sitevision-cli 1.0.0-beta.32 → 1.0.0-beta.33

package/dist/utils/i18n.js

@@ -45,7 +45,7 @@ const sv = {
     auth: 'auth',
     'signing user': 'signeringsanv.',
     'not set': 'ej satt',
-    '↑ root': '↑ rot',
+    '↑ root': '↑ root',
     ' · bundled': ' · paketerad',
     deps: 'beroenden',
     config: 'konfig',
@@ -54,16 +54,16 @@ const sv = {
     scripts: 'scripts',
     'missing · i to install': 'saknas · i för att installera',
     'not installed · i to install': 'ej installerat · i för att installera',
-    'dev properties': 'dev-egenskaper',
+    'dev properties': 'dev_properties',
     'missing · e to edit': 'saknas · e för att redigera',
     '{n} diffs · y to apply': '{n} skillnader · y för att tillämpa',
     '1 diff · y to apply': '1 skillnad · y för att tillämpa',
     'missing · / set up signing': 'saknas · / konfigurera signering',
     'not installed': 'ej installerat',
-    '⚠ plaintext password in .dev_properties.json · / migrate': '⚠ lösenord i klartext i .dev_properties.json · / migrera',
+    '⚠ plaintext password in .dev_properties.json · / migrate': '⚠ lösenord i klartext funna i .dev_properties.json · / migrera',
     RECENT: 'SENASTE',
     '⚠ Configure dev properties first (e).': '⚠ Konfigurera dev-egenskaper först (e).',
-    'Press R to fetch versions from {domain}.': 'Tryck R för att hämta versioner från {domain}.',
+    'Press r to fetch versions from {domain}.': 'Tryck r för att hämta versioner från {domain}.',
     'APP IDENTIFIER': 'APP-ID',
     VERSION: 'VERSION',
     ACTIVE: 'AKTIV',
@@ -89,13 +89,13 @@ const sv = {
     Watch: 'Watch',
     Build: 'Build',
     Sign: 'Sign',
-    Deploy: 'Driftsätt',
-    'Deploy (force)': 'Driftsätt (tvinga)',
+    Deploy: 'Deploy',
+    'Deploy (force)': 'Deploy (force)',
     'to {env}': 'till {env}',
     'Switch environment': 'Byt miljö',
     'Add environment': 'Lägg till miljö',
     Help: 'Hjälp',
-    'every key in one place': 'alla tangenter på ett ställe',
+    'every key in one place': 'alla kortkommandon på ett ställe',
     Keys: 'Tangenter',
     'Esc close': 'Esc stäng',
     Here: 'Här',
@@ -129,7 +129,7 @@ const sv = {
     'Addon {addon} does not exist on {domain}. Create it and deploy again?': 'Tillägget {addon} finns inte på {domain}. Skapa det och driftsätt igen?',
     'e.g. test or prod, overriding domain and auth': 't.ex. test eller prod, med egen domän och auth',
     'Environment name (e.g. test, prod)': 'Miljönamn (t.ex. test, prod)',
-    'Deploy the signed {id} to {env} and activate it?': 'Driftsätt signerade {id} till {env} och aktivera?',
+    'Deploy the signed {id} to {env} (addon {addon}) and activate it?': 'Driftsätt signerade {id} till {env} (addon {addon}) och aktivera?',
     'Dev never deploys to a production environment ({env}). Switch with v.': 'Dev driftsätter aldrig till en produktionsmiljö ({env}). Byt med v.',
     'switched to {env}': 'bytte till {env}',
     'environment {env} added': 'miljön {env} tillagd',
@@ -137,9 +137,16 @@ const sv = {
     production: 'produktion',
     env: 'miljö',
     '↑ dev': '↑ dev',
-    'Activate a remote version': 'Aktivera en fjärrversion',
-    'Stop running task': 'Stoppa pågående uppgift',
+    'Activate a remote version': 'Aktivera en uppladdad version',
+    'Stop running task': 'Stoppa pågående körning',
     'Edit config': 'Redigera konfig',
+    'New app': 'Ny app',
+    'Skipped: {reason}': 'Hoppade över: {reason}',
+    'Skipped {n} apps. First: {reason}': 'Hoppade över {n} appar. Första: {reason}',
+    'A new app is still being created. Stop it and quit?': 'En ny app håller på att skapas. Avbryta den och avsluta?',
+    'An app is already being created.': 'En app håller redan på att skapas.',
+    'Could not save to the OS keychain; you will be asked again next time.': 'Kunde inte spara i nyckelringen; du får frågan igen nästa gång.',
+    Navigator: 'Navigering',
     'Sync package.json': 'Synka package.json',
     'Migrate password to OS keychain': 'Flytta lösenord till nyckelringen',
     'Install dependencies': 'Installera beroenden',
@@ -187,7 +194,7 @@ const sv = {
     'Auth method': 'Auth-metod',
     Password: 'Lösenord',
     'OAuth2 client id': 'OAuth2 klient-id',
-    'Authorization endpoint': 'Auktoriseringsendpoint',
+    'Authorization endpoint': 'Authorization url',
     'Token endpoint': 'Token-endpoint',
     Scopes: 'Scopes',
     'Client secret': 'Klienthemlighet',
@@ -197,7 +204,7 @@ const sv = {
     Certificate: 'Certifikat',
     'Signing password': 'Signeringslösenord',
     '^O pick from repo': '^O välj från förråd',
-    'Space-separated scopes to request. ALL grants the Sitevision API and offline_access adds a refresh token so later runs log in silently. Match the casing your client expects.': 'Scopes att begära, separerade med mellanslag. ALL ger Sitevision-API:et och offline_access ger en refresh-token så att senare körningar loggar in tyst. Använd det skiftläge klienten förväntar sig.',
+    'Space-separated scopes to request. ALL grants the Sitevision API and offline_access adds a refresh token so later runs log in silently. Match the casing your client expects.': 'Scopes att begära, separerade med mellanslag. ALL ger Sitevision-API:et och offline_access ger en refresh-token så att senare körningar loggar in tyst. Skriftlägesskänsligt.',
     'blank = site root': 'tomt = webbplatsens rot',
     'required for signed deploys': 'krävs för signerad driftsättning',
     'blank = prompt each run': 'tomt = fråga varje gång',
@@ -306,7 +313,9 @@ const sv = {
     // Config help
     "Domain of this environment's site (USE or TSE) without https://, e.g. myorg-use.sitevision-cloud.se. Deploys and version lookups go here.": 'Domän för den här miljöns webbplats (USE eller TSE) utan https://, t.ex. myorg-use.sitevision-cloud.se. Driftsättningar och versionslistor går hit.',
     "Name of the site's root node in Sitevision, exactly as shown in the site tree. It becomes part of the REST API path.": 'Namnet på webbplatsens rotnod i Sitevision, exakt som i webbplatsträdet. Det blir en del av REST API-sökvägen.',
-    "Name of the addon (custom module) in the site's Addon Repository that this app is uploaded into. Ctrl+O lists the existing ones.": 'Namnet på tillägget (custom module) i webbplatsens tilläggsförråd som appen laddas upp till. Ctrl+O listar befintliga.',
+    "Name of the addon (custom module) in the site's Addon Repository that this app is uploaded into. Ctrl+O lists the existing ones. It is separate from the manifest name: to make them match, rename the addon in Sitevision (Addons, General, Settings) and pick it again with Ctrl+O. For a RESTApp the addon name is part of its endpoint URL.": 'Namnet på tillägget (custom module) i webbplatsens tilläggsförråd som appen laddas upp till. Ctrl+O listar befintliga. Det är skilt från manifestets namn: för att få dem att stämma, byt namn på tillägget i Sitevision (Tillägg, Allmänt, Inställningar) och välj det igen med Ctrl+O. För en RESTApp ingår tilläggets namn i dess endpoint-URL.',
+    '≠ manifest': '≠ manifest',
+    'addon name {addon} · manifest name {names}': 'tilläggsnamn {addon} · manifestnamn {names}',
     'Sitevision account used for deploys, usually your Sitevision Cloud e-mail. It needs DEVELOPER or MANAGE_ADDONS permission on the site. Required for basic auth; with oauth2 or cookie it only labels the stored credential.': 'Sitevision-konto som används för driftsättning, oftast din Sitevision Cloud-e-post. Behöver DEVELOPER eller MANAGE_ADDONS på webbplatsen. Krävs för basic; med oauth2 eller cookie används det bara för att märka den sparade inloggningen.',
     "How deploys authenticate: basic = username and password; oauth2 = bearer token from the site's OAuth2 provider (PKCE, opens a browser); cookie = reuse a browser SSO/SAML session.": 'Hur driftsättningar autentiseras: basic = användarnamn och lösenord; oauth2 = bearer-token från webbplatsens OAuth2-provider (PKCE, öppnar webbläsare); cookie = återanvänd en SSO/SAML-session från webbläsaren.',
     'Deploy password for the account above. Stored in the OS keychain, never in a file. Leave empty to be asked on each run.': 'Driftsättningslösenord för kontot ovan. Sparas i nyckelringen, aldrig i en fil. Lämna tomt för att bli tillfrågad varje gång.',
@@ -322,6 +331,20 @@ const sv = {
     // Settings screen
     Language: 'Språk',
     'Intro animation': 'Introanimation',
+    'Update check': 'Uppdateringskoll',
+    'Addon name warning': 'Varning om tilläggsnamn',
+    'Default signing user': 'Förvald signeringsanvändare',
+    'Default certificate': 'Förvalt certifikat',
+    'The language svc itself speaks.': 'Språket som svc självt använder.',
+    'Play the logo animation when the shell starts.': 'Spela logotypanimationen när skalet startar.',
+    'Look for a newer svc on npm at start.': 'Leta efter en nyare svc på npm vid start.',
+    'Mark the addon name with ≠ manifest when it is none of the names in manifest.json.': 'Markera tilläggsnamnet med ≠ manifest när det inte är något av namnen i manifest.json.',
+    'The developer.sitevision.se account that signs in every project without a signing user of its own.': 'Kontot på developer.sitevision.se som signerar i alla projekt utan egen signeringsanvändare.',
+    'Which certificate signs when the account has several. Empty = the account default.': 'Vilket certifikat som signerar när kontot har flera. Tomt = kontots standard.',
+    'Enter confirm · Esc cancel': 'Enter bekräfta · Esc avbryt',
+    'Not saved: the settings file does not parse.': 'Inte sparat: inställningsfilen går inte att tolka.',
+    'The settings file does not parse and is ignored until it is fixed.': 'Inställningsfilen går inte att tolka och ignoreras tills den är lagad.',
+    global: 'global',
     on: 'på',
     off: 'av',
     'Saved.': 'Sparat.',

package/dist/utils/jsonc.js

@@ -70,5 +70,6 @@ export function stripJsonComments(input) {
  * SyntaxError if the content is invalid even after comments are removed.
  */
 export function parseJsonc(input) {
-    return JSON.parse(stripJsonComments(input));
+    // Editors on Windows may prepend a BOM, which JSON.parse rejects.
+    return JSON.parse(stripJsonComments(input.replace(/^\uFEFF/, '')));
 }

package/dist/utils/keychain.js

@@ -1,5 +1,36 @@
-import { Entry } from '@napi-rs/keyring';
+import { createRequire } from 'node:module';
 const SERVICE = 'sitevision-cli';
+let EntryImpl;
+// SVC_NO_KEYCHAIN=1 turns the keychain off (documented, for CI). `memory` is
+// for the test suite only: secrets live and die with the process.
+const memory = new Map();
+const memoryEntry = (account) => ({
+    getPassword: () => memory.get(account) ?? null,
+    setPassword(password) {
+        memory.set(account, password);
+    },
+    deletePassword: () => memory.delete(account),
+});
+// Loaded on first use so a missing native binding never breaks startup.
+function entry(account) {
+    const off = process.env['SVC_NO_KEYCHAIN'];
+    if (off === 'memory')
+        return memoryEntry(account);
+    if (off)
+        throw new Error('Keychain disabled');
+    if (EntryImpl === undefined) {
+        try {
+            const keyring = createRequire(import.meta.url)('@napi-rs/keyring');
+            EntryImpl = keyring.Entry;
+        }
+        catch {
+            EntryImpl = null;
+        }
+    }
+    if (!EntryImpl)
+        throw new Error('Keychain unavailable');
+    return new EntryImpl(SERVICE, account);
+}
 function deployAccount(domain, username) {
     return `deploy:${username}@${domain}`;
 }
@@ -17,24 +48,33 @@ function sessionCookieAccount(domain, username) {
 }
 function safeGet(account) {
     try {
-        return new Entry(SERVICE, account).getPassword();
+        return entry(account).getPassword();
     }
     catch {
         return null;
     }
 }
+let saveFailed = () => {
+    console.warn('\u001B[33mCould not save to the OS keychain; you will be asked again next time.\u001B[0m');
+};
+/** Replace how a failed keychain save is reported (the shell shows a notice). */
+export function onKeychainSaveFailed(listener) {
+    saveFailed = listener;
+}
 function safeSet(account, password) {
     try {
-        new Entry(SERVICE, account).setPassword(password);
+        entry(account).setPassword(password);
         return true;
     }
     catch {
+        // Callers mostly ignore the result, so the user hears it from here.
+        saveFailed();
         return false;
     }
 }
 function safeDelete(account) {
     try {
-        new Entry(SERVICE, account).deletePassword();
+        entry(account).deletePassword();
     }
     catch {
         // ignore

package/dist/utils/oauth2-auth.js

@@ -23,8 +23,32 @@ export function createPkcePair() {
     const challenge = base64url(crypto.createHash('sha256').update(verifier).digest());
     return { verifier, challenge };
 }
-function hasOAuth2Config(config) {
-    return Boolean(config?.authorizationEndpoint && config.tokenEndpoint && config.clientId);
+/**
+ * Why this project's OAuth2 settings cannot be used, if they cannot. The
+ * endpoints may come from a committed package.json, and the keychain secrets
+ * are stored per site, so they only ever go to that site, over TLS.
+ */
+export function oauth2ConfigProblem(dev) {
+    const config = dev.oauth2;
+    if (!config?.authorizationEndpoint ||
+        !config.tokenEndpoint ||
+        !config.clientId) {
+        return 'OAuth2 is not fully configured (authorization/token endpoint or client ID missing).';
+    }
+    if (!dev.domain)
+        return 'OAuth2 needs the site domain to be set.';
+    const schemes = dev.useHTTPForDevDeploy ? ['https:', 'http:'] : ['https:'];
+    for (const endpoint of [config.authorizationEndpoint, config.tokenEndpoint]) {
+        const url = URL.canParse(endpoint) ? new URL(endpoint) : undefined;
+        if (!url || !schemes.includes(url.protocol)) {
+            return `OAuth2 endpoint ${endpoint} must be an https URL.`;
+        }
+    }
+    const tokenHost = new URL(config.tokenEndpoint).host.toLowerCase();
+    if (tokenHost !== dev.domain.toLowerCase()) {
+        return `OAuth2 token endpoint is on ${tokenHost}, not on ${dev.domain}. Stored secrets are only sent to the site they belong to.`;
+    }
+    return undefined;
 }
 async function postToken(config, params, secret) {
     const body = Buffer.from(new URLSearchParams(params).toString());
@@ -41,6 +65,7 @@ async function postToken(config, params, secret) {
         });
         if (response.statusCode !== 200) {
             return {
+                status: response.statusCode,
                 error: `Token endpoint returned ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`,
             };
         }
@@ -169,7 +194,7 @@ function startLoopback(port, state) {
  */
 export function beginOAuth2Login(dev) {
     const config = dev.oauth2;
-    if (!hasOAuth2Config(config))
+    if (!config || oauth2ConfigProblem(dev))
         return null;
     const { domain } = dev;
     const secret = getOAuth2ClientSecret(domain, config.clientId) ?? undefined;
@@ -218,14 +243,14 @@ export function beginOAuth2Login(dev) {
  */
 export async function resolveOAuth2AccessToken(dev) {
     const config = dev.oauth2;
-    if (!hasOAuth2Config(config))
+    if (!config || oauth2ConfigProblem(dev))
         return null;
     const { domain } = dev;
     const secret = getOAuth2ClientSecret(domain, config.clientId) ?? undefined;
     const storedRefresh = getOAuth2RefreshToken(domain, config.clientId);
     if (!storedRefresh)
         return null;
-    const { tokens } = await postToken(config, {
+    const { tokens, status } = await postToken(config, {
         grant_type: 'refresh_token',
         refresh_token: storedRefresh,
         client_id: config.clientId,
@@ -236,7 +261,10 @@ export async function resolveOAuth2AccessToken(dev) {
         }
         return tokens.access_token;
     }
-    // Stale/expired refresh token — drop it so the next run logs in fresh.
-    deleteOAuth2RefreshToken(domain, config.clientId);
+    // Only a rejection (invalid_grant) means the token is dead. Offline, a
+    // timeout or a 5xx says nothing about it, so it stays.
+    if (status === 400 || status === 401) {
+        deleteOAuth2RefreshToken(domain, config.clientId);
+    }
     return null;
 }

package/dist/utils/password-prompt.js

@@ -1,9 +1,18 @@
+// Without a terminal nobody can answer: prompts resolve to their "no answer"
+// value (default, nothing, empty password) and the caller reports what is missing.
+const interactive = () => Boolean(process.stdin.isTTY);
+// 130 = 128 + SIGINT, so `svc sign && svc deploy` stops at a cancelled prompt.
+const cancelled = () => process.exit(130);
 /**
  * Prompt for a yes/no answer. Returns true for y/Y.
  * Pressing Enter (empty answer) returns `defaultYes` (default: false).
  */
 export function promptYesNo(prompt, defaultYes = false) {
     return new Promise(resolve => {
+        if (!interactive()) {
+            resolve(defaultYes);
+            return;
+        }
         process.stdout.write(prompt);
         const stdin = process.stdin;
         stdin.setRawMode(true);
@@ -17,7 +26,7 @@ export function promptYesNo(prompt, defaultYes = false) {
             process.stdout.write(`${char}\n`);
             const charCode = char.charCodeAt(0);
             if (charCode === 3) {
-                process.exit();
+                cancelled();
             }
             // Enter (CR/LF) or empty input → use the default
             if (char === '' || charCode === 13 || charCode === 10) {
@@ -35,6 +44,10 @@ export function promptYesNo(prompt, defaultYes = false) {
  */
 export function promptEnter(prompt) {
     return new Promise(resolve => {
+        if (!interactive()) {
+            resolve();
+            return;
+        }
         process.stdout.write(prompt);
         const stdin = process.stdin;
         stdin.setRawMode(true);
@@ -44,7 +57,7 @@ export function promptEnter(prompt) {
             const char = data[0] || '';
             const charCode = char.charCodeAt(0);
             if (charCode === 3) {
-                process.exit();
+                cancelled();
             }
             if (char === '' || charCode === 13 || charCode === 10) {
                 stdin.setRawMode(false);
@@ -62,6 +75,10 @@ export function promptEnter(prompt) {
  */
 export function promptPassword(prompt) {
     return new Promise(resolve => {
+        if (!interactive()) {
+            resolve('');
+            return;
+        }
         process.stdout.write(prompt);
         const stdin = process.stdin;
         stdin.setRawMode(true);
@@ -69,6 +86,9 @@ export function promptPassword(prompt) {
         stdin.setEncoding('utf8');
         let password = '';
         const onData = (data) => {
+            // Arrow keys and the like arrive as escape sequences, not as text.
+            if (data.startsWith('\u001B'))
+                return;
             // Handle each character in the input (supports paste)
             for (const char of data) {
                 const charCode = char.charCodeAt(0);
@@ -90,7 +110,7 @@ export function promptPassword(prompt) {
                 }
                 else if (charCode === 3) {
                     // Ctrl+C
-                    process.exit();
+                    cancelled();
                 }
                 else if (charCode >= 32) {
                     // Printable characters

package/dist/utils/process-runner.js

@@ -63,7 +63,9 @@ export class ProcessRunner extends EventEmitter {
     }
     run() {
         return new Promise((resolve, reject) => {
-            this.process = spawnChild(this.command, this.args, {
+            // One pre-joined string: the shell resolves npm.cmd on Windows, and Node
+            // deprecates shell + args (DEP0190). Callers pass trusted args only.
+            this.process = spawnChild([this.command, ...this.args].join(' '), [], {
                 cwd: this.cwd || process.cwd(),
                 env: this.env,
                 shell: true,
@@ -84,7 +86,7 @@ export class ProcessRunner extends EventEmitter {
                 reject(error);
             });
             this.process.on('close', code => {
-                const exitCode = code ?? 0;
+                const exitCode = code ?? 1;
                 this.emit('exit', exitCode);
                 resolve({
                     exitCode,

package/dist/utils/project-detection.js

@@ -3,6 +3,7 @@ import path from 'path';
 import { getDeployPassword, setDeployPassword, getSessionCookie, } from './keychain.js';
 import { parseJsonc, stripJsonComments } from './jsonc.js';
 import { getLanguage } from './i18n.js';
+import { getGlobalSigning } from './config.js';
 // =============================================================================
 // LOCALIZED TEXT
 // =============================================================================
@@ -22,6 +23,20 @@ export function localizedText(value, preferred = getLanguage()) {
         return value;
     return value[preferred] ?? value['en'] ?? Object.values(value)[0] ?? '';
 }
+/**
+ * The manifest's names when the addon name is none of them. The two are
+ * separate things (the addon is an object on the site, the name a label in the
+ * zip), so a difference is only ever pointed out, never "fixed".
+ */
+export function addonNameDrift(addonName, manifest) {
+    const same = (text) => text.trim().toLowerCase();
+    const names = (typeof manifest?.name === 'string'
+        ? [manifest.name]
+        : Object.values(manifest?.name ?? {})).filter(name => name.trim() !== '');
+    if (!addonName?.trim() || names.length === 0)
+        return undefined;
+    return names.some(name => same(name) === same(addonName)) ? undefined : names;
+}
 // =============================================================================
 // PATH UTILITIES
 // =============================================================================
@@ -105,16 +120,33 @@ function readDevPropertiesFile(dir) {
         return null;
     }
 }
+/**
+ * Merge config layers, later ones winning. `environments` merges per name, so a
+ * layer that overrides one field of an environment keeps the rest of it.
+ */
+export function mergeDevLayers(...layers) {
+    let merged = {};
+    for (const layer of layers) {
+        if (!layer)
+            continue;
+        const environments = { ...merged.environments };
+        for (const [name, override] of Object.entries(layer.environments ?? {})) {
+            environments[name] = { ...environments[name], ...override };
+        }
+        merged = { ...merged, ...layer };
+        if (Object.keys(environments).length > 0) {
+            merged.environments = environments;
+        }
+    }
+    return merged;
+}
 /**
  * The dev properties a workspace root defines (its own file merged over any
  * ancestors'), with the deploy password resolved from the keychain like an
  * app's would be. Used to edit shared config from the shell.
  */
 export function readWorkspaceDevProperties(root) {
-    const merged = {
-        ...readInheritedDevProperties(root),
-        ...readDevPropertiesFile(root),
-    };
+    const merged = mergeDevLayers(readInheritedDevProperties(root), readDevPropertiesFile(root));
     if (merged.domain && merged.username && !merged.password) {
         merged.password =
             process.env['SITEVISION_DEPLOY_PASSWORD'] ??
@@ -125,37 +157,31 @@ export function readWorkspaceDevProperties(root) {
 }
 /** Ancestor directories' .dev_properties.json merged, nearest wins (no own file). */
 export function readAncestorDevProperties(root) {
-    let merged = {};
-    for (const dir of ancestorDirs(root)) {
-        merged = { ...merged, ...readDevPropertiesFile(dir) };
-    }
-    return merged;
+    return mergeDevLayers(...ancestorDirs(root).map(dir => readDevPropertiesFile(dir)));
 }
 /** Shared defaults from package.json: the workspace root's first, the app's on top. */
 export function readPackageDefaultsChain(root) {
-    let merged = {};
-    for (const dir of [...ancestorDirs(root), root]) {
-        merged = { ...merged, ...readPackageDefaults(dir) };
-    }
-    return merged;
+    return mergeDevLayers(...[...ancestorDirs(root), root].map(dir => readPackageDefaults(dir)));
 }
 /**
  * Everything an app's own .dev_properties.json sits on top of: package.json
  * defaults (root, then app), then ancestor .dev_properties.json files.
  */
 export function readInheritedDevProperties(root) {
-    return {
-        ...readPackageDefaultsChain(root),
-        ...readAncestorDevProperties(root),
-    };
+    return mergeDevLayers(readPackageDefaultsChain(root), readAncestorDevProperties(root));
 }
 /**
  * Get app ID configuration from environment or defaults
  */
-function getAppIdConfig() {
+export function getAppIdConfig() {
     return {
-        prefix: process.env['SITEVISION_APP_ID_PREFIX'] || '',
-        suffix: process.env['SITEVISION_APP_ID_SUFFIX'] || '',
+        // svc's own names first, then the ones sitevision-scripts reads.
+        prefix: process.env['SITEVISION_APP_ID_PREFIX'] ||
+            process.env['APP_ID_PREFIX'] ||
+            '',
+        suffix: process.env['SITEVISION_APP_ID_SUFFIX'] ||
+            process.env['APP_ID_SUFFIX'] ||
+            '',
     };
 }
 /**
@@ -270,7 +296,7 @@ export function buildImportEndpointUrl(domain, siteName, addonName, appType, use
 export class ManifestParseError extends Error {
     constructor(manifestPath, cause) {
         const reason = cause instanceof Error ? cause.message : String(cause);
-        super(`${manifestPath} is not valid JSON: ${reason}`);
+        super(`${manifestPath} ${reason}`);
         this.name = 'ManifestParseError';
     }
 }
@@ -290,15 +316,23 @@ export function readManifest(cwd) {
         }
         // Manifests may contain comments (Sitevision's own docs show them), so
         // parse as JSONC.
+        let manifest;
         try {
-            return {
-                manifestPath,
-                manifest: parseJsonc(fs.readFileSync(manifestPath, 'utf-8')),
-            };
+            manifest = parseJsonc(fs.readFileSync(manifestPath, 'utf-8'));
         }
         catch (error) {
-            throw new ManifestParseError(manifestPath, error);
+            throw new ManifestParseError(manifestPath, `is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (typeof manifest !== 'object' || manifest === null) {
+            throw new ManifestParseError(manifestPath, 'must be a JSON object');
+        }
+        // Zip names, endpoints and the build all derive from these.
+        for (const key of ['id', 'version', 'type']) {
+            if (typeof manifest[key] !== 'string' || manifest[key] === '') {
+                throw new ManifestParseError(manifestPath, `is missing "${key}"`);
+            }
         }
+        return { manifestPath, manifest };
     }
     return null;
 }
@@ -313,6 +347,11 @@ const escapeRegExp = (s) => s.replaceAll(/[$()*+.?[\\\]^{|}]/g, String.raw `\$&`
 export function writeManifestField(manifestPath, key, value, lang) {
     const raw = fs.readFileSync(manifestPath, 'utf-8');
     const wanted = parseJsonc(raw);
+    const existing = wanted[key];
+    if (lang && typeof existing !== 'object') {
+        // A plain string becomes the English text of a multilingual value.
+        wanted[key] = existing ? { en: existing } : {};
+    }
     const holder = lang ? wanted[key] : wanted;
     const leaf = lang ?? key;
     // JSON.stringify drops an undefined key.
@@ -369,7 +408,9 @@ export function detectProject(cwd = process.cwd()) {
         let hasLegacyPassword = false;
         if (hasDevProperties) {
             try {
-                const parsed = { ...inherited, ...own };
+                // ponytail: the global signing identity only reaches a project that
+                // has some config of its own, so "configured?" checks stay truthful.
+                const parsed = mergeDevLayers(getGlobalSigning(), inherited, own);
                 hasLegacyPassword =
                     typeof parsed.password === 'string' && parsed.password.length > 0;
                 devProperties = parsed;
@@ -446,7 +487,7 @@ export function requireProject(cwd) {
  * the whole shell down.
  */
 export function appTypeOf(manifest) {
-    const type = manifest.type.toLowerCase();
+    const type = String(manifest.type ?? '').toLowerCase();
     if (type.startsWith('web'))
         return 'web';
     if (type.startsWith('widget'))
@@ -505,10 +546,18 @@ export function writeDevProperties(projectRoot, properties,
     // that would shadow the inherited value.
     const inherited = complete
         ? {}
-        : readInheritedDevProperties(projectRoot);
+        : mergeDevLayers(getGlobalSigning(), readInheritedDevProperties(projectRoot));
     const own = Object.fromEntries(Object.entries(persisted).filter(([key, value]) => value !== '' &&
         (!Object.hasOwn(inherited, key) ||
             JSON.stringify(inherited[key]) !== JSON.stringify(value))));
+    // A plaintext password already in the file (sitevision-scripts puts it
+    // there) moves to the keychain; if that fails it stays rather than be lost.
+    const legacy = readDevPropertiesFile(projectRoot)?.password;
+    if (legacy) {
+        const { domain, username } = { ...inherited, ...persisted };
+        if (!setDeployPassword(domain, username, legacy))
+            own['password'] = legacy;
+    }
     fs.writeFileSync(devPropertiesPath, JSON.stringify(own, null, 2));
 }
 export function readSvcConfig(projectRoot) {
@@ -742,11 +791,13 @@ export function migrateLegacyPassword(project) {
             }
         }
         catch {
-            // Unreadable file: nothing to migrate there.
+            // Unreadable file: nothing to migrate there. Unwritable: checked below.
         }
     }
-    project.hasLegacyPassword = false;
-    return true;
+    // Moved only if no file still holds it.
+    const left = [project.root, ...ancestorDirs(project.root)].some(dir => readDevPropertiesFile(dir)?.password);
+    project.hasLegacyPassword = left;
+    return !left;
 }
 /**
  * Ensure the dist directory exists

package/dist/utils/session-cookie-auth.js

@@ -15,14 +15,15 @@ function domainRelated(a, b) {
  * browser — so it's unit-testable.
  */
 export function selectSessionCookie(all, siteDomain) {
-    const sessions = all.filter(c => c.name === 'JSESSIONID');
-    if (sessions.length === 0) {
+    // Only a session on the deploy site counts: a Java IdP sets a JSESSIONID of
+    // its own, and that one must never be sent to the site.
+    const chosen = all.find(c => c.name === 'JSESSIONID' && domainRelated(c.domain, siteDomain));
+    if (!chosen) {
         const domains = [...new Set(all.map(c => bareDomain(c.domain)))];
         return {
-            error: `No JSESSIONID among ${all.length} cookies. Domains seen: ${domains.join(', ') || 'none'}. If these are only your IdP, open a Sitevision page in the browser, then press Enter again.`,
+            error: `No JSESSIONID for ${siteDomain} among ${all.length} cookies. Domains seen: ${domains.join(', ') || 'none'}. If these are only your IdP, open a Sitevision page in the browser, then press Enter again.`,
         };
     }
-    const chosen = sessions.find(c => domainRelated(c.domain, siteDomain)) ?? sessions[0];
     const cookies = all.filter(c => domainRelated(c.domain, chosen.domain));
     return {
         cookie: cookies.map(c => `${c.name}=${c.value}`).join('; '),