts(ask, onCancel) {
+    const id = `svc-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
+    const socketPath = process.platform === 'win32'
+        ? `\\\\.\\pipe\\${id}`
+        : path.join(os.tmpdir(), `${id}.sock`);
+    let connected = false;
+    const server = net.createServer(socket => {
+        connected = true;
+        socket.on('error', () => { });
+        void (async () => {
+            for await (const line of readline.createInterface({ input: socket })) {
+                const reply = await ask(JSON.parse(line));
+                if (!reply) {
+                    socket.destroy();
+                    onCancel();
+                    return;
+                }
+                socket.write(JSON.stringify(reply) + '\n');
+            }
+        })();
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(socketPath, resolve);
+    });
+    return {
+        socketPath,
+        connected: () => connected,
+        close: () => server.close(),
+    };
+}
+/**
+ * Run the scaffolder for `name` inside `parentDir`. "unmanaged" means it never
+ * asked svc anything and left no app: the prompt bridge did not take.
+ */
+export function startCreateApp(options) {
+    const { name, parentDir, ask, command = CREATE_COMMAND } = options;
+    const appDir = path.join(parentDir, name);
+    let runner;
+    let stopped = false;
+    const { task, log, finish } = createTask('create', { root: appDir, manifest: { name, id: name } }, 'create-sitevision-app', () => {
+        stopped = true;
+        runner?.kill();
+        finish('stopped');
+    });
+    const done = (async () => {
+        const prompts = await servePrompts(ask, () => task.stop());
+        try {
+            // .js from dist, .ts when svc itself runs from source.
+            const register = new URL(`../scaffold/register${path.extname(import.meta.url)}`, import.meta.url).href;
+            runner = new ProcessRunner(command[0], [...command.slice(1), name], parentDir, {
+                ...process.env,
+                NODE_OPTIONS: `${process.env['NODE_OPTIONS'] ?? ''} --import=${register}`.trim(),
+                SVC_PROMPT_SOCKET: prompts.socketPath,
+            });
+            runner.on('output', (output) => {
+                // The tool clears the screen between steps; that is noise in a log.
+                const text = stripVTControlCharacters(output.data);
+                if (text.trim())
+                    log('create', text, output.type === 'stderr' ? 'warn' : 'info');
+            });
+            setPhase(task, 'scaffolding');
+            await runner.run();
+            if (stopped)
+                return 'stopped';
+            // The exit code is 0 even when the prompts crash, so look at the result.
+            if (readManifest(appDir)) {
+                finish('success');
+                return 'created';
+            }
+            if (prompts.connected()) {
+                finish('error', 'The scaffolder finished without creating an app');
+                return 'failed';
+            }
+            finish('stopped');
+            return 'unmanaged';
+        }
+        catch (error) {
+            finish('error', error instanceof Error ? error.message : String(error));
+            return 'failed';
+        }
+        finally {
+            prompts.close();
+        }
+    })();
+    return { task, done };
+}
+/** Run the scaffolder on the real terminal; resolves when it exits. */
+export async function createAppInTerminal(name, parentDir) {
+    await new Promise(resolve => {
+        // `name` is validated by the caller; joined to avoid DEP0190.
+        const child = spawn([...CREATE_COMMAND, name].join(' '), {
+            cwd: parentDir,
+            stdio: 'inherit',
+            shell: true,
+        });
+        child.on('close', () => resolve());
+        child.on('error', () => resolve());
+    });
+    try {
+        return Boolean(readManifest(path.join(parentDir, name)));
+    }
+    catch {
+        // A half-written manifest is a failed scaffold, not a crash.
+        return false;
+    }
+}
+/**
+ * Replace the template's placeholders with what is known, and fold the config
+ * the tool wrote into svc's layout: no plaintext password, and nothing in the
+ * app's .dev_properties.json that the workspace already provides.
+ */
+export function seedNewApp(appDir, workspaceRoot) {
+    const found = readManifest(appDir);
+    if (!found)
+        return;
+    const { manifest, manifestPath } = found;
+    const seed = (key, value) => {
+        const localized = typeof manifest[key] === 'object';
+        writeManifestField(manifestPath, key, value, localized ? 'en' : undefined);
+    };
+    seed('name', path.basename(appDir));
+    if (workspaceRoot) {
+        let shared = {};
+        try {
+            shared = JSON.parse(fs.readFileSync(path.join(workspaceRoot, 'package.json'), 'utf8'));
+        }
+        catch { }
+        const author = typeof shared['author'] === 'object'
+            ? shared['author']?.name
+            : shared['author'];
+        if (typeof author === 'string' && author)
+            writeManifestField(manifestPath, 'author', author);
+        if (typeof shared['homepage'] === 'string' && shared['homepage'])
+            writeManifestField(manifestPath, 'helpUrl', shared['homepage']);
+    }
+    const project = detectProject(appDir);
+    if (project)
+        migrateLegacyPassword(project);
+    const file = findDevPropertiesPath(appDir);
+    if (!workspaceRoot || !file)
+        return;
+    const own = JSON.parse(fs.readFileSync(file, 'utf8'));
+    const inherited = readInheritedDevProperties(appDir);
+    if (typeof own['addonName'] === 'string' && own['addonName']) {
+        const addonName = own['addonName'];
+        updatePackageJson(appDir, packageJson => {
+            packageJson['addonName'] = addonName;
+        });
+    }
+    const rest = Object.fromEntries(Object.entries(own).filter(([key, value]) => key !== 'addonName' &&
+        value !== '' &&
+        value !== undefined &&
+        !(key === 'useHTTPForDevDeploy' && value === false) &&
+        JSON.stringify(value) !== JSON.stringify(inherited[key])));
+    if (Object.keys(rest).length === 0)
+        fs.rmSync(file);
+    else
+        fs.writeFileSync(file, JSON.stringify(rest, null, 2) + '\n');
+}

package/dist/utils/i18n.js

@@ -45,7 +45,7 @@ const sv = {
     auth: 'auth',
     'signing user': 'signeringsanv.',
     'not set': 'ej satt',
-    '↑ root': '↑ rot',
+    '↑ root': '↑ root',
     ' · bundled': ' · paketerad',
     deps: 'beroenden',
     config: 'konfig',
@@ -54,16 +54,16 @@ const sv = {
     scripts: 'scripts',
     'missing · i to install': 'saknas · i för att installera',
     'not installed · i to install': 'ej installerat · i för att installera',
-    'dev properties': 'dev-egenskaper',
+    'dev properties': 'dev_properties',
     'missing · e to edit': 'saknas · e för att redigera',
     '{n} diffs · y to apply': '{n} skillnader · y för att tillämpa',
     '1 diff · y to apply': '1 skillnad · y för att tillämpa',
     'missing · / set up signing': 'saknas · / konfigurera signering',
     'not installed': 'ej installerat',
-    '⚠ plaintext password in .dev_properties.json · / migrate': '⚠ lösenord i klartext i .dev_properties.json · / migrera',
+    '⚠ plaintext password in .dev_properties.json · / migrate': '⚠ lösenord i klartext funna i .dev_properties.json · / migrera',
     RECENT: 'SENASTE',
     '⚠ Configure dev properties first (e).': '⚠ Konfigurera dev-egenskaper först (e).',
-    'Press R to fetch versions from {domain}.': 'Tryck R för att hämta versioner från {domain}.',
+    'Press r to fetch versions from {domain}.': 'Tryck r för att hämta versioner från {domain}.',
     'APP IDENTIFIER': 'APP-ID',
     VERSION: 'VERSION',
     ACTIVE: 'AKTIV',
@@ -89,13 +89,13 @@ const sv = {
     Watch: 'Watch',
     Build: 'Build',
     Sign: 'Sign',
-    Deploy: 'Driftsätt',
-    'Deploy (force)': 'Driftsätt (tvinga)',
+    Deploy: 'Deploy',
+    'Deploy (force)': 'Deploy (force)',
     'to {env}': 'till {env}',
     'Switch environment': 'Byt miljö',
     'Add environment': 'Lägg till miljö',
     Help: 'Hjälp',
-    'every key in one place': 'alla tangenter på ett ställe',
+    'every key in one place': 'alla kortkommandon på ett ställe',
     Keys: 'Tangenter',
     'Esc close': 'Esc stäng',
     Here: 'Här',
@@ -129,7 +129,7 @@ const sv = {
     'Addon {addon} does not exist on {domain}. Create it and deploy again?': 'Tillägget {addon} finns inte på {domain}. Skapa det och driftsätt igen?',
     'e.g. test or prod, overriding domain and auth': 't.ex. test eller prod, med egen domän och auth',
     'Environment name (e.g. test, prod)': 'Miljönamn (t.ex. test, prod)',
-    'Deploy the signed {id} to {env} and activate it?': 'Driftsätt signerade {id} till {env} och aktivera?',
+    'Deploy the signed {id} to {env} (addon {addon}) and activate it?': 'Driftsätt signerade {id} till {env} (addon {addon}) och aktivera?',
     'Dev never deploys to a production environment ({env}). Switch with v.': 'Dev driftsätter aldrig till en produktionsmiljö ({env}). Byt med v.',
     'switched to {env}': 'bytte till {env}',
     'environment {env} added': 'miljön {env} tillagd',
@@ -137,9 +137,16 @@ const sv = {
     production: 'produktion',
     env: 'miljö',
     '↑ dev': '↑ dev',
-    'Activate a remote version': 'Aktivera en fjärrversion',
-    'Stop running task': 'Stoppa pågående uppgift',
+    'Activate a remote version': 'Aktivera en uppladdad version',
+    'Stop running task': 'Stoppa pågående körning',
     'Edit config': 'Redigera konfig',
+    'New app': 'Ny app',
+    'Skipped: {reason}': 'Hoppade över: {reason}',
+    'Skipped {n} apps. First: {reason}': 'Hoppade över {n} appar. Första: {reason}',
+    'A new app is still being created. Stop it and quit?': 'En ny app håller på att skapas. Avbryta den och avsluta?',
+    'An app is already being created.': 'En app håller redan på att skapas.',
+    'Could not save to the OS keychain; you will be asked again next time.': 'Kunde inte spara i nyckelringen; du får frågan igen nästa gång.',
+    Navigator: 'Navigering',
     'Sync package.json': 'Synka package.json',
     'Migrate password to OS keychain': 'Flytta lösenord till nyckelringen',
     'Install dependencies': 'Installera beroenden',
@@ -187,7 +194,7 @@ const sv = {
     'Auth method': 'Auth-metod',
     Password: 'Lösenord',
     'OAuth2 client id': 'OAuth2 klient-id',
-    'Authorization endpoint': 'Auktoriseringsendpoint',
+    'Authorization endpoint': 'Authorization url',
     'Token endpoint': 'Token-endpoint',
     Scopes: 'Scopes',
     'Client secret': 'Klienthemlighet',
@@ -197,11 +204,43 @@ const sv = {
     Certificate: 'Certifikat',
     'Signing password': 'Signeringslösenord',
     '^O pick from repo': '^O välj från förråd',
-    'Space-separated scopes to request. ALL grants the Sitevision API and offline_access adds a refresh token so later runs log in silently. Match the casing your client expects.': 'Scopes att begära, separerade med mellanslag. ALL ger Sitevision-API:et och offline_access ger en refresh-token så att senare körningar loggar in tyst. Använd det skiftläge klienten förväntar sig.',
+    'Space-separated scopes to request. ALL grants the Sitevision API and offline_access adds a refresh token so later runs log in silently. Match the casing your client expects.': 'Scopes att begära, separerade med mellanslag. ALL ger Sitevision-API:et och offline_access ger en refresh-token så att senare körningar loggar in tyst. Skriftlägesskänsligt.',
     'blank = site root': 'tomt = webbplatsens rot',
     'required for signed deploys': 'krävs för signerad driftsättning',
     'blank = prompt each run': 'tomt = fråga varje gång',
     SIGNING: 'SIGNERING',
+    MANIFEST: 'MANIFEST',
+    // New app
+    'Name of the new app': 'Namn på den nya appen',
+    'Create it in folder': 'Skapa den i mappen',
+    'Other folder…': 'Annan mapp…',
+    'Type a name for the app, for example my-new-app.': 'Skriv ett namn på appen, till exempel min-nya-app.',
+    'Try "{suggestion}".': 'Prova "{suggestion}".',
+    "An app name can't have spaces.": 'Ett appnamn kan inte innehålla mellanslag.',
+    "An app name can't contain {chars}: it becomes the folder, the package name and the app id.": 'Ett appnamn kan inte innehålla {chars}: det blir mappen, paketnamnet och appens id.',
+    'Lowercase is safer: npm expects it, and "{name}" and "{lower}" are one folder on macOS and Windows but two on Linux. Try "{suggestion}", or press Enter again to keep "{name}".': 'Gemener är säkrare: npm förväntar sig det, och "{name}" och "{lower}" är samma mapp på macOS och Windows men två på Linux. Prova "{suggestion}", eller tryck Enter igen för att behålla "{name}".',
+    'Start the name with a letter or a digit.': 'Börja namnet med en bokstav eller en siffra.',
+    '{dir} already exists. Pick another name, or keep it and choose a different folder next.': '{dir} finns redan. Välj ett annat namn, eller behåll det och välj en annan mapp i nästa steg.',
+    'creating {app}: installing, questions follow': 'skapar {app}: installerar, frågor kommer strax',
+    'The scaffolder could not be run from here': 'Verktyget kunde inte köras härifrån',
+    'creating {app} failed, see the log': 'kunde inte skapa {app}, se loggen',
+    '{app} created in {dir}': '{app} skapad i {dir}',
+    '{app} created': '{app} skapad',
+    'Create the addon "{addon}" on {domain} now?': 'Skapa tillägget "{addon}" på {domain} nu?',
+    '↑↓ move · Space toggle · Enter submit · Esc cancel': '↑↓ flytta · Mellanslag markera · Enter skicka · Esc avbryt',
+    'App id': 'App-id',
+    Version: 'Version',
+    Name: 'Namn',
+    Description: 'Beskrivning',
+    Author: 'Författare',
+    'Help URL': 'Hjälp-URL',
+    'Not saved: {label} is required.': 'Inte sparat: {label} krävs.',
+    'Identifier of the app in Sitevision; it also names the zip. Changing it makes the next deploy a new app instead of an update.': 'Appens identifierare i Sitevision; den namnger också zip-filen. Ändras den blir nästa driftsättning en ny app i stället för en uppdatering.',
+    'Version of the app. Id and version together identify an upload, so bump it to deploy a new version instead of overwriting the current one.': 'Appens version. Id och version identifierar tillsammans en uppladdning, så höj den för att driftsätta en ny version i stället för att skriva över den nuvarande.',
+    'Name shown when importing and administering the app in the Sitevision editor. A multilingual manifest needs at least English.': 'Namnet som visas när appen importeras och administreras i Sitevisions redigerare. Ett flerspråkigt manifest behöver minst engelska.',
+    'Short description shown next to the name in the Sitevision editor.': 'Kort beskrivning som visas bredvid namnet i Sitevisions redigerare.',
+    'Who made the app, shown in the Sitevision editor.': 'Vem som gjort appen, visas i Sitevisions redigerare.',
+    "Link to the app's documentation, shown in the Sitevision editor.": 'Länk till appens dokumentation, visas i Sitevisions redigerare.',
     ENVIRONMENT: 'MILJÖ',
     'Environment name': 'Miljönamn',
     Production: 'Produktion',
@@ -274,7 +313,9 @@ const sv = {
     // Config help
     "Domain of this environment's site (USE or TSE) without https://, e.g. myorg-use.sitevision-cloud.se. Deploys and version lookups go here.": 'Domän för den här miljöns webbplats (USE eller TSE) utan https://, t.ex. myorg-use.sitevision-cloud.se. Driftsättningar och versionslistor går hit.',
     "Name of the site's root node in Sitevision, exactly as shown in the site tree. It becomes part of the REST API path.": 'Namnet på webbplatsens rotnod i Sitevision, exakt som i webbplatsträdet. Det blir en del av REST API-sökvägen.',
-    "Name of the addon (custom module) in the site's Addon Repository that this app is uploaded into. Ctrl+O lists the existing ones.": 'Namnet på tillägget (custom module) i webbplatsens tilläggsförråd som appen laddas upp till. Ctrl+O listar befintliga.',
+    "Name of the addon (custom module) in the site's Addon Repository that this app is uploaded into. Ctrl+O lists the existing ones. It is separate from the manifest name: to make them match, rename the addon in Sitevision (Addons, General, Settings) and pick it again with Ctrl+O. For a RESTApp the addon name is part of its endpoint URL.": 'Namnet på tillägget (custom module) i webbplatsens tilläggsförråd som appen laddas upp till. Ctrl+O listar befintliga. Det är skilt från manifestets namn: för att få dem att stämma, byt namn på tillägget i Sitevision (Tillägg, Allmänt, Inställningar) och välj det igen med Ctrl+O. För en RESTApp ingår tilläggets namn i dess endpoint-URL.',
+    '≠ manifest': '≠ manifest',
+    'addon name {addon} · manifest name {names}': 'tilläggsnamn {addon} · manifestnamn {names}',
     'Sitevision account used for deploys, usually your Sitevision Cloud e-mail. It needs DEVELOPER or MANAGE_ADDONS permission on the site. Required for basic auth; with oauth2 or cookie it only labels the stored credential.': 'Sitevision-konto som används för driftsättning, oftast din Sitevision Cloud-e-post. Behöver DEVELOPER eller MANAGE_ADDONS på webbplatsen. Krävs för basic; med oauth2 eller cookie används det bara för att märka den sparade inloggningen.',
     "How deploys authenticate: basic = username and password; oauth2 = bearer token from the site's OAuth2 provider (PKCE, opens a browser); cookie = reuse a browser SSO/SAML session.": 'Hur driftsättningar autentiseras: basic = användarnamn och lösenord; oauth2 = bearer-token från webbplatsens OAuth2-provider (PKCE, öppnar webbläsare); cookie = återanvänd en SSO/SAML-session från webbläsaren.',
     'Deploy password for the account above. Stored in the OS keychain, never in a file. Leave empty to be asked on each run.': 'Driftsättningslösenord för kontot ovan. Sparas i nyckelringen, aldrig i en fil. Lämna tomt för att bli tillfrågad varje gång.',
@@ -290,6 +331,20 @@ const sv = {
     // Settings screen
     Language: 'Språk',
     'Intro animation': 'Introanimation',
+    'Update check': 'Uppdateringskoll',
+    'Addon name warning': 'Varning om tilläggsnamn',
+    'Default signing user': 'Förvald signeringsanvändare',
+    'Default certificate': 'Förvalt certifikat',
+    'The language svc itself speaks.': 'Språket som svc självt använder.',
+    'Play the logo animation when the shell starts.': 'Spela logotypanimationen när skalet startar.',
+    'Look for a newer svc on npm at start.': 'Leta efter en nyare svc på npm vid start.',
+    'Mark the addon name with ≠ manifest when it is none of the names in manifest.json.': 'Markera tilläggsnamnet med ≠ manifest när det inte är något av namnen i manifest.json.',
+    'The developer.sitevision.se account that signs in every project without a signing user of its own.': 'Kontot på developer.sitevision.se som signerar i alla projekt utan egen signeringsanvändare.',
+    'Which certificate signs when the account has several. Empty = the account default.': 'Vilket certifikat som signerar när kontot har flera. Tomt = kontots standard.',
+    'Enter confirm · Esc cancel': 'Enter bekräfta · Esc avbryt',
+    'Not saved: the settings file does not parse.': 'Inte sparat: inställningsfilen går inte att tolka.',
+    'The settings file does not parse and is ignored until it is fixed.': 'Inställningsfilen går inte att tolka och ignoreras tills den är lagad.',
+    global: 'global',
     on: 'på',
     off: 'av',
     'Saved.': 'Sparat.',

package/dist/utils/jsonc.js

@@ -70,5 +70,6 @@ export function stripJsonComments(input) {
  * SyntaxError if the content is invalid even after comments are removed.
  */
 export function parseJsonc(input) {
-    return JSON.parse(stripJsonComments(input));
+    // Editors on Windows may prepend a BOM, which JSON.parse rejects.
+    return JSON.parse(stripJsonComments(input.replace(/^\uFEFF/, '')));
 }

package/dist/utils/keychain.js

@@ -1,5 +1,36 @@
-import { Entry } from '@napi-rs/keyring';
+import { createRequire } from 'node:module';
 const SERVICE = 'sitevision-cli';
+let EntryImpl;
+// SVC_NO_KEYCHAIN=1 turns the keychain off (documented, for CI). `memory` is
+// for the test suite only: secrets live and die with the process.
+const memory = new Map();
+const memoryEntry = (account) => ({
+    getPassword: () => memory.get(account) ?? null,
+    setPassword(password) {
+        memory.set(account, password);
+    },
+    deletePassword: () => memory.delete(account),
+});
+// Loaded on first use so a missing native binding never breaks startup.
+function entry(account) {
+    const off = process.env['SVC_NO_KEYCHAIN'];
+    if (off === 'memory')
+        return memoryEntry(account);
+    if (off)
+        throw new Error('Keychain disabled');
+    if (EntryImpl === undefined) {
+        try {
+            const keyring = createRequire(import.meta.url)('@napi-rs/keyring');
+            EntryImpl = keyring.Entry;
+        }
+        catch {
+            EntryImpl = null;
+        }
+    }
+    if (!EntryImpl)
+        throw new Error('Keychain unavailable');
+    return new EntryImpl(SERVICE, account);
+}
 function deployAccount(domain, username) {
     return `deploy:${username}@${domain}`;
 }
@@ -17,24 +48,33 @@ function sessionCookieAccount(domain, username) {
 }
 function safeGet(account) {
     try {
-        return new Entry(SERVICE, account).getPassword();
+        return entry(account).getPassword();
     }
     catch {
         return null;
     }
 }
+let saveFailed = () => {
+    console.warn('\u001B[33mCould not save to the OS keychain; you will be asked again next time.\u001B[0m');
+};
+/** Replace how a failed keychain save is reported (the shell shows a notice). */
+export function onKeychainSaveFailed(listener) {
+    saveFailed = listener;
+}
 function safeSet(account, password) {
     try {
-        new Entry(SERVICE, account).setPassword(password);
+        entry(account).setPassword(password);
         return true;
     }
     catch {
+        // Callers mostly ignore the result, so the user hears it from here.
+        saveFailed();
         return false;
     }
 }
 function safeDelete(account) {
     try {
-        new Entry(SERVICE, account).deletePassword();
+        entry(account).deletePassword();
     }
     catch {
         // ignore

package/dist/utils/oauth2-auth.js

@@ -23,8 +23,32 @@ export function createPkcePair() {
     const challenge = base64url(crypto.createHash('sha256').update(verifier).digest());
     return { verifier, challenge };
 }
-function hasOAuth2Config(config) {
-    return Boolean(config?.authorizationEndpoint && config.tokenEndpoint && config.clientId);
+/**
+ * Why this project's OAuth2 settings cannot be used, if they cannot. The
+ * endpoints may come from a committed package.json, and the keychain secrets
+ * are stored per site, so they only ever go to that site, over TLS.
+ */
+export function oauth2ConfigProblem(dev) {
+    const config = dev.oauth2;
+    if (!config?.authorizationEndpoint ||
+        !config.tokenEndpoint ||
+        !config.clientId) {
+        return 'OAuth2 is not fully configured (authorization/token endpoint or client ID missing).';
+    }
+    if (!dev.domain)
+        return 'OAuth2 needs the site domain to be set.';
+    const schemes = dev.useHTTPForDevDeploy ? ['https:', 'http:'] : ['https:'];
+    for (const endpoint of [config.authorizationEndpoint, config.tokenEndpoint]) {
+        const url = URL.canParse(endpoint) ? new URL(endpoint) : undefined;
+        if (!url || !schemes.includes(url.protocol)) {
+            return `OAuth2 endpoint ${endpoint} must be an https URL.`;
+        }
+    }
+    const tokenHost = new URL(config.tokenEndpoint).host.toLowerCase();
+    if (tokenHost !== dev.domain.toLowerCase()) {
+        return `OAuth2 token endpoint is on ${tokenHost}, not on ${dev.domain}. Stored secrets are only sent to the site they belong to.`;
+    }
+    return undefined;
 }
 async function postToken(config, params, secret) {
     const body = Buffer.from(new URLSearchParams(params).toString());
@@ -41,6 +65,7 @@ async function postToken(config, params, secret) {
         });
         if (response.statusCode !== 200) {
             return {
+                status: response.statusCode,
                 error: `Token endpoint returned ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`,
             };
         }
@@ -169,7 +194,7 @@ function startLoopback(port, state) {
  */
 export function beginOAuth2Login(dev) {
     const config = dev.oauth2;
-    if (!hasOAuth2Config(config))
+    if (!config || oauth2ConfigProblem(dev))
         return null;
     const { domain } = dev;
     const secret = getOAuth2ClientSecret(domain, config.clientId) ?? undefined;
@@ -218,14 +243,14 @@ export function beginOAuth2Login(dev) {
  */
 export async function resolveOAuth2AccessToken(dev) {
     const config = dev.oauth2;
-    if (!hasOAuth2Config(config))
+    if (!config || oauth2ConfigProblem(dev))
         return null;
     const { domain } = dev;
     const secret = getOAuth2ClientSecret(domain, config.clientId) ?? undefined;
     const storedRefresh = getOAuth2RefreshToken(domain, config.clientId);
     if (!storedRefresh)
         return null;
-    const { tokens } = await postToken(config, {
+    const { tokens, status } = await postToken(config, {
         grant_type: 'refresh_token',
         refresh_token: storedRefresh,
         client_id: config.clientId,
@@ -236,7 +261,10 @@ export async function resolveOAuth2AccessToken(dev) {
         }
         return tokens.access_token;
     }
-    // Stale/expired refresh token — drop it so the next run logs in fresh.
-    deleteOAuth2RefreshToken(domain, config.clientId);
+    // Only a rejection (invalid_grant) means the token is dead. Offline, a
+    // timeout or a 5xx says nothing about it, so it stays.
+    if (status === 400 || status === 401) {
+        deleteOAuth2RefreshToken(domain, config.clientId);
+    }
     return null;
 }

package/dist/utils/password-prompt.js

@@ -1,9 +1,18 @@
+// Without a terminal nobody can answer: prompts resolve to their "no answer"
+// value (default, nothing, empty password) and the caller reports what is missing.
+const interactive = () => Boolean(process.stdin.isTTY);
+// 130 = 128 + SIGINT, so `svc sign && svc deploy` stops at a cancelled prompt.
+const cancelled = () => process.exit(130);
 /**
  * Prompt for a yes/no answer. Returns true for y/Y.
  * Pressing Enter (empty answer) returns `defaultYes` (default: false).
  */
 export function promptYesNo(prompt, defaultYes = false) {
     return new Promise(resolve => {
+        if (!interactive()) {
+            resolve(defaultYes);
+            return;
+        }
         process.stdout.write(prompt);
         const stdin = process.stdin;
         stdin.setRawMode(true);
@@ -17,7 +26,7 @@ export function promptYesNo(prompt, defaultYes = false) {
             process.stdout.write(`${char}\n`);
             const charCode = char.charCodeAt(0);
             if (charCode === 3) {
-                process.exit();
+                cancelled();
             }
             // Enter (CR/LF) or empty input → use the default
             if (char === '' || charCode === 13 || charCode === 10) {
@@ -35,6 +44,10 @@ export function promptYesNo(prompt, defaultYes = false) {
  */
 export function promptEnter(prompt) {
     return new Promise(resolve => {
+        if (!interactive()) {
+            resolve();
+            return;
+        }
         process.stdout.write(prompt);
         const stdin = process.stdin;
         stdin.setRawMode(true);
@@ -44,7 +57,7 @@ export function promptEnter(prompt) {
             const char = data[0] || '';
             const charCode = char.charCodeAt(0);
             if (charCode === 3) {
-                process.exit();
+                cancelled();
             }
             if (char === '' || charCode === 13 || charCode === 10) {
                 stdin.setRawMode(false);
@@ -62,6 +75,10 @@ export function promptEnter(prompt) {
  */
 export function promptPassword(prompt) {
     return new Promise(resolve => {
+        if (!interactive()) {
+            resolve('');
+            return;
+        }
         process.stdout.write(prompt);
         const stdin = process.stdin;
         stdin.setRawMode(true);
@@ -69,6 +86,9 @@ export function promptPassword(prompt) {
         stdin.setEncoding('utf8');
         let password = '';
         const onData = (data) => {
+            // Arrow keys and the like arrive as escape sequences, not as text.
+            if (data.startsWith('\u001B'))
+                return;
             // Handle each character in the input (supports paste)
             for (const char of data) {
                 const charCode = char.charCodeAt(0);
@@ -90,7 +110,7 @@ export function promptPassword(prompt) {
                 }
                 else if (charCode === 3) {
                     // Ctrl+C
-                    process.exit();
+                    cancelled();
                 }
                 else if (charCode >= 32) {
                     // Printable characters

package/dist/utils/process-runner.js

@@ -53,16 +53,21 @@ export class ProcessRunner extends EventEmitter {
     command;
     args;
     cwd;
-    constructor(command, args = [], cwd) {
+    env;
+    constructor(command, args = [], cwd, env) {
         super();
         this.command = command;
         this.args = args;
         this.cwd = cwd;
+        this.env = env;
     }
     run() {
         return new Promise((resolve, reject) => {
-            this.process = spawnChild(this.command, this.args, {
+            // One pre-joined string: the shell resolves npm.cmd on Windows, and Node
+            // deprecates shell + args (DEP0190). Callers pass trusted args only.
+            this.process = spawnChild([this.command, ...this.args].join(' '), [], {
                 cwd: this.cwd || process.cwd(),
+                env: this.env,
                 shell: true,
                 stdio: 'pipe',
             });
@@ -81,7 +86,7 @@ export class ProcessRunner extends EventEmitter {
                 reject(error);
             });
             this.process.on('close', code => {
-                const exitCode = code ?? 0;
+                const exitCode = code ?? 1;
                 this.emit('exit', exitCode);
                 resolve({
                     exitCode,