@binaryandthread/cli 0.1.0 → 0.1.2

package/dist/{chunk-DWTH7CNI.js → chunk-WYCZ6BPV.js}

@@ -1,13 +1,4 @@
 #!/usr/bin/env node
-import {
-  PLAIN,
-  colourMarker,
-  colourSwatch,
-  cyan,
-  dim,
-  header,
-  makeBrand
-} from "./chunk-P3LSUCEO.js";
 
 // ../store-client/dist/index.js
 var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
@@ -53,15 +44,21 @@ function redact(input, _seen) {
   if (typeof input !== "object") {
     return input;
   }
-  const seen = _seen ?? /* @__PURE__ */ new WeakSet();
-  if (seen.has(input)) {
-    return input;
+  const seen = _seen ?? /* @__PURE__ */ new Map();
+  const existing = seen.get(input);
+  if (existing !== void 0) {
+    return existing;
   }
-  seen.add(input);
   if (Array.isArray(input)) {
-    return input.map((v) => redact(v, seen));
+    const out2 = [];
+    seen.set(input, out2);
+    for (const v of input) {
+      out2.push(redact(v, seen));
+    }
+    return out2;
   }
   const out = {};
+  seen.set(input, out);
   for (const [key, value] of Object.entries(input)) {
     if (SENSITIVE_KEYS.has(key.toLowerCase())) {
       out[key] = MASK;
@@ -303,10 +300,20 @@ var StoreClient = class {
   // ----- products (region resolved BEFORE pricing) ---------------------------
   async listProducts(opts) {
     const region = opts?.region ?? await this.resolveRegion(opts?.countryCode);
-    const data = await this.request("GET", "/store/products", {
-      query: { region_id: region.id, limit: 100 }
-    });
-    return data.products ?? [];
+    const PAGE = 100;
+    const HARD_CAP = 1e3;
+    const all = [];
+    for (let offset = 0; offset < HARD_CAP; offset += PAGE) {
+      const data = await this.request("GET", "/store/products", {
+        query: { region_id: region.id, limit: PAGE, offset }
+      });
+      const page = data.products ?? [];
+      all.push(...page);
+      if (page.length < PAGE) {
+        break;
+      }
+    }
+    return all;
   }
   async getProduct(handle, opts) {
     const region = opts?.region ?? await this.resolveRegion(opts?.countryCode);
@@ -397,7 +404,9 @@ var StoreClient = class {
     return res.cart;
   }
   // ----- headless contract (04.5-01) -----------------------------------------
-  async mintCheckout(cartId, email, channel = "cli") {
+  // `channel` is REQUIRED (L11): a default silently mis-attributes analytics for a future caller that
+  // forgets it. Both current callers (cli, mcp) pass it explicitly.
+  async mintCheckout(cartId, email, channel) {
     return this.request("POST", "/store/headless/checkout", {
       idempotent: true,
       body: { cart_id: cartId, email, channel }
@@ -470,13 +479,15 @@ var StoreClient = class {
     }
   }
   /**
-   * Guest order lookup — requires order display id + EXACT email (F-H1).
-   * The backend returns 404 on a mismatch (no enumeration); the client surfaces null.
+   * Guest order lookup (AUD-8) — POST /store/order-lookup with the order id (display id OR internal
+   * id) + the EXACT email in the BODY (never the query string, so the email is not access-logged).
+   * The backend returns 404 on any mismatch (no enumeration) → the client surfaces null. Rate-limited
+   * server-side; returns minimal status only, never PII (F-H1 / F-H3).
    */
-  async getOrder(displayId, email) {
+  async getOrder(idOrDisplayId, email) {
     try {
-      return await this.request("GET", "/store/orders", {
-        query: { display_id: String(displayId), email }
+      return await this.request("POST", "/store/order-lookup", {
+        body: { id: String(idOrDisplayId), email }
       });
     } catch (e) {
       if (e instanceof StoreApiError && e.status === 404) {
@@ -576,7 +587,7 @@ function findVariant(p, opts = {}) {
     return variants.find((v) => colourMatches(v));
   }
   if (size && !colour) {
-    return variants.find((v) => sizeMatches(v)) ?? variants[0];
+    return variants.find((v) => sizeMatches(v));
   }
   return variants[0];
 }
@@ -664,6 +675,104 @@ function versionLine(version) {
   return `bt ${version} "${codename(version)}"`;
 }
 
+// src/brand.ts
+var ANSI = {
+  reset: "\x1B[0m",
+  // cyan: the signature accent. On a dark terminal this is the neon "glow" the design system
+  // reserves for key elements. 38;5;48 ≈ #00ffc2 family on 256-colour terminals.
+  cyan: "\x1B[38;5;48m",
+  // green: reserved for the contribution graph ONLY — the GitHub-contribution-green flex on the
+  // `bt whoami` card. Not a general accent (that's cyan); a deliberate, single second colour.
+  green: "\x1B[38;5;42m",
+  dim: "\x1B[2m",
+  bold: "\x1B[1m"
+};
+function colorEnabled(opts = {}) {
+  if (opts.noColor) return false;
+  if (process.env.NO_COLOR !== void 0 && process.env.NO_COLOR !== "") return false;
+  const tty = opts.isTTY ?? Boolean(process.stdout.isTTY);
+  return tty;
+}
+function makeBrand(opts = {}) {
+  return { color: colorEnabled(opts) };
+}
+var PLAIN = { color: false };
+function wrap(style, code, s) {
+  if (!style.color) return s;
+  return `${code}${s}${ANSI.reset}`;
+}
+function cyan(style, s) {
+  return wrap(style, ANSI.cyan, s);
+}
+function dim(style, s) {
+  return wrap(style, ANSI.dim, s);
+}
+function green(style, s) {
+  return wrap(style, ANSI.green, s);
+}
+var BOX = {
+  tl: "\u250C",
+  tr: "\u2510",
+  bl: "\u2514",
+  br: "\u2518",
+  h: "\u2500",
+  v: "\u2502",
+  ml: "\u251C",
+  mr: "\u2524"
+};
+function header(style, title, width = 56) {
+  const label = ` ${title} `;
+  const lead = BOX.h.repeat(2);
+  const used = lead.length + label.length;
+  const tail = BOX.h.repeat(Math.max(2, width - used));
+  return `${lead}${cyan(style, label)}${tail}`;
+}
+function rule(width = 56) {
+  return BOX.h.repeat(width);
+}
+function box(lines, opts = {}) {
+  const style = opts.style ?? PLAIN;
+  const inner = opts.width ?? 56;
+  const out = [];
+  if (opts.title) {
+    const label = ` ${opts.title} `;
+    const lead = BOX.h.repeat(2);
+    const used = lead.length + visibleLength(label);
+    const tail = BOX.h.repeat(Math.max(1, inner - used));
+    out.push(`${BOX.tl}${lead}${cyan(style, label)}${tail}${BOX.tr}`);
+  } else {
+    out.push(`${BOX.tl}${BOX.h.repeat(inner)}${BOX.tr}`);
+  }
+  for (const line of lines) {
+    const pad = Math.max(0, inner - 1 - visibleLength(line));
+    out.push(`${BOX.v} ${line}${" ".repeat(pad)}${BOX.v}`);
+  }
+  out.push(`${BOX.bl}${BOX.h.repeat(inner)}${BOX.br}`);
+  return out;
+}
+function visibleLength(s) {
+  return s.replace(/\x1b\[[0-9;]*m/g, "").length;
+}
+function contributionBar(style, commits, cap = 20) {
+  const n = Number.isFinite(commits) ? Math.max(0, Math.floor(commits)) : 0;
+  const filledCount = Math.min(n, cap);
+  const filled = green(style, "\u2587".repeat(filledCount));
+  const empty2 = "\u2591".repeat(Math.max(0, cap - filledCount));
+  return `${filled}${empty2}`;
+}
+function colourSwatch(colour) {
+  const c = colour.trim().toLowerCase();
+  if (c === "white") return "\u2B1C";
+  if (c === "black") return "\u2B1B";
+  return "\u25FC";
+}
+function colourMarker(colours) {
+  if (colours.length === 0) return "";
+  const swatches = colours.map((c) => colourSwatch(c)).join("");
+  const names = colours.join("/");
+  return `${swatches} ${names}`;
+}
+
 // src/commands/shared.ts
 function brandOf(args) {
   return args?.brand ?? PLAIN;
@@ -739,15 +848,35 @@ function resolveLineItemRef(items, ref) {
   );
   return byTitle ?? null;
 }
+function resolveOutput(program) {
+  const opts = program.opts();
+  const json = Boolean(opts.json);
+  const brand = json ? makeBrand({ noColor: true }) : makeBrand({ noColor: opts.color === false });
+  return { json, brand };
+}
+function printResult(res, json) {
+  if (json && res.json !== void 0) {
+    process.stdout.write(JSON.stringify(res.json, null, 2) + "\n");
+    return;
+  }
+  process.stdout.write(res.lines.join("\n") + "\n");
+}
 
 // src/image-ladder.ts
 var DEFAULT_RENDER_HEIGHT = 28;
 function urlFloor(url) {
   return `   ${url}`;
 }
+function isHttpsUrl(url) {
+  try {
+    return new URL(url).protocol === "https:";
+  } catch {
+    return false;
+  }
+}
 async function renderImage(blobUrl, opts = {}) {
   const noColor = opts.noColor ?? Boolean(process.env.NO_COLOR);
-  if (!isAllowedImageHost(blobUrl)) {
+  if (!isAllowedImageHost(blobUrl) || !isHttpsUrl(blobUrl)) {
     return `   (image host not allowed \u2014 showing link only)
 ${urlFloor(blobUrl)}`;
   }
@@ -764,6 +893,7 @@ ${urlFloor(blobUrl)}`;
   }
 }
 var IMAGE_FETCH_TIMEOUT_MS = 5e3;
+var IMAGE_BYTE_CAP = 2 * 1024 * 1024;
 async function defaultRender(url, opts) {
   const mod = await import("terminal-image");
   const terminalImage = mod.default ?? mod;
@@ -782,7 +912,15 @@ async function defaultRender(url, opts) {
   if (!res.ok) {
     throw new Error(`blob fetch failed: HTTP ${res.status}`);
   }
+  const cap = opts.byteCap ?? IMAGE_BYTE_CAP;
+  const declaredLen = Number.parseInt(res.headers?.get?.("content-length") ?? "", 10);
+  if (Number.isFinite(declaredLen) && declaredLen > cap) {
+    throw new Error("blob exceeds byte cap (declared)");
+  }
   const buf = Buffer.from(await res.arrayBuffer());
+  if (buf.byteLength === 0 || buf.byteLength > cap) {
+    throw new Error("blob empty or exceeds byte cap");
+  }
   return bufferFn(buf, {
     height: opts.height ?? DEFAULT_RENDER_HEIGHT,
     preserveAspectRatio: true,
@@ -790,94 +928,6 @@ async function defaultRender(url, opts) {
   });
 }
 
-// src/commands/browse.ts
-function productRow(p, stage, style) {
-  const { amount, currency } = firstPrice(p);
-  const { title, handle } = displayName(p);
-  const colours = colourMarker(productColours(p));
-  const parts = [
-    title.padEnd(22),
-    cyan(style, fmtPrice(amount, currency).padEnd(11)),
-    dim(style, handle.padEnd(34)),
-    stageMarker(stage)
-  ];
-  const row = parts.join(" ").trimEnd();
-  return colours ? `${row}
-   ${dim(style, colours)}` : row;
-}
-async function runBrowse(client, config, args) {
-  const style = brandOf(args);
-  const region = await client.resolveRegion(config.region);
-  const products = await client.listProducts({ region });
-  const rows = products.map((p) => ({
-    p,
-    stage: p.metadata?.["channel_stage"] ?? "main"
-  }));
-  let drops = [];
-  if (args.branch === "next") {
-    drops = await client.listDrops();
-  }
-  const lines = [];
-  if (rows.length === 0 && drops.length === 0) {
-    lines.push(empty("nothing in stock on this branch yet. main is the latest."));
-    lines.push("   peek at next \u2192 bt browse --branch=next");
-  } else {
-    lines.push(header(style, "bt browse \u2014 in stock"));
-    for (const { p, stage } of rows) {
-      lines.push(productRow(p, stage, style));
-    }
-    for (const d of drops) {
-      const dt = (d.title ?? d.handle ?? d.id).toString();
-      lines.push(
-        [
-          dt.padEnd(22),
-          cyan(style, fmtPrice(d.price, region.currency_code).padEnd(11)),
-          dim(style, (d.handle ?? d.id).padEnd(34)),
-          stageMarker(d.channel_stage)
-        ].join(" ").trimEnd()
-      );
-    }
-    if (drops.length > 0) {
-      lines.push("   on next, before the web \u2192 bt drops");
-    }
-    lines.push("   view one \u2192 bt view <handle>   \xB7   stage one \u2192 bt stage <handle> --size L");
-  }
-  return {
-    lines,
-    json: args.json ? products.map((p) => ({
-      id: p.id,
-      handle: p.handle,
-      title: p.title,
-      price: firstPrice(p).amount,
-      currency: firstPrice(p).currency,
-      colours: productColours(p),
-      channel_stage: p.metadata?.["channel_stage"] ?? "main"
-    })) : void 0
-  };
-}
-function registerBrowse(program, makeClient, loadConfig) {
-  program.command("browse").alias("ls").description("list what's in stock on a branch.").option("--branch <branch>", "main (live) or next (terminal-only drops)").option("--plain", "force the static table (skip the interactive picker)").action(async (opts) => {
-    const gOpts = program.opts();
-    const json = Boolean(gOpts.json);
-    const noColor = gOpts.color === false;
-    const brand = json ? makeBrand({ noColor: true }) : makeBrand({ noColor });
-    if (!json && !opts.plain && brand.color && process.stdout.isTTY) {
-      const { runInteractiveBrowse } = await import("./interactive-TFZOY3JU.js");
-      const handled = await runInteractiveBrowse(makeClient(), loadConfig(), { branch: opts.branch, brand });
-      if (handled) return;
-    }
-    const res = await runBrowse(makeClient(), loadConfig(), { branch: opts.branch, json, brand });
-    printResult(res, json);
-  });
-}
-function printResult(res, json) {
-  if (json && res.json !== void 0) {
-    process.stdout.write(JSON.stringify(res.json, null, 2) + "\n");
-    return;
-  }
-  process.stdout.write(res.lines.join("\n") + "\n");
-}
-
 // src/commands/view.ts
 async function runView(client, config, args) {
   const style = brandOf(args);
@@ -964,10 +1014,8 @@ async function runView(client, config, args) {
 }
 function registerView(program, makeClient, loadConfig) {
   program.command("view").alias("show").argument("<handle>", "the product handle/slug").option("--colour <colour>", "render a specific colour's mockup (e.g. black)").description("render a design: specs + image (always with the link as the floor).").action(async (handle, opts) => {
-    const gOpts = program.opts();
-    const json = Boolean(gOpts.json);
-    const noColor = gOpts.color === false;
-    const brand = json ? makeBrand({ noColor: true }) : makeBrand({ noColor });
+    const { json, brand } = resolveOutput(program);
+    const noColor = program.opts().color === false;
     const res = await runView(makeClient(), loadConfig(), {
       handle,
       colour: opts.colour,
@@ -1072,9 +1120,7 @@ async function runStage(client, config, args) {
 }
 function registerStage(program, makeClient, loadConfig) {
   program.command("stage").alias("add").argument("<handle>", "the product handle/slug").option("--size <size>", "garment size (default: your last commit's size)").option("--colour <colour>", "colour, e.g. white / black (default: the product's first colour)").option("--dry-run", "resolve the variant + show what would be staged, without staging").description("reserve stock \u2014 acquires an inventory lock, reserves nothing permanent.").action(async (handle, opts) => {
-    const gOpts = program.opts();
-    const json = Boolean(gOpts.json);
-    const brand = json ? makeBrand({ noColor: true }) : makeBrand({ noColor: gOpts.color === false });
+    const { json, brand } = resolveOutput(program);
     const res = await runStage(makeClient(), loadConfig(), {
       handle,
       size: opts.size,
@@ -1108,6 +1154,15 @@ export {
   empty,
   fail,
   versionLine,
+  cyan,
+  dim,
+  green,
+  header,
+  rule,
+  box,
+  contributionBar,
+  colourSwatch,
+  colourMarker,
   brandOf,
   fmtPrice,
   firstPrice,
@@ -1116,11 +1171,11 @@ export {
   lineColour,
   formatCartLine,
   resolveLineItemRef,
+  resolveOutput,
+  printResult,
   runView,
   registerView,
   runStage,
-  registerStage,
-  registerBrowse,
-  printResult
+  registerStage
 };
-//# sourceMappingURL=chunk-DWTH7CNI.js.map
+//# sourceMappingURL=chunk-WYCZ6BPV.js.map