@dreamboard-games/cli 0.1.30-alpha.31 → 0.1.30-alpha.33

package/README.md

@@ -1,6 +1,6 @@
 # dreamboard
 
-Dreamboard CLI for working with Dreamboard games from your own editor/tooling.
+Dreamboard for working with Dreamboard games from your own editor/tooling.
 
 Dreamboard is built to take you from napkin sketch to playable prototype without the paper cuts:
 
@@ -18,7 +18,7 @@ Published npm package:
 npm install -g dreamboard
 ```
 
-The published CLI targets Node 20+.
+The published `dreamboard` package targets Node 20+.
 
 ## Why Dreamboard
 
@@ -35,11 +35,11 @@ Use browser login:
 dreamboard auth login
 ```
 
-The CLI stores your refreshable session in `~/.dreamboard/auth.json` by default. The file is written atomically with owner-only permissions (`0600`).
+Dreamboard stores your refreshable session in `~/.dreamboard/auth.json` by default. The file is written atomically with owner-only permissions (`0600`).
 
 The operating system keychain is optional. Set `"credentialBackend": "keychain"` in `~/.dreamboard/config.json`, or use `DREAMBOARD_CREDENTIAL_BACKEND=keychain`, to opt in.
 
-That stored session includes the Clerk refresh token the CLI needs to renew and exchange for short-lived Dreamboard API tokens automatically. Direct JWT injection is intentionally not part of the published CLI flow.
+That stored session includes the Clerk refresh token Dreamboard needs to renew and exchange for short-lived Dreamboard API tokens automatically. Direct JWT injection is intentionally not part of the published Dreamboard flow.
 
 ## Source Checkout Setup
 
@@ -112,15 +112,15 @@ dreamboard dev
 ## Notes
 
 - Project state lives in `.dreamboard/project.json`.
-- Published/public CLI installs target Node 20+ and support commit-scoped
+- Published/public `dreamboard` installs target Node 20+ and support commit-scoped
   build, preview, release, and status workflows.
-- Published/public CLI builds are production-only; they do not support environment overrides or direct JWT injection.
+- Published stable `dreamboard` builds are production-only and do not support environment overrides or direct JWT injection. Published alpha builds allow `--env <local|staging|prod>` for operator verification, but still reject direct JWT injection.
 - Local embedded-harness testing remains Bun-only and requires a source checkout with local backend support.
-- Internal source-checkout builds may expose extra auth and environment helpers, but those are not part of the published CLI contract.
+- Internal source-checkout builds may expose extra auth and environment helpers, but those are not part of the published Dreamboard contract.
 
 ## Skill Source
 
 - Public skill source lives under `skills/dreamboard/`.
 - `skills/dreamboard/references/*.md` are generated from `docs/` via `pnpm run sync:skill-docs`.
 - `dreamboard project create` installs the bundled skill into `.agents/skills/dreamboard/` in the generated game project.
-- Public GitHub repo for the CLI is [dreamboard-games/dreamboard-cli](https://github.com/dreamboard-games/dreamboard-cli).
+- Public GitHub repo for Dreamboard is [dreamboard-games/dreamboard](https://github.com/dreamboard-games/dreamboard).

package/dist/agent-verifier/agent-workspace-verifier.mjs

@@ -1129,8 +1129,15 @@ var consola = createConsola2();
 
 // src/build-target.ts
 var injectedBuildChannel = true ? "development" : void 0;
+var injectedPackageVersion = typeof __DREAMBOARD_PACKAGE_VERSION__ === "string" ? __DREAMBOARD_PACKAGE_VERSION__ : void 0;
 var BUILD_CHANNEL = injectedBuildChannel === "published" ? "published" : "development";
+var PACKAGE_VERSION = injectedPackageVersion ?? "0.0.0-development";
+function isAlphaReleaseVersion(version) {
+  return /(?:^|-|\.)alpha(?:$|-|\.)/.test(version);
+}
 var IS_PUBLISHED_BUILD = BUILD_CHANNEL === "published";
+var IS_ALPHA_RELEASE = isAlphaReleaseVersion(PACKAGE_VERSION);
+var CAN_SELECT_ENVIRONMENT = !IS_PUBLISHED_BUILD || IS_ALPHA_RELEASE;
 var PUBLISHED_ENVIRONMENT = "prod";
 
 // src/auth/refresh-error.ts
@@ -1618,15 +1625,15 @@ function resolveConfig(globalConfig, flags, project, credentials) {
   if (IS_PUBLISHED_BUILD) {
     assertPublicRuntimeFlags(flags);
   }
-  const envEnvironment = IS_PUBLISHED_BUILD ? void 0 : environmentFromProcess();
-  const projectEnvironment = IS_PUBLISHED_BUILD ? void 0 : project?.environment;
-  const environment = IS_PUBLISHED_BUILD ? PUBLISHED_ENVIRONMENT : flags.env || envEnvironment || projectEnvironment || globalConfig.environment || "staging";
+  const envEnvironment = CAN_SELECT_ENVIRONMENT ? environmentFromProcess() : void 0;
+  const projectEnvironment = CAN_SELECT_ENVIRONMENT ? project?.environment : void 0;
+  const environment = CAN_SELECT_ENVIRONMENT ? flags.env || envEnvironment || projectEnvironment || globalConfig.environment || (IS_PUBLISHED_BUILD ? PUBLISHED_ENVIRONMENT : "staging") : PUBLISHED_ENVIRONMENT;
   const envConfig = ENVIRONMENT_CONFIGS[environment];
   const publishedEnvConfig = ENVIRONMENT_CONFIGS[PUBLISHED_ENVIRONMENT];
-  const hasExplicitEnvironmentOverride = !IS_PUBLISHED_BUILD && Boolean(flags.env || envEnvironment || projectEnvironment);
-  const resolvedApiBaseUrl = IS_PUBLISHED_BUILD ? publishedEnvConfig?.apiBaseUrl ?? DEFAULT_API_BASE_URL : hasExplicitEnvironmentOverride ? projectLocalBaseUrl(project?.apiBaseUrl, environment) || envConfig?.apiBaseUrl || DEFAULT_API_BASE_URL : project?.apiBaseUrl || envConfig?.apiBaseUrl || DEFAULT_API_BASE_URL;
+  const hasExplicitEnvironmentOverride = CAN_SELECT_ENVIRONMENT && Boolean(flags.env || envEnvironment || projectEnvironment);
+  const resolvedApiBaseUrl = IS_PUBLISHED_BUILD && !CAN_SELECT_ENVIRONMENT ? publishedEnvConfig?.apiBaseUrl ?? DEFAULT_API_BASE_URL : hasExplicitEnvironmentOverride ? projectLocalBaseUrl(project?.apiBaseUrl, environment) || envConfig?.apiBaseUrl || DEFAULT_API_BASE_URL : project?.apiBaseUrl || envConfig?.apiBaseUrl || DEFAULT_API_BASE_URL;
   const apiBaseUrl = valueOrUndefined(process.env.DREAMBOARD_API_BASE_URL) ?? resolvedApiBaseUrl;
-  const resolvedWebBaseUrl = IS_PUBLISHED_BUILD ? publishedEnvConfig?.webBaseUrl ?? DEFAULT_WEB_BASE_URL : hasExplicitEnvironmentOverride ? projectLocalBaseUrl(project?.webBaseUrl, environment) || envConfig?.webBaseUrl || DEFAULT_WEB_BASE_URL : project?.webBaseUrl || envConfig?.webBaseUrl || DEFAULT_WEB_BASE_URL;
+  const resolvedWebBaseUrl = IS_PUBLISHED_BUILD && !CAN_SELECT_ENVIRONMENT ? publishedEnvConfig?.webBaseUrl ?? DEFAULT_WEB_BASE_URL : hasExplicitEnvironmentOverride ? projectLocalBaseUrl(project?.webBaseUrl, environment) || envConfig?.webBaseUrl || DEFAULT_WEB_BASE_URL : project?.webBaseUrl || envConfig?.webBaseUrl || DEFAULT_WEB_BASE_URL;
   const webBaseUrl = valueOrUndefined(process.env.DREAMBOARD_WEB_BASE_URL) ?? resolvedWebBaseUrl;
   const snapshot = buildCredentialSnapshot(flags, credentials, environment);
   const oauthConfig = resolveEnvironmentOAuthConfig(environment, envConfig);
@@ -1731,9 +1738,10 @@ function projectLocalBaseUrl(rawUrl, environment) {
     return void 0;
   }
 }
-function assertPublicRuntimeFlags(flags) {
-  const argv2 = process.argv.slice(2);
-  if (flags.env || argv2.includes("--env")) {
+function assertPublicRuntimeFlags(flags, options = {}) {
+  const canSelectEnvironment = options.canSelectEnvironment ?? CAN_SELECT_ENVIRONMENT;
+  const argv2 = options.argv ?? process.argv.slice(2);
+  if (!canSelectEnvironment && (flags.env || argv2.includes("--env"))) {
     throw new Error(
       "The published Dreamboard CLI is production-only and does not accept `--env`."
     );
@@ -1763,12 +1771,18 @@ function createRetryingReadFetch(fetchImpl) {
   return (async (input, init2) => {
     const method = resolveFetchMethod(input, init2);
     if (method !== "GET" && method !== "HEAD") {
-      return fetchImpl(input, init2);
+      return fetchWithOptionalTrace(fetchImpl, input, init2, {
+        attempt: 0,
+        willRetry: false
+      });
     }
     let lastError;
     for (let attempt = 0; attempt <= TRANSIENT_READ_RETRY_DELAYS_MS.length; attempt += 1) {
       try {
-        return await fetchImpl(input, init2);
+        return await fetchWithOptionalTrace(fetchImpl, input, init2, {
+          attempt,
+          willRetry: attempt < TRANSIENT_READ_RETRY_DELAYS_MS.length
+        });
       } catch (error) {
         lastError = error;
         if (attempt >= TRANSIENT_READ_RETRY_DELAYS_MS.length || !isTransientFetchError(error)) {
@@ -1780,6 +1794,88 @@ function createRetryingReadFetch(fetchImpl) {
     throw lastError;
   });
 }
+async function fetchWithOptionalTrace(fetchImpl, input, init2, options) {
+  if (!isHttpTraceEnabled()) {
+    return fetchImpl(input, init2);
+  }
+  const request = describeRequest(input, init2);
+  const startedAt = Date.now();
+  try {
+    const response = await fetchImpl(input, init2);
+    writeHttpTrace({
+      ...request,
+      attempt: options.attempt,
+      status: response.status,
+      durationMs: Date.now() - startedAt
+    });
+    return response;
+  } catch (error) {
+    writeHttpTrace({
+      ...request,
+      attempt: options.attempt,
+      durationMs: Date.now() - startedAt,
+      error: error instanceof Error ? error.name : "UnknownError",
+      willRetry: options.willRetry
+    });
+    throw error;
+  }
+}
+function isHttpTraceEnabled() {
+  return process.env.DREAMBOARD_CLI_HTTP_TRACE === "1";
+}
+function describeRequest(input, init2) {
+  return {
+    method: resolveFetchMethod(input, init2),
+    url: redactUrl(input),
+    hasAuthorization: hasAuthorizationHeader(input, init2)
+  };
+}
+function redactUrl(input) {
+  const rawUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+  try {
+    const url = new URL(rawUrl);
+    return `${url.origin}${url.pathname}`;
+  } catch {
+    return "<unparseable-url>";
+  }
+}
+function hasAuthorizationHeader(input, init2) {
+  return headersContainAuthorization(init2?.headers) || typeof Request !== "undefined" && input instanceof Request && input.headers.has("Authorization");
+}
+function headersContainAuthorization(headers) {
+  if (!headers) {
+    return false;
+  }
+  if (headers instanceof Headers) {
+    return headers.has("Authorization");
+  }
+  if (Array.isArray(headers)) {
+    return headers.some(([name]) => name.toLowerCase() === "authorization");
+  }
+  return Object.keys(headers).some(
+    (name) => name.toLowerCase() === "authorization"
+  );
+}
+function writeHttpTrace(event) {
+  const parts = [
+    "[dreamboard-cli:http]",
+    `method=${event.method}`,
+    `url=${event.url}`,
+    `auth=${event.hasAuthorization ? "present" : "missing"}`,
+    `attempt=${event.attempt + 1}`,
+    `durationMs=${event.durationMs}`
+  ];
+  if (typeof event.status === "number") {
+    parts.push(`status=${event.status}`);
+  }
+  if (event.error) {
+    parts.push(`error=${event.error}`);
+  }
+  if (event.willRetry) {
+    parts.push("willRetry=true");
+  }
+  console.error(parts.join(" "));
+}
 function resolveFetchMethod(input, init2) {
   const method = init2?.method ?? (typeof Request !== "undefined" && input instanceof Request ? input.method : void 0);
   return (method ?? "GET").toUpperCase();
@@ -2012,7 +2108,7 @@ Usage:
 }
 async function materializePreparedWorkspace(args) {
   const inputPath = readRequiredOption(args, "--input");
-  const { materializeWorkspaceProject } = await import("./materialize-workspace-MAGKDMK5.mjs");
+  const { materializeWorkspaceProject } = await import("./materialize-workspace-3ECF4EYD.mjs");
   const input = JSON.parse(await readFile(inputPath, "utf8"));
   await materializeWorkspaceProject({
     ...input,
@@ -2080,7 +2176,7 @@ async function runCloudLocalVerification(projectRoot, projectConfig, config) {
     { assertReducerContractPreflight },
     { getProjectLocalMaintainerRegistry }
   ] = await Promise.all([
-    import("./static-scaffold-CLRRWXON.mjs"),
+    import("./static-scaffold-XZ4FS4RR.mjs"),
     import("./local-files-OF4QFISU.mjs"),
     import("./workspace-codegen-SPPVHURX.mjs"),
     import("./workspace-dependencies-5HEEKZFP.mjs"),