sitevision-cli 1.0.0-beta.31 → 1.0.0-beta.33

package/dist/utils/project-detection.js

@@ -1,8 +1,9 @@
 import fs from 'fs';
 import path from 'path';
 import { getDeployPassword, setDeployPassword, getSessionCookie, } from './keychain.js';
-import { parseJsonc } from './jsonc.js';
+import { parseJsonc, stripJsonComments } from './jsonc.js';
 import { getLanguage } from './i18n.js';
+import { getGlobalSigning } from './config.js';
 // =============================================================================
 // LOCALIZED TEXT
 // =============================================================================
@@ -22,6 +23,20 @@ export function localizedText(value, preferred = getLanguage()) {
         return value;
     return value[preferred] ?? value['en'] ?? Object.values(value)[0] ?? '';
 }
+/**
+ * The manifest's names when the addon name is none of them. The two are
+ * separate things (the addon is an object on the site, the name a label in the
+ * zip), so a difference is only ever pointed out, never "fixed".
+ */
+export function addonNameDrift(addonName, manifest) {
+    const same = (text) => text.trim().toLowerCase();
+    const names = (typeof manifest?.name === 'string'
+        ? [manifest.name]
+        : Object.values(manifest?.name ?? {})).filter(name => name.trim() !== '');
+    if (!addonName?.trim() || names.length === 0)
+        return undefined;
+    return names.some(name => same(name) === same(addonName)) ? undefined : names;
+}
 // =============================================================================
 // PATH UTILITIES
 // =============================================================================
@@ -105,16 +120,33 @@ function readDevPropertiesFile(dir) {
         return null;
     }
 }
+/**
+ * Merge config layers, later ones winning. `environments` merges per name, so a
+ * layer that overrides one field of an environment keeps the rest of it.
+ */
+export function mergeDevLayers(...layers) {
+    let merged = {};
+    for (const layer of layers) {
+        if (!layer)
+            continue;
+        const environments = { ...merged.environments };
+        for (const [name, override] of Object.entries(layer.environments ?? {})) {
+            environments[name] = { ...environments[name], ...override };
+        }
+        merged = { ...merged, ...layer };
+        if (Object.keys(environments).length > 0) {
+            merged.environments = environments;
+        }
+    }
+    return merged;
+}
 /**
  * The dev properties a workspace root defines (its own file merged over any
  * ancestors'), with the deploy password resolved from the keychain like an
  * app's would be. Used to edit shared config from the shell.
  */
 export function readWorkspaceDevProperties(root) {
-    const merged = {
-        ...readInheritedDevProperties(root),
-        ...readDevPropertiesFile(root),
-    };
+    const merged = mergeDevLayers(readInheritedDevProperties(root), readDevPropertiesFile(root));
     if (merged.domain && merged.username && !merged.password) {
         merged.password =
             process.env['SITEVISION_DEPLOY_PASSWORD'] ??
@@ -125,37 +157,31 @@ export function readWorkspaceDevProperties(root) {
 }
 /** Ancestor directories' .dev_properties.json merged, nearest wins (no own file). */
 export function readAncestorDevProperties(root) {
-    let merged = {};
-    for (const dir of ancestorDirs(root)) {
-        merged = { ...merged, ...readDevPropertiesFile(dir) };
-    }
-    return merged;
+    return mergeDevLayers(...ancestorDirs(root).map(dir => readDevPropertiesFile(dir)));
 }
 /** Shared defaults from package.json: the workspace root's first, the app's on top. */
 export function readPackageDefaultsChain(root) {
-    let merged = {};
-    for (const dir of [...ancestorDirs(root), root]) {
-        merged = { ...merged, ...readPackageDefaults(dir) };
-    }
-    return merged;
+    return mergeDevLayers(...[...ancestorDirs(root), root].map(dir => readPackageDefaults(dir)));
 }
 /**
  * Everything an app's own .dev_properties.json sits on top of: package.json
  * defaults (root, then app), then ancestor .dev_properties.json files.
  */
 export function readInheritedDevProperties(root) {
-    return {
-        ...readPackageDefaultsChain(root),
-        ...readAncestorDevProperties(root),
-    };
+    return mergeDevLayers(readPackageDefaultsChain(root), readAncestorDevProperties(root));
 }
 /**
  * Get app ID configuration from environment or defaults
  */
-function getAppIdConfig() {
+export function getAppIdConfig() {
     return {
-        prefix: process.env['SITEVISION_APP_ID_PREFIX'] || '',
-        suffix: process.env['SITEVISION_APP_ID_SUFFIX'] || '',
+        // svc's own names first, then the ones sitevision-scripts reads.
+        prefix: process.env['SITEVISION_APP_ID_PREFIX'] ||
+            process.env['APP_ID_PREFIX'] ||
+            '',
+        suffix: process.env['SITEVISION_APP_ID_SUFFIX'] ||
+            process.env['APP_ID_SUFFIX'] ||
+            '',
     };
 }
 /**
@@ -270,7 +296,7 @@ export function buildImportEndpointUrl(domain, siteName, addonName, appType, use
 export class ManifestParseError extends Error {
     constructor(manifestPath, cause) {
         const reason = cause instanceof Error ? cause.message : String(cause);
-        super(`${manifestPath} is not valid JSON: ${reason}`);
+        super(`${manifestPath} ${reason}`);
         this.name = 'ManifestParseError';
     }
 }
@@ -290,18 +316,65 @@ export function readManifest(cwd) {
         }
         // Manifests may contain comments (Sitevision's own docs show them), so
         // parse as JSONC.
+        let manifest;
         try {
-            return {
-                manifestPath,
-                manifest: parseJsonc(fs.readFileSync(manifestPath, 'utf-8')),
-            };
+            manifest = parseJsonc(fs.readFileSync(manifestPath, 'utf-8'));
         }
         catch (error) {
-            throw new ManifestParseError(manifestPath, error);
+            throw new ManifestParseError(manifestPath, `is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (typeof manifest !== 'object' || manifest === null) {
+            throw new ManifestParseError(manifestPath, 'must be a JSON object');
         }
+        // Zip names, endpoints and the build all derive from these.
+        for (const key of ['id', 'version', 'type']) {
+            if (typeof manifest[key] !== 'string' || manifest[key] === '') {
+                throw new ManifestParseError(manifestPath, `is missing "${key}"`);
+            }
+        }
+        return { manifestPath, manifest };
     }
     return null;
 }
+const JSON_STRING = String.raw `"(?:[^"\\]|\\.)*"`;
+const escapeRegExp = (s) => s.replaceAll(/[$()*+.?[\\\]^{|}]/g, String.raw `\$&`);
+/**
+ * Set one text field of manifest.json, or one language of a localized field.
+ * An empty value removes the key. A value that is already a string is replaced
+ * in the text, so comments and formatting survive; anything else rewrites the
+ * file, which is refused when that would drop comments.
+ */
+export function writeManifestField(manifestPath, key, value, lang) {
+    const raw = fs.readFileSync(manifestPath, 'utf-8');
+    const wanted = parseJsonc(raw);
+    const existing = wanted[key];
+    if (lang && typeof existing !== 'object') {
+        // A plain string becomes the English text of a multilingual value.
+        wanted[key] = existing ? { en: existing } : {};
+    }
+    const holder = lang ? wanted[key] : wanted;
+    const leaf = lang ?? key;
+    // JSON.stringify drops an undefined key.
+    holder[leaf] = value || undefined;
+    const prefix = lang
+        ? String.raw `"${escapeRegExp(key)}"\s*:\s*\{[^}]*?"${escapeRegExp(lang)}"\s*:\s*`
+        : String.raw `"${escapeRegExp(key)}"\s*:\s*`;
+    const patched = raw.replace(new RegExp(`(${prefix})${JSON_STRING}`), (_, before) => before + JSON.stringify(value));
+    let patchedOk = false;
+    try {
+        patchedOk = JSON.stringify(parseJsonc(patched)) === JSON.stringify(wanted);
+    }
+    catch { }
+    if (patchedOk) {
+        fs.writeFileSync(manifestPath, patched);
+        return;
+    }
+    if (stripJsonComments(raw) !== raw) {
+        throw new Error(`${manifestPath} has comments; add or remove "${leaf}" by hand`);
+    }
+    const indent = /^(?<indent>[\t ]+)/m.exec(raw)?.groups?.['indent'] ?? '\t';
+    fs.writeFileSync(manifestPath, JSON.stringify(wanted, null, indent) + (raw.endsWith('\n') ? '\n' : ''));
+}
 /**
  * Detect if the current directory is a Sitevision project
  */
@@ -335,7 +408,9 @@ export function detectProject(cwd = process.cwd()) {
         let hasLegacyPassword = false;
         if (hasDevProperties) {
             try {
-                const parsed = { ...inherited, ...own };
+                // ponytail: the global signing identity only reaches a project that
+                // has some config of its own, so "configured?" checks stay truthful.
+                const parsed = mergeDevLayers(getGlobalSigning(), inherited, own);
                 hasLegacyPassword =
                     typeof parsed.password === 'string' && parsed.password.length > 0;
                 devProperties = parsed;
@@ -412,7 +487,7 @@ export function requireProject(cwd) {
  * the whole shell down.
  */
 export function appTypeOf(manifest) {
-    const type = manifest.type.toLowerCase();
+    const type = String(manifest.type ?? '').toLowerCase();
     if (type.startsWith('web'))
         return 'web';
     if (type.startsWith('widget'))
@@ -471,10 +546,18 @@ export function writeDevProperties(projectRoot, properties,
     // that would shadow the inherited value.
     const inherited = complete
         ? {}
-        : readInheritedDevProperties(projectRoot);
+        : mergeDevLayers(getGlobalSigning(), readInheritedDevProperties(projectRoot));
     const own = Object.fromEntries(Object.entries(persisted).filter(([key, value]) => value !== '' &&
         (!Object.hasOwn(inherited, key) ||
             JSON.stringify(inherited[key]) !== JSON.stringify(value))));
+    // A plaintext password already in the file (sitevision-scripts puts it
+    // there) moves to the keychain; if that fails it stays rather than be lost.
+    const legacy = readDevPropertiesFile(projectRoot)?.password;
+    if (legacy) {
+        const { domain, username } = { ...inherited, ...persisted };
+        if (!setDeployPassword(domain, username, legacy))
+            own['password'] = legacy;
+    }
     fs.writeFileSync(devPropertiesPath, JSON.stringify(own, null, 2));
 }
 export function readSvcConfig(projectRoot) {
@@ -568,6 +651,38 @@ function pendingSync(dir) {
     }
     return pending;
 }
+// Manifest fields package.json mirrors under the same name; the manifest wins.
+const MANIFEST_PACKAGE_KEYS = ['version', 'description', 'author'];
+/**
+ * Manifest values the app's own package.json does not mirror yet. Nothing when
+ * either file is missing, so syncing never creates a package.json for this.
+ */
+function pendingManifestSync(dir) {
+    const packageJson = readPackageJson(dir);
+    if (!packageJson)
+        return [];
+    let manifest;
+    try {
+        manifest = readManifest(dir)?.manifest;
+    }
+    catch { }
+    if (!manifest)
+        return [];
+    const pending = [];
+    for (const key of MANIFEST_PACKAGE_KEYS) {
+        const value = key === 'description'
+            ? localizedText(manifest.description, 'en')
+            : manifest[key];
+        const current = packageJson[key];
+        // ponytail: an author object ({name, email}) is left alone.
+        if (!value || typeof value !== 'string' || value === current)
+            continue;
+        if (current !== undefined && typeof current !== 'string')
+            continue;
+        pending.push({ key, from: current, value });
+    }
+    return pending;
+}
 /** What an unset field means, so spelling out the default is not a change. */
 export const IMPLICIT_VALUES = {
     authMethod: 'basic',
@@ -579,27 +694,38 @@ const display = (value) => typeof value === 'string' ? value : JSON.stringify(va
 /** What syncing this directory would change in its package.json. */
 export function getPackageJsonSyncChanges(dir) {
     const current = readPackageDefaults(dir);
-    return pendingSync(dir).map(({ key, value }) => current[key] === undefined
-        ? { key: packageLabel(key), to: display(value) }
-        : {
-            key: packageLabel(key),
-            from: display(current[key]),
-            to: display(value),
-        });
+    return [
+        ...pendingSync(dir).map(({ key, value }) => current[key] === undefined
+            ? { key: packageLabel(key), to: display(value) }
+            : {
+                key: packageLabel(key),
+                from: display(current[key]),
+                to: display(value),
+            }),
+        ...pendingManifestSync(dir).map(({ key, from, value }) => ({
+            key,
+            ...(from !== undefined && { from }),
+            to: value,
+        })),
+    ];
 }
 export function hasPackageJson(dir) {
     return fs.existsSync(path.join(dir, 'package.json'));
 }
 /**
- * Copy the pending shared values from .dev_properties.json into package.json,
- * creating package.json when the directory has none. Throws if it cannot be
+ * Copy the pending shared values from .dev_properties.json, and the manifest
+ * fields package.json mirrors, into package.json, creating package.json when
+ * the directory has none. Throws if it cannot be
  * read or written.
  */
 export function syncDevPropertiesToPackageJson(dir) {
     const pending = pendingSync(dir);
-    if (pending.length === 0 && hasPackageJson(dir))
+    const mirrored = pendingManifestSync(dir);
+    if (pending.length + mirrored.length === 0 && hasPackageJson(dir))
         return false;
     updatePackageJson(dir, packageJson => {
+        for (const { key, value } of mirrored)
+            packageJson[key] = value;
         for (const { key, value } of pending) {
             const topKey = PACKAGE_TOP_KEYS[key];
             if (topKey) {
@@ -665,11 +791,13 @@ export function migrateLegacyPassword(project) {
             }
         }
         catch {
-            // Unreadable file: nothing to migrate there.
+            // Unreadable file: nothing to migrate there. Unwritable: checked below.
         }
     }
-    project.hasLegacyPassword = false;
-    return true;
+    // Moved only if no file still holds it.
+    const left = [project.root, ...ancestorDirs(project.root)].some(dir => readDevPropertiesFile(dir)?.password);
+    project.hasLegacyPassword = left;
+    return !left;
 }
 /**
  * Ensure the dist directory exists

package/dist/utils/session-cookie-auth.js

@@ -15,14 +15,15 @@ function domainRelated(a, b) {
  * browser — so it's unit-testable.
  */
 export function selectSessionCookie(all, siteDomain) {
-    const sessions = all.filter(c => c.name === 'JSESSIONID');
-    if (sessions.length === 0) {
+    // Only a session on the deploy site counts: a Java IdP sets a JSESSIONID of
+    // its own, and that one must never be sent to the site.
+    const chosen = all.find(c => c.name === 'JSESSIONID' && domainRelated(c.domain, siteDomain));
+    if (!chosen) {
         const domains = [...new Set(all.map(c => bareDomain(c.domain)))];
         return {
-            error: `No JSESSIONID among ${all.length} cookies. Domains seen: ${domains.join(', ') || 'none'}. If these are only your IdP, open a Sitevision page in the browser, then press Enter again.`,
+            error: `No JSESSIONID for ${siteDomain} among ${all.length} cookies. Domains seen: ${domains.join(', ') || 'none'}. If these are only your IdP, open a Sitevision page in the browser, then press Enter again.`,
         };
     }
-    const chosen = sessions.find(c => domainRelated(c.domain, siteDomain)) ?? sessions[0];
     const cookies = all.filter(c => domainRelated(c.domain, chosen.domain));
     return {
         cookie: cookies.map(c => `${c.name}=${c.value}`).join('; '),

package/dist/utils/sitevision-api.js

@@ -127,6 +127,12 @@ export function makeRequest(url, options) {
                     headers: res.headers,
                 });
             });
+            // A connection cut mid-body never emits 'end'.
+            res.on('error', reject);
+            res.on('close', () => {
+                if (!res.complete)
+                    reject(new Error('Response was cut off'));
+            });
         });
         // Abort hung connections instead of blocking the CLI indefinitely.
         req.setTimeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS, () => {
@@ -424,23 +430,24 @@ export async function deployProduction(signedZipPath, config, appType) {
     if (!deployResult.success) {
         return deployResult;
     }
-    // If activation requested and we have an executable ID
-    if (config.activate && deployResult.executableId) {
-        const activationResult = await activateApp(deployResult.executableId, config, appType);
-        if (!activationResult.success) {
-            return {
-                success: true,
-                executableId: deployResult.executableId,
-                message: `Deployed successfully but activation failed: ${activationResult.error}`,
-            };
-        }
+    if (!config.activate)
+        return deployResult;
+    if (!deployResult.executableId) {
         return {
-            success: true,
-            executableId: deployResult.executableId,
-            message: 'Deployed and activated successfully',
+            ...deployResult,
+            activated: false,
+            message: 'Deployed, but not activated: the server did not return an executable id.',
         };
     }
-    return deployResult;
+    const activationResult = await activateApp(deployResult.executableId, config, appType);
+    return {
+        success: true,
+        executableId: deployResult.executableId,
+        activated: activationResult.success,
+        message: activationResult.success
+            ? 'Deployed and activated successfully'
+            : `Deployed successfully but activation failed: ${activationResult.error}`,
+    };
 }
 // =============================================================================
 // ADDON MANAGEMENT API

package/dist/utils/sitevision-scripts-runner.js

@@ -18,13 +18,32 @@
 import path from 'path';
 import fs from 'fs';
 import { killChild, spawnChild } from './process-runner.js';
+import { getAppIdConfig, getFullAppId } from './project-detection.js';
 /**
- * Resolve the path to the sitevision-scripts CLI entry inside a project.
+ * Directory of an installed package, looked up the way Node does: the project's
+ * node_modules, then each parent's, since workspaces hoist to the repo root.
+ */
+export function findInstalledPackage(projectRoot, name) {
+    let dir = path.resolve(projectRoot);
+    for (;;) {
+        const candidate = path.join(dir, 'node_modules', name);
+        if (fs.existsSync(candidate))
+            return candidate;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+const PACKAGE = '@sitevision/sitevision-scripts';
+/**
+ * Resolve the path to the sitevision-scripts CLI entry for a project.
  * Returns null if the package is not installed.
  */
 export function getSitevisionScriptsBin(projectRoot) {
-    const bin = path.join(projectRoot, 'node_modules', '@sitevision', 'sitevision-scripts', 'bin', 'sitevision-scripts.js');
-    return fs.existsSync(bin) ? bin : null;
+    const dir = findInstalledPackage(projectRoot, PACKAGE);
+    const bin = dir && path.join(dir, 'bin', 'sitevision-scripts.js');
+    return bin && fs.existsSync(bin) ? bin : null;
 }
 /**
  * Whether the sitevision-scripts package is available in the project.
@@ -35,18 +54,12 @@ export function hasSitevisionScripts(projectRoot) {
 /**
  * Path of the zip that `sitevision-scripts build` writes.
  *
- * IMPORTANT: this mirrors sitevision-scripts' own app-id convention
- * (`APP_ID_PREFIX`/`APP_ID_SUFFIX` env vars + `dist/<appId>.zip`), which differs
- * from the CLI's own `getZipPath` env vars (`SITEVISION_APP_ID_*`). For delegated
- * builds the package is the one writing the file, so its convention is the source
- * of truth — using `getZipPath` here would look for the wrong filename whenever a
- * prefix/suffix is configured.
+ * sitevision-scripts names it from `APP_ID_PREFIX`/`APP_ID_SUFFIX`; the build is
+ * started with those set from `getAppIdConfig`, so this is the same file that
+ * sign and deploy look for.
  */
 export function getDelegatedZipPath(projectRoot, manifestId) {
-    const prefix = process.env['APP_ID_PREFIX'] ?? '';
-    const suffix = process.env['APP_ID_SUFFIX'] ?? '';
-    const appId = `${prefix}${manifestId}${suffix}`;
-    return path.join(projectRoot, 'dist', `${appId}.zip`);
+    return path.join(projectRoot, 'dist', `${getFullAppId(manifestId)}.zip`);
 }
 // =============================================================================
 // VERSION COMPATIBILITY
@@ -68,9 +81,11 @@ export const SUPPORTED_SITEVISION_SCRIPTS_RANGE = `>=${SUPPORTED_SITEVISION_SCRI
  * is not installed / unreadable.
  */
 export function getSitevisionScriptsVersion(projectRoot) {
-    const packageJsonPath = path.join(projectRoot, 'node_modules', '@sitevision', 'sitevision-scripts', 'package.json');
+    const dir = findInstalledPackage(projectRoot, PACKAGE);
+    if (!dir)
+        return null;
     try {
-        const parsed = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+        const parsed = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
         return parsed.version ?? null;
     }
     catch {
@@ -158,8 +173,10 @@ export async function runSitevisionScriptsBuild(projectRoot, onOutput, signal) {
     }
     return new Promise(resolve => {
         let output = '';
+        const { prefix, suffix } = getAppIdConfig();
         const child = spawnChild(process.execPath, [bin, 'build'], {
             cwd: projectRoot,
+            env: { ...process.env, APP_ID_PREFIX: prefix, APP_ID_SUFFIX: suffix },
             stdio: ['ignore', 'pipe', 'pipe'],
         });
         const abort = () => {