@automattic/vip 4.0.10 → 4.0.13

package/dist/bin/vip-defensive-mode-configure.js

@@ -0,0 +1,216 @@
+#!/usr/bin/env node
+"use strict";
+
+exports.__esModule = true;
+exports.defensiveModeConfigureCommand = defensiveModeConfigureCommand;
+var _chalk = _interopRequireDefault(require("chalk"));
+var _enquirer = require("enquirer");
+var _command = _interopRequireDefault(require("../lib/cli/command"));
+var _format = require("../lib/cli/format");
+var _api = require("../lib/defensive-mode/api");
+var _cliHelpers = require("../lib/defensive-mode/cli-helpers");
+var _input = require("../lib/envvar/input");
+var _tracker = require("../lib/tracker");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const baseUsage = 'vip defensive-mode configure';
+const exampleUsage = 'vip @example-app.production defensive-mode configure';
+const examples = [{
+  usage: `${exampleUsage} --enabled=true --challenge-type=1`,
+  description: 'Update defensive mode configuration non-interactively (minimal required flags).'
+}, {
+  usage: `${exampleUsage} --enabled=true --challenge-type=2 --connection-threshold-absolute=5000 --connection-threshold-percentage=80`,
+  description: 'Update with explicit thresholds.'
+}];
+function parseBoolean(raw) {
+  if (raw === true || raw === false) {
+    return raw;
+  }
+  if (typeof raw !== 'string') {
+    return null;
+  }
+  const normalized = raw.trim().toLowerCase();
+  if (['true', 'yes', '1', 'on', 'enable', 'enabled'].includes(normalized)) {
+    return true;
+  }
+  if (['false', 'no', '0', 'off', 'disable', 'disabled'].includes(normalized)) {
+    return false;
+  }
+  return null;
+}
+function parsePositiveInt(raw) {
+  // A bare flag (e.g. `--challenge-type` with no value) arrives as boolean true,
+  // which Number() would silently coerce to 1.
+  if (raw === undefined || raw === null || typeof raw === 'boolean') {
+    return null;
+  }
+  if (typeof raw === 'string' && raw.trim() === '') {
+    return null;
+  }
+  const num = Number(raw);
+  if (!Number.isInteger(num) || num < 0) {
+    return null;
+  }
+  return num;
+}
+function validateFlags(opt) {
+  const errors = [];
+  const enabled = opt.enabled === undefined ? null : parseBoolean(opt.enabled);
+  if (opt.enabled !== undefined && enabled === null) {
+    errors.push(`Invalid value for --enabled: ${opt.enabled}. Expected true or false.`);
+  }
+  const challengeType = opt.challengeType === undefined ? null : parsePositiveInt(opt.challengeType);
+  if (opt.challengeType !== undefined && challengeType === null) {
+    errors.push(`Invalid value for --challenge-type: ${opt.challengeType}. Expected a non-negative integer.`);
+  }
+  const absolute = opt.connectionThresholdAbsolute === undefined ? undefined : parsePositiveInt(opt.connectionThresholdAbsolute);
+  if (opt.connectionThresholdAbsolute !== undefined && absolute === null) {
+    errors.push(`Invalid value for --connection-threshold-absolute: ${opt.connectionThresholdAbsolute}. Expected a non-negative integer.`);
+  }
+  const percentage = opt.connectionThresholdPercentage === undefined ? undefined : parsePositiveInt(opt.connectionThresholdPercentage);
+  if (opt.connectionThresholdPercentage !== undefined && percentage === null) {
+    errors.push(`Invalid value for --connection-threshold-percentage: ${opt.connectionThresholdPercentage}. Expected a non-negative integer.`);
+  }
+  return {
+    enabled,
+    challengeType,
+    absolute,
+    percentage,
+    errors
+  };
+}
+function formatSettingValue(value) {
+  return value === undefined || value === null ? '-' : String(value);
+}
+function buildSettingRows(currentConfig, {
+  enabled,
+  challengeType,
+  absolute,
+  percentage
+}) {
+  return [{
+    setting: 'Enabled',
+    current: formatSettingValue(currentConfig?.enabled),
+    proposed: formatSettingValue(enabled)
+  }, {
+    setting: 'Challenge type',
+    current: formatSettingValue(currentConfig?.challengeType),
+    proposed: formatSettingValue(challengeType)
+  }, {
+    setting: 'Connection threshold (absolute)',
+    current: formatSettingValue(currentConfig?.connectionThresholdAbsolute),
+    proposed: absolute === undefined ? '(not specified)' : formatSettingValue(absolute)
+  }, {
+    setting: 'Connection threshold (percentage)',
+    current: formatSettingValue(currentConfig?.connectionThresholdPercentage),
+    proposed: percentage === undefined ? '(not specified)' : formatSettingValue(percentage)
+  }];
+}
+async function resolveRequiredViaPrompt(missing, enabled, challengeType) {
+  const answers = await (0, _enquirer.prompt)(missing.map(flag => flag === '--enabled' ? {
+    type: 'confirm',
+    name: 'enabled',
+    message: 'Enable defensive mode?'
+  } : {
+    type: 'input',
+    name: 'challengeType',
+    message: 'Challenge type (integer):'
+  }));
+  let resolvedEnabled = enabled;
+  let resolvedChallengeType = challengeType;
+  if (resolvedEnabled === null && 'enabled' in answers) {
+    resolvedEnabled = Boolean(answers.enabled);
+  }
+  if (resolvedChallengeType === null && 'challengeType' in answers) {
+    resolvedChallengeType = parsePositiveInt(answers.challengeType);
+    if (resolvedChallengeType === null) {
+      console.error(_chalk.default.red('Challenge type must be a non-negative integer.'));
+      process.exit(1);
+    }
+  }
+  return {
+    enabled: resolvedEnabled,
+    challengeType: resolvedChallengeType
+  };
+}
+async function defensiveModeConfigureCommand(_args, opt) {
+  const interactive = (0, _cliHelpers.isInteractive)(opt);
+  const trackingParams = {
+    app_id: opt.app.id,
+    command: baseUsage,
+    env_id: opt.env.id,
+    org_id: opt.app.organization.id,
+    org_sfid: opt.app.organization.salesforceId,
+    interactive,
+    skip_confirm: Boolean(opt.skipConfirmation)
+  };
+  await (0, _tracker.trackEvent)('defensive_mode_configure_command_execute', trackingParams);
+  const {
+    enabled: rawEnabled,
+    challengeType: rawChallengeType,
+    absolute,
+    percentage,
+    errors
+  } = validateFlags(opt);
+  if (errors.length > 0) {
+    errors.forEach(msg => console.error(_chalk.default.red(msg)));
+    process.exit(1);
+  }
+  const missing = [];
+  if (rawEnabled === null) {
+    missing.push('--enabled');
+  }
+  if (rawChallengeType === null) {
+    missing.push('--challenge-type');
+  }
+  let enabled = rawEnabled;
+  let challengeType = rawChallengeType;
+  if (missing.length > 0) {
+    if (!interactive) {
+      console.error(_chalk.default.red(`Missing required flags in non-interactive mode: ${missing.join(', ')}`));
+      console.error('Re-run with all required flags, or remove --non-interactive and run on a TTY.');
+      await (0, _tracker.trackEvent)('defensive_mode_configure_command_error', {
+        ...trackingParams,
+        error: 'missing-required-flags'
+      });
+      process.exit(1);
+    }
+    ({
+      enabled,
+      challengeType
+    } = await resolveRequiredViaPrompt(missing, enabled, challengeType));
+  }
+  const input = {
+    appId: opt.app.id,
+    envId: opt.env.id,
+    enabled,
+    challengeType
+  };
+  if (absolute !== undefined) {
+    input.connectionThresholdAbsolute = absolute;
+  }
+  if (percentage !== undefined) {
+    input.connectionThresholdPercentage = percentage;
+  }
+  const currentConfig = opt.env.defensiveMode?.config?.effective ?? null;
+  const settingRows = buildSettingRows(currentConfig, {
+    enabled,
+    challengeType,
+    absolute,
+    percentage
+  });
+  console.log(`Defensive mode configuration for ${_chalk.default.bold(opt.app.name)} (${(0, _format.formatEnvironment)(opt.env.type)}):`);
+  console.log((0, _format.table)(settingRows));
+
+  // Production mutations require confirmation. In non-interactive contexts this
+  // hard-errors unless --skip-confirmation is passed, so unattended/CI runs fail
+  // fast rather than silently mutating production — matching enable/disable.
+  await (0, _cliHelpers.guardProductionMutation)(opt, 'configure', trackingParams, _input.confirm, _tracker.trackEvent, _format.formatEnvironment);
+  const result = await (0, _api.updateDefensiveModeConfig)(input);
+  await (0, _cliHelpers.reportMutationResult)(result, trackingParams, 'configure', opt.app.name, opt.env.type, 'configuration updated', 'update defensive mode config', _tracker.trackEvent);
+}
+(0, _command.default)({
+  appContext: true,
+  appQuery: _api.appQuery,
+  envContext: true,
+  usage: baseUsage
+}).option('enabled', 'Whether defensive mode should be enabled (true|false). Required.').option('challenge-type', 'Challenge type integer. Required.').option('connection-threshold-absolute', 'Absolute connection threshold that triggers defensive mode.').option('connection-threshold-percentage', 'Connection threshold percentage that triggers defensive mode.').option('non-interactive', 'Disable prompts and browser-open; fail fast if a required flag is missing.', false).option('skip-confirmation', 'Skip the confirmation prompt for production envs.', false).option('rechallenge-wait', 'When step-up verification is required non-interactively, print the URL and wait for verification on another device instead of failing fast.', false).examples(examples).argv(process.argv, defensiveModeConfigureCommand);

package/dist/bin/vip-defensive-mode-disable.js

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+"use strict";
+
+exports.__esModule = true;
+exports.defensiveModeDisableCommand = defensiveModeDisableCommand;
+var _command = _interopRequireDefault(require("../lib/cli/command"));
+var _format = require("../lib/cli/format");
+var _api = require("../lib/defensive-mode/api");
+var _cliHelpers = require("../lib/defensive-mode/cli-helpers");
+var _input = require("../lib/envvar/input");
+var _tracker = require("../lib/tracker");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const baseUsage = 'vip defensive-mode disable';
+const exampleUsage = 'vip @example-app.production defensive-mode disable';
+const examples = [{
+  usage: exampleUsage,
+  description: 'Disable defensive mode for the environment.'
+}];
+async function defensiveModeDisableCommand(_args, opt) {
+  const trackingParams = {
+    app_id: opt.app.id,
+    command: baseUsage,
+    env_id: opt.env.id,
+    org_id: opt.app.organization.id,
+    org_sfid: opt.app.organization.salesforceId,
+    skip_confirm: Boolean(opt.skipConfirmation)
+  };
+  await (0, _tracker.trackEvent)('defensive_mode_disable_command_execute', trackingParams);
+  await (0, _cliHelpers.guardProductionMutation)(opt, 'disable', trackingParams, _input.confirm, _tracker.trackEvent, _format.formatEnvironment);
+  const result = await (0, _api.updateDefensiveModeStatus)({
+    appId: opt.app.id,
+    envId: opt.env.id,
+    enabled: false
+  });
+  await (0, _cliHelpers.reportMutationResult)(result, trackingParams, 'disable', opt.app.name, opt.env.type, 'disabled', 'disable defensive mode', _tracker.trackEvent);
+}
+(0, _command.default)({
+  appContext: true,
+  appQuery: _api.appQuery,
+  envContext: true,
+  usage: baseUsage
+}).option('skip-confirmation', 'Skip the confirmation prompt for production envs.', false).option('non-interactive', 'Disable prompts; error if a production mutation is attempted without --skip-confirmation.', false).option('rechallenge-wait', 'When step-up verification is required non-interactively, print the URL and wait for verification on another device instead of failing fast.', false).examples(examples).argv(process.argv, defensiveModeDisableCommand);

package/dist/bin/vip-defensive-mode-enable.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+"use strict";
+
+exports.__esModule = true;
+exports.defensiveModeEnableCommand = defensiveModeEnableCommand;
+var _command = _interopRequireDefault(require("../lib/cli/command"));
+var _format = require("../lib/cli/format");
+var _api = require("../lib/defensive-mode/api");
+var _cliHelpers = require("../lib/defensive-mode/cli-helpers");
+var _input = require("../lib/envvar/input");
+var _tracker = require("../lib/tracker");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const baseUsage = 'vip defensive-mode enable';
+const exampleUsage = 'vip @example-app.production defensive-mode enable';
+const examples = [{
+  usage: exampleUsage,
+  description: 'Enable defensive mode for the environment (interactive).'
+}, {
+  usage: `${exampleUsage} --skip-confirmation`,
+  description: 'Enable defensive mode without the production confirmation prompt.'
+}];
+async function defensiveModeEnableCommand(_args, opt) {
+  const trackingParams = {
+    app_id: opt.app.id,
+    command: baseUsage,
+    env_id: opt.env.id,
+    org_id: opt.app.organization.id,
+    org_sfid: opt.app.organization.salesforceId,
+    skip_confirm: Boolean(opt.skipConfirmation)
+  };
+  await (0, _tracker.trackEvent)('defensive_mode_enable_command_execute', trackingParams);
+  await (0, _cliHelpers.guardProductionMutation)(opt, 'enable', trackingParams, _input.confirm, _tracker.trackEvent, _format.formatEnvironment);
+  const result = await (0, _api.updateDefensiveModeStatus)({
+    appId: opt.app.id,
+    envId: opt.env.id,
+    enabled: true
+  });
+  await (0, _cliHelpers.reportMutationResult)(result, trackingParams, 'enable', opt.app.name, opt.env.type, 'enabled', 'enable defensive mode', _tracker.trackEvent);
+}
+(0, _command.default)({
+  appContext: true,
+  appQuery: _api.appQuery,
+  envContext: true,
+  usage: baseUsage
+}).option('skip-confirmation', 'Skip the confirmation prompt for production envs.', false).option('non-interactive', 'Disable prompts; error if a production mutation is attempted without --skip-confirmation.', false).option('rechallenge-wait', 'When step-up verification is required non-interactively, print the URL and wait for verification on another device instead of failing fast.', false).examples(examples).argv(process.argv, defensiveModeEnableCommand);

package/dist/bin/vip-defensive-mode.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+"use strict";
+
+var _command = _interopRequireDefault(require("../lib/cli/command"));
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const usage = 'vip defensive-mode';
+const exampleUsage = 'vip @example-app.production defensive-mode';
+const examples = [{
+  usage: `${exampleUsage} enable`,
+  description: 'Enable defensive mode for the environment.'
+}, {
+  usage: `${exampleUsage} disable`,
+  description: 'Disable defensive mode for the environment.'
+}, {
+  usage: `${exampleUsage} configure --enabled=true --challenge-type=1`,
+  description: 'Update the defensive mode configuration non-interactively.'
+}];
+(0, _command.default)({
+  requiredArgs: 1,
+  usage
+}).command('enable', 'Enable defensive mode (step-up auth required).').command('disable', 'Disable defensive mode (step-up auth required).').command('configure', 'Update the defensive mode configuration (step-up auth required).').examples(examples).argv(process.argv);

package/dist/bin/vip-import-sql.js

@@ -48,12 +48,6 @@ const appQuery = `
 			dbOperationInProgress
 			importInProgress
 		}
-		wpSitesSDS {
-			nodes {
-				homeUrl
-				id
-			}
-		}
 	}
 `;
 const START_IMPORT_MUTATION = (0, _graphqlTag.default)`
@@ -403,7 +397,6 @@ const displayPlaybook = ({
   fileName,
   domain,
   formattedEnvironment,
-  unformattedEnvironment,
   isMultiSite,
   app
 }) => {
@@ -418,53 +411,19 @@ const displayPlaybook = ({
     };
     (0, _format.formatSearchReplaceValues)(searchReplace, output);
   }
-  let siteArray = [];
   if (isMultiSite) {
     console.log(`  multisite: ${isMultiSite.toString()}`);
-    const selectedEnvironmentObj = app?.environments?.find(env => unformattedEnvironment === env.type);
-    siteArray = selectedEnvironmentObj?.wpSitesSDS?.nodes;
   }
   if (!tableNames.length) {
     debug('Validation was skipped. No playbook information will be displayed.');
   } else {
     // output the table names
     console.log();
-    if (!isMultiSite) {
-      console.log('Tables that will be imported by this process:');
-      console.log((0, _cliColumns.default)(tableNames));
-    } else {
-      // we have siteArray from the API, use it and the table names together
-      if (siteArray === 'undefined' || !siteArray) {
-        console.log(_chalk.default.yellowBright('Unable to determine the network sites affected by this import. Please proceed only if you are confident that the contents of the file are valid for import.'));
-        return;
-      } else if (!siteArray?.length) {
-        throw new Error('There were no sites in your multisite installation.');
-      }
-      const multiSiteBreakdown = siteArray.map(wpSite => {
-        let siteRegex;
-        if (wpSite.id === 1) {
-          siteRegex = /^wp_[a-z]+/i;
-        } else {
-          // eslint-disable-next-line security/detect-non-literal-regexp
-          siteRegex = new RegExp(`^wp_${parseInt(wpSite.id, 10)}_[a-z]+`, 'i');
-        }
-        const tableNamesInGroup = tableNames.filter(name => siteRegex.test(name));
-        return {
-          id: wpSite.id,
-          url: wpSite.homeUrl,
-          tables: tableNamesInGroup
-        };
-      });
-      if (launched) {
-        console.log(_chalk.default.yellowBright('You are updating tables in a launched multisite environment. The performance of sites on the network might be impacted by this operation.'));
-      }
-      console.log(_chalk.default.yellow('The following sites will be affected by the import:'));
-      multiSiteBreakdown.forEach(siteObject => {
-        console.log();
-        console.log(_chalk.default.blueBright(`Blog with ID ${siteObject.id} and URL ${siteObject.url} will import the following tables:`));
-        console.log((0, _cliColumns.default)(siteObject.tables));
-      });
+    if (isMultiSite && launched) {
+      console.log(_chalk.default.yellowBright('You are updating tables in a launched multisite environment. The performance of sites on the network might be impacted by this operation.'));
     }
+    console.log('Tables that will be imported by this process:');
+    console.log((0, _cliColumns.default)(tableNames));
   }
 };
 (0, _command.default)({
@@ -546,7 +505,6 @@ const displayPlaybook = ({
     fileName: fileNameOrURL,
     domain,
     formattedEnvironment,
-    unformattedEnvironment: opts.env.type,
     isMultiSite,
     app
   });

package/dist/bin/vip.js

@@ -9,6 +9,7 @@ var _command = _interopRequireWildcard(require("../lib/cli/command"));
 var _config = _interopRequireDefault(require("../lib/cli/config"));
 var _internalBinLoader = require("../lib/cli/internal-bin-loader");
 var _seaDispatch = require("../lib/cli/sea-dispatch");
+var _tokenCache = _interopRequireDefault(require("../lib/rechallenge/token-cache"));
 var _token = _interopRequireDefault(require("../lib/token"));
 var _tracker = require("../lib/tracker");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
@@ -42,7 +43,7 @@ async function maybeExecuteSeaTargetCommand() {
 }
 const runCmd = async function () {
   const cmd = (0, _command.default)();
-  cmd.command('logout', 'Log out the current authenticated VIP-CLI user.').command('app', 'Interact with applications that the current authenticated VIP-CLI user has permission to access.').command('backup', 'Generate a backup of an environment.').command('cache', 'Manage page cache for an environment.').command('config', 'Manage environment configurations.').command('dev-env', 'Create and manage VIP Local Development Environments.').command('export', 'Export a copy of data associated with an environment.').command('import', 'Import media or SQL database files to an environment.').command('logs', 'Retrieve Runtime Logs from an environment.').command('search-replace', 'Search for a string in a local SQL file and replace it with a new string.').command('slowlogs', 'Retrieve MySQL slow query logs from an environment.').command('db', "Access an environment's database.").command('sync', 'Sync the database from production to a non-production environment.').command('whoami', 'Retrieve details about the current authenticated VIP-CLI user.').command('wp', 'Execute a WP-CLI command against an environment.');
+  cmd.command('logout', 'Log out the current authenticated VIP-CLI user.').command('app', 'Interact with applications that the current authenticated VIP-CLI user has permission to access.').command('backup', 'Generate a backup of an environment.').command('cache', 'Manage page cache for an environment.').command('config', 'Manage environment configurations.').command('dev-env', 'Create and manage VIP Local Development Environments.').command('export', 'Export a copy of data associated with an environment.').command('import', 'Import media or SQL database files to an environment.').command('logs', 'Retrieve Runtime Logs from an environment.').command('search-replace', 'Search for a string in a local SQL file and replace it with a new string.').command('slowlogs', 'Retrieve MySQL slow query logs from an environment.').command('db', "Access an environment's database.").command('defensive-mode', 'Manage VIP defensive mode for an environment.').command('sync', 'Sync the database from production to a non-production environment.').command('whoami', 'Retrieve details about the current authenticated VIP-CLI user.').command('wp', 'Execute a WP-CLI command against an environment.');
   await cmd.argv(process.argv);
 };
 
@@ -123,6 +124,10 @@ async function runLoginFlow() {
     throw err;
   }
 
+  // Elevated tokens are keyed by API host + scope, not by user identity. Drop any
+  // cached elevation from a previous login so it cannot carry across identities.
+  await _tokenCache.default.clearAll();
+
   // De-anonymize user for tracking
   await (0, _tracker.aliasUser)(token.id);
   await (0, _tracker.trackEvent)('login_command_token_submit_success');

package/dist/lib/api/constants.js

@@ -0,0 +1,7 @@
+"use strict";
+
+exports.__esModule = true;
+exports.PRODUCTION_API_HOST = exports.API_URL = exports.API_HOST = void 0;
+const PRODUCTION_API_HOST = exports.PRODUCTION_API_HOST = 'https://api.wpvip.com';
+const API_HOST = exports.API_HOST = process.env.API_HOST || PRODUCTION_API_HOST; // NOSONAR
+const API_URL = exports.API_URL = `${API_HOST}/graphql`;

package/dist/lib/api/feature-flags.js

@@ -5,9 +5,22 @@ exports.get = get;
 var _graphqlTag = _interopRequireDefault(require("graphql-tag"));
 var _api = _interopRequireDefault(require("../../lib/api"));
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const api = (0, _api.default)({
-  silenceAuthErrors: true
-});
+// Lazy-initialize the API client so that this module can be imported during the
+// rechallenge module chain without triggering a circular-dependency crash.  The
+// cycle that existed before this change:
+//   api.ts → rechallenge/link.ts → flow.ts → tracker.ts → tracks.ts
+//   → cli/apiConfig.ts → api/feature-flags.ts → api.ts
+// By deferring construction to the first call we ensure api.ts is fully
+// evaluated before API() is invoked.
+let api = null;
+function getApi() {
+  if (!api) {
+    api = (0, _api.default)({
+      silenceAuthErrors: true
+    });
+  }
+  return api;
+}
 const isVipQuery = (0, _graphqlTag.default)`
 	query isVIP {
 		me {
@@ -16,7 +29,7 @@ const isVipQuery = (0, _graphqlTag.default)`
 	}
 `;
 function get() {
-  return api.query({
+  return getApi().query({
     query: isVipQuery,
     fetchPolicy: 'cache-first'
   });

package/dist/lib/api/http.js

@@ -4,7 +4,7 @@ exports.__esModule = true;
 exports.default = void 0;
 var _debug = _interopRequireDefault(require("debug"));
 var _undici = require("undici");
-var _api = require("../../lib/api");
+var _constants = require("./constants");
 var _env = _interopRequireDefault(require("../../lib/env"));
 var _proxyDispatcher = require("../../lib/http/proxy-dispatcher");
 var _token = _interopRequireDefault(require("../../lib/token"));
@@ -31,8 +31,8 @@ var _default = async (path, options = {}) => {
 
   // For convenience, we support just passing in the path to this function...
   // but some things (Apollo) always pass the full url
-  if (!path.startsWith(_api.API_HOST)) {
-    url = `${_api.API_HOST}${path}`;
+  if (!path.startsWith(_constants.API_HOST)) {
+    url = `${_constants.API_HOST}${path}`;
   }
   const authToken = await _token.default.get();
   const proxyDispatcher = (0, _proxyDispatcher.createProxyDispatcher)(url);

package/dist/lib/api.js

@@ -1,7 +1,7 @@
 "use strict";
 
 exports.__esModule = true;
-exports.PRODUCTION_API_HOST = exports.API_URL = exports.API_HOST = void 0;
+exports.PRODUCTION_API_HOST = exports.API_HOST = void 0;
 exports.default = API;
 exports.disableGlobalGraphQLErrorHandling = disableGlobalGraphQLErrorHandling;
 exports.enableGlobalGraphQLErrorHandling = enableGlobalGraphQLErrorHandling;
@@ -12,12 +12,16 @@ var _retry = require("@apollo/client/link/retry");
 var _chalk = _interopRequireDefault(require("chalk"));
 var _debug = _interopRequireDefault(require("debug"));
 var _graphql = require("graphql");
+var _constants = require("./api/constants");
+exports.API_URL = _constants.API_URL;
+exports.API_HOST = _constants.API_HOST;
+exports.PRODUCTION_API_HOST = _constants.PRODUCTION_API_HOST;
 var _http = _interopRequireDefault(require("./api/http"));
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-// Config
-const PRODUCTION_API_HOST = exports.PRODUCTION_API_HOST = 'https://api.wpvip.com';
-const API_HOST = exports.API_HOST = process.env.API_HOST || PRODUCTION_API_HOST; // NOSONAR
-const API_URL = exports.API_URL = `${API_HOST}/graphql`;
+// Config — re-exported from ./api/constants so modules in the rechallenge tree
+// can import them without pulling in the full api.ts graph (which would create
+// a circular dependency via the rechallenge link).
+
 let globalGraphQLErrorHandlingEnabled = true;
 const RETRY_LINK_MAX_ATTEMPTS = 5;
 const RETRY_LINK_INITIAL_DELAY_MS = 1000; // 1 second
@@ -88,10 +92,10 @@ function API({
     uri: operation => {
       // to make it easier to write tests, we'll skip adding x_query for tests
       if (process.env.NODE_ENV === 'test') {
-        return API_URL;
+        return _constants.API_URL;
       }
       const operationName = operation.operationName ?? '';
-      return `${API_URL}?x_query=${encodeURIComponent(operationName)}`;
+      return `${_constants.API_URL}?x_query=${encodeURIComponent(operationName)}`;
     },
     fetch: _http.default
   });
@@ -102,8 +106,19 @@ function API({
     },
     attempts: shouldRetryRequest
   });
+
+  // Lazy-require the rechallenge link to avoid a circular-dependency issue in
+  // Jest tests.  Importing at module top-level would cause rechallenge/client.ts
+  // to be loaded during jest.setupMocks.js (via apiConfig → feature-flags →
+  // api.ts → link.ts → client.ts), preventing jest.mock('../api/http') from
+  // intercepting the http reference captured inside client.ts.  A require()
+  // call inside the function body is resolved after all mocks are registered.
+
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const linkMod = require('./rechallenge/link');
+  const createRechallengeLink = linkMod.default;
   return new _core.ApolloClient({
-    link: _core.ApolloLink.from([errorLink, retryLink, httpLink]),
+    link: _core.ApolloLink.from([errorLink, createRechallengeLink(), retryLink, httpLink]),
     cache: new _core.InMemoryCache({
       typePolicies: {
         WPSite: {

package/dist/lib/cli/internal-bin-loader.js

@@ -28,6 +28,10 @@ const internalBinLoaders = {
   'vip-config-software-update': () => import('../../bin/vip-config-software-update'),
   'vip-db': () => import('../../bin/vip-db'),
   'vip-db-phpmyadmin': () => import('../../bin/vip-db-phpmyadmin'),
+  'vip-defensive-mode': () => import('../../bin/vip-defensive-mode'),
+  'vip-defensive-mode-configure': () => import('../../bin/vip-defensive-mode-configure'),
+  'vip-defensive-mode-disable': () => import('../../bin/vip-defensive-mode-disable'),
+  'vip-defensive-mode-enable': () => import('../../bin/vip-defensive-mode-enable'),
   'vip-dev-env': () => import('../../bin/vip-dev-env'),
   'vip-dev-env-create': () => import('../../bin/vip-dev-env-create'),
   'vip-dev-env-destroy': () => import('../../bin/vip-dev-env-destroy'),