@impeccable/reviews 0.1.17 → 0.1.19

package/dist/ui/screens.js

@@ -478,7 +478,7 @@ export function showRun(opts) {
 }
 /** The outro in plain lines, for the scrollback: what stays once the screen has gone. */
 function summary(o) {
-    return ['', `${OUTCOME[o.outcome]} ${o.title}. ${o.result}`, ...o.links.map((l) => `${l.label}: ${l.url}`), ...o.todo.map((line) => `→ ${line}`), ...o.warnings.map((warning) => `! ${warning}`)];
+    return ['', `${OUTCOME[o.outcome]} ${o.title}. ${o.result}`, ...(o.used ?? []), ...o.links.map((l) => `${l.label}: ${l.url}`), ...o.todo.map((line) => `→ ${line}`), ...o.warnings.map((warning) => `! ${warning}`)];
 }
 /** Opens `url` in the browser and puts it on the clipboard, true once it is there. Neither can fail the screen, which shows the link either way. */
 async function handOver(url, hand) {
@@ -507,7 +507,7 @@ export async function showPullRequest(url, hand) {
 /** The last screen: what happened, what is left, any warnings and its pull request (handed over as it appears) or the links, until a key other than ↑↓ PgUp PgDn is pressed, or for 20 minutes. Its summary then stays in the scrollback. */
 export async function showOutro(outro, hand) {
     // What is left and why it stopped can be the model's words, which reach the scrollback after the clipboard holds the pull request.
-    const o = { ...outro, result: plainText(outro.result), todo: outro.todo.map(plainText), warnings: outro.warnings.map(plainText) };
+    const o = { ...outro, result: plainText(outro.result), todo: outro.todo.map(plainText), warnings: outro.warnings.map(plainText), ...(outro.used ? { used: outro.used.map(plainText) } : {}) };
     const screen = host();
     if (screen) {
         const copied = o.link && hand ? await handOver(o.link, hand) : false;

package/dist/vercel.js

@@ -2,7 +2,7 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { setTimeout as sleep } from 'node:timers/promises';
 import { folderOf, matchesBranch, TEST_DRIVE_BRANCH } from './host-previews.js';
-import { asLink, readLink } from './vercel-bypass.js';
+import { asLink, isBypassSecret, readLink, SECRET_NOTE } from './vercel-bypass.js';
 /** `vercel whoami`: the CLI prints the username, or says it has no credentials and exits 1. */
 export async function vercelStatus(vercel) {
     try {
@@ -147,7 +147,9 @@ export async function readLinkedProject(vercel, link) {
     // The live app: the production deployment's first alias, the project's own domain, as Vercel lists them (its automatic aliases follow). Its own hashed address is one build's, which the next production deployment leaves behind: never the before.
     const live = target && !failed(target) ? (Array.isArray(target.alias) ? target.alias : []).map(hostname).find(Boolean) : undefined;
     const root = folderOf(project.rootDirectory);
-    return { ...(root !== undefined ? { rootDirectory: root } : {}), ...(typeof project.name === 'string' && project.name ? { name: project.name } : {}), production: exists ? 'exists' : 'none', ...(typeof branch === 'string' && branch ? { productionBranch: branch } : {}), ...(live ? { productionUrl: `https://${live}` } : {}), protection: typeof protection === 'string' ? protection : null, previewsProtected, deploymentHosts: new Set(hosts), ...(repository ? { repository } : {}), ignoredBuildStep: typeof ignore === 'string' && ignore.trim().length > 0, githubDeployments: record(project.gitProviderOptions)?.createDeployments !== 'disabled' };
+    // As impeccable_vercel_bypass picks its secret: one for automation, labelled for Impeccable.
+    const labelled = Object.entries(record(project.protectionBypass) ?? {}).some(([value, meta]) => isBypassSecret(value) && record(meta)?.scope === 'automation-bypass' && record(meta)?.note === SECRET_NOTE);
+    return { ...(labelled ? { bypassLabelled: true } : {}), ...(root !== undefined ? { rootDirectory: root } : {}), ...(typeof project.name === 'string' && project.name ? { name: project.name } : {}), production: exists ? 'exists' : 'none', ...(typeof branch === 'string' && branch ? { productionBranch: branch } : {}), ...(live ? { productionUrl: `https://${live}` } : {}), protection: typeof protection === 'string' ? protection : null, previewsProtected, deploymentHosts: new Set(hosts), ...(repository ? { repository } : {}), ignoredBuildStep: typeof ignore === 'string' && ignore.trim().length > 0, githubDeployments: record(project.gitProviderOptions)?.createDeployments !== 'disabled' };
 }
 /**
  * The linked project as this repository's: read now, and connected to the repository on Vercel, which its Git link

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,

package/dist/playbook/cases/static-site.md

@@ -1,16 +0,0 @@
-### When this applies
-
-The pages need no server from this repository: plain HTML, or a build that writes a complete static site. Pages that need SSR, API routes or a backend here follow server-previews; an external API they call does not change that. A build that writes only JavaScript, CSS or types is a library, not a site.
-
-### Steps
-
-1. **Find the output**: the folder the build writes the pages to (framework config, scripts), or, with no build, the folder that holds the real `index.html`. Done when you can name that folder and the build command, or that there is none.
-2. **Prove it** with impeccable_verify_preview in static mode. Done when it answers `verified: true` with the folder's `index.html` in `files`; a failure names its `stage`, which the report explains, and pull-requests' "No preview, no test drive" says how the run goes on without a proof. When it answers that this machine has no sandbox for the check (Linux, or `--no-sandbox`), the check is skipped: save the build the scripts name in step 3, and the preview job on the pull request proves it; put that under "What is not verified".
-3. **Save it** with impeccable_write to `preview`: `intendedMethod: "static-upload"`, `outputDir` and the commands you proved, clearing a saved command you did not prove; when the check was skipped on this machine, the build the scripts name is what you save, and the preview job proves it. Done when the answer's `keys` show each key stored or unchanged.
-
-### Reference
-
-- **No build**: `steps` is empty and the output is the page's folder, `.` for the checkout's root. Invent no manifest, build, runtime or server for plain HTML.
-- **A base path**: `<base>/index.html` must exist under the output folder; pass `basePath` to the check, and save it.
-- **A single-page app**: the write takes no `spa` key, and the entry check proves no deep link; report a route the preview cannot serve.
-- A verified result proves the entry files exist, nothing more: rendering, assets, deep links and external APIs go under "What is not verified".