@haystackeditor/cli 0.25.0 → 0.26.0

package/dist/capture/adapters/sveltekit.js

@@ -71,6 +71,13 @@ export async function detectSvelteKit(ctx) {
         label: `SvelteKit ${version.version}`,
         manifestAdapter: `sveltekit@${version.version}`,
         blocked: blocked.length > 0 ? blocked.join('; ') : null,
+        // The routes come from the source, so whatever stops init placing the tag stops the manifest too.
+        manifestBlocked: blocked.length > 0 ? blocked.join('; ') : null,
+        fromBuild: false,
+        rewriting: null,
+        publishNote: null,
+        buildPublishDirs: () => [],
+        buildNotes: () => [],
         looked: [templatePath, where, repoPath(ctx, join(ctx.appDir, routesDir))],
         staticDir: assets,
         async integrate(tags) {

package/dist/capture/adapters/vite.js

@@ -79,6 +79,13 @@ export async function detectVite(ctx) {
         label: `Vite ${version.version}${router ? ` with ${router}` : ''}`,
         manifestAdapter: `vite@${version.version}`,
         blocked: blocked.length > 0 ? blocked.join('; ') : null,
+        // The routes come from the source, so whatever stops init placing the tag stops the manifest too.
+        manifestBlocked: blocked.length > 0 ? blocked.join('; ') : null,
+        fromBuild: false,
+        rewriting: null,
+        publishNote: null,
+        buildPublishDirs: () => [],
+        buildNotes: () => [],
         looked: [indexPath, where, repoPath(ctx, srcDir)],
         staticDir: toPosix(posix.join(toPosix(root), toPosix(publicDir))),
         integrate: async (tags) => htmlEdit(index, tags, indexPath),
@@ -109,6 +116,13 @@ export async function detectStaticHtml(ctx) {
         label: 'a static HTML site',
         manifestAdapter: 'static-html',
         blocked: pages.length === 1 ? null : `the site has ${pages.length} HTML pages (${pages.slice(0, 5).join(', ')}${pages.length > 5 ? ', …' : ''}), each needing the tag`,
+        // The routes come from the source, so whatever stops init placing the tag stops the manifest too.
+        manifestBlocked: pages.length === 1 ? null : `the site has ${pages.length} HTML pages (${pages.slice(0, 5).join(', ')}${pages.length > 5 ? ', …' : ''}), each needing the tag`,
+        fromBuild: false,
+        rewriting: null,
+        publishNote: null,
+        buildPublishDirs: () => [],
+        buildNotes: () => [],
         looked: [indexPath],
         staticDir: '.',
         integrate: async (tags) => htmlEdit(index, tags, indexPath),

package/dist/capture/app-config.js

@@ -12,8 +12,9 @@
  *   publish  the directories (relative to the app) the build step publishes the manifest into, so haystack-capture-step,
  *            which loads nothing of the CLI, can withdraw a stale current.json there when the manifest was not made.
  */
+import { spawnSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, posix } from 'node:path';
 import { CAPTURE_KEY_PATTERN, CAPTURE_STATUS_PATH, CAPTURE_VERSION } from '../commands/capture-contract.js';
 import { haystackFetch, haystackJson } from '../utils/haystack-api.js';
 export const CAPTURE_CONFIG_PATH = '.haystack/capture.json';
@@ -36,11 +37,35 @@ export function readCaptureConfig(appDir) {
     if (parsed.version !== CAPTURE_VERSION || strings.some(name => typeof parsed[name] !== 'string')
         || !CAPTURE_KEY_PATTERN.test(parsed.key) || !(parsed.adapter === null || typeof parsed.adapter === 'string')
         || !Array.isArray(parsed.origins) || !parsed.origins.every(origin => typeof origin === 'string')
-        || !Array.isArray(parsed.publish) || !parsed.publish.every(dir => typeof dir === 'string')) {
+        || !Array.isArray(parsed.publish) || !parsed.publish.every(dir => typeof dir === 'string')
+        || !(parsed.urlRewrites === undefined || parsed.urlRewrites === null || typeof parsed.urlRewrites === 'string')) {
         throw new Error(`${CAPTURE_CONFIG_PATH} is not a capture configuration init wrote; remove it and run \`haystack init\` again.`);
     }
     return parsed;
 }
+/** The directories (repository-relative, posix; '.' for the root) holding a .haystack/capture.json: those git lists
+ * (committed, or not yet), and the candidates that have one even when ignored. */
+export function captureConfigDirs(gitRoot, candidates) {
+    const listed = spawnSync('git', ['ls-files', '-z', '--cached', '--others', '--exclude-standard', '--', CAPTURE_CONFIG_PATH,
+        `:(glob)**/${CAPTURE_CONFIG_PATH}`], { cwd: gitRoot, encoding: 'utf8' });
+    if (listed.status !== 0)
+        throw new Error(`git ls-files failed in ${gitRoot}: ${listed.stderr.trim()}`);
+    return [...new Set([...listed.stdout.split('\0').filter(path => path !== '' && !path.split('/').includes('node_modules'))
+                .map(path => posix.dirname(posix.dirname(path))), ...candidates])].filter(dir => existsSync(captureConfigFile(join(gitRoot, dir)))).sort();
+}
+/** The apps (repository-relative, posix; '.' for the root) whose .haystack/capture.json records them: the user's earlier
+ * answer to which app serves production. Records git lists (committed, or not yet), and those in the candidate app
+ * directories even when ignored. */
+export function recordedApps(gitRoot, candidates) {
+    return captureConfigDirs(gitRoot, candidates).filter(dir => {
+        try {
+            return readCaptureConfig(join(gitRoot, dir))?.app === dir;
+        }
+        catch (error) {
+            throw new Error(`${posix.join(dir, CAPTURE_CONFIG_PATH)}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    });
+}
 export function formatCaptureConfig(config) {
     return `${JSON.stringify(config, null, 2)}\n`;
 }

package/dist/capture/csp.js

@@ -11,7 +11,7 @@
  */
 import fg from 'fast-glob';
 import { readFileSync, statSync } from 'node:fs';
-import { extname, join } from 'node:path';
+import { extname, join, relative } from 'node:path';
 import { SAXParser } from 'parse5-sax-parser';
 import { CAPTURE_ORIGIN } from '../commands/capture-contract.js';
 import { keyName, parseFile, parseJsonLike, unwrapTs, walk } from './js-ast.js';
@@ -159,7 +159,7 @@ function jsPolicies(text, file, json) {
                     ? (value.properties.find((property) => property.type === 'ObjectProperty' && keyName(property) === 'directives')?.value ?? value) : value;
                 const policy = resolvePolicy(directives, ast);
                 // `csp` is a common key for other things; it counts only when it spells a policy.
-                if (name !== 'csp' || policy !== null)
+                if (name !== 'csp' || (policy !== null && DIRECTIVE.test(policy)))
                     found.push({ offset: node.start, policy, reportOnly: name.endsWith('report-only') });
                 seen.add(node.value);
             }
@@ -203,8 +203,9 @@ function resolvePolicy(node, ast, depth = 0) {
         && ['replace', 'replaceAll', 'trim'].includes(current.callee.property.name)) {
         return resolvePolicy(current.callee.object, ast, depth + 1);
     }
-    const policy = policyFromNode(current);
-    return policy !== null && DIRECTIVE.test(policy) ? policy : null;
+    // A header's value is its policy whatever it says (`frame-ancestors 'none'` restricts nothing the tag does); a computed
+    // value init cannot read stays null.
+    return policyFromNode(current);
 }
 /** helmet()'s default policy (helmet 5–8), which applies when its options leave contentSecurityPolicy alone. */
 const HELMET_DEFAULT = "default-src 'self'; base-uri 'self'; font-src 'self' https: data:; form-action 'self'; frame-ancestors 'self';"
@@ -298,7 +299,7 @@ export function findCsp(repoRoot, appDir, nextLoader, origins) {
         if (!MARKER.test(text))
             continue;
         const extension = extname(file);
-        const where = toPosix(file.slice(repoRoot.length + 1));
+        const where = toPosix(relative(repoRoot, file));
         let policies;
         if (['.js', '.mjs', '.cjs', '.ts', '.mts', '.cts', '.jsx', '.tsx'].includes(extension))
             policies = jsPolicies(text, file, false);
@@ -327,5 +328,5 @@ export function findCsp(repoRoot, appDir, nextLoader, origins) {
             });
         }
     }
-    return { findings, looked: `${toPosix(appDir.slice(repoRoot.length + 1)) || '.'} (headers config, middleware, meta tags, framework CSP options, server configs)` };
+    return { findings, looked: `${toPosix(relative(repoRoot, appDir)) || '.'} (headers config, middleware, meta tags, framework CSP options, server configs)` };
 }

package/dist/capture/url-rewrites.js

@@ -0,0 +1,232 @@
+/**
+ * URL rewrites (CAPTURE-V1 rule 4). The tag matches a page's URL against the manifest's routes, so a route's rule must say
+ * which URLs show it. A middleware or proxy that rewrites (Rallly's proxy turns every /x into /<locale>/x) or a config
+ * rewrite into a page makes the URL and the route's path differ in ways only the app's code says. Init reads that code
+ * only where it can read it exactly (a middleware that rewrites nothing and calls nothing it cannot see into, or
+ * next-intl's middleware with a literal routing config); for anything else it never guesses: it asks the coding agent's
+ * user (who can read that code) for one answer, recorded in .haystack/capture.json:
+ *
+ *   none                     rewrites never make a page's URL show another page
+ *   hidden-segment:<name>    the middleware or proxy adds the leading dynamic segment [<name>] to every page path, so
+ *                            URLs never contain it (the manifest drops that segment from the routes under it)
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { keyName, literalValue, parseFile, pathOf, readPathAliases, resolveImport, unwrapTs, UNREADABLE, walk } from './js-ast.js';
+import { isFile } from './adapters/files.js';
+import { repoPath, resolveVersion } from './project.js';
+export function parseUrlRewrites(raw) {
+    const value = raw.trim();
+    if (value === 'none')
+        return { kind: 'none' };
+    const hidden = /^hidden-segment:([A-Za-z0-9_-]+)$/.exec(value);
+    if (hidden)
+        return { kind: 'hidden-segment', name: hidden[1] };
+    throw new Error(`--url-rewrites ${raw} is not an answer: use none, or hidden-segment:<name> for a leading [<name>] segment the app's middleware or proxy adds to every page path.`);
+}
+export const URL_REWRITES_QUESTION = 'Does it make a page\'s URL show another page? Ask your user (or read that code), then run `haystack init` again with'
+    + ' `--url-rewrites none` when its rewrites never do, or `--url-rewrites hidden-segment:<name>` when it adds a leading [<name>] segment to every'
+    + ' page path (so URLs never contain it).';
+const MIDDLEWARE_FILES = ['middleware', 'proxy'].flatMap(name => ['ts', 'js', 'mjs', 'mts', 'cts', 'cjs', 'tsx', 'jsx'].map(extension => `${name}.${extension}`));
+const INTL_MIDDLEWARE = 'next-intl/middleware';
+const INTL_ROUTING = 'next-intl/routing';
+/** next/server and the rest of Next's own modules: what they return init knows (NextResponse.rewrite is caught by name). */
+function nextModule(source) {
+    return source === 'next' || source.startsWith('next/');
+}
+/** The identifier a call's callee starts from (`a.b.c()` → a), or null (a call on a call's result, `(…)()`). */
+function calleeRoot(callee) {
+    let current = unwrapTs(callee);
+    while (current.type === 'MemberExpression' || current.type === 'OptionalMemberExpression')
+        current = unwrapTs(current.object);
+    return current.type === 'Identifier' ? current : null;
+}
+/** The value a routing config names: an object literal, a top-level const bound to one or to defineRouting({...}), or
+ * the same exported from a local module; null when it is not literally there. */
+function routingObject(node, ast, file, ctx, depth = 0) {
+    const current = unwrapTs(node);
+    if (depth > 4)
+        return null;
+    if (current.type === 'ObjectExpression')
+        return { value: current, ast };
+    if (current.type === 'CallExpression' && current.arguments.length === 1) {
+        const root = calleeRoot(current.callee);
+        const source = root ? importOf(ast, root.name) : null;
+        if (source?.module === INTL_ROUTING && source.imported === 'defineRouting')
+            return routingObject(current.arguments[0], ast, file, ctx, depth + 1);
+        return null;
+    }
+    if (current.type !== 'Identifier')
+        return null;
+    for (const statement of ast.program.body) {
+        const declaration = statement.type === 'ExportNamedDeclaration' ? statement.declaration : statement;
+        if (declaration?.type !== 'VariableDeclaration')
+            continue;
+        for (const declarator of declaration.declarations) {
+            if (declarator.id.type === 'Identifier' && declarator.id.name === current.name && declarator.init) {
+                return routingObject(declarator.init, ast, file, ctx, depth + 1);
+            }
+        }
+    }
+    const imported = importOf(ast, current.name);
+    if (!imported)
+        return null;
+    const target = resolveImport(file, imported.module, readPathAliases(ctx.appDir));
+    if (!target)
+        return null;
+    const targetAst = parseFile(readFileSync(target, 'utf8'), target);
+    if (!targetAst)
+        return null;
+    const exported = exportedExpression(targetAst, imported.imported);
+    return exported ? routingObject(exported, targetAst, target, ctx, depth + 1) : null;
+}
+function importOf(ast, local) {
+    for (const statement of ast.program.body) {
+        if (statement.type !== 'ImportDeclaration')
+            continue;
+        for (const specifier of statement.specifiers) {
+            if (specifier.local.name !== local)
+                continue;
+            const imported = specifier.type === 'ImportDefaultSpecifier' ? 'default'
+                : specifier.type === 'ImportNamespaceSpecifier' ? '*' : specifier.imported.name ?? specifier.imported.value;
+            return { module: statement.source.value, imported };
+        }
+    }
+    return null;
+}
+/** The expression a module exports under `name` ('default' for its default export), or null. */
+function exportedExpression(ast, name) {
+    for (const statement of ast.program.body) {
+        if (name === 'default' && statement.type === 'ExportDefaultDeclaration')
+            return statement.declaration;
+        if (statement.type !== 'ExportNamedDeclaration' || statement.source)
+            continue;
+        for (const declarator of statement.declaration?.type === 'VariableDeclaration' ? statement.declaration.declarations : []) {
+            if (declarator.id.type === 'Identifier' && declarator.id.name === name)
+                return declarator.init;
+        }
+        for (const specifier of statement.specifiers ?? []) {
+            if ((specifier.exported?.name ?? specifier.exported?.value) === name)
+                return specifier.local;
+        }
+    }
+    return null;
+}
+/** next-intl's routing, read exactly, or why it cannot be. */
+function intlRouting(config, ast, file, ctx, where) {
+    const unknown = (why) => ({ kind: 'unknown', why: `${where} uses next-intl's middleware, ${why}` });
+    const found = config ? routingObject(config, ast, file, ctx) : null;
+    if (!found)
+        return unknown('whose routing config init cannot read literally');
+    const value = literalValue(found.value, found.ast);
+    if (value === UNREADABLE || typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return unknown('whose routing config is not literal');
+    }
+    const routing = value;
+    if (routing.pathnames !== undefined)
+        return unknown('whose localized pathnames make a URL show a page under another path');
+    if (routing.domains !== undefined)
+        return unknown('whose domains decide the locale by host');
+    const locales = Array.isArray(routing.locales) && routing.locales.every(locale => typeof locale === 'string') ? routing.locales : null;
+    const defaultLocale = typeof routing.defaultLocale === 'string' ? routing.defaultLocale : null;
+    if (!locales || !defaultLocale)
+        return unknown('whose locales or defaultLocale are not a literal list and string');
+    let mode;
+    let prefixes = {};
+    const prefix = routing.localePrefix;
+    if (prefix === undefined) {
+        // next-intl 3 made `always` the default; 2 had `as-needed`.
+        const version = resolveVersion(ctx, 'next-intl');
+        if (!version || version.major === null)
+            return unknown('whose default localePrefix depends on a next-intl version init cannot resolve');
+        mode = version.major >= 3 ? 'always' : 'as-needed';
+    }
+    else if (typeof prefix === 'string') {
+        mode = prefix;
+    }
+    else if (prefix && typeof prefix === 'object' && !Array.isArray(prefix)) {
+        mode = prefix.mode;
+        if (prefix.prefixes !== undefined) {
+            const given = prefix.prefixes;
+            if (!given || typeof given !== 'object' || Array.isArray(given) || !Object.values(given).every(item => typeof item === 'string' && item.startsWith('/'))) {
+                return unknown('whose localePrefix.prefixes are not literal paths');
+            }
+            prefixes = given;
+        }
+    }
+    if (mode !== 'always' && mode !== 'as-needed' && mode !== 'never')
+        return unknown(`whose localePrefix mode (${JSON.stringify(mode)}) init does not know`);
+    return { kind: 'locale-prefix', where, mode, locales, defaultLocale, prefixes };
+}
+/** One middleware or proxy file, read. */
+function readMiddleware(ctx, file) {
+    const where = repoPath(ctx, file);
+    const ast = parseFile(readFileSync(file, 'utf8'), file);
+    if (!ast)
+        return { kind: 'unknown', why: `${where} (which init cannot parse)` };
+    const program = pathOf(ast, ast.program);
+    if (!program)
+        return { kind: 'unknown', why: `${where} (whose names init cannot resolve)` };
+    const reasons = [];
+    walk(ast.program, node => {
+        if (node.type === 'ExportAllDeclaration' || (node.type === 'ExportNamedDeclaration' && node.source)) {
+            reasons.push(`re-exports from ${node.source.value}`);
+        }
+        if (node.type === 'StringLiteral' && node.value.toLowerCase() === 'x-middleware-rewrite')
+            reasons.push('sets the x-middleware-rewrite header');
+        if ((node.type === 'CallExpression' || node.type === 'OptionalCallExpression') && node.callee.type === 'MemberExpression' && !node.callee.computed
+            && node.callee.property.name === 'rewrite')
+            reasons.push('calls rewrite()');
+        if (node.type === 'ObjectProperty' && keyName(node) === 'rewrite')
+            reasons.push('passes a rewrite');
+        if (node.type === 'ImportExpression' || (node.type === 'CallExpression' && (node.callee.type === 'Import'
+            || (node.callee.type === 'Identifier' && node.callee.name === 'require'))))
+            reasons.push('loads a module at runtime');
+    });
+    // Every value imported from outside Next is code init cannot see into, wherever it is used (called, passed to a local
+    // helper that calls it, exported as the middleware), except next-intl's createMiddleware and the routing it is given,
+    // which init reads.
+    const intlCalls = [];
+    for (const [local, binding] of Object.entries(program.scope.bindings)) {
+        const declaration = binding.path.parentPath?.node;
+        if (binding.kind !== 'module' || declaration?.type !== 'ImportDeclaration' || declaration.importKind === 'type'
+            || binding.path.node.importKind === 'type' || nextModule(declaration.source.value))
+            continue;
+        const factory = declaration.source.value === INTL_MIDDLEWARE && binding.path.node.type === 'ImportDefaultSpecifier';
+        for (const reference of binding.referencePaths) {
+            const parent = reference.parentPath?.node;
+            if (factory && parent?.type === 'CallExpression' && parent.callee === reference.node) {
+                intlCalls.push(parent);
+                continue;
+            }
+            const factoryArgument = parent?.type === 'CallExpression' && parent.arguments[0] === reference.node && parent.callee.type === 'Identifier'
+                && program.scope.getBinding(parent.callee.name)?.path.parentPath?.node.source?.value === INTL_MIDDLEWARE;
+            if (factoryArgument)
+                continue;
+            reasons.push(`uses ${local} from ${declaration.source.value}`);
+            break;
+        }
+    }
+    if (reasons.length > 0)
+        return { kind: 'unknown', why: `${where}, which ${reasons[0]} (init cannot read what that does to page paths)` };
+    if (intlCalls.length === 0)
+        return { kind: 'none' };
+    // next-intl: every createMiddleware call must read as the same routing.
+    const readings = intlCalls.map(call => intlRouting(call.arguments[0], ast, file, ctx, where));
+    const first = readings[0];
+    if (first.kind !== 'locale-prefix')
+        return first;
+    return readings.every(reading => JSON.stringify(reading) === JSON.stringify(first)) ? first
+        : { kind: 'unknown', why: `${where}, which calls next-intl's createMiddleware with several routing configs` };
+}
+/** What the app's middleware or proxy does to page paths (the first one found, as Next loads one). Needs loadBabel(). */
+export function middlewareRewrites(ctx) {
+    for (const dir of [ctx.appDir, join(ctx.appDir, 'src')]) {
+        for (const name of MIDDLEWARE_FILES) {
+            const file = join(dir, name);
+            if (isFile(file))
+                return readMiddleware(ctx, file);
+        }
+    }
+    return { kind: 'none' };
+}

package/dist/capture-step.js

@@ -42,6 +42,9 @@ try {
     if (written) {
         const files = Array.isArray(result.files) ? result.files.join(', ') : '';
         console.log(`Haystack route manifest ${String(result.release)}: ${files}`);
+        // What the person must still do for it to be reachable (a Next.js basePath): said on every build until done.
+        for (const note of Array.isArray(result.notes) ? result.notes : [])
+            console.warn(`haystack capture manifest: ${String(note)}.`);
     }
 }
 catch { /* the command did not answer: no manifest was written */ }

package/dist/commands/capture-brief.js

@@ -1,42 +1,37 @@
 /** CAPTURE-V1 rule 7b in `haystack pre-verify`: the routes a change touches (the brief's blast-radius files and the changed
  * files, joined through the route manifest's source entries) with their share of captured sessions over the window, the union
- * over all of them, freshness and drops; sessions on routes no manifest names are unmapped, never zero. The application is the
- * one `.haystack/capture.json` names (rule 8b, written by `haystack init`); a checkout without it has no capture and the brief
- * is exactly as before. A capture read that fails is reported in the block and never fails the command. */
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
+ * over all of them, freshness and drops; sessions on routes no manifest names are unmapped, never zero. One section per app
+ * whose `.haystack/capture.json` (rule 8b, written by `haystack init` in the app's directory, apps/web in a monorepo) records it,
+ * found as init finds them (app-config.ts); a checkout without one has no capture and the brief is exactly as before. A capture
+ * read that fails is reported in its section and never fails the command. */
+import { join, posix } from 'node:path';
 import chalk from 'chalk';
+import { CAPTURE_CONFIG_PATH, captureConfigDirs, readCaptureConfig } from '../capture/app-config.js';
 import { classifyHttpError } from '../utils/haystack-api.js';
 import { gatewayFetch } from './case-batch.js';
 import { CAPTURE_APPLICATION_ID, CAPTURE_WINDOW_PATH, captureChangedRoutes, } from './capture-contract.js';
-/** Rule 8b: the application identity init commits (key, repository id, application id, adapter). */
-export const CAPTURE_IDENTITY_FILE = '.haystack/capture.json';
-/** The checkout's application id, null without the identity file, or why the file cannot be read. */
-function captureApplication(gitRoot) {
-    const path = join(gitRoot, CAPTURE_IDENTITY_FILE);
-    if (!existsSync(path))
-        return null;
-    let value;
+/** An app's application id from its record, or why the record cannot give one. */
+function captureApplication(gitRoot, app) {
+    const file = posix.join(app, CAPTURE_CONFIG_PATH);
+    let config;
     try {
-        value = JSON.parse(readFileSync(path, 'utf8'));
+        config = readCaptureConfig(join(gitRoot, app));
     }
     catch (error) {
-        return { unreadable: `${CAPTURE_IDENTITY_FILE} is not JSON (${error instanceof Error ? error.message : String(error)})` };
-    }
-    const applicationId = value?.applicationId;
-    if (typeof applicationId !== 'string' || !CAPTURE_APPLICATION_ID.test(applicationId)) {
-        return { unreadable: `${CAPTURE_IDENTITY_FILE} names no valid applicationId` };
+        return { unreadable: `${file}: ${error instanceof Error ? error.message : String(error)}` };
     }
-    return { applicationId };
+    if (config === null)
+        return { unreadable: `${file} is gone` };
+    if (config.app !== app)
+        return { unreadable: `${file} records the app ${config.app}, not its own directory; run \`haystack init --app ${app}\`` };
+    if (!CAPTURE_APPLICATION_ID.test(config.applicationId))
+        return { unreadable: `${file} names no valid applicationId` };
+    return { applicationId: config.applicationId };
 }
-/** The pre-verify capture block, or null for a checkout with no capture identity. `files`: the brief's function files and the
- * changed files. */
-export async function readPreVerifyCapture(gitRoot, repository, token, files, now) {
-    const application = captureApplication(gitRoot);
-    if (application === null)
-        return null;
+async function readApp(gitRoot, app, repository, token, files, now) {
+    const application = captureApplication(gitRoot, app);
     if ('unreadable' in application)
-        return { applicationId: null, state: 'unavailable', reason: application.unreadable };
+        return { app, applicationId: null, state: 'unavailable', reason: application.unreadable };
     const { applicationId } = application;
     try {
         const response = await gatewayFetch(`${CAPTURE_WINDOW_PATH}?repository=${encodeURIComponent(repository)}&app=${encodeURIComponent(applicationId)}`, token);
@@ -46,18 +41,32 @@ export async function readPreVerifyCapture(gitRoot, repository, token, files, no
         if (answer.version !== 'capture-v1' || answer.applicationId !== applicationId)
             throw new Error('the capture window answer names another application');
         if (answer.window === null)
-            return { applicationId, state: 'no-data' };
-        return { applicationId, state: 'ready', window: captureChangedRoutes(answer.window, files, now) };
+            return { app, applicationId, state: 'no-data' };
+        return { app, applicationId, state: 'ready', window: captureChangedRoutes(answer.window, files, now) };
     }
     catch (error) {
-        return { applicationId, state: 'unavailable', reason: error instanceof Error ? error.message : String(error) };
+        return { app, applicationId, state: 'unavailable', reason: error instanceof Error ? error.message : String(error) };
     }
 }
+/** The pre-verify capture sections, one per app with a record, or null for a checkout with none. `files`: the brief's function
+ * files and the changed files. */
+export async function readPreVerifyCapture(gitRoot, repository, token, files, now) {
+    let apps;
+    try {
+        apps = captureConfigDirs(gitRoot, []);
+    }
+    catch (error) {
+        return [{ app: '.', applicationId: null, state: 'unavailable', reason: error instanceof Error ? error.message : String(error) }];
+    }
+    if (apps.length === 0)
+        return null;
+    return Promise.all(apps.map(app => readApp(gitRoot, app, repository, token, files, now)));
+}
 const percent = (share) => share === null ? 'n/a' : `${(share * 100).toFixed(1)}%`;
 const plain = (value) => value.replace(/[\u0000-\u001f\u007f-\u009f]/gu, ' '); // eslint-disable-line no-control-regex
-/** The block as a coding agent reads it, after the brief. */
+/** One app's block as a coding agent reads it, after the brief. */
 export function formatCapture(capture) {
-    const lines = [chalk.bold('What real users do where your change is (captured sessions)')];
+    const lines = [chalk.bold(`What real users do where your change is (captured sessions of ${capture.app === '.' ? 'the app at the repository root' : plain(capture.app)})`)];
     if (capture.state === 'unavailable') {
         lines.push(`  Captured sessions could not be read${capture.applicationId ? ` for ${plain(capture.applicationId)}` : ''}: ${plain(capture.reason)}`);
         return lines.join('\n');

package/dist/commands/capture-manifest.js

@@ -5,13 +5,13 @@
  * current.json. No credential is involved: whoever deploys the app publishes its manifest.
  *
  * It runs inside the customer's build (the package script init extends, or the Rails rake file), from the CLI the app pins
- * as an exact devDependency. It never fails that build (rule 13): whatever goes wrong, it prints one warning line and exits
+ * as an exact production dependency. It never fails that build (rule 13): whatever goes wrong, it prints one warning line and exits
  * 0, because a missing manifest only stops the tag on this release (rule 13a: no manifest, no work). It needs no git
  * checkout: repository paths come from the app path init recorded.
  */
 import chalk from 'chalk';
 import { relative, resolve, sep } from 'node:path';
-import { detectApp } from '../capture/adapters/index.js';
+import { ADAPTER_IDS, detectApp, detectWith } from '../capture/adapters/index.js';
 import { isManual } from '../capture/adapters/types.js';
 import { CAPTURE_CONFIG_PATH, readCaptureConfig } from '../capture/app-config.js';
 import { loadBabel } from '../capture/js-ast.js';
@@ -44,35 +44,43 @@ async function publish(options, locations) {
     if (!config)
         throw new Error(`${appDir} has no ${CAPTURE_CONFIG_PATH}: run \`haystack init\` in the repository to set capture up.`);
     locations.push(...config.publish.map(dir => resolve(appDir, dir)));
-    if (config.adapter === null)
-        throw new Error(`${CAPTURE_CONFIG_PATH} names no framework adapter: init left this app's manifest to a manual step.`);
+    if (options.adapter !== undefined && !ADAPTER_IDS.includes(options.adapter)) {
+        throw new Error(`--adapter ${options.adapter} is not one of ${ADAPTER_IDS.join(', ')}`);
+    }
+    const adapter = (options.adapter ?? config.adapter);
+    if (adapter === null)
+        throw new Error(`${CAPTURE_CONFIG_PATH} names no framework adapter: run it with --adapter <${ADAPTER_IDS.join('|')}>`);
     // The checkout's root when the app sits at its recorded path; else (a build that sees only the app) the app itself.
     const suffix = config.app === '.' ? '' : config.app.split('/').join(sep);
     const repoRoot = suffix !== '' && appDir.endsWith(`${sep}${suffix}`) ? appDir.slice(0, -suffix.length - 1) : appDir;
     await loadBabel();
     const ctx = appContext(repoRoot, appDir, config.app);
-    const detected = await detectApp(ctx);
-    if (!detected || detected.id !== config.adapter) {
-        throw new Error(`${CAPTURE_CONFIG_PATH} was written for ${config.adapter}, and this app is now ${detected?.label ?? 'no framework init recognizes'}; run \`haystack init\` again.`);
-    }
-    if (!isManual(detected.publishDirs))
-        locations.push(...detected.publishDirs.map(dir => resolve(appDir, dir)).filter(dir => !locations.includes(dir)));
-    if (detected.blocked)
-        throw new Error(`${detected.label}: ${detected.blocked}.`);
-    const routes = exactRoutes(await detected.routes({ railsRoutes: options.railsRoutes ? resolve(options.railsRoutes) : undefined }));
-    if (isManual(routes))
-        throw new Error(routes.manual);
+    const detected = await detectWith(ctx, adapter);
+    if (!detected)
+        throw new Error(`the ${adapter} adapter does not recognize ${appDir} (${(await detectApp(ctx))?.label ?? 'no framework init recognizes'}); run \`haystack init\` again`);
+    // Checked on every build, so once the user removes the cause the next build publishes, with nothing to rerun.
+    if (detected.manifestBlocked)
+        throw new Error(`${detected.label}: ${detected.manifestBlocked}`);
     if (isManual(detected.publishDirs))
         throw new Error(detected.publishDirs.manual);
+    const publishDirs = [...detected.publishDirs, ...detected.buildPublishDirs()].map(dir => resolve(appDir, dir));
+    locations.push(...publishDirs.filter(dir => !locations.includes(dir)));
+    const routes = exactRoutes(await detected.routes({ railsRoutes: options.railsRoutes ? resolve(options.railsRoutes) : undefined,
+        urlRewrites: config.urlRewrites ?? null }));
+    if (isManual(routes))
+        throw new Error(routes.manual);
     const manifest = buildManifest(config, detected.manifestAdapter, routes, detected.chunks());
-    const written = writeManifest(detected.publishDirs.map(dir => resolve(appDir, dir)), manifest);
+    const written = writeManifest(publishDirs, manifest);
+    const notes = detected.buildNotes();
     if (options.json) {
         process.stdout.write(`${JSON.stringify({ written: true, release: manifest.release, routes: manifest.routes.length, chunks: manifest.chunks.length,
-            files: written.map(file => relative(appDir, file)) }, null, 2)}\n`);
+            files: written.map(file => relative(appDir, file)), notes }, null, 2)}\n`);
         return;
     }
     const count = (n, noun) => `${n} ${noun}${n === 1 ? '' : 's'}`;
     console.log(chalk.green(`Haystack route manifest ${manifest.release}: ${count(manifest.routes.length, 'route')}, ${count(manifest.chunks.length, 'chunk')} (${detected.label})`));
     for (const file of written)
         console.log(chalk.dim(`  ${relative(appDir, file)}`));
+    for (const note of notes)
+        console.warn(chalk.yellow(`haystack capture manifest: ${note}.`));
 }

package/dist/commands/feedback.js

@@ -0,0 +1,66 @@
+/**
+ * haystack feedback <message...>
+ *
+ * Tells the Haystack team something, in a sentence: a verify that went wrong,
+ * an output that confused you, a missing option. Meant for coding agents as
+ * much as for people: when Haystack gets in the way, say so here and keep
+ * going. The message lands in the team's Slack at once, with the CLI version,
+ * the platform and the repository (when run inside a GitHub checkout).
+ *
+ * `-` as the whole message reads it from stdin.
+ */
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import chalk from 'chalk';
+import { withSchema } from '../schema.js';
+import { resolveAuthContext } from '../utils/auth.js';
+import { parseRemoteUrl } from '../utils/git.js';
+import { haystackJson } from '../utils/haystack-api.js';
+export const FEEDBACK_MAX_CHARS = 4000;
+function cliVersion() {
+    const pkgPath = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'package.json');
+    return JSON.parse(readFileSync(pkgPath, 'utf8')).version;
+}
+/** The checkout's GitHub repository, or null outside one (feedback never needs a repository). */
+function currentRepository() {
+    try {
+        const remote = parseRemoteUrl();
+        return `${remote.owner}/${remote.repo}`;
+    }
+    catch {
+        return null;
+    }
+}
+export function buildFeedbackRequest(message, options, repository) {
+    const text = message.trim();
+    if (!text)
+        throw new Error('Say what happened: haystack feedback "<message>" (or - to read it from stdin)');
+    if (text.length > FEEDBACK_MAX_CHARS) {
+        throw new Error(`Feedback is ${text.length} characters; keep it under ${FEEDBACK_MAX_CHARS}`);
+    }
+    return {
+        message: text,
+        context: {
+            cliVersion: cliVersion(),
+            platform: `${process.platform}-${process.arch} node ${process.versions.node}`,
+            repository,
+            runId: options.run ?? null,
+        },
+    };
+}
+export async function feedbackCommand(words, options) {
+    const message = words.length === 1 && words[0] === '-' ? readFileSync(0, 'utf8') : words.join(' ');
+    const request = buildFeedbackRequest(message, options, currentRepository());
+    const { token } = await resolveAuthContext({ preferredLogin: options.account });
+    await haystackJson('/api/cli/feedback', token, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(request),
+    });
+    if (options.json) {
+        process.stdout.write(JSON.stringify(withSchema('feedback', { status: 'sent' }), null, 2) + '\n');
+        return;
+    }
+    console.log(chalk.green('Sent to the Haystack team.'));
+}