sitevision-cli 1.0.0-beta.4 → 1.0.0-beta.6

package/dist/utils/project-detection.js

@@ -1,6 +1,6 @@
 import fs from 'fs';
 import path from 'path';
-import { getDeployPassword, setDeployPassword } from './keychain.js';
+import { getDeployPassword, setDeployPassword, getSessionCookie, } from './keychain.js';
 import { parseJsonc } from './jsonc.js';
 // =============================================================================
 // LOCALIZED TEXT
@@ -167,38 +167,44 @@ export class ManifestParseError extends Error {
         this.name = 'ManifestParseError';
     }
 }
+/**
+ * Read manifest.json from its supported locations (root, static/, src/).
+ * Throws ManifestParseError on malformed JSON.
+ */
+export function readManifest(cwd) {
+    const manifestPaths = [
+        path.join(cwd, 'manifest.json'),
+        path.join(cwd, 'static', 'manifest.json'),
+        path.join(cwd, 'src', 'manifest.json'),
+    ];
+    for (const manifestPath of manifestPaths) {
+        if (!fs.existsSync(manifestPath)) {
+            continue;
+        }
+        // Manifests may contain comments (Sitevision's own docs show them), so
+        // parse as JSONC.
+        try {
+            return {
+                manifestPath,
+                manifest: parseJsonc(fs.readFileSync(manifestPath, 'utf-8')),
+            };
+        }
+        catch (error) {
+            throw new ManifestParseError(manifestPath, error);
+        }
+    }
+    return null;
+}
 /**
  * Detect if the current directory is a Sitevision project
  */
 export function detectProject(cwd = process.cwd()) {
     try {
-        // Look for manifest.json in multiple locations (current, static/, src/)
-        const manifestPaths = [
-            path.join(cwd, 'manifest.json'),
-            path.join(cwd, 'static', 'manifest.json'),
-            path.join(cwd, 'src', 'manifest.json'),
-        ];
-        let manifestPath = null;
-        let manifest = null;
-        for (const p of manifestPaths) {
-            if (fs.existsSync(p)) {
-                manifestPath = p;
-                // Manifests may contain comments (Sitevision's own docs show them), so
-                // parse as JSONC. A still-unparseable manifest is a real, fixable
-                // error — surface it rather than silently reporting "Not a Sitevision
-                // project".
-                try {
-                    manifest = parseJsonc(fs.readFileSync(p, 'utf-8'));
-                }
-                catch (error) {
-                    throw new ManifestParseError(p, error);
-                }
-                break;
-            }
-        }
-        if (!manifest || !manifestPath) {
+        const found = readManifest(cwd);
+        if (!found) {
             return null;
         }
+        const { manifestPath, manifest } = found;
         // Check for package.json
         const packageJsonPath = path.join(cwd, 'package.json');
         if (!fs.existsSync(packageJsonPath)) {
@@ -238,6 +244,25 @@ export function detectProject(cwd = process.cwd()) {
                         }
                     }
                 }
+                // Resolve an OAuth2 access token: env var > keychain refresh.
+                // The env var is the manual/CI path; the interactive login stores a
+                // refresh token in the keychain and mints access tokens from it.
+                if (devProperties.authMethod === 'oauth2') {
+                    const envToken = process.env['SITEVISION_ACCESS_TOKEN'];
+                    if (envToken) {
+                        devProperties.accessToken = envToken;
+                    }
+                }
+                // Resolve a session cookie: env var > keychain (captured at login).
+                if (devProperties.authMethod === 'cookie' &&
+                    devProperties.domain &&
+                    devProperties.username) {
+                    const envCookie = process.env['SITEVISION_SESSION_COOKIE'];
+                    devProperties.sessionCookie =
+                        envCookie ??
+                            getSessionCookie(devProperties.domain, devProperties.username) ??
+                            undefined;
+                }
             }
             catch {
                 // Invalid dev properties file
@@ -317,15 +342,102 @@ export function readDevProperties(projectRoot) {
     }
 }
 /**
- * Write dev properties to file. The `password` field is never persisted —
- * it is held in the OS keychain instead.
+ * Write dev properties to file. Secrets are never persisted — `password`,
+ * `accessToken` and `sessionCookie` are held in the OS keychain / resolved at
+ * runtime instead.
  */
 export function writeDevProperties(projectRoot, properties) {
     const devPropertiesPath = findDevPropertiesPath(projectRoot) ||
         getDefaultDevPropertiesPath(projectRoot);
-    const { password: _password, ...persisted } = properties;
+    const { password: _password, accessToken: _accessToken, sessionCookie: _sessionCookie, ...persisted } = properties;
     fs.writeFileSync(devPropertiesPath, JSON.stringify(persisted, null, 2));
 }
+export function readSvcConfig(projectRoot) {
+    try {
+        return parseJsonc(fs.readFileSync(path.join(projectRoot, '.svcconfig'), 'utf-8'));
+    }
+    catch {
+        return {};
+    }
+}
+export function writeSvcConfig(projectRoot, updates) {
+    const merged = { ...readSvcConfig(projectRoot), ...updates };
+    fs.writeFileSync(path.join(projectRoot, '.svcconfig'), JSON.stringify(merged, null, 2) + '\n');
+}
+// =============================================================================
+// PACKAGE.JSON SYNC
+// =============================================================================
+/**
+ * Fields duplicated between .dev_properties.json and package.json, where
+ * sitevision-scripts reads them under different names.
+ */
+const PACKAGE_JSON_SYNC_KEYS = [
+    { packageKey: 'developmentDomain', devKey: 'domain' },
+    { packageKey: 'siteName', devKey: 'siteName' },
+    { packageKey: 'addonName', devKey: 'addonName' },
+];
+function readPackageJson(projectRoot) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(projectRoot, 'package.json'), 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Which of the shared fields package.json is missing or disagrees on, relative
+ * to the given dev properties. Reads package.json from disk — an earlier
+ * `npm install` in the same session may have rewritten it.
+ */
+export function getPackageJsonSyncChanges(projectRoot, properties) {
+    const packageJson = readPackageJson(projectRoot);
+    if (!packageJson)
+        return [];
+    const changes = [];
+    for (const { packageKey, devKey } of PACKAGE_JSON_SYNC_KEYS) {
+        const to = properties[devKey];
+        if (typeof to !== 'string' || to === '')
+            continue;
+        const from = packageJson[packageKey];
+        if (from !== to) {
+            changes.push(from === undefined
+                ? { key: packageKey, to }
+                : { key: packageKey, from, to });
+        }
+    }
+    return changes;
+}
+/**
+ * Copy the shared fields from dev properties into package.json, preserving the
+ * file's existing indentation and trailing newline.
+ */
+export function syncDevPropertiesToPackageJson(projectRoot, properties) {
+    const packageJsonPath = path.join(projectRoot, 'package.json');
+    let raw;
+    try {
+        raw = fs.readFileSync(packageJsonPath, 'utf-8');
+    }
+    catch {
+        return false;
+    }
+    let packageJson;
+    try {
+        packageJson = JSON.parse(raw);
+    }
+    catch {
+        return false;
+    }
+    for (const { packageKey, devKey } of PACKAGE_JSON_SYNC_KEYS) {
+        const value = properties[devKey];
+        if (typeof value === 'string' && value !== '') {
+            packageJson[packageKey] = value;
+        }
+    }
+    const indent = /^(?<indent>[\t ]+)/m.exec(raw)?.groups?.['indent'] ?? '\t';
+    const newline = raw.endsWith('\n') ? '\n' : '';
+    fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, indent) + newline);
+    return true;
+}
 /**
  * Move a plaintext password from .dev_properties.json into the OS keychain and
  * strip it from the file. Returns true if the password was migrated.

package/dist/utils/session-cookie-auth.d.ts

@@ -0,0 +1,9 @@
+import type { DevProperties } from '../types/index.js';
+/**
+ * Return a usable session cookie, or null. Order: keychain (a prior capture),
+ * then (when `interactive`) a browser login. Pass `interactive: false` from the
+ * Ink menu, which can't own the terminal for the "press Enter" handoff.
+ */
+export declare function resolveSessionCookie(dev: DevProperties, options?: {
+    interactive?: boolean;
+}): Promise<string | null>;

package/dist/utils/session-cookie-auth.js

@@ -0,0 +1,72 @@
+import { getSessionCookie, setSessionCookie } from './keychain.js';
+import { promptEnter } from './password-prompt.js';
+/** Match cookies set on the site host or any parent domain. */
+function domainMatches(cookieDomain, siteDomain) {
+    const bare = cookieDomain.replace(/^\./, '');
+    return siteDomain === bare || siteDomain.endsWith(`.${bare}`);
+}
+/**
+ * Open a real browser at the login URL, let the user complete SSO, then read
+ * the session cookies (JSESSIONID and any siblings) via CDP — which returns
+ * httponly cookies that page JavaScript can't see. Returns a `Cookie:` header
+ * value, or null if capture failed.
+ */
+async function captureViaBrowser(loginUrl, siteDomain) {
+    let puppeteer;
+    try {
+        ({ default: puppeteer } = await import('puppeteer-core'));
+    }
+    catch {
+        console.log('\x1b[31mpuppeteer-core is not installed. Run `npm i puppeteer-core`, or pass --cookie / set SITEVISION_SESSION_COOKIE.\x1b[0m');
+        return null;
+    }
+    let browser;
+    try {
+        browser = await puppeteer.launch({ headless: false, channel: 'chrome' });
+        const page = await browser.newPage();
+        await page.goto(loginUrl, { waitUntil: 'domcontentloaded' }).catch(() => {
+            // A SAML redirect may abort the initial navigation — that's fine.
+        });
+        await promptEnter('\nLog in in the opened browser, then press Enter here to capture the session: ');
+        const client = await page.createCDPSession();
+        const { cookies } = await client.send('Network.getAllCookies');
+        const wanted = cookies.filter(c => domainMatches(c.domain, siteDomain));
+        if (wanted.every(c => c.name !== 'JSESSIONID')) {
+            console.log('\x1b[31mNo JSESSIONID found for this site. Was the login completed?\x1b[0m');
+            return null;
+        }
+        return wanted.map(c => `${c.name}=${c.value}`).join('; ');
+    }
+    catch (error) {
+        console.log(`\x1b[31mBrowser login failed: ${error instanceof Error ? error.message : String(error)}\x1b[0m`);
+        return null;
+    }
+    finally {
+        if (browser) {
+            await browser.close().catch(() => {
+                // Best-effort close.
+            });
+        }
+    }
+}
+/**
+ * Return a usable session cookie, or null. Order: keychain (a prior capture),
+ * then (when `interactive`) a browser login. Pass `interactive: false` from the
+ * Ink menu, which can't own the terminal for the "press Enter" handoff.
+ */
+export async function resolveSessionCookie(dev, options = {}) {
+    const { interactive = true } = options;
+    const { domain, username } = dev;
+    if (!domain || !username)
+        return null;
+    const stored = getSessionCookie(domain, username);
+    if (stored)
+        return stored;
+    if (!interactive || !process.stdin.isTTY)
+        return null;
+    const loginUrl = dev.sessionLoginUrl || `https://${domain}/`;
+    const cookie = await captureViaBrowser(loginUrl, domain);
+    if (cookie)
+        setSessionCookie(domain, username, cookie);
+    return cookie;
+}

package/dist/utils/sitevision-api.d.ts

@@ -13,6 +13,27 @@ import type { SigningCredentials, DeployConfig, ProductionDeployConfig, SigningR
  * Create Basic Auth header value
  */
 declare function createBasicAuth(username: string, password: string): string;
+type RequestAuth = {
+    username: string;
+    password: string;
+} | {
+    token: string;
+} | {
+    cookie: string;
+};
+type AuthKind = 'basic' | 'bearer' | 'cookie';
+/** Single source of the 401 message, worded for the auth kind actually used. */
+declare function unauthorizedMessage(kind: AuthKind): string;
+/** Pick cookie > bearer > basic based on what the deploy config carries. */
+declare function configAuth(config: {
+    username: string;
+    password?: string;
+    accessToken?: string;
+    sessionCookie?: string;
+}): {
+    auth: RequestAuth;
+    kind: AuthKind;
+};
 /**
  * Make an HTTP/HTTPS request
  */
@@ -20,10 +41,7 @@ export declare function makeRequest(url: string, options: {
     method: string;
     headers?: Record<string, string>;
     body?: Buffer;
-    auth?: {
-        username: string;
-        password: string;
-    };
+    auth?: RequestAuth;
     timeoutMs?: number;
 }): Promise<{
     statusCode: number;
@@ -45,6 +63,12 @@ export declare function summarizeErrorBody(body: Buffer, headers: Record<string,
  * the signing endpoint returns an error page with HTTP 200.
  */
 export declare function looksLikeZip(body: Buffer): boolean;
+/**
+ * A stale Sitevision session usually answers with a redirect to the login page
+ * or a 200 carrying an HTML login form — not a clean 401. Detect both so cookie
+ * auth can drop the dead session and re-login instead of showing a generic error.
+ */
+export declare function looksLikeAuthExpired(statusCode: number, body: Buffer, headers: Record<string, string>): boolean;
 /**
  * Sign an app via developer.sitevision.se
  *
@@ -85,4 +109,4 @@ export declare function createAddon(config: DeployConfig, appType: SimpleAppType
  * @param appType - The app type (web, widget, rest)
  */
 export declare function activateApp(executableId: string, config: DeployConfig, _appType: SimpleAppType): Promise<ActivationResponse>;
-export { createBasicAuth };
+export { createBasicAuth, configAuth, unauthorizedMessage };

package/dist/utils/sitevision-api.js

@@ -33,6 +33,30 @@ const RETRY_BASE_DELAY_MS = 1000;
 function createBasicAuth(username, password) {
     return `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`;
 }
+/** Single source of the 401 message, worded for the auth kind actually used. */
+function unauthorizedMessage(kind) {
+    switch (kind) {
+        case 'bearer':
+            return 'Unauthorized. The access token was rejected or has expired.';
+        case 'cookie':
+            return 'Unauthorized. The session cookie was rejected or has expired — log in again.';
+        default:
+            return 'Unauthorized. Check username and password.';
+    }
+}
+/** Pick cookie > bearer > basic based on what the deploy config carries. */
+function configAuth(config) {
+    if (config.sessionCookie) {
+        return { auth: { cookie: config.sessionCookie }, kind: 'cookie' };
+    }
+    if (config.accessToken) {
+        return { auth: { token: config.accessToken }, kind: 'bearer' };
+    }
+    return {
+        auth: { username: config.username, password: config.password ?? '' },
+        kind: 'basic',
+    };
+}
 /**
  * Generate a random boundary for multipart form data
  */
@@ -71,7 +95,18 @@ export function makeRequest(url, options) {
             ...options.headers,
         };
         if (options.auth) {
-            headers['Authorization'] = createBasicAuth(options.auth.username, options.auth.password);
+            if ('cookie' in options.auth) {
+                headers['Cookie'] = options.auth.cookie;
+                // Session-authenticated state-changing calls typically need this to
+                // pass Sitevision's CSRF guard, unlike Basic-auth requests.
+                headers['X-Requested-With'] ??= 'XMLHttpRequest';
+            }
+            else if ('token' in options.auth) {
+                headers['Authorization'] = `Bearer ${options.auth.token}`;
+            }
+            else {
+                headers['Authorization'] = createBasicAuth(options.auth.username, options.auth.password);
+            }
         }
         const requestOptions = {
             hostname: parsedUrl.hostname,
@@ -145,6 +180,31 @@ const ZIP_MAGIC = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
 export function looksLikeZip(body) {
     return body.length >= 4 && body.subarray(0, 4).equals(ZIP_MAGIC);
 }
+/**
+ * A stale Sitevision session usually answers with a redirect to the login page
+ * or a 200 carrying an HTML login form — not a clean 401. Detect both so cookie
+ * auth can drop the dead session and re-login instead of showing a generic error.
+ */
+export function looksLikeAuthExpired(statusCode, body, headers) {
+    if (statusCode === 401)
+        return true;
+    if (statusCode >= 300 && statusCode < 400)
+        return true;
+    if (statusCode === 200) {
+        const contentType = headers['content-type'] ?? '';
+        if (contentType.includes('html'))
+            return true;
+        const head = body
+            .subarray(0, 64)
+            .toString('utf8')
+            .trimStart()
+            .toLowerCase();
+        if (head.startsWith('<!doctype html') || head.startsWith('<html')) {
+            return true;
+        }
+    }
+    return false;
+}
 // =============================================================================
 // SIGNING API
 // =============================================================================
@@ -211,7 +271,7 @@ export async function signApp(zipPath, credentials, outputPath) {
                 // Auth failures will not resolve on retry.
                 return {
                     success: false,
-                    error: 'Unauthorized. Check username and password.',
+                    error: unauthorizedMessage('basic'),
                 };
             }
             lastError = `Signing failed with status ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`;
@@ -259,6 +319,7 @@ export async function deployApp(zipPath, config, appType, force = false) {
     // Create multipart form data
     const boundary = generateBoundary();
     const { body, contentType } = createMultipartFormData(zipPath, 'file', boundary);
+    const { auth, kind } = configAuth(config);
     try {
         const response = await makeRequest(url, {
             method: 'POST',
@@ -267,11 +328,25 @@ export async function deployApp(zipPath, config, appType, force = false) {
                 'Content-Length': String(body.length),
             },
             body,
-            auth: {
-                username: config.username,
-                password: config.password,
-            },
+            auth,
         });
+        if (response.statusCode === 401) {
+            return {
+                success: false,
+                error: unauthorizedMessage(kind),
+                authExpired: true,
+            };
+        }
+        // A cookie session fails without a clean 401: a redirect to login or a
+        // 200 carrying an HTML login page. Flag it so the caller re-authenticates.
+        if (kind === 'cookie' &&
+            looksLikeAuthExpired(response.statusCode, response.body, response.headers)) {
+            return {
+                success: false,
+                error: unauthorizedMessage('cookie'),
+                authExpired: true,
+            };
+        }
         if (response.statusCode === 200) {
             // Try to parse response for executable ID
             let executableId;
@@ -288,12 +363,6 @@ export async function deployApp(zipPath, config, appType, force = false) {
                 message: 'Deployment successful',
             };
         }
-        if (response.statusCode === 401) {
-            return {
-                success: false,
-                error: 'Unauthorized. Check username and password.',
-            };
-        }
         if (response.statusCode === 409) {
             return {
                 success: false,
@@ -358,6 +427,7 @@ export async function createAddon(config, appType) {
         name: config.addonName,
         category: 'Other',
     });
+    const { auth, kind } = configAuth(config);
     try {
         const response = await makeRequest(url, {
             method: 'POST',
@@ -366,10 +436,7 @@ export async function createAddon(config, appType) {
                 'Content-Length': String(Buffer.byteLength(body)),
             },
             body: Buffer.from(body),
-            auth: {
-                username: config.username,
-                password: config.password,
-            },
+            auth,
         });
         if (response.statusCode === 200 || response.statusCode === 201) {
             let addonId;
@@ -388,7 +455,8 @@ export async function createAddon(config, appType) {
         if (response.statusCode === 401) {
             return {
                 success: false,
-                error: 'Unauthorized. Check username and password.',
+                error: unauthorizedMessage(kind),
+                authExpired: true,
             };
         }
         if (response.statusCode === 409) {
@@ -422,6 +490,7 @@ export async function activateApp(executableId, config, _appType) {
     const body = JSON.stringify({
         executableId,
     });
+    const { auth, kind } = configAuth(config);
     try {
         const response = await makeRequest(url, {
             method: 'PUT',
@@ -430,10 +499,7 @@ export async function activateApp(executableId, config, _appType) {
                 'Content-Length': String(Buffer.byteLength(body)),
             },
             body: Buffer.from(body),
-            auth: {
-                username: config.username,
-                password: config.password,
-            },
+            auth,
         });
         if (response.statusCode === 200) {
             return { success: true };
@@ -441,7 +507,8 @@ export async function activateApp(executableId, config, _appType) {
         if (response.statusCode === 401) {
             return {
                 success: false,
-                error: 'Unauthorized. Check username and password.',
+                error: unauthorizedMessage(kind),
+                authExpired: true,
             };
         }
         return {
@@ -459,4 +526,4 @@ export async function activateApp(executableId, config, _appType) {
 // =============================================================================
 // HELPER EXPORTS
 // =============================================================================
-export { createBasicAuth };
+export { createBasicAuth, configAuth, unauthorizedMessage };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sitevision-cli",
-	"version": "1.0.0-beta.4",
+	"version": "1.0.0-beta.6",
 	"license": "MIT",
 	"bin": {
 		"svc": "dist/cli.js"
@@ -24,6 +24,7 @@
 		"ink": "^7.1.0",
 		"ink-spinner": "^5.0.0",
 		"meow": "^14.1.0",
+		"puppeteer-core": "^25.10.0",
 		"react": "^19.2.7"
 	},
 	"devDependencies": {

package/readme.md

@@ -126,6 +126,29 @@ Create this file in your project root for deployment configuration:
 }
 ```
 
+### Keeping `package.json` in sync
+
+`sitevision-scripts` reads `developmentDomain`, `siteName` and `addonName`
+from `package.json`, which duplicates three fields of
+`.dev_properties.json`. When they disagree — or when a fresh setup has just
+written `.dev_properties.json` — `svc` shows the differences and offers to
+update `package.json` from `.dev_properties.json`. Nothing is written without
+confirmation, and `.dev_properties.json` is always the source of truth for
+the copy. Existing indentation and unrelated fields are left alone.
+
+After answering, `svc` offers to remember the choice in a `.svcconfig` file
+in the project root:
+
+```json
+{
+	"syncPackageJson": true
+}
+```
+
+With `true`, `svc` updates `package.json` automatically without asking; with
+`false`, the check is skipped entirely. Delete the key (or the file) to be
+asked again. The file contains no secrets, so it is safe to commit.
+
 ### Password storage
 
 Passwords are stored in the OS-native secret store (macOS Keychain, Windows