@impeccable/reviews 0.1.31 → 0.1.33

package/dist/hosting.js

@@ -33,7 +33,24 @@ export function hostingOf(state, repo) {
         return [{ key, liveUrl: address(a.liveUrl), previews }];
     });
     const unread = Array.isArray(hosting.unread) ? hosting.unread.flatMap((u) => text(u) ?? []) : [];
-    return { apps, readAt: text(hosting.readAt), unread };
+    return { apps, readAt: text(hosting.readAt), unread, ...(hosting.readPending === true ? { readPending: true } : {}) };
+}
+/**
+ * The record once it is whole: while the state says a read of it is pending, the state is read again every few seconds,
+ * up to a minute by the clock, each read bounded by what is left of it. Past that, its previews are left out and it
+ * counts as never read, so each host tool reads its previews itself, as it does without a record; the live addresses stay.
+ */
+export async function settledHosting(first, repo, readState, opts = {}) {
+    const { everyMs = 3_000, upToMs = 60_000, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), now = Date.now } = opts;
+    const deadline = now() + upToMs;
+    let hosting = hostingOf(first, repo);
+    while (hosting?.readPending && now() + everyMs < deadline) {
+        await sleep(everyMs);
+        const state = await readState(deadline - now());
+        if (state.ok)
+            hosting = hostingOf(state.data, repo) ?? hosting;
+    }
+    return hosting?.readPending ? { apps: hosting.apps.map((a) => ({ ...a, previews: [] })), readAt: null, unread: hosting.unread } : hosting;
 }
 /** The reports each host's previews are read from, besides the deployments every read takes. */
 const REPORTS = { netlify: ['statuses', 'comments'], cloudflare: ['check-runs', 'comments'], render: [] };

package/dist/main.js

@@ -7,7 +7,7 @@ import { runAgent } from './agent.js';
 import { runSkillCommand } from './skill.js';
 import { fenceExtension, guardedFileOperations, hostsAgreed, placeOf, previewRetryState } from './fence.js';
 import { accountsSaved, focusInstructions, focusState, severalApps, signInItem } from './focus.js';
-import { hostingOf } from './hosting.js';
+import { settledHosting } from './hosting.js';
 import { requestJson } from './http.js';
 import { copyText, letTabsHear, openBrowser, progressPage, screenPrompt, setupAuth, signIn } from './login.js';
 import { checkoutJournal } from './leftovers.js';
@@ -234,6 +234,8 @@ export async function main(argv) {
         ]);
         if (!instructions.ok || !state.ok)
             throw new UserError(`Impeccable's setup API did not answer: ${instructions.error ?? state.error}.`);
+        // A hosting record behind GitHub is read again while the questions below are asked (hosting.ts `settledHosting`).
+        const hosting = settledHosting(state.data, token.repository.name, (timeoutMs) => requestJson(`${setupApi}/state`, { token: token.access_token, timeoutMs }, log));
         // When the checkout cannot tell, the setup state's own verdict decides. When it has a web front end Impeccable skipped, the person adds it first.
         if (stateSaysNoFrontEnd(state.data, token.repository.name)) {
             if (frontEnd === 'unknown')
@@ -395,7 +397,7 @@ export async function main(argv) {
                 sandbox,
                 pushAccess: push.outcome,
                 severalApps: severalApps(state.data),
-                hosting: hostingOf(state.data, token.repository.name),
+                hosting: await hosting,
                 ...(flags.app ? { app: flags.app } : {}),
                 start: checkout.start,
                 ...(flags.signedInTestDrive ? { signedInTestDrive: { accountsSaved: accountsSaved(state.data, token.repository.name) } } : {}),

package/dist/tools.js

@@ -16,7 +16,7 @@ import { checkoutNames, liveShaped, netlifySiteOf, previewHostName, provePreview
 import { closedPulls, deploymentsOf, hostingApp, hostingRead, liveHostOf, renderSitesOf } from './hosting.js';
 import { enableRenderPreviews, parseRenderDeployment, readRenderService, RENDER_DASHBOARD, renderSitesNamed } from './render.js';
 import { cloudflareFromHosting, cfRunner, cfStatus, CLOUDFLARE_APP_PAGE, connectCloudflareProject, enableCloudflarePreviews, pagesProject, pagesProjectName, readCloudflarePreviews } from './cloudflare.js';
-import { passCloudflareAccess } from './cloudflare-access.js';
+import { passCloudflareAccess, TOKEN_NAME } from './cloudflare-access.js';
 import { netlifyFromHosting, commandRunner, connectNetlifySite, liveSite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
 import { netlifyToken, passNetlifyLock, setSitePassword } from './netlify-password.js';
 import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, projectMadeDeployment, readLinkedProject, readOwnProject, vercelDashboardScope, vercelPreviewsFact, vercelProjectFor, vercelProjectPage, vercelRepoProject, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
@@ -213,6 +213,8 @@ function plainReason(text) {
 }
 /** Names as a reader lists them: "a", "a and b", "a, b and c". */
 const andList = (names) => (names.length > 1 ? `${names.slice(0, -1).join(', ')} and ${names.at(-1)}` : names.join(''));
+/** The end screen's line for a Cloudflare service token the run created: what it made, on which Access application, and where it is revoked (REN-1187). */
+const accessNote = (application) => `Impeccable created the Cloudflare service token "${TOKEN_NAME}" and its policy on the Access application "${application}". Revoke it in Zero Trust → Access controls → Service credentials; reviews stop until a new one is saved.`;
 /** The end screen's one line for the Netlify sites whose password the run set and saved, set but did not save, or saved as it was: every site in one line (#419). */
 const PASSWORD_NOTES = {
     set: (sites) => sites.length === 1
@@ -2840,10 +2842,12 @@ export function createTools(ctx) {
             }
             if (testAccounts && response.ok)
                 retry.signedIn?.saved.add(appsRepo ? String(object(p.body)?.appKey) : '');
-            // The accounts the save signed in with, said on screen: the tasks show no status line (#417).
+            // The accounts the save signed in with, said on screen: the tasks show no status line (#417). The web page moves on with it, not at the model's next status (REN-1183).
             const signedIn = testAccounts && response.ok ? signedInLine(response.data, appsRepo ? appName(String(object(p.body)?.appKey)) : undefined) : undefined;
-            if (signedIn)
+            if (signedIn) {
                 reportDone(signedIn);
+                ctx.sync.update({ status: signedIn });
+            }
             // A check that answered, a preview not running yet included, ran for its app; one still turned away did not.
             if (check && (response.ok || response.status === 409))
                 checkedApps.add(typeof object(p.body)?.appKey === 'string' ? String(object(p.body)?.appKey) : '');
@@ -4202,6 +4206,9 @@ export function createTools(ctx) {
                 });
             }
             const { value, ...told } = answer;
+            // A token the run made stays in the person's Cloudflare account, saved or not: the end screen says so, and where it is revoked (REN-1187).
+            if (value && told.token === 'created' && told.application)
+                ctx.onKeyCreated?.(accessNote(told.application), `cloudflare-access:${told.application}`);
             if (value) {
                 // What is in hand follows the store, which holds one token: a new one is the one saved now, and the projects the last one opened no longer stand.
                 if (value !== accessToken)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.31",
+  "version": "0.1.33",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,