@impeccable/reviews 0.1.12 → 0.1.13

package/dist/cloudflare.js

@@ -1,5 +1,6 @@
+import { realpathSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { join, resolve, sep } from 'node:path';
 import { cloudflarePreviewsFact, cloudflarePreviewsPage, folderOf } from './host-previews.js';
 import { commandRunner } from './netlify.js';
 import { ownFolder, ownNpmCache } from './sandbox.js';
@@ -238,13 +239,50 @@ export const CF_PACKAGE = 'cf@1.0.0-beta.13';
 /**
  * cf here: its JSON uncoloured, and an account's command given its account, which cf otherwise asks the person to pick
  * when they have several. `browser` lets its sign-in open one. npx runs it from a folder of the command's own, never the
- * checkout, whose node_modules and .npmrc would choose which cf runs as the person, outside the sandbox: every cf
- * command names its project or its account, so none needs the checkout. It fetches cf through a cache of the command's
- * own, never ~/.npm, where a sandboxed install could have planted a cf under the registry's live ETag; the registry is
- * asked afresh, and no install script of cf's runs, which it does without.
+ * checkout, whose node_modules and .npmrc would choose which cf runs as the person, outside the sandbox, and from where cf
+ * itself would read the checkout's .env into its token and account and evaluate its cloudflare.config.ts: every cf
+ * command names its project or its account, so none needs the checkout. Only the sign-in cf picks by folder does: with
+ * `checkout`, each command runs as the profile cf binds to it (`cf auth activate`), which cf names from its own folder
+ * too, so the account is the one the person's cf uses there; where reading the bindings failed, the command fails as well,
+ * never falling back to another sign-in. It fetches cf through a cache of the command's own, never ~/.npm, where a
+ * sandboxed install could have planted a cf under the registry's live ETag; the registry is asked afresh, and no install
+ * script of cf's runs, which it does without.
  */
 export function cfRunner(opts = {}, runner = commandRunner) {
-    return (args, { account, signal } = {}) => runner('npx', ownFolder(), { timeoutMs: 120_000, ...opts, signal, env: { NO_COLOR: '1', ...(account ? { CLOUDFLARE_ACCOUNT_ID: account } : {}) } })(['--yes', '--cache', ownNpmCache(), '--prefer-online', '--ignore-scripts', CF_PACKAGE, ...args]);
+    const { checkout, ...run } = opts;
+    const npx = (args, signal, env = {}) => runner('npx', ownFolder(), { timeoutMs: 120_000, ...run, signal, env: { NO_COLOR: '1', ...env } })(['--yes', '--cache', ownNpmCache(), '--prefer-online', '--ignore-scripts', CF_PACKAGE, ...args]);
+    let profile;
+    return async (args, { account, signal } = {}) => {
+        // Read once a runner; a failed read is read again by the next command.
+        if (checkout && !profile)
+            profile = npx(['auth', 'list'], signal).then((listed) => boundProfile(listed, checkout)).catch((err) => { profile = undefined; throw err; });
+        const bound = await profile;
+        return npx([...(bound ? ['--profile', bound] : []), ...args], signal, account ? { CLOUDFLARE_ACCOUNT_ID: account } : {});
+    };
+}
+/** The profile `cf auth list` binds to `checkout`, found as cf finds it from there: the longest bound folder that is the checkout's real path or holds it; none where no folder does. A list that is not cf's throws. */
+export function boundProfile(listed, checkout) {
+    const profiles = JSON.parse(listed);
+    if (!Array.isArray(profiles))
+        throw new Error('cf auth list printed no list of profiles');
+    let here = resolve(checkout);
+    try {
+        here = realpathSync(here);
+    }
+    catch { /* cf's own folder, as cf resolves it */ }
+    let found;
+    for (const p of profiles) {
+        const { name, boundDirectories } = record(p) ?? {};
+        if (typeof name !== 'string' || !/^[A-Za-z0-9_-]+$/.test(name) || !Array.isArray(boundDirectories))
+            continue;
+        for (const dir of boundDirectories) {
+            if (typeof dir !== 'string' || !(here === dir || (here.startsWith(dir) && here[dir.length] === sep)))
+                continue;
+            if (!found || dir.length > found.dir.length)
+                found = { name, dir };
+        }
+    }
+    return found?.name;
 }
 /** The status of the API call a cf command failed on, which its error box names on a line of its own ("│ 403 Forbidden", "│ 404 Not Found · HTTP /accounts/…"); null when it names none. */
 export function cfFailure(err) {
@@ -406,7 +444,7 @@ export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
     // `project`, one app's told by an earlier read, is the one read: never the project the first check run names, which may be another app's.
     const named = app ? undefined : deps.project ?? github.previews.map((p) => pagesProject(p.url)).find(Boolean) ?? (config?.kind === 'pages' ? config.name : undefined);
     // cf installs itself through npx on a machine without it, which takes a while the first time. The project's settings are read with the plain evidence, not while a build is waited for.
-    const cf = await fromCf(named, deps.cf ?? cfRunner(), { owner, repo, heads: github.heads.map((h) => h.sha), readme: readme.pages, ...(app ? { directory: deps.directory } : {}) }, plain, deps.signal);
+    const cf = await fromCf(named, deps.cf ?? cfRunner({ checkout: cwd }, deps.run), { owner, repo, heads: github.heads.map((h) => h.sha), readme: readme.pages, ...(app ? { directory: deps.directory } : {}) }, plain, deps.signal);
     const where = deps.directory ? `the folder ${deps.directory}` : "the repository's root";
     const unmatched = !app ? undefined
         : cf.cli !== 'signed-in' ? `Which Cloudflare Pages project builds ${where} cannot be told: cf here is not signed in with Pages access, and only a project's settings name the folder it builds (its root directory).`

package/dist/main.js

@@ -256,8 +256,8 @@ export async function main(argv) {
                     todo: [...apps.todo, ...report.left],
                     warnings: [...removed, ...(saved && !saved.ok ? [`The web page missed the last update (${saved.error}), so it may lag behind this.`] : [])],
                 }, hand);
-                // The web page has the report; when it missed it, the report stays here instead.
-                if (!saved?.ok)
+                // The web page has the report; when it missed it, or there is no test drive, whose why it holds, the report stays here as well.
+                if (!saved?.ok || !testPr)
                     say(`\n${plainReport(report.markdown)}`);
                 if (!saved?.ok)
                     reporter.step({ event: 'setup_command_stopped', outcome: 'update_lost' });

package/dist/tools.js

@@ -137,7 +137,7 @@ function stageError(status, tasks) {
 }
 /** The line under the last screen's heading ("You're all set up", or "Settings saved" without a test drive), about the pull request that screen ends on: the setup pull request when there is one, else the test drive; and, where a host builds the previews and so no setup pull request was needed, one line saying so. */
 export function resultLine(report) {
-    const lead = !report.testPr ? 'No test drive: the report says why.' : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
+    const lead = !report.testPr ? 'No test drive: the report says why, printed here when this screen closes.' : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
     return report.setupPr || !report.hostedBy ? lead : `${lead} ${nothingToMerge(report.hostedBy)}`;
 }
 /** Said once, here and in the report, when the host builds the previews and the repository needed no change. */
@@ -2797,7 +2797,7 @@ export function createTools(ctx) {
             const turnOn = async () => {
                 if (host === 'netlify')
                     return enableNetlifyPreviews((ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal }), fact.project);
-                const cf = cfRunner({}, ctx.hostRunner);
+                const cf = cfRunner({ checkout: pi.cwd }, ctx.hostRunner);
                 return enableCloudflarePreviews(cf, fact.project, await cfStatus(cf, signal), signal);
             };
             // The run's change, read back; where the host kept the setting, the person changes it on the host's page and the run reads again, twice at most.
@@ -2842,8 +2842,8 @@ export function createTools(ctx) {
             if ((await ask({ ...screen, prompt: create ? `Create the Pages project ${project} for ${ctx.owner}/${ctx.repo}?` : `Connect ${ctx.owner}/${ctx.repo} to the Pages project ${project}?` })).skipped)
                 return answer('skipped', { reason: `The person skipped ${create ? 'creating the Pages project' : 'connecting the repository to the Pages project'}.` });
             // cf signed in with pages:write, as it is or after Cloudflare's sign-in in the browser, keeping the scopes it held; a sign-in that did not complete offers a retry, twice.
-            const cf = cfRunner({}, ctx.hostRunner);
-            const login = cfRunner({ browser: true, timeoutMs: 300_000 }, ctx.hostRunner);
+            const cf = cfRunner({ checkout: pi.cwd }, ctx.hostRunner);
+            const login = cfRunner({ browser: true, timeoutMs: 300_000, checkout: pi.cwd }, ctx.hostRunner);
             const writes = (status) => status.cli === 'signed-in' && (!status.scopes || status.scopes.includes('pages:write'));
             let status = await cfStatus(cf, signal);
             if (!writes(status)) {
@@ -3121,8 +3121,8 @@ export function createTools(ctx) {
                 answer = await passCloudflareAccess({
                     url: at.url,
                     consent: async () => !(await ask(sentTo(HOST_SCREENS['cloudflare-access'], at.url))).skipped,
-                    cf: cfRunner({}, ctx.hostRunner),
-                    login: cfRunner({ browser: true, timeoutMs: 300_000 }, ctx.hostRunner),
+                    cf: cfRunner({ checkout: pi.cwd }, ctx.hostRunner),
+                    login: cfRunner({ browser: true, timeoutMs: 300_000, checkout: pi.cwd }, ctx.hostRunner),
                     retry: async () => !(await ask(HOST_SCREENS['cloudflare-signin-retry'])).skipped,
                     status: said,
                     apiToken: async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,