@binaryandthread/cli 0.1.8 → 0.2.0

package/dist/{browser-EO5EQUXQ.js → browser-WCNC4AWS.js}

@@ -2,6 +2,17 @@
 import "./chunk-7OCVIDC7.js";
 
 // src/browser.ts
+var DEFAULT_CHECKOUT_HOSTS = ["binaryandthread.com"];
+function isSafeCheckoutUrl(url, allowedHosts = DEFAULT_CHECKOUT_HOSTS) {
+  try {
+    const u = new URL(url);
+    if (u.protocol !== "https:") return false;
+    const host = u.hostname.toLowerCase();
+    return allowedHosts.some((a) => host === a || host.endsWith("." + a));
+  } catch {
+    return false;
+  }
+}
 async function defaultOpener(url) {
   const mod = await import("open");
   return mod.default(url);
@@ -24,15 +35,22 @@ function renderQr(url, qr) {
 async function openCheckout(url, opts = {}) {
   const opener = opts.opener ?? defaultOpener;
   const qr = opts.qr ?? await defaultQr();
-  const qrString = renderQr(url, qr);
+  const safe = isSafeCheckoutUrl(url, opts.allowedHosts);
+  const lines = [];
   let opened = false;
+  if (!safe) {
+    lines.push("\u26A0  this checkout link isn't the expected binaryandthread.com https page.");
+    lines.push("   not opening it automatically \u2014 verify the domain, then open the link below yourself.");
+    lines.push(`   link \u2192 ${url}`);
+    return { opened: false, lines };
+  }
+  const qrString = renderQr(url, qr);
   try {
     await opener(url);
     opened = true;
   } catch {
     opened = false;
   }
-  const lines = [];
   lines.push("\u2699  opening checkout in your browser. cards never touch the terminal.");
   if (qrString) {
     lines.push(qrString);
@@ -45,6 +63,7 @@ async function openCheckout(url, opts = {}) {
   return { opened, lines };
 }
 export {
+  isSafeCheckoutUrl,
   openCheckout
 };
-//# sourceMappingURL=browser-EO5EQUXQ.js.map
+//# sourceMappingURL=browser-WCNC4AWS.js.map

package/dist/browser-WCNC4AWS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/browser.ts"],"sourcesContent":["// The browser/QR handoff — the Spike-A floor's client side (F-C5).\n//\n// The terminal NEVER takes a card. After minting the checkout, we hand the buyer off to the\n// storefront checkout page (Stripe Elements lives there, not here). We do that two ways at\n// once so the buyer always has a path:\n//   1. open the default browser at the checkout url, AND\n//   2. render a scannable QR of the same url (so a phone can complete the checkout).\n//\n// This MUST degrade gracefully: a headless/SSH/CI session has no browser to open, so a\n// failed open is normal, not an error. On failure we still print the url + the QR and a\n// one-line \"open this manually\" hint, and we NEVER throw — a buy is never blocked on the\n// browser opening cleanly (F-C5). The `open` and `qrcode-terminal` libraries are injected so\n// the handoff is testable without spawning a real browser or a real QR renderer.\n\n/** The hosts a checkout_url is allowed to point at before we'll auto-open it. The brand storefront\n *  (checkout_url = STOREFRONT_URL + path, and STOREFRONT_URL is binaryandthread.com in prod). */\nconst DEFAULT_CHECKOUT_HOSTS = [\"binaryandthread.com\"]\n\n/**\n * Is `url` safe to auto-open? Only https on an allowed host (exact or a subdomain). The checkout_url\n * comes from the backend; this is the last gate before an OS-level open() — it refuses http/file/\n * custom-scheme and a swapped host, so a coerced URL can't be launched or QR'd (defense-in-depth).\n */\nexport function isSafeCheckoutUrl(url: string, allowedHosts: string[] = DEFAULT_CHECKOUT_HOSTS): boolean {\n  try {\n    const u = new URL(url)\n    if (u.protocol !== \"https:\") return false\n    const host = u.hostname.toLowerCase()\n    return allowedHosts.some((a) => host === a || host.endsWith(\".\" + a))\n  } catch {\n    return false\n  }\n}\n\n/** open the url in the default browser; returns when the handoff is launched. */\nexport type Opener = (url: string) => Promise<unknown>\n\n/** qrcode-terminal-shaped renderer: generate(url, opts, cb) → cb(qrString). */\nexport type QrRenderer = (\n  url: string,\n  opts: { small?: boolean },\n  cb: (qr: string) => void\n) => void\n\nexport interface OpenCheckoutOptions {\n  /** injectable browser opener (default: the `open` npm package). */\n  opener?: Opener\n  /** injectable QR renderer (default: the `qrcode-terminal` package). */\n  qr?: QrRenderer\n  /** hosts a checkout_url may point at to be auto-opened (default: the brand storefront). */\n  allowedHosts?: string[]\n}\n\nexport interface OpenCheckoutResult {\n  /** whether the default browser was launched (false on a headless/CI session). */\n  opened: boolean\n  /** voice-compliant output lines (QR + url floor + a manual-open hint when needed). */\n  lines: string[]\n}\n\n/** Lazily load the real `open` package (ESM, spawns OS binaries — kept external by tsup). */\nasync function defaultOpener(url: string): Promise<unknown> {\n  const mod = (await import(\"open\")) as unknown as { default: Opener }\n  return mod.default(url)\n}\n\n/** Lazily load the real `qrcode-terminal` package. */\nasync function defaultQr(): Promise<QrRenderer> {\n  const mod = (await import(\"qrcode-terminal\")) as unknown as {\n    default: { generate: QrRenderer }\n  }\n  return mod.default.generate\n}\n\n/** Render the QR string for `url`, never throwing (returns \"\" if the renderer blows up). */\nfunction renderQr(url: string, qr: QrRenderer): string {\n  try {\n    let out = \"\"\n    qr(url, { small: true }, (s) => {\n      out = s\n    })\n    return out\n  } catch {\n    return \"\"\n  }\n}\n\n/**\n * Open the storefront checkout in the browser AND print a scannable QR. Degrades gracefully\n * (never throws): on a failed browser open it still emits the QR + the url + a manual hint.\n * The caller prints `result.lines`; cards never touch the terminal — they live on that page.\n */\nexport async function openCheckout(\n  url: string,\n  opts: OpenCheckoutOptions = {}\n): Promise<OpenCheckoutResult> {\n  const opener = opts.opener ?? defaultOpener\n  const qr = opts.qr ?? (await defaultQr())\n  const safe = isSafeCheckoutUrl(url, opts.allowedHosts)\n\n  const lines: string[] = []\n  let opened = false\n\n  if (!safe) {\n    // The URL isn't the expected brand https page → NEVER auto-open or QR it (a coerced/misconfigured\n    // checkout_url could be a phishing origin or a non-http scheme). Show it with a warning so the\n    // buyer can inspect + decide; the buy is not blocked (the link floor is still printed).\n    lines.push(\"⚠  this checkout link isn't the expected binaryandthread.com https page.\")\n    lines.push(\"   not opening it automatically — verify the domain, then open the link below yourself.\")\n    lines.push(`   link → ${url}`)\n    return { opened: false, lines }\n  }\n\n  // Safe: render the QR (part of the floor) + try to open the browser.\n  const qrString = renderQr(url, qr)\n  try {\n    await opener(url)\n    opened = true\n  } catch {\n    // headless / SSH / CI — no browser to open. Not an error; degrade to the manual floor.\n    opened = false\n  }\n\n  lines.push(\"⚙  opening checkout in your browser. cards never touch the terminal.\")\n  if (qrString) {\n    lines.push(qrString)\n    lines.push(\"   scan the code above to finish on your phone.\")\n  }\n  if (!opened) {\n    lines.push(\"   couldn't open a browser here — open this link manually:\")\n  }\n  // the url is the floor — always printed last so it's the easy copy target.\n  lines.push(`   link → ${url}`)\n\n  return { opened, lines }\n}\n"],"mappings":";;;;AAgBA,IAAM,yBAAyB,CAAC,qBAAqB;AAO9C,SAAS,kBAAkB,KAAa,eAAyB,wBAAiC;AACvG,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,GAAG;AACrB,QAAI,EAAE,aAAa,SAAU,QAAO;AACpC,UAAM,OAAO,EAAE,SAAS,YAAY;AACpC,WAAO,aAAa,KAAK,CAAC,MAAM,SAAS,KAAK,KAAK,SAAS,MAAM,CAAC,CAAC;AAAA,EACtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA6BA,eAAe,cAAc,KAA+B;AAC1D,QAAM,MAAO,MAAM,OAAO,MAAM;AAChC,SAAO,IAAI,QAAQ,GAAG;AACxB;AAGA,eAAe,YAAiC;AAC9C,QAAM,MAAO,MAAM,OAAO,iBAAiB;AAG3C,SAAO,IAAI,QAAQ;AACrB;AAGA,SAAS,SAAS,KAAa,IAAwB;AACrD,MAAI;AACF,QAAI,MAAM;AACV,OAAG,KAAK,EAAE,OAAO,KAAK,GAAG,CAAC,MAAM;AAC9B,YAAM;AAAA,IACR,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,eAAsB,aACpB,KACA,OAA4B,CAAC,GACA;AAC7B,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,KAAK,KAAK,MAAO,MAAM,UAAU;AACvC,QAAM,OAAO,kBAAkB,KAAK,KAAK,YAAY;AAErD,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS;AAEb,MAAI,CAAC,MAAM;AAIT,UAAM,KAAK,+EAA0E;AACrF,UAAM,KAAK,8FAAyF;AACpG,UAAM,KAAK,kBAAa,GAAG,EAAE;AAC7B,WAAO,EAAE,QAAQ,OAAO,MAAM;AAAA,EAChC;AAGA,QAAM,WAAW,SAAS,KAAK,EAAE;AACjC,MAAI;AACF,UAAM,OAAO,GAAG;AAChB,aAAS;AAAA,EACX,QAAQ;AAEN,aAAS;AAAA,EACX;AAEA,QAAM,KAAK,2EAAsE;AACjF,MAAI,UAAU;AACZ,UAAM,KAAK,QAAQ;AACnB,UAAM,KAAK,iDAAiD;AAAA,EAC9D;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,KAAK,iEAA4D;AAAA,EACzE;AAEA,QAAM,KAAK,kBAAa,GAAG,EAAE;AAE7B,SAAO,EAAE,QAAQ,MAAM;AACzB;","names":[]}

package/dist/{chunk-B6PV7EQG.js → chunk-NJ3DW5AX.js}

@@ -286,24 +286,45 @@ var StoreClient = class {
     return this.regionsCache;
   }
   /**
-   * Resolve a region by country code, falling back to region #1.
-   * SEK is region #1 by configuration — NEVER a hardcoded literal.
+   * Resolve a region by country code, WITH provenance (matched / home / requested), so callers on
+   * the money path can fail closed on an unmatched explicit country instead of silently pricing in
+   * the wrong currency (F-A2). Region #1 is the launch/home default — SEK today, derived, never a
+   * hardcoded literal.
+   *
+   * Semantics:
+   *  - country given AND a region ships there → { matched: true, home: false }.
+   *  - country given, none ships there        → { matched: false, home: false } (money surfaces MUST
+   *    refuse; discovery may show the home region + a warning). We still return a region so a
+   *    discovery command can render *something*, but `matched:false` is the signal to fail closed.
+   *  - no country given                         → { matched: false, home: true } (the legitimate
+   *    launch default — not a "wrong" currency).
    */
-  async resolveRegion(countryCode) {
+  async resolveRegionResult(countryCode) {
     const regions = this.regionsCache ?? await this.getRegions();
     if (regions.length === 0) {
       throw new Error("no regions configured \u2014 cannot resolve a region for pricing");
     }
+    const home = regions[0];
     if (countryCode) {
       const cc = countryCode.toLowerCase();
       const match = regions.find(
         (r) => (r.countries ?? []).some((c) => (c.iso_2 ?? "").toLowerCase() === cc)
       );
       if (match) {
-        return match;
+        return { region: match, matched: true, requested: cc, home: false };
       }
+      this.logWarn("store.region.unmatched", { countryCode: cc, fallback: home.id });
+      return { region: home, matched: false, requested: cc, home: false };
     }
-    return regions[0];
+    return { region: home, matched: false, requested: void 0, home: true };
+  }
+  /**
+   * Resolve a region by country code, falling back to region #1. A thin wrapper over
+   * resolveRegionResult for callers that only need the region (back-compat).
+   * SEK is region #1 by configuration — NEVER a hardcoded literal.
+   */
+  async resolveRegion(countryCode) {
+    return (await this.resolveRegionResult(countryCode)).region;
   }
   // ----- products (region resolved BEFORE pricing) ---------------------------
   async listProducts(opts) {
@@ -657,6 +678,9 @@ function productLore(p) {
   ).map((s) => ({ url: s.url, label: s.label }));
   return { text, sources };
 }
+function isCartTaxInclusive(cart) {
+  return (cart?.items ?? []).some((i) => i.is_tax_inclusive === true);
+}
 
 // src/voice.ts
 var GLYPH = {
@@ -805,12 +829,15 @@ var BOX = {
   ml: "\u251C",
   mr: "\u2524"
 };
+function cursor(style) {
+  return cyan(style, "_");
+}
 function header(style, title, width = 56) {
   const label = ` ${title} `;
   const lead = BOX.h.repeat(2);
   const used = lead.length + label.length;
-  const tail = BOX.h.repeat(Math.max(2, width - used));
-  return `${lead}${cyan(style, label)}${tail}`;
+  const tail = BOX.h.repeat(Math.max(2, width - used - 2));
+  return `${lead}${cyan(style, label)}${tail} ${cursor(style)}`;
 }
 function rule(width = 56) {
   return BOX.h.repeat(width);
@@ -859,6 +886,20 @@ function colourMarker(colours) {
 }
 
 // src/commands/shared.ts
+function regionLine(rr, style) {
+  const cc = (rr.requested ?? rr.region.countries?.[0]?.iso_2 ?? "").toLowerCase();
+  const loc = cc ? `${cc} \xB7 ` : "";
+  const nudge = rr.home ? " \xB7 not you? \u2192 bt region" : "";
+  return dim(style, `${GLYPH.gear}  region: ${loc}${rr.region.currency_code}${nudge}`);
+}
+var SIZE_ORDER = ["xxs", "xs", "s", "m", "l", "xl", "2xl", "xxl", "3xl", "xxxl", "4xl", "5xl"];
+function sortSizes(sizes) {
+  const rank = (s) => {
+    const i = SIZE_ORDER.indexOf(s.trim().toLowerCase());
+    return i === -1 ? SIZE_ORDER.length : i;
+  };
+  return [...sizes].sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
+}
 function brandOf(args) {
   return args?.brand ?? PLAIN;
 }
@@ -869,11 +910,15 @@ function fmtPrice(amount, currency) {
   const cur = (currency ?? "").toUpperCase();
   return cur ? `${amount} ${cur}` : `${amount}`;
 }
+function taxSuffix(isTaxInclusive) {
+  return isTaxInclusive ? " incl. VAT" : "";
+}
 function firstPrice(p) {
   const v = (p.variants ?? [])[0];
   return {
     amount: v?.calculated_price?.calculated_amount ?? null,
-    currency: v?.calculated_price?.currency_code ?? null
+    currency: v?.calculated_price?.currency_code ?? null,
+    taxInclusive: v?.calculated_price?.is_calculated_price_tax_inclusive ?? null
   };
 }
 function stageMarker(channelStage) {
@@ -986,12 +1031,32 @@ function resolveOutput(program) {
   const brand = json ? makeBrand({ noColor: true }) : makeBrand({ noColor: opts.color === false });
   return { json, brand };
 }
+function failResult(spec) {
+  const numericCode = typeof spec.code === "number" && spec.code >= 1 && spec.code <= 255;
+  const exitCode = spec.exit ?? (numericCode ? spec.code : EXIT.GENERIC);
+  return {
+    lines: [fail(spec)],
+    exitCode,
+    json: {
+      error: {
+        code: exitCode,
+        message: spec.what,
+        ...spec.fix ? { fix: spec.fix } : {},
+        ...spec.link ? { link: spec.link } : {}
+      }
+    }
+  };
+}
 function printResult(res, json) {
   if (res.exitCode) {
     process.exitCode = res.exitCode;
   }
-  if (json && res.json !== void 0) {
-    process.stdout.write(JSON.stringify(res.json, null, 2) + "\n");
+  if (json) {
+    if (res.json !== void 0) {
+      process.stdout.write(JSON.stringify(res.json, null, 2) + "\n");
+    } else {
+      process.stderr.write(res.lines.join("\n") + "\n");
+    }
     return;
   }
   process.stdout.write(res.lines.join("\n") + "\n");
@@ -1066,30 +1131,21 @@ async function defaultRender(url, opts) {
 // src/commands/view.ts
 async function runView(client, config, args) {
   const style = brandOf(args);
-  const region = await client.resolveRegion(config.region);
+  const rr = await client.resolveRegionResult(config.region);
+  const region = rr.region;
   const picked = await resolveProduct(client, region, args.handle);
   const product = picked.product;
   if (!product) {
     if (picked.candidates && picked.candidates.length > 1) {
-      return {
-        lines: [
-          fail({ code: EXIT.DATAERR, what: `"${args.handle}" matches ${picked.candidates.length} designs \u2014 pick one:` }),
-          ...picked.candidates.map((p) => `     ${p.handle ?? p.id}`),
-          "   or be exact \u2192 bt view <slug>"
-        ],
-        exitCode: EXIT.DATAERR
-      };
+      const r = failResult({ code: EXIT.DATAERR, what: `"${args.handle}" matches ${picked.candidates.length} designs \u2014 pick one:` });
+      r.lines.push(...picked.candidates.map((p) => `     ${p.handle ?? p.id}`), "   or be exact \u2192 bt view <slug>");
+      return r;
     }
-    return {
-      lines: [
-        fail({
-          code: EXIT.UNAVAILABLE,
-          what: `no design here called "${args.handle}".`,
-          fix: "bt browse   (to see what's in stock)"
-        })
-      ],
-      exitCode: EXIT.UNAVAILABLE
-    };
+    return failResult({
+      code: EXIT.UNAVAILABLE,
+      what: `no design here called "${args.handle}".`,
+      fix: "bt browse   (to see what's in stock)"
+    });
   }
   const { title, handle } = displayName(product);
   const colours = productColours(product);
@@ -1110,18 +1166,19 @@ async function runView(client, config, args) {
   if (colours.length > 0) {
     lines.push(`   colours  ${colours.map((c) => `${colourSwatch(c)} ${c}`).join(" \xB7 ")}`);
     for (const c of colours) {
-      const sizes = sizesForColour(product, c);
+      const sizes = sortSizes(sizesForColour(product, c));
       lines.push(`   ${colourSwatch(c)} ${c.padEnd(6)} ${sizes.join("  ")}`);
     }
   } else {
-    const sizes = (product.variants ?? []).map((v) => v.title ?? "?");
+    const sizes = sortSizes((product.variants ?? []).map((v) => v.title ?? "?"));
     lines.push(`   sizes    ${sizes.join("  ")}`);
   }
   const v0 = (product.variants ?? [])[0];
   if (v0?.calculated_price) {
     lines.push(
-      `   price    ${cyan(style, fmtPrice(v0.calculated_price.calculated_amount, v0.calculated_price.currency_code))} incl. VAT`
+      `   price    ${cyan(style, fmtPrice(v0.calculated_price.calculated_amount, v0.calculated_price.currency_code))}${taxSuffix(v0.calculated_price.is_calculated_price_tax_inclusive)}`
     );
+    lines.push(`   ${regionLine(rr, style)}`);
   }
   let imageUrl = product.thumbnail ?? null;
   let blackNote = null;
@@ -1185,27 +1242,24 @@ function registerView(program, makeClient, loadConfig) {
 // src/commands/stage.ts
 async function runStage(client, config, args) {
   const style = brandOf(args);
-  const region = await client.resolveRegion(config.region);
+  const rr = await client.resolveRegionResult(config.region);
+  if (rr.requested && !rr.matched) {
+    return failResult({
+      code: EXIT.DATAERR,
+      what: `we don't ship to ${rr.requested} yet.`,
+      money: "nothing staged, nothing charged.",
+      fix: "bt region --list   (see where we ship, then bt region <cc>)"
+    });
+  }
+  const region = rr.region;
   const resolved = await resolveProduct(client, region, args.handle);
   if (!resolved.product) {
     if (resolved.candidates && resolved.candidates.length > 1) {
-      return {
-        lines: [
-          fail({ code: EXIT.DATAERR, what: `"${args.handle}" matches ${resolved.candidates.length} designs \u2014 pick one:` }),
-          ...resolved.candidates.map((p) => `     ${p.handle ?? p.id}`),
-          "   or be exact \u2192 bt stage <slug>"
-        ],
-        exitCode: EXIT.DATAERR
-        // ambiguous input → non-zero so `bt stage x && bt checkout` halts (d10)
-      };
+      const r = failResult({ code: EXIT.DATAERR, what: `"${args.handle}" matches ${resolved.candidates.length} designs \u2014 pick one:` });
+      r.lines.push(...resolved.candidates.map((p) => `     ${p.handle ?? p.id}`), "   or be exact \u2192 bt stage <slug>");
+      return r;
     }
-    return {
-      lines: [
-        fail({ code: EXIT.UNAVAILABLE, what: `no design here called "${args.handle}".`, fix: "bt browse" })
-      ],
-      exitCode: EXIT.UNAVAILABLE
-      // not-found → non-zero (d10)
-    };
+    return failResult({ code: EXIT.UNAVAILABLE, what: `no design here called "${args.handle}".`, fix: "bt browse" });
   }
   const product = resolved.product;
   const matchNote = resolved.fuzzy && (product.handle ?? "") !== args.handle.trim() ? working(`matched "${product.handle}" from "${args.handle}"`) : null;
@@ -1215,17 +1269,11 @@ async function runStage(client, config, args) {
   const variant = findVariant(product, { size, colour });
   if (!variant) {
     const have = colours.length ? `  available colours: ${colours.join(", ")}.` : "";
-    return {
-      lines: [
-        fail({
-          code: EXIT.DATAERR,
-          what: `no variant for ${args.handle}${size ? `#size=${size}` : ""}${colour ? ` (${colour})` : ""}.`,
-          fix: `bt view ${args.handle}   (to see available sizes + colours)${have}`
-        })
-      ],
-      exitCode: EXIT.DATAERR
-      // unprocessable size+colour combo → non-zero (d10)
-    };
+    return failResult({
+      code: EXIT.DATAERR,
+      what: `no variant for ${args.handle}${size ? `#size=${size}` : ""}${colour ? ` (${colour})` : ""}.`,
+      fix: `bt view ${args.handle}   (to see available sizes + colours)${have}`
+    });
   }
   if (args.dryRun) {
     const colourSuffix2 = colour ? ` (${colour})` : "";
@@ -1324,6 +1372,7 @@ export {
   sizesForColour,
   findVariant,
   productLore,
+  isCartTaxInclusive,
   GLYPH,
   ok,
   warn,
@@ -1342,8 +1391,10 @@ export {
   contributionBar,
   colourSwatch,
   colourMarker,
+  regionLine,
   brandOf,
   fmtPrice,
+  taxSuffix,
   firstPrice,
   stageMarker,
   displayName,
@@ -1352,10 +1403,11 @@ export {
   resolveLineItemRef,
   resolveProduct,
   resolveOutput,
+  failResult,
   printResult,
   runView,
   registerView,
   runStage,
   registerStage
 };
-//# sourceMappingURL=chunk-B6PV7EQG.js.map
+//# sourceMappingURL=chunk-NJ3DW5AX.js.map