@impeccable/reviews 0.1.0 → 0.1.2

package/dist/focus.js

@@ -6,54 +6,82 @@
  */
 /** The state items and checkup checks this setup works on. */
 const ITEMS = new Set(['scan', 'preview', 'signin']);
-/** The one lock in front of the previews this setup gets past, Vercel's, as the state's item, card and check name it. Where the lock is Vercel's they are part of the setup; for any other (Cloudflare Access) they are left alone. */
-const LOCK = { item: 'preview-protection', card: 'protection', host: 'Vercel' };
+/** The locks in front of the previews this setup gets past, Vercel's login, Netlify's password and Cloudflare Access, by the host the state's item, card and check name. Where the lock is one of theirs they are part of the setup; for any other they are left alone. */
+const LOCK = { item: 'preview-protection', card: 'protection', hosts: ['Vercel', 'Netlify', 'Cloudflare Access'] };
+/** The apps question, as the state's item and card and the write name it: part of the setup only on a repository whose scan proposed several apps, which is where the state has the item (the monorepo case). */
+const APPS = { item: 'apps', card: 'apps', write: 'apps' };
 /** The setup page's cards this setup covers, by their key in the state's `steps`: every other card is not part of it. */
 const CARDS = new Set(['installed', 'preview', 'signin', 'done']);
 /** The writes this setup makes, by their key in the instructions' `endpoints` and `writes`; `previewUrlPattern` saves the address of a host's previews that the host does not report to GitHub. */
 const WRITES = new Set(['preview', 'testAccounts', 'connectionCheck', 'latestPullCheck', 'previewUrlPattern']);
 /** What the model reads of the instructions; `steps`, `rules`, `endpoints` and `writes` are trimmed further. */
 const INSTRUCTIONS = ['product', 'goal', 'signIn', 'buildSettings', 'endpoints', 'writes', 'steps', 'rules'];
-/** A step or rule about a card this setup leaves alone: several apps, the design contract or profile, personas, review modules and settings, exclusions, preview protection (which the case reads from the state's item), preview credentials, the address pattern. */
-const OTHER_CARDS = /\bapps\b|\bprofile\b|\bcontract\b|persona|\bmodules?\b|exclu|protect|bypass|Cloudflare Access|review.settings|reviewSettings|preview-auth|previewAuth|pattern/i;
+/** The words of a step or rule about a card this setup leaves alone: the design contract or profile, personas, review modules and settings, exclusions, preview protection (which the case reads from the state's item), preview credentials, the address pattern; and several apps, except in the monorepo case. */
+const OTHER_CARD_WORDS = [String.raw `\bprofile\b`, String.raw `\bcontract\b`, 'persona', String.raw `\bmodules?\b`, 'exclu', 'protect', 'bypass', 'Cloudflare Access', 'review.settings', 'reviewSettings', 'preview-auth', 'previewAuth', 'pattern'];
+const otherCards = (apps) => new RegExp([...(apps ? [] : [String.raw `\bapps\b`]), ...OTHER_CARD_WORDS].join('|'), 'i');
 const record = (value) => (value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined);
 const only = (value, keys) => Object.fromEntries(Object.entries(value).filter(([key]) => keys.has(key)));
 const without = (value, keys) => Object.fromEntries(Object.entries(value).filter(([key]) => !keys.includes(key)));
-/** GET /api/setup/instructions, trimmed to this setup. */
-export function focusInstructions(instructions) {
+const withApps = (keys, key, apps) => (apps ? new Set([...keys, key]) : keys);
+const records = (value) => (Array.isArray(value) ? value.map(record).filter((item) => item !== undefined) : []);
+const reposOf = (answer) => records(record(answer)?.repos);
+/** A repository of the state or the checkup whose scan proposed several apps: it has the apps item, or the apps check, to answer or answered. */
+const hasApps = (repo) => Boolean(record(repo.items)?.[APPS.item]) || records(repo.checks).some((check) => check.key === APPS.item);
+/** Whether a repository in the state or the checkup has several apps. */
+export function severalApps(answer) {
+    return reposOf(answer).some(hasApps);
+}
+/**
+ * Whether the state or the checkup shows a card of this setup `not-selected` on `repo`, a repository with several apps.
+ * The command's token covers the apps there were when the person signed in, so this is an app the scan proposed later.
+ */
+export function appsLeftOut(answer, repo) {
+    const out = (status) => status === 'not-selected';
+    return reposOf(answer).some((r) => String(r.name).toLowerCase() === repo.toLowerCase() && hasApps(r)
+        && (Object.entries(record(r.items) ?? {}).some(([key, item]) => ITEMS.has(key) && (out(record(item)?.status) || records(record(item)?.perApp).some((app) => out(app.status))))
+            || records(r.checks).some((check) => ITEMS.has(String(check.key)) && out(check.state))));
+}
+/** GET /api/setup/instructions, trimmed to this setup; with `apps`, for a state with several apps, the apps write and the lines about several apps stay. */
+export function focusInstructions(instructions, { apps = false } = {}) {
     const all = record(instructions);
     if (!all)
         return instructions;
+    const writes = withApps(WRITES, APPS.write, apps);
+    const other = otherCards(apps);
     const trim = (key, value) => {
         if (key === 'endpoints' || key === 'writes')
-            return record(value) ? only(record(value), WRITES) : value;
+            return record(value) ? only(record(value), writes) : value;
         if (key === 'steps' || key === 'rules')
-            return Array.isArray(value) ? value.filter((line) => typeof line !== 'string' || !OTHER_CARDS.test(line)) : value;
+            return Array.isArray(value) ? value.filter((line) => typeof line !== 'string' || !other.test(line)) : value;
         return value;
     };
     return Object.fromEntries(INSTRUCTIONS.filter((key) => key in all).map((key) => [key, trim(key, all[key])]));
 }
-/** Whether a state item is the lock this setup gets past. */
-const vercelLock = (item) => record(item)?.host === LOCK.host;
-/** GET /api/setup/state, trimmed to this setup: each repository's scan, preview and sign-in, the lock in front of its previews when it is Vercel's, and the titles of the cards left alone. */
+/** Whether a state item is a lock this setup gets past. */
+const hostLock = (item) => LOCK.hosts.includes(String(record(item)?.host));
+/** GET /api/setup/state, trimmed to this setup: each repository's scan, preview and sign-in, its apps item where the scan proposed several apps, the lock in front of its previews when it is one this setup gets past, and the titles of the cards left alone. */
 export function focusState(state) {
     const all = record(state);
     if (!all)
         return state;
     const steps = Array.isArray(all.steps) ? all.steps.map(record) : [];
-    // The lock's card is part of the setup only when every lock the scan read is Vercel's: another host's keeps it among the cards left alone.
+    // The lock's card is part of the setup only when every lock the scan read is one this setup gets past: another host's keeps it among the cards left alone.
     const locks = Array.isArray(all.repos) ? all.repos.map((r) => record(record(r)?.items)?.[LOCK.item]).filter(Boolean) : [];
-    const vercelOnly = locks.length > 0 && locks.every(vercelLock);
-    const outside = steps.filter((step) => step && !CARDS.has(String(step.key)) && !(vercelOnly && step.key === LOCK.card) && typeof step.title === 'string').map((step) => step.title);
+    const hostsOnly = locks.length > 0 && locks.every(hostLock);
+    const apps = severalApps(all);
+    const cards = withApps(CARDS, APPS.card, apps);
+    const items = withApps(ITEMS, APPS.item, apps);
+    const writes = withApps(WRITES, APPS.write, apps);
+    const outside = steps.filter((step) => step && !cards.has(String(step.key)) && !(hostsOnly && step.key === LOCK.card) && typeof step.title === 'string').map((step) => step.title);
     const repo = (value) => {
         const r = record(value);
         if (!r)
             return value;
-        const items = record(r.items);
+        const own = record(r.items);
         return {
             ...r,
-            ...(items ? { items: Object.fromEntries(Object.entries(items).filter(([key, item]) => ITEMS.has(key) || (key === LOCK.item && vercelLock(item)))) } : {}),
-            ...(record(r.endpoints) ? { endpoints: only(record(r.endpoints), WRITES) } : {}),
+            ...(own ? { items: Object.fromEntries(Object.entries(own).filter(([key, item]) => items.has(key) || (key === LOCK.item && hostLock(item)))) } : {}),
+            ...(record(r.endpoints) ? { endpoints: only(record(r.endpoints), writes) } : {}),
         };
     };
     return {
@@ -64,9 +92,9 @@ export function focusState(state) {
 }
 /**
  * GET /api/setup/checkup, trimmed the same way: each repository's checks of the
- * scan, the preview and the sign-in, the lists with only those checks' entries,
- * and the status those lists make. Its summary and advice counted every card, so
- * they go.
+ * scan, the preview, the sign-in and the apps (a check only a repository with
+ * several apps has), the lists with only those checks' entries, and the status
+ * those lists make. Its summary and advice counted every card, so they go.
  */
 export function focusCheckup(checkup) {
     const all = record(checkup);
@@ -80,7 +108,7 @@ export function focusCheckup(checkup) {
         if (!r || !Array.isArray(r.checks))
             return value;
         // The lock's check names its host in what it says while it asks for a key; once the key is saved it says nothing of the host, and the lists no longer carry it.
-        const checks = r.checks.filter((c) => ITEMS.has(String(record(c)?.key)) || (record(c)?.key === LOCK.item && new RegExp(`\\b${LOCK.host}\\b`).test(String(record(c)?.says))));
+        const checks = r.checks.filter((c) => ITEMS.has(String(record(c)?.key)) || record(c)?.key === APPS.item || (record(c)?.key === LOCK.item && new RegExp(`\\b(${LOCK.hosts.join('|')})\\b`).test(String(record(c)?.says))));
         for (const says of checks.map((c) => record(c)?.says))
             if (typeof r.name === 'string' && typeof says === 'string' && says)
                 kept.push({ repo: r.name, says });

package/dist/host-questions.js

@@ -19,7 +19,9 @@ export const HOST_QUESTIONS = {
     },
     'netlify-team': { kind: 'single', title: 'Netlify team', prompt: 'Which Netlify team should own the new site?' },
 };
-/** The screens a tool shows on its own: a sign-in's retry, the one-time access the host's GitHub app needs, and the consent to a bypass secret for Vercel's login, with the paste when the CLI cannot make one. */
+/** Where a person reads or changes a site's password in Netlify, as Netlify's docs name the page on every plan. */
+export const NETLIFY_PASSWORD_WHERE = 'Project configuration → General → Visitor access';
+/** The screens a tool shows on its own: a sign-in's retry, the one-time access the host's GitHub app needs, and the consent to a key for a host's lock (a bypass secret for Vercel's login, the site password for Netlify's, a service token for Cloudflare Access), with the paste where the run does not get one. */
 export const HOST_SCREENS = {
     'netlify-signin-retry': { id: 'netlify-signin-retry', kind: 'confirm', title: 'Sign in to Netlify', prompt: 'The sign-in did not complete.', confirmLabel: 'Try again', skipLabel: 'Skip' },
     'netlify-access': {
@@ -61,6 +63,50 @@ export const HOST_SCREENS = {
         prompt: 'Vercel keeps your previews behind a login, and the Vercel CLI here could not make a bypass secret for them: that takes your Vercel sign-in, this folder linked to the project, and the Member role. Make one yourself: your project → Settings → Deployment Protection → Protection Bypass for Automation → Create, named "Impeccable reviews". It is stored encrypted and used only to open previews.',
         hint: 'Paste the secret',
     },
+    // Netlify's site password in front of the previews: the one consent to storing the password the run reads from the site as the person, and the paste when it cannot read it.
+    'netlify-password': {
+        id: 'netlify-password',
+        kind: 'confirm',
+        title: 'Your Netlify previews are protected',
+        hint: `Impeccable reviews each pull request on its preview, and Netlify keeps yours behind the site password. The run reads that password from your site as you and stores it encrypted, used only to open previews. Change it any time in ${NETLIFY_PASSWORD_WHERE}.`,
+        prompt: 'Store the site password for Impeccable?',
+        confirmLabel: 'Store',
+        skipLabel: 'Skip',
+    },
+    'netlify-password-key': {
+        id: 'netlify-password-key',
+        kind: 'text',
+        sensitive: true,
+        title: 'Your Netlify previews are protected',
+        prompt: `Netlify keeps your previews behind the site password, and the run could not read it: the Netlify CLI here is signed out, the site is in none of your teams, or Netlify does not give the password back. Find it, or set a new one, in ${NETLIFY_PASSWORD_WHERE}. It is stored encrypted and used only to open previews.`,
+        hint: 'Paste the password',
+    },
+    // Cloudflare Access in front of the previews: the one consent to a service token the run creates as the person through cf, the retry of cf's sign-in, the API token where that sign-in cannot create it, and the paste where the run does not create one.
+    'cloudflare-access': {
+        id: 'cloudflare-access',
+        kind: 'confirm',
+        title: 'Your Cloudflare previews are protected',
+        hint: 'Impeccable reviews each pull request on its preview, and Cloudflare Access keeps yours behind a login. Cloudflare\'s way in for tools is a service token made for one tool: with your Cloudflare sign-in, the run creates one named "Impeccable reviews" and allows it in your Access application\'s policy. It is stored encrypted, used only to open previews, and you can revoke it any time in Zero Trust → Access controls → Service credentials.',
+        prompt: 'Create the token for Impeccable?',
+        confirmLabel: 'Create',
+        skipLabel: 'Skip',
+    },
+    'cloudflare-signin-retry': { id: 'cloudflare-signin-retry', kind: 'confirm', title: 'Sign in to Cloudflare', prompt: 'The sign-in did not complete.', confirmLabel: 'Try again', skipLabel: 'Skip' },
+    'cloudflare-access-api': {
+        id: 'cloudflare-access-api',
+        kind: 'text',
+        sensitive: true,
+        title: 'One Cloudflare API token',
+        prompt: 'The Cloudflare CLI here could not create the token, so creating it takes a Cloudflare API token, used for this run only and stored nowhere. Make one at dash.cloudflare.com/profile/api-tokens → Create Token → Create Custom Token, with two permissions: Access: Apps and Policies → Edit, and Access: Service Tokens → Edit.',
+        hint: 'Paste the API token',
+    },
+    'cloudflare-access-key': {
+        id: 'cloudflare-access-key',
+        kind: 'account',
+        fields: ['Client ID', 'Client secret'],
+        title: 'Your Cloudflare previews are protected',
+        prompt: 'Cloudflare Access keeps your previews behind a login. Paste a service token for Impeccable, or make one: Zero Trust → Access controls → Service credentials → Service Tokens → Create Service Token, named "Impeccable reviews", then allow it in your Access application with a Service Auth policy. It is stored encrypted and used only to open previews.',
+    },
 };
 /** The ids whose screens the tool puts up itself, when it needs the person, and takes down: the web page follows those, not the model's call. */
 export const TOOL_SHOWN = new Set(['netlify-setup', 'vercel-setup']);

package/dist/hosted.js

@@ -1,5 +1,8 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { ACCESS_ID_HEADER, ACCESS_SECRET_HEADER } from './cloudflare-access.js';
+import { basicCredentials } from './netlify-password.js';
+import { gitEnvironment } from './sandbox.js';
 import { BYPASS_HEADER } from './vercel-bypass.js';
 /**
  * Previews a host already deploys: what GitHub has on record of the
@@ -80,19 +83,34 @@ export async function readHostedPreviews(owner, repo, deps = {}) {
 const HOSTS = {
     vercel: { name: 'Vercel', gate: 'vercel-protection', login: /(^|\.)vercel\.com$/ },
     netlify: { name: 'Netlify', gate: 'netlify-protection', login: /(^|\.)netlify\.com$/ },
+    cloudflare: { name: 'Cloudflare Pages', gate: 'cloudflare-access', login: /(^|\.)cloudflareaccess\.com$/ },
 };
 const NETLIFY = /^(?=[^.]{1,63}\.netlify\.app$)deploy-preview-[1-9]\d{0,6}--([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.netlify\.app$/;
-/** A deployment's own address: https on one name, and nothing else. Vercel's is one name under vercel.app, Netlify's a pull request's deploy preview. */
+/** A Pages preview: one label (the deployment's id, or the branch's alias), then the project, under pages.dev. The project's own address, with no label, is its production. */
+const PAGES = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.pages\.dev$/;
+/** A deployment's own address: https on one name, and nothing else. Vercel's is one name under vercel.app, Netlify's a pull request's deploy preview, Cloudflare's a Pages preview. */
 const hostOf = (url) => {
     if (url.protocol !== 'https:' || url.username || url.password || url.port || url.search || url.hash)
         return null;
-    return /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.vercel\.app$/.test(url.hostname) ? 'vercel' : NETLIFY.test(url.hostname) ? 'netlify' : null;
+    return /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.vercel\.app$/.test(url.hostname) ? 'vercel' : NETLIFY.test(url.hostname) ? 'netlify' : PAGES.test(url.hostname) ? 'cloudflare' : null;
 };
-/** The host a preview address belongs to, by name; null for an address of neither. */
+/** The host a preview address belongs to, by name; null for an address of none. */
 export function previewHostName(url) {
     const host = URL.canParse(url) ? hostOf(new URL(url)) : null;
     return host ? HOSTS[host].name : null;
 }
+/** The Netlify site a deploy preview address belongs to, by name; null for any other address. */
+export function netlifySiteOf(url) {
+    return URL.canParse(url) && hostOf(new URL(url)) === 'netlify' ? NETLIFY.exec(new URL(url).hostname)[1] : null;
+}
+/** The address pattern a proven preview stands for, where the host reports none to GitHub: Netlify's by pull request, Cloudflare's by the branch's alias. */
+function patternOf(host, hostname) {
+    if (host === 'netlify')
+        return { pattern: `https://deploy-preview-{pr}--${NETLIFY.exec(hostname)[1]}.netlify.app` };
+    if (host === 'cloudflare')
+        return { pattern: `https://{branch}.${PAGES.exec(hostname)[1]}.pages.dev` };
+    return {};
+}
 const ENTITIES = {
     amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: ' ', mdash: '—', ndash: '–', lsquo: '‘', rsquo: '’', ldquo: '“', rdquo: '”',
     hellip: '…', middot: '·', bull: '•', laquo: '«', raquo: '»', copy: '©', reg: '®', trade: '™', times: '×',
@@ -107,15 +125,33 @@ function plain(text) {
 /** Whether a file the checkout tracks holds the words; .env files are never read. */
 async function inCheckout(root, words) {
     try {
-        await execFileAsync('git', ['grep', '--quiet', '--fixed-strings', '--ignore-case', '-e', words, '--', '.', ':(exclude,glob)**/.env*'], { cwd: root, timeout: 30_000 });
+        await execFileAsync('git', ['grep', '--quiet', '--fixed-strings', '--ignore-case', '-e', words, '--', '.', ':(exclude,glob)**/.env*'], { cwd: root, timeout: 30_000, env: gitEnvironment() });
         return true;
     }
     catch {
         return false;
     }
 }
+/** What a visitor never sees of a page: comments, scripts, styles and templates. */
+const UNSEEN = /<!--[\s\S]*?-->|<(script|style|noscript|template)\b[^>]*>[\s\S]*?<\/\1\s*>/gi;
 /** The words a visitor sees: the title and the text, without comments, scripts, styles, tags or attributes. */
-const visible = (html) => plain(html.replace(/<!--[\s\S]*?-->|<(script|style|noscript|template)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, ' ').replace(/<[^>]*>/g, ' '));
+const visible = (html) => plain(html.replace(UNSEEN, ' ').replace(/<[^>]*>/g, ' '));
+/**
+ * Netlify's own lock, never the status alone, as Netlify documents it: the basic challenge (`WWW-Authenticate: Basic`)
+ * its Basic-Auth rules send, which "trigger the built-in basic browser authentication"
+ * (https://docs.netlify.com/manage/security/secure-access-to-sites/basic-authentication-with-custom-http-headers/); the
+ * "generic password prompt" of its Password Protection, where a visitor enters a shared password and nothing else
+ * (https://docs.netlify.com/manage/security/secure-access-to-sites/password-protection/); or the "Netlify-branded page"
+ * its team login shows a visitor (https://docs.netlify.com/manage/security/secure-access-to-sites/project-visibility/),
+ * whose title names Netlify other than in the site's own address: a mention in an app's own page, such as a footer, is
+ * not one.
+ */
+function netlifyLock(challenge, html) {
+    const seen = html.replace(UNSEEN, ' ');
+    const fields = [...seen.matchAll(/<input\b[^>]*>/gi)].map(([tag]) => /\stype\s*=\s*["']?([\w-]+)/i.exec(tag)?.[1]?.toLowerCase() ?? 'text').filter((type) => !['hidden', 'submit', 'button', 'reset', 'image'].includes(type));
+    const title = plain(/<title\b[^>]*>([\s\S]*?)<\/title\s*>/i.exec(seen)?.[1] ?? '');
+    return /^basic\b/i.test(challenge ?? '') || (/<form\b/i.test(seen) && fields.join() === 'password') || /\bnetlify\b/.test(title.replace(/\S*\.netlify\.app\S*/g, ' '));
+}
 /** The first `max` bytes of a page, as text. */
 async function pageText(res, max = 1_000_000) {
     const reader = res.body?.getReader();
@@ -136,16 +172,44 @@ async function pageText(res, max = 1_000_000) {
     }
     return Buffer.concat(chunks).toString('utf8');
 }
+/**
+ * Whether Netlify's own password form opens the address: the password posted as that form posts it (a `password` field
+ * to the address itself), then the page read with the session cookie Netlify set. Says whether a password is right
+ * where the header did not open the address; a review cannot fill a form, so this proves nothing for one.
+ */
+async function formOpens(target, password, phrase, open, signal) {
+    try {
+        const posted = await open(target, { method: 'POST', redirect: 'manual', credentials: 'omit', signal, headers: { accept: 'text/html', 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ password }).toString() });
+        await posted.body?.cancel().catch(() => { });
+        const cookies = posted.headers.getSetCookie().map((cookie) => cookie.split(';')[0]).filter((pair) => pair.includes('='));
+        if (posted.status >= 400 || !cookies.length)
+            return false;
+        const res = await open(target, { redirect: 'manual', credentials: 'omit', signal, headers: { accept: 'text/html', cookie: cookies.join('; ') } });
+        if (res.status < 200 || res.status >= 300) {
+            await res.body?.cancel().catch(() => { });
+            return false;
+        }
+        return visible(await pageText(res)).includes(plain(phrase));
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Opens a preview address the way a visitor does, signed in nowhere, and proves it: it answers, and its page shows
  * `words` that a file of the checkout at `root` holds, so the page is this app's and not another site's. With `bypass`, a
- * Vercel bypass secret, a Vercel address is opened with it in the header Vercel reads it from, as reviews do; no other host's is.
+ * Vercel bypass secret, a Vercel address is opened with it in the header Vercel reads it from, as reviews do; with
+ * `password`, a Netlify site password, a Netlify address is opened with it as basic credentials in the Authorization
+ * header, the one way reviews can send it, and with `form` posted to Netlify's form too where the header did not get past
+ * the lock (only for a site whose settings show a password: an app's own password form looks the same); with `access`, a
+ * Cloudflare Access service token, a Pages address is opened with it in the two headers Access reads it from. None goes
+ * to another host.
  */
 export async function provePreview(url, words, root, deps = {}) {
     const unproven = (reason, status = null) => ({ proven: false, status, reason });
     const host = URL.canParse(url) ? hostOf(new URL(url)) : null;
     if (!host)
-        return unproven('Only a Vercel preview address, https://<name>.vercel.app, or a Netlify deploy preview, https://deploy-preview-<n>--<name>.netlify.app, with no query, is opened.');
+        return unproven('Only a Vercel preview address, https://<name>.vercel.app, a Netlify deploy preview, https://deploy-preview-<n>--<name>.netlify.app, or a Cloudflare Pages preview, https://<id or branch>.<project>.pages.dev, with no query, is opened.');
     const { name, gate, login } = HOSTS[host];
     const phrase = words.trim();
     if (phrase.length < 3 || phrase.length > 120 || /[\r\n]/.test(phrase))
@@ -153,14 +217,22 @@ export async function provePreview(url, words, root, deps = {}) {
     if (!(await inCheckout(root, phrase)))
         return unproven("No file of this checkout holds those words: give words the app's pages show, from its source.");
     const signal = AbortSignal.any([AbortSignal.timeout(15_000), ...(deps.signal ? [deps.signal] : [])]);
+    const open = deps.fetch ?? fetch;
     const opened = deps.bypass && host === 'vercel';
-    const headers = { accept: 'text/html', ...(opened ? { [BYPASS_HEADER]: deps.bypass } : {}) };
-    // Where the login stands in front all the same, the bypass secret did not get past it.
-    const still = opened ? ' even with the bypass secret' : '';
+    const withPassword = deps.password !== undefined && host === 'netlify';
+    const withToken = deps.access !== undefined && host === 'cloudflare';
+    const headers = {
+        accept: 'text/html',
+        ...(opened ? { [BYPASS_HEADER]: deps.bypass } : {}),
+        ...(withPassword ? { authorization: basicCredentials(deps.password) } : {}),
+        ...(withToken ? { [ACCESS_ID_HEADER]: deps.access.id, [ACCESS_SECRET_HEADER]: deps.access.secret } : {}),
+    };
+    // Where the login stands in front all the same, the bypass secret, the password or the service token did not get past it.
+    const still = opened ? ' even with the bypass secret' : withPassword ? ' even with the password' : withToken ? ' even with the service token' : '';
     let target = new URL(url);
     try {
         for (let hop = 0; hop < 4; hop++) {
-            const res = await (deps.fetch ?? fetch)(target, { redirect: 'manual', headers, credentials: 'omit', signal });
+            const res = await open(target, { redirect: 'manual', headers, credentials: 'omit', signal });
             if (res.status >= 300 && res.status < 400) {
                 await res.body?.cancel().catch(() => { });
                 const location = res.headers.get('location') ?? '';
@@ -172,19 +244,26 @@ export async function provePreview(url, words, root, deps = {}) {
                 target = next;
                 continue;
             }
-            if (res.status === 401 || (host === 'netlify' && res.status === 403)) {
+            if (res.status === 401 || (host !== 'vercel' && res.status === 403)) {
                 // Vercel's own page names Vercel; any other 401 there is the app's own sign-in, which a page a visitor opens without signing in gets past.
-                // A password or a login in front of a Netlify preview answers 401 or 403 on every page of it, and its page names nothing to go by.
+                // Netlify's lock shows itself; the app's own 401 or 403 does not, so it gets no site password.
+                // Cloudflare Access names itself on the 401 or 403 it answers a request it will not let in (a service token it does not admit), where a browser gets its login.
                 const page = await pageText(res, 64_000);
-                return host === 'netlify' || /vercel/i.test(page) ? { ...unproven(`The address asked for ${name}'s login or password${still}.`, res.status), gate }
-                    : unproven("The address asked for the app's own sign-in: try a page a visitor opens without signing in.", 401);
+                const named = (host === 'netlify' && netlifyLock(res.headers.get('www-authenticate'), page)) || (host === 'vercel' && /vercel/i.test(page)) || (host === 'cloudflare' && (/^cloudflare-access\b/i.test(res.headers.get('www-authenticate') ?? '') || /cloudflareaccess\.com|cloudflare access/i.test(page)));
+                if (!named)
+                    return unproven(res.status === 401 ? "The address asked for the app's own sign-in: try a page a visitor opens without signing in." : `The address answered ${res.status}.`, res.status);
+                // A password the header did not get past: Netlify's own form says whether it is the site's password at all.
+                if (withPassword && deps.form && (await formOpens(target, deps.password, phrase, open, signal))) {
+                    return { ...unproven("The password opens the address on Netlify's own form, but not in the Authorization header, the one way reviews can send it.", res.status), gate, formOpened: true };
+                }
+                return { ...unproven(`The address asked for ${name}'s login or password${still}.`, res.status), gate };
             }
             if (res.status < 200 || res.status >= 300) {
                 await res.body?.cancel().catch(() => { });
                 return unproven(`The address answered ${res.status}.`, res.status);
             }
             return visible(await pageText(res)).includes(plain(phrase))
-                ? { proven: true, status: res.status, ...(host === 'netlify' ? { pattern: `https://deploy-preview-{pr}--${NETLIFY.exec(new URL(url).hostname)[1]}.netlify.app` } : {}) }
+                ? { proven: true, status: res.status, ...patternOf(host, new URL(url).hostname) }
                 : unproven('The page does not show those words: it is another app, or another page.', res.status);
         }
         return unproven('The address redirected too many times.');

package/dist/log.js

@@ -1,8 +1,13 @@
 import { appendFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-/** An error whose message is written for the person at the terminal. */
+/** An error whose message is written for the person at the terminal; `step` is the onboarding step it ends, which the command reports (report.ts). */
 export class UserError extends Error {
+    step;
+    constructor(message, step) {
+        super(message);
+        this.step = step;
+    }
 }
 const TOKEN = /\b(pst|phr)_[A-Za-z0-9._~+/=-]+/g;
 const NAMES = 'access_token|run_token|code_verifier|code|authorization|x-api-key';

package/dist/login.js

@@ -130,7 +130,7 @@ export async function startCallbackServer(state, ports = CALLBACK_PORTS) {
             },
         };
     }
-    throw new UserError(`Ports ${ports.join(', ')} are all taken on this machine, and sign-in needs one. Close what uses one of them and run it again.`);
+    throw new UserError(`Ports ${ports.join(', ')} are all taken on this machine, and sign-in needs one. Close what uses one of them and run it again.`, { event: 'setup_command_sign_in_ended', outcome: 'ports_busy' });
 }
 /** The code from what the person pasted: the whole callback address, or the code alone. Null when it is neither, or from another sign-in. */
 export function parsePasted(text, state) {
@@ -215,18 +215,20 @@ export async function exchangeCode(host, input, log) {
 }
 /**
  * The browser sign-in: callback server, PKCE and state, the paste fallback,
- * then the token exchange, once per code. `check` stops a token the command
+ * then the token exchange, once per code. `repo` is the checkout's owner/name:
+ * the consent page names it, so the person approves and picks nothing (an
+ * older Impeccable ignores it and asks). `check` stops a token the command
  * cannot use; otherwise the tab that brought the code goes on to the page
  * `landing` resolves to (the web page that mirrors the run, once the command
  * has what it needs to show a run there), or says why it will not.
  */
-export async function signIn(host, log, prompt, check = (t) => t, landing = async (t) => progressPage(host, t)) {
+export async function signIn(host, repo, log, prompt, check = (t) => t, landing = async (t) => progressPage(host, t)) {
     const state = randomBytes(24).toString('base64url');
     const { verifier, challenge } = pkcePair();
     log.secret(verifier);
     const server = await startCallbackServer(state);
     const authorize = new URL(`${host}/app/cli/authorize`);
-    authorize.search = new URLSearchParams({ redirect_uri: server.redirectUri, state, code_challenge: challenge, code_challenge_method: 'S256' }).toString();
+    authorize.search = new URLSearchParams({ redirect_uri: server.redirectUri, state, code_challenge: challenge, code_challenge_method: 'S256', repo }).toString();
     log.write(`callback server at ${server.redirectUri}`);
     prompt.show(authorize.href);
     openBrowser(authorize.href);
@@ -235,8 +237,8 @@ export async function signIn(host, log, prompt, check = (t) => t, landing = asyn
     try {
         const code = await new Promise((resolve, reject) => {
             server.code.then(resolve, reject);
-            stopPaste = prompt.listen(state, resolve, () => reject(new UserError('Sign-in cancelled.')));
-            timer = setTimeout(() => reject(new UserError('Sign-in timed out after 30 minutes. Run impeccable-reviews again.')), LOGIN_TIMEOUT_MS);
+            stopPaste = prompt.listen(state, resolve, () => reject(new UserError('Sign-in cancelled.', { event: 'setup_command_sign_in_ended', outcome: 'cancelled' })));
+            timer = setTimeout(() => reject(new UserError('Sign-in timed out after 30 minutes. Run impeccable-reviews again.', { event: 'setup_command_sign_in_ended', outcome: 'timed_out' })), LOGIN_TIMEOUT_MS);
         });
         log.secret(code);
         const token = check(await exchangeCode(host, { code, verifier, redirectUri: server.redirectUri }, log));
@@ -261,7 +263,7 @@ export function setupAuth(first, signInAgain, now = Date.now) {
     const until = (t) => now() + (Number.isFinite(t.expires_in) ? t.expires_in : 3600) * 1000;
     let current = { token: first.access_token, expiresAt: until(first) };
     let pending;
-    const renew = (pi) => (pending ??= signInAgain(pi)
+    const renew = (pi, why = 'ran-out') => (pending ??= signInAgain(pi, why)
         .then((t) => {
         current = { token: t.access_token, expiresAt: until(t) };
         return t.access_token;