@impeccable/reviews 0.1.11 → 0.1.13

package/dist/cloudflare.js

@@ -1,5 +1,6 @@
+import { realpathSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { join, resolve, sep } from 'node:path';
 import { cloudflarePreviewsFact, cloudflarePreviewsPage, folderOf } from './host-previews.js';
 import { commandRunner } from './netlify.js';
 import { ownFolder, ownNpmCache } from './sandbox.js';
@@ -238,13 +239,50 @@ export const CF_PACKAGE = 'cf@1.0.0-beta.13';
 /**
  * cf here: its JSON uncoloured, and an account's command given its account, which cf otherwise asks the person to pick
  * when they have several. `browser` lets its sign-in open one. npx runs it from a folder of the command's own, never the
- * checkout, whose node_modules and .npmrc would choose which cf runs as the person, outside the sandbox: every cf
- * command names its project or its account, so none needs the checkout. It fetches cf through a cache of the command's
- * own, never ~/.npm, where a sandboxed install could have planted a cf under the registry's live ETag; the registry is
- * asked afresh, and no install script of cf's runs, which it does without.
+ * checkout, whose node_modules and .npmrc would choose which cf runs as the person, outside the sandbox, and from where cf
+ * itself would read the checkout's .env into its token and account and evaluate its cloudflare.config.ts: every cf
+ * command names its project or its account, so none needs the checkout. Only the sign-in cf picks by folder does: with
+ * `checkout`, each command runs as the profile cf binds to it (`cf auth activate`), which cf names from its own folder
+ * too, so the account is the one the person's cf uses there; where reading the bindings failed, the command fails as well,
+ * never falling back to another sign-in. It fetches cf through a cache of the command's own, never ~/.npm, where a
+ * sandboxed install could have planted a cf under the registry's live ETag; the registry is asked afresh, and no install
+ * script of cf's runs, which it does without.
  */
 export function cfRunner(opts = {}, runner = commandRunner) {
-    return (args, { account, signal } = {}) => runner('npx', ownFolder(), { timeoutMs: 120_000, ...opts, signal, env: { NO_COLOR: '1', ...(account ? { CLOUDFLARE_ACCOUNT_ID: account } : {}) } })(['--yes', '--cache', ownNpmCache(), '--prefer-online', '--ignore-scripts', CF_PACKAGE, ...args]);
+    const { checkout, ...run } = opts;
+    const npx = (args, signal, env = {}) => runner('npx', ownFolder(), { timeoutMs: 120_000, ...run, signal, env: { NO_COLOR: '1', ...env } })(['--yes', '--cache', ownNpmCache(), '--prefer-online', '--ignore-scripts', CF_PACKAGE, ...args]);
+    let profile;
+    return async (args, { account, signal } = {}) => {
+        // Read once a runner; a failed read is read again by the next command.
+        if (checkout && !profile)
+            profile = npx(['auth', 'list'], signal).then((listed) => boundProfile(listed, checkout)).catch((err) => { profile = undefined; throw err; });
+        const bound = await profile;
+        return npx([...(bound ? ['--profile', bound] : []), ...args], signal, account ? { CLOUDFLARE_ACCOUNT_ID: account } : {});
+    };
+}
+/** The profile `cf auth list` binds to `checkout`, found as cf finds it from there: the longest bound folder that is the checkout's real path or holds it; none where no folder does. A list that is not cf's throws. */
+export function boundProfile(listed, checkout) {
+    const profiles = JSON.parse(listed);
+    if (!Array.isArray(profiles))
+        throw new Error('cf auth list printed no list of profiles');
+    let here = resolve(checkout);
+    try {
+        here = realpathSync(here);
+    }
+    catch { /* cf's own folder, as cf resolves it */ }
+    let found;
+    for (const p of profiles) {
+        const { name, boundDirectories } = record(p) ?? {};
+        if (typeof name !== 'string' || !/^[A-Za-z0-9_-]+$/.test(name) || !Array.isArray(boundDirectories))
+            continue;
+        for (const dir of boundDirectories) {
+            if (typeof dir !== 'string' || !(here === dir || (here.startsWith(dir) && here[dir.length] === sep)))
+                continue;
+            if (!found || dir.length > found.dir.length)
+                found = { name, dir };
+        }
+    }
+    return found?.name;
 }
 /** The status of the API call a cf command failed on, which its error box names on a line of its own ("│ 403 Forbidden", "│ 404 Not Found · HTTP /accounts/…"); null when it names none. */
 export function cfFailure(err) {
@@ -406,7 +444,7 @@ export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
     // `project`, one app's told by an earlier read, is the one read: never the project the first check run names, which may be another app's.
     const named = app ? undefined : deps.project ?? github.previews.map((p) => pagesProject(p.url)).find(Boolean) ?? (config?.kind === 'pages' ? config.name : undefined);
     // cf installs itself through npx on a machine without it, which takes a while the first time. The project's settings are read with the plain evidence, not while a build is waited for.
-    const cf = await fromCf(named, deps.cf ?? cfRunner(), { owner, repo, heads: github.heads.map((h) => h.sha), readme: readme.pages, ...(app ? { directory: deps.directory } : {}) }, plain, deps.signal);
+    const cf = await fromCf(named, deps.cf ?? cfRunner({ checkout: cwd }, deps.run), { owner, repo, heads: github.heads.map((h) => h.sha), readme: readme.pages, ...(app ? { directory: deps.directory } : {}) }, plain, deps.signal);
     const where = deps.directory ? `the folder ${deps.directory}` : "the repository's root";
     const unmatched = !app ? undefined
         : cf.cli !== 'signed-in' ? `Which Cloudflare Pages project builds ${where} cannot be told: cf here is not signed in with Pages access, and only a project's settings name the folder it builds (its root directory).`

package/dist/main.js

@@ -256,8 +256,8 @@ export async function main(argv) {
                     todo: [...apps.todo, ...report.left],
                     warnings: [...removed, ...(saved && !saved.ok ? [`The web page missed the last update (${saved.error}), so it may lag behind this.`] : [])],
                 }, hand);
-                // The web page has the report; when it missed it, the report stays here instead.
-                if (!saved?.ok)
+                // The web page has the report; when it missed it, or there is no test drive, whose why it holds, the report stays here as well.
+                if (!saved?.ok || !testPr)
                     say(`\n${plainReport(report.markdown)}`);
                 if (!saved?.ok)
                     reporter.step({ event: 'setup_command_stopped', outcome: 'update_lost' });

package/dist/tools.js

@@ -137,7 +137,7 @@ function stageError(status, tasks) {
 }
 /** The line under the last screen's heading ("You're all set up", or "Settings saved" without a test drive), about the pull request that screen ends on: the setup pull request when there is one, else the test drive; and, where a host builds the previews and so no setup pull request was needed, one line saying so. */
 export function resultLine(report) {
-    const lead = !report.testPr ? 'No test drive: the report says why.' : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
+    const lead = !report.testPr ? 'No test drive: the report says why, printed here when this screen closes.' : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
     return report.setupPr || !report.hostedBy ? lead : `${lead} ${nothingToMerge(report.hostedBy)}`;
 }
 /** Said once, here and in the report, when the host builds the previews and the repository needed no change. */
@@ -2797,7 +2797,7 @@ export function createTools(ctx) {
             const turnOn = async () => {
                 if (host === 'netlify')
                     return enableNetlifyPreviews((ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal }), fact.project);
-                const cf = cfRunner({}, ctx.hostRunner);
+                const cf = cfRunner({ checkout: pi.cwd }, ctx.hostRunner);
                 return enableCloudflarePreviews(cf, fact.project, await cfStatus(cf, signal), signal);
             };
             // The run's change, read back; where the host kept the setting, the person changes it on the host's page and the run reads again, twice at most.
@@ -2842,8 +2842,8 @@ export function createTools(ctx) {
             if ((await ask({ ...screen, prompt: create ? `Create the Pages project ${project} for ${ctx.owner}/${ctx.repo}?` : `Connect ${ctx.owner}/${ctx.repo} to the Pages project ${project}?` })).skipped)
                 return answer('skipped', { reason: `The person skipped ${create ? 'creating the Pages project' : 'connecting the repository to the Pages project'}.` });
             // cf signed in with pages:write, as it is or after Cloudflare's sign-in in the browser, keeping the scopes it held; a sign-in that did not complete offers a retry, twice.
-            const cf = cfRunner({}, ctx.hostRunner);
-            const login = cfRunner({ browser: true, timeoutMs: 300_000 }, ctx.hostRunner);
+            const cf = cfRunner({ checkout: pi.cwd }, ctx.hostRunner);
+            const login = cfRunner({ browser: true, timeoutMs: 300_000, checkout: pi.cwd }, ctx.hostRunner);
             const writes = (status) => status.cli === 'signed-in' && (!status.scopes || status.scopes.includes('pages:write'));
             let status = await cfStatus(cf, signal);
             if (!writes(status)) {
@@ -3121,8 +3121,8 @@ export function createTools(ctx) {
                 answer = await passCloudflareAccess({
                     url: at.url,
                     consent: async () => !(await ask(sentTo(HOST_SCREENS['cloudflare-access'], at.url))).skipped,
-                    cf: cfRunner({}, ctx.hostRunner),
-                    login: cfRunner({ browser: true, timeoutMs: 300_000 }, ctx.hostRunner),
+                    cf: cfRunner({ checkout: pi.cwd }, ctx.hostRunner),
+                    login: cfRunner({ browser: true, timeoutMs: 300_000, checkout: pi.cwd }, ctx.hostRunner),
                     retry: async () => !(await ask(HOST_SCREENS['cloudflare-signin-retry'])).skipped,
                     status: said,
                     apiToken: async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,

package/dist/playbook/github-previews.js

@@ -1,101 +0,0 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-const execFileAsync = promisify(execFile);
-const LIMIT = 20;
-const COVERAGE = 'Only the 20 newest GitHub deployments, their latest statuses, and the 20 most recently updated pull requests are checked. A missing match does not prove previews are absent. Empty GitHub deployment history does not prove that a live app or host previews do not exist. A deployment URL does not prove the application rendered.';
-const FAILURE = 'GitHub preview evidence could not be read completely.';
-const STATES = ['error', 'failure', 'inactive', 'in_progress', 'queued', 'pending', 'success'];
-function record(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : undefined;
-}
-function positiveInteger(value) {
-    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0;
-}
-function sha(value) {
-    return typeof value === 'string' && /^[a-f0-9]{40}$/.test(value);
-}
-function previewUrl(value) {
-    if (typeof value !== 'string' || value.length > 2048 || !/^https:\/\/[^\s\\?#]+$/i.test(value))
-        return null;
-    try {
-        const url = new URL(value);
-        if (url.username || url.password || url.search || url.hash || /^https:\/\/[^/]*@/i.test(value))
-            return null;
-        return url.href;
-    }
-    catch {
-        return null;
-    }
-}
-/** Read a bounded projection of GitHub evidence; never return response bodies or command errors. */
-export async function readHostedPreviews(owner, repo, dependencies = {}) {
-    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(owner)
-        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(repo) || repo === '.' || repo === '..') {
-        return { coverage: COVERAGE, deployments: [], error: FAILURE };
-    }
-    const runGh = dependencies.runGh ?? (async (args) => {
-        const { stdout } = await execFileAsync('gh', args, {
-            encoding: 'utf8', timeout: 30_000, maxBuffer: 2 * 1024 * 1024, signal: dependencies.signal,
-        });
-        return stdout;
-    });
-    const base = `/repos/${owner}/${repo}`;
-    async function get(route) {
-        if (dependencies.signal?.aborted)
-            throw new Error(FAILURE);
-        const stdout = await runGh(['api', '--hostname', 'github.com', '--method', 'GET', route]);
-        if (dependencies.signal?.aborted)
-            throw new Error(FAILURE);
-        const data = JSON.parse(stdout);
-        if (!Array.isArray(data))
-            throw new Error(FAILURE);
-        return data.slice(0, LIMIT);
-    }
-    try {
-        const [deployments, pulls] = await Promise.all([
-            get(`${base}/deployments?per_page=${LIMIT}`),
-            get(`${base}/pulls?state=all&sort=updated&direction=desc&per_page=${LIMIT}`),
-        ]);
-        let incomplete = false;
-        const evidence = [];
-        for (const entry of deployments) {
-            if (dependencies.signal?.aborted) {
-                incomplete = true;
-                break;
-            }
-            const deployment = record(entry);
-            if (!deployment || !positiveInteger(deployment.id) || !sha(deployment.sha))
-                continue;
-            let latest;
-            try {
-                latest = record((await get(`${base}/deployments/${deployment.id}/statuses?per_page=1`))[0]);
-            }
-            catch {
-                incomplete = true;
-                if (dependencies.signal?.aborted)
-                    break;
-            }
-            const status = STATES.find((state) => state === latest?.state) ?? null;
-            const environment = typeof deployment.environment === 'string' && deployment.environment.length <= 100
-                && !/[\u0000-\u001f\u007f]/.test(deployment.environment) ? deployment.environment : null;
-            const pullRequests = [];
-            for (const item of pulls) {
-                const pull = record(item);
-                if (pull && positiveInteger(pull.number) && (pull.state === 'open' || pull.state === 'closed')
-                    && record(pull.head)?.sha === deployment.sha) {
-                    pullRequests.push({ number: pull.number, state: pull.state });
-                }
-            }
-            evidence.push({ id: deployment.id, sha: deployment.sha, environment, status,
-                previewUrl: status ? previewUrl(latest?.environment_url) : null, pullRequests });
-        }
-        incomplete ||= dependencies.signal?.aborted ?? false;
-        return { coverage: COVERAGE, deployments: evidence,
-            ...(incomplete ? { error: FAILURE } : { emptyDeploymentHistory: deployments.length === 0 }) };
-    }
-    catch {
-        return { coverage: COVERAGE, deployments: [], error: FAILURE };
-    }
-}

package/dist/playbook/netlify-pattern.js

@@ -1,24 +0,0 @@
-/** Keep Netlify's repository-wide pattern tied to successful discovery evidence. */
-export function netlifyPatternError(body, observed) {
-    const pattern = body.previewUrlPattern;
-    if (typeof pattern !== 'string')
-        return null;
-    let netlify = /netlify\.app|<site>/i.test(pattern);
-    try {
-        const hostname = new URL(pattern.replaceAll('{pr}', '1')).hostname;
-        netlify ||= hostname === 'netlify.app' || hostname.endsWith('.netlify.app');
-    }
-    catch { /* The canonical validation below rejects malformed Netlify patterns. */ }
-    if (!netlify)
-        return null;
-    const match = /^https:\/\/deploy-preview-\{pr\}--([a-z0-9](?:[a-z0-9-]*[a-z0-9])?)\.netlify\.app$/.exec(pattern);
-    if (!match || match[1].length > 63)
-        return 'Use a real Netlify site pattern from successful preview evidence; placeholders and malformed patterns are not saved.';
-    if (Object.hasOwn(body, 'appKey'))
-        return 'A Netlify preview URL pattern belongs to the repository; omit appKey.';
-    if (body.intendedMethod !== 'preview-deploy')
-        return 'Save a Netlify pattern with intendedMethod preview-deploy.';
-    if (!observed.has(pattern))
-        return 'Read this repository\'s Netlify previews first and choose a pattern backed by a successful current-head status.';
-    return null;
-}

package/dist/playbook/netlify-previews.js

@@ -1,144 +0,0 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-const execFileAsync = promisify(execFile);
-const FAILURE = 'Netlify preview evidence could not be read completely.';
-const COVERAGE = 'Only the 20 most recently updated pull requests, the newest 100 statuses on each exact head SHA, and the 100 most recently updated repository issue comments are checked. Context-derived URLs do not prove the application rendered. Bot comments are historical candidates, not current-head deployment proof. Missing evidence does not prove previews are absent.';
-const SITE = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
-const CONTEXT = new RegExp(`^netlify/(${SITE})/deploy-preview$`);
-const PREVIEW_HOST = new RegExp(`^deploy-preview-([1-9][0-9]*)--(${SITE})\\.netlify\\.app$`);
-const STATES = ['success', 'pending', 'failure', 'error'];
-function record(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value)
-        ? value : undefined;
-}
-function cleanUrl(value) {
-    if (typeof value !== 'string' || value.length > 2048 || !/^https:\/\/[^\s\\?#@]+$/i.test(value))
-        return;
-    try {
-        const url = new URL(value);
-        if (!url.username && !url.password && !url.port && !url.search && !url.hash)
-            return url;
-    }
-    catch { /* Discard unsafe evidence without returning it. */ }
-}
-function urls(pull, site) {
-    if (`deploy-preview-${pull.number}--${site}`.length > 63)
-        return;
-    return {
-        previewUrl: `https://deploy-preview-${pull.number}--${site}.netlify.app/`,
-        previewUrlPattern: `https://deploy-preview-{pr}--${site}.netlify.app`,
-    };
-}
-function validTarget(value, pull, site) {
-    if (value === null || value === undefined || value === '')
-        return true;
-    const target = cleanUrl(value);
-    if (!target)
-        return false;
-    if (target.hostname === `deploy-preview-${pull.number}--${site}.netlify.app` && target.pathname === '/')
-        return true;
-    return target.hostname === 'app.netlify.com'
-        && new RegExp(`^/(?:sites|projects)/${site}/deploys(?:/[a-zA-Z0-9_-]+)?/?$`).test(target.pathname);
-}
-/** Read a bounded, repository-scoped projection; never expose comments, command errors or credentials. */
-export async function readNetlifyPreviews(owner, repo, dependencies = {}) {
-    const previews = [];
-    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(owner)
-        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(repo) || repo === '.' || repo === '..') {
-        return { coverage: COVERAGE, previews, error: FAILURE };
-    }
-    const runGh = dependencies.runGh ?? (async (args) => {
-        const { stdout } = await execFileAsync('gh', args, {
-            encoding: 'utf8', timeout: 30_000, maxBuffer: 2 * 1024 * 1024, signal: dependencies.signal,
-        });
-        return stdout;
-    });
-    const base = `/repos/${owner}/${repo}`;
-    async function get(route, limit) {
-        if (dependencies.signal?.aborted)
-            throw new Error();
-        const raw = await runGh(['api', '--hostname', 'github.com', '--method', 'GET', route]);
-        if (dependencies.signal?.aborted)
-            throw new Error();
-        const data = JSON.parse(raw);
-        if (!Array.isArray(data))
-            throw new Error();
-        return data.slice(0, limit);
-    }
-    const [pullRead, commentRead] = await Promise.allSettled([
-        get(`${base}/pulls?state=all&sort=updated&direction=desc&per_page=20`, 20),
-        get(`${base}/issues/comments?sort=updated&direction=desc&per_page=100`, 100),
-    ]);
-    if (pullRead.status === 'rejected')
-        return { coverage: COVERAGE, previews, error: FAILURE };
-    let incomplete = false;
-    const warnings = commentRead.status === 'rejected'
-        ? ['Historical Netlify bot comments could not be read. Current-head status evidence is still checked.'] : [];
-    const pulls = new Map();
-    for (const item of pullRead.value) {
-        const pull = record(item);
-        const headSha = record(pull?.head)?.sha;
-        if (!pull || typeof pull.number !== 'number' || !Number.isSafeInteger(pull.number) || pull.number <= 0
-            || (pull.state !== 'open' && pull.state !== 'closed') || typeof headSha !== 'string' || !/^[a-f0-9]{40}$/.test(headSha))
-            continue;
-        const issueUrl = `https://api.github.com${base}/issues/${pull.number}`;
-        if (!pulls.has(issueUrl))
-            pulls.set(issueUrl, { number: pull.number, state: pull.state, headSha });
-    }
-    const seen = new Set();
-    const statusesBySha = new Map();
-    for (const pull of pulls.values()) {
-        if (dependencies.signal?.aborted) {
-            incomplete = true;
-            break;
-        }
-        try {
-            if (!statusesBySha.has(pull.headSha)) {
-                statusesBySha.set(pull.headSha, get(`${base}/commits/${pull.headSha}/statuses?per_page=100`, 100));
-            }
-            for (const item of await statusesBySha.get(pull.headSha)) {
-                const status = record(item);
-                const site = typeof status?.context === 'string' ? CONTEXT.exec(status.context)?.[1] : undefined;
-                if (!site || seen.has(`${pull.number}:${site}`))
-                    continue;
-                // GitHub returns newest first: even an invalid latest entry must hide older success.
-                seen.add(`${pull.number}:${site}`);
-                const state = STATES.find((state) => state === status?.state);
-                const canonical = urls(pull, site);
-                if (!state || !canonical || !validTarget(status?.target_url, pull, site))
-                    continue;
-                previews.push({ pullRequest: pull.number, state: pull.state, headSha: pull.headSha, site,
-                    status: state, ...canonical, source: 'commit-status', matchesHead: true });
-            }
-        }
-        catch {
-            incomplete = true;
-        }
-    }
-    if (!dependencies.signal?.aborted && commentRead.status === 'fulfilled') {
-        for (const item of commentRead.value) {
-            const comment = record(item);
-            const author = record(comment?.user);
-            const pull = typeof comment?.issue_url === 'string' ? pulls.get(comment.issue_url) : undefined;
-            if (!pull || author?.login !== 'netlify[bot]' || author.type !== 'Bot'
-                || typeof comment?.body !== 'string' || comment.body.length > 65_536)
-                continue;
-            for (const match of comment.body.matchAll(/https:\/\/[^\s<>"'()[\]`]+/gi)) {
-                const url = cleanUrl(match[0].replace(/[.,;:]+$/, ''));
-                const parts = url ? PREVIEW_HOST.exec(url.hostname) : null;
-                if (!url || url.pathname !== '/' || !parts || parts[1] !== String(pull.number))
-                    continue;
-                const site = parts[2];
-                const canonical = urls(pull, site);
-                if (!canonical || seen.has(`${pull.number}:${site}`))
-                    continue;
-                seen.add(`${pull.number}:${site}`);
-                previews.push({ pullRequest: pull.number, state: pull.state, headSha: pull.headSha, site,
-                    status: null, ...canonical, source: 'bot-comment', matchesHead: false });
-            }
-        }
-    }
-    if (dependencies.signal?.aborted)
-        incomplete = true;
-    return { coverage: COVERAGE, previews, ...(warnings.length ? { warnings } : {}), ...(incomplete ? { error: FAILURE } : {}) };
-}

package/dist/playbook/probe-preview.js

@@ -1,67 +0,0 @@
-function redirectGate(location, source) {
-    if (!location)
-        return 'redirected';
-    try {
-        const target = new URL(location, source);
-        if (target.protocol !== 'https:')
-            return 'redirected';
-        if (target.origin === 'https://vercel.com' && target.pathname === '/sso-api'
-            && target.searchParams.has('url'))
-            return 'vercel-protection';
-        if ((target.hostname === 'vercel.com' || target.hostname.endsWith('.vercel.com'))
-            && /^\/login(?:\/|$)/.test(target.pathname))
-            return 'vercel-protection';
-        if (target.hostname.endsWith('.cloudflareaccess.com'))
-            return 'cloudflare-access';
-        if (target.origin === source.origin && /^\/(?:login|sign-in|signin)(?:\/|$)/.test(target.pathname)) {
-            return 'app-sign-in';
-        }
-    }
-    catch {
-        // A malformed redirect reveals nothing about preview protection.
-    }
-    return 'redirected';
-}
-/** An unauthenticated HTTP check only: reachable does not prove this is the intended app. */
-export async function probePreview(url, dependencies = {}) {
-    let target;
-    try {
-        target = new URL(url);
-        if (!isPlatformPreview(target)
-            || /[?#\\\s]/.test(url) || !/^https:\/\//i.test(url))
-            throw new Error();
-    }
-    catch {
-        return { status: null, gate: 'unavailable', error: 'invalid-preview-url' };
-    }
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 15_000);
-    const signal = dependencies.signal
-        ? AbortSignal.any([controller.signal, dependencies.signal])
-        : controller.signal;
-    try {
-        signal.throwIfAborted();
-        const response = dependencies.fetch ? await dependencies.fetch(target, {
-            method: 'GET',
-            headers: { accept: 'text/html' },
-            credentials: 'omit',
-            redirect: 'manual',
-            signal,
-        }) : await publicPreviewRequest(target, signal);
-        const status = response.status;
-        const gate = status === 401 && response.headers.get('x-vercel-error') === 'UNAUTHORIZED'
-            ? 'vercel-protection' : status >= 300 && status < 400
-            ? redirectGate(response.headers.get('location'), target)
-            : status >= 200 && status < 300 ? 'reachable' : 'unavailable';
-        // Bodies and redirect details may contain credentials; never read or return them.
-        await response.body?.cancel().catch(() => undefined);
-        return { status, gate };
-    }
-    catch {
-        return { status: null, gate: 'unavailable', error: 'request-failed' };
-    }
-    finally {
-        clearTimeout(timeout);
-    }
-}
-import { isPlatformPreview, publicPreviewRequest } from './public-preview-request.js';

package/dist/playbook/protection-secrets.js

@@ -1,15 +0,0 @@
-/** Register credential-shaped write fields before a message can be recorded.
- * Do not trust the requested path: even a refused or malformed destination must
- * keep its supplied credentials private. Values remain unchanged in memory.
- */
-export function protectionWriteSecrets(input) {
-    if (!input || typeof input !== 'object' || Array.isArray(input))
-        return [];
-    const body = input.body;
-    if (!body || typeof body !== 'object' || Array.isArray(body))
-        return [];
-    return ['value', 'clientId', 'clientSecret']
-        .map((key) => body[key])
-        .filter((value) => typeof value === 'string' && value.length > 0)
-        .sort((a, b) => b.length - a.length);
-}

package/dist/playbook/public-preview-request.js

@@ -1,96 +0,0 @@
-import { lookup } from 'node:dns/promises';
-import { request } from 'node:https';
-import { BlockList, isIP } from 'node:net';
-const blockedV4 = new BlockList();
-for (const [address, prefix] of [
-    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8],
-    ['169.254.0.0', 16], ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.0.2.0', 24],
-    ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15], ['198.51.100.0', 24],
-    ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4],
-])
-    blockedV4.addSubnet(address, prefix, 'ipv4');
-const publicV6 = new BlockList();
-publicV6.addSubnet('2000::', 3, 'ipv6');
-const blockedV6 = new BlockList();
-// Conservatively exclude special-purpose, transition and documentation prefixes.
-for (const [address, prefix] of [
-    ['2001::', 23], ['2001:db8::', 32], ['2002::', 16], ['3fff::', 20],
-])
-    blockedV6.addSubnet(address, prefix, 'ipv6');
-export function isPlatformPreview(target) {
-    return target.protocol === 'https:' && !target.username && !target.password && !target.port
-        && !/[?#]/.test(target.href)
-        && /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+(?:vercel|netlify)\.app$/.test(target.hostname);
-}
-function isPublicAddress(value) {
-    if (!value || typeof value.address !== 'string' || value.address.includes('%'))
-        return false;
-    const family = isIP(value.address);
-    if (family !== value.family)
-        return false;
-    if (family === 4)
-        return !blockedV4.check(value.address, 'ipv4');
-    return family === 6 && publicV6.check(value.address, 'ipv6') && !blockedV6.check(value.address, 'ipv6');
-}
-/** Resolve once, validate every answer, then connect only to the pinned public addresses. */
-export async function publicPreviewRequest(target, signal, dependencies = {}) {
-    try {
-        if (!isPlatformPreview(target))
-            throw new Error();
-        signal.throwIfAborted();
-        let abortDns = () => { };
-        const aborted = new Promise((_resolve, reject) => {
-            abortDns = () => reject(new Error());
-            signal.addEventListener('abort', abortDns, { once: true });
-        });
-        const addresses = await Promise.race([
-            (dependencies.lookup ?? lookup)(target.hostname, { all: true, verbatim: true }), aborted,
-        ]).finally(() => signal.removeEventListener('abort', abortDns));
-        signal.throwIfAborted();
-        if (!Array.isArray(addresses) || !addresses.length || !addresses.every(isPublicAddress))
-            throw new Error();
-        const pinned = addresses.map(({ address, family }) => ({ address, family }));
-        return await new Promise((resolve, reject) => {
-            const options = {
-                method: 'GET', headers: { accept: 'text/html' }, signal,
-                agent: false, autoSelectFamily: true, rejectUnauthorized: true,
-                lookup(hostname, options, callback) {
-                    if (hostname !== target.hostname)
-                        return callback(new Error('Preview request failed'), '');
-                    if (options.all)
-                        callback(null, pinned.map((address) => ({ ...address })));
-                    else
-                        callback(null, pinned[0].address, pinned[0].family);
-                },
-            };
-            const req = (dependencies.request ?? request)(target, options, (response) => {
-                response.once('error', () => { });
-                try {
-                    const status = response.statusCode;
-                    const headers = new Headers();
-                    for (const name of ['location', 'x-vercel-error']) {
-                        const value = response.headers[name];
-                        if (typeof value === 'string')
-                            headers.set(name, value);
-                    }
-                    if (!status)
-                        reject(new Error());
-                    else
-                        resolve({ status, headers, body: null });
-                }
-                catch {
-                    reject(new Error());
-                }
-                finally {
-                    response.destroy();
-                }
-            });
-            req.once('error', () => reject(new Error()));
-            req.once('upgrade', (_response, socket) => { socket.destroy(); reject(new Error()); });
-            req.end();
-        });
-    }
-    catch {
-        throw new Error('Preview request failed');
-    }
-}

package/dist/playbook/publication-wait.js

@@ -1,46 +0,0 @@
-import { setTimeout as sleep } from 'node:timers/promises';
-const INTERVAL_MS = 30_000;
-const DEADLINE_MS = 8 * 60_000;
-/** One publication deadline per setup PR, including time spent checking the preview. */
-export function createPublicationWait(dependencies = {}) {
-    const now = dependencies.now ?? (() => performance.now());
-    const pause = dependencies.sleep ?? ((ms, signal) => sleep(ms, undefined, { signal }));
-    const starts = new Map();
-    return {
-        begin(pr) {
-            if (!starts.has(pr))
-                starts.set(pr, now());
-        },
-        remainingMs(pr) {
-            const start = starts.get(pr);
-            return start === undefined ? null : Math.max(0, DEADLINE_MS - (now() - start));
-        },
-        async wait(pr, signal) {
-            const start = starts.get(pr);
-            if (start === undefined)
-                return null;
-            const result = (status) => {
-                const elapsed = Math.max(0, now() - start);
-                return {
-                    status,
-                    waited_seconds: Math.floor(elapsed / 1000),
-                    remaining_seconds: Math.ceil(Math.max(0, DEADLINE_MS - elapsed) / 1000),
-                };
-            };
-            if (signal?.aborted)
-                return result('cancelled');
-            const remaining = DEADLINE_MS - (now() - start);
-            if (remaining <= 0)
-                return result('timed-out');
-            try {
-                await pause(Math.min(INTERVAL_MS, remaining), signal);
-            }
-            catch {
-                return result('cancelled');
-            }
-            if (signal?.aborted)
-                return result('cancelled');
-            return result(now() - start >= DEADLINE_MS ? 'timed-out' : 'retry');
-        },
-    };
-}

package/dist/playbook/vercel-protection.js

@@ -1,121 +0,0 @@
-import { execFile } from 'node:child_process';
-import { constants } from 'node:fs';
-import { lstat, open, realpath } from 'node:fs/promises';
-import { join } from 'node:path';
-const METADATA_LIMIT = 16 * 1024;
-const OUTPUT_LIMIT = 2 * 1024 * 1024;
-function record(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value)
-        ? value : undefined;
-}
-/** Only the root's small project-link metadata is read; CLI authentication stays with the CLI. */
-async function linkedProject(cwd) {
-    try {
-        const root = await realpath(cwd);
-        const directory = join(root, '.vercel');
-        const directoryStat = await lstat(directory);
-        if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink() || await realpath(directory) !== directory)
-            return;
-        const path = join(directory, 'project.json');
-        if (!(await lstat(path)).isFile())
-            return;
-        const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-        try {
-            const stat = await file.stat();
-            const currentDirectory = await lstat(directory);
-            const currentFile = await lstat(path);
-            if (!stat.isFile() || stat.size > METADATA_LIMIT
-                || currentDirectory.dev !== directoryStat.dev || currentDirectory.ino !== directoryStat.ino
-                || currentFile.isSymbolicLink() || currentFile.dev !== stat.dev || currentFile.ino !== stat.ino
-                || await realpath(path) !== path)
-                return;
-            const buffer = Buffer.alloc(METADATA_LIMIT + 1);
-            const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
-            if (bytesRead > METADATA_LIMIT)
-                return;
-            const metadata = record(JSON.parse(buffer.toString('utf8', 0, bytesRead)));
-            if (typeof metadata?.projectId !== 'string' || !/^prj_[A-Za-z0-9]{1,128}$/.test(metadata.projectId)
-                || typeof metadata.orgId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(metadata.orgId))
-                return;
-            return { root, projectId: metadata.projectId, orgId: metadata.orgId };
-        }
-        finally {
-            await file.close();
-        }
-    }
-    catch {
-        return;
-    }
-}
-/** Reuse one existing default automation bypass in memory, without exposing project responses or keys. */
-export async function useExistingVercelBypass(input, dependencies) {
-    const { signal } = dependencies;
-    if (signal?.aborted)
-        return { status: 'cancelled' };
-    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(input.owner)
-        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(input.repo) || input.repo === '.' || input.repo === '..') {
-        return { status: 'project-mismatch' };
-    }
-    const linked = await linkedProject(input.cwd);
-    if (signal?.aborted)
-        return { status: 'cancelled' };
-    if (!linked)
-        return { status: 'not-linked' };
-    const runVercel = dependencies.runVercel ?? ((args) => new Promise((resolve, reject) => {
-        const child = execFile('vercel', args, {
-            cwd: linked.root, encoding: 'utf8', timeout: 30_000, maxBuffer: OUTPUT_LIMIT, signal,
-        }, (error, stdout) => error ? reject(new Error('Vercel project lookup failed.')) : resolve(stdout));
-        child.stdin?.end();
-    }));
-    // teamId selects the linked team. Legacy personal projects omit it and still require accountId to match.
-    const route = `/v9/projects/${linked.projectId}${linked.orgId.startsWith('team_') ? `?teamId=${linked.orgId}` : ''}`;
-    let selected;
-    try {
-        const stdout = await runVercel(['api', route, '--method', 'GET', '--raw', '--non-interactive'], signal);
-        if (signal?.aborted)
-            return { status: 'cancelled' };
-        if (Buffer.byteLength(stdout, 'utf8') > OUTPUT_LIMIT)
-            return { status: 'unavailable' };
-        const project = record(JSON.parse(stdout));
-        const link = record(project?.link);
-        if (project?.id !== linked.projectId || project.accountId !== linked.orgId
-            || !link || !['github', 'github-limited'].includes(String(link.type))
-            || typeof link.org !== 'string' || link.org.toLowerCase() !== input.owner.toLowerCase()
-            || typeof link.repo !== 'string' || link.repo.toLowerCase() !== input.repo.toLowerCase()) {
-            return { status: 'project-mismatch' };
-        }
-        const bypasses = record(project.protectionBypass);
-        if (!bypasses || Object.keys(bypasses).length > 128)
-            return { status: 'unavailable' };
-        const candidates = [];
-        for (const [value, metadata] of Object.entries(bypasses)) {
-            const bypass = record(metadata);
-            if (bypass?.scope !== 'automation-bypass')
-                continue;
-            if (!/^[A-Za-z0-9]{32}$/.test(value)
-                || (bypass.isEnvVar !== undefined && typeof bypass.isEnvVar !== 'boolean'))
-                return { status: 'unavailable' };
-            // An omitted isEnvVar is the legacy default. Explicit false keys must never be chosen implicitly.
-            if (bypass.isEnvVar !== false)
-                candidates.push(value);
-        }
-        if (candidates.length > 1)
-            return { status: 'ambiguous' };
-        if (candidates.length === 0)
-            return { status: 'unavailable' };
-        selected = candidates[0];
-        dependencies.rememberSecret(selected);
-    }
-    catch {
-        return { status: signal?.aborted ? 'cancelled' : 'unavailable' };
-    }
-    if (signal?.aborted)
-        return { status: 'cancelled' };
-    try {
-        const status = await dependencies.save(selected);
-        return { status: ['saved', 'save-failed', 'partial-save', 'cancelled'].includes(status) ? status : 'save-failed' };
-    }
-    catch {
-        return { status: signal?.aborted ? 'cancelled' : 'save-failed' };
-    }
-}