@impeccable/reviews 0.1.8 → 0.1.10

package/dist/vercel-bypass.js

@@ -1,5 +1,7 @@
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { redactShapes } from './scan.js';
 /**
  * Getting past Vercel's Deployment Protection the way Vercel documents it for tools: Protection Bypass for Automation, a
  * secret of the project that a request sends in the x-vercel-protection-bypass header (every plan has it; a team member
@@ -67,24 +69,71 @@ function pick(secrets, before) {
     const newest = (list) => [...list].sort((a, b) => b.createdAt - a.createdAt)[0];
     return newest(secrets.filter((s) => s.note === SECRET_NOTE)) ?? (before && newest(secrets.filter((s) => !before.has(s.value))));
 }
-/** Makes the secret with the label through `vercel api`; a CLI without `api` (or one Vercel refuses) falls back to its own command, which the same role check stops. */
+/**
+ * What a failed CLI run printed, as one line for a reason the screen and the model read: Vercel's own error message
+ * where the output is its JSON, else the first line that says "Error"; nothing shaped like a secret, which a CLI can
+ * echo back from its arguments, since the reason goes to the model and the transcript.
+ */
+export function cliSaid(err) {
+    const printed = `${String(err.stdout ?? '')}\n${String(err.stderr ?? '')}`;
+    const json = printed.slice(printed.indexOf('{'), printed.lastIndexOf('}') + 1);
+    let said = '';
+    try {
+        const error = record(record(JSON.parse(json))?.error);
+        if (typeof error?.message === 'string' && error.message)
+            said = error.message.trim();
+    }
+    catch {
+        // Not JSON: the lines below.
+    }
+    if (!said) {
+        const line = printed.split('\n').map((l) => l.replace(/\x1b\[[0-9;]*m/g, '').trim()).find((l) => /error/i.test(l));
+        said = (line ?? '').replace(/^error[:!]?\s*/i, '');
+    }
+    return redactShapes(said).slice(0, 200);
+}
+/** Vercel's answer to a role that may not make the secret: 403, or its words for it. */
+const REFUSED = /forbidden|not authorized|not_authorized|permission|\b403\b/i;
+/**
+ * Makes the secret with the label through `vercel api`; a CLI without `api` (or one Vercel refuses) falls back to its own
+ * command, which the same role check stops. Once made, which kind the project now holds (labelled through `api`, or the
+ * CLI's own without a label); else why not, in Vercel's words where it gave any, the role named only where Vercel refused.
+ */
 async function make(run, link, name) {
+    const said = [];
     if (link) {
         try {
             await run(makeApi(link));
-            return true;
+            return { made: 'labelled' };
         }
-        catch {
+        catch (err) {
             // The CLI's own command below fails the same way when the role is missing, and works when `api` is the one missing.
+            said.push(cliSaid(err));
         }
     }
     try {
         await run(makeArgs(name));
-        return true;
+        return { made: 'unlabelled' };
     }
-    catch {
-        return false;
+    catch (err) {
+        said.push(cliSaid(err));
     }
+    const words = said.filter(Boolean).at(-1);
+    const detail = words ? ` (Vercel said: ${words})` : '';
+    return {
+        reason: REFUSED.test(said.join('\n'))
+            ? `Vercel refused to make a bypass secret on the project for the Vercel CLI here${detail}: that takes the Member role, or Project Administrator.`
+            : `The Vercel CLI here could not make a bypass secret on the project${detail}.`,
+    };
+}
+/** The proof again, while Vercel's login still stands in front of the address, until the edge takes a secret made moments ago or the wait runs out; any other answer stands at once. */
+async function admitted(secret, deps) {
+    const wait = deps.wait ?? { totalMs: 30_000, everyMs: 3_000 };
+    let proof = await deps.prove(secret);
+    for (const end = Date.now() + wait.totalMs; !proof.proven && proof.gate === 'vercel-protection' && Date.now() < end && !deps.signal?.aborted; proof = await deps.prove(secret)) {
+        await sleep(wait.everyMs, undefined, { signal: deps.signal });
+    }
+    return proof;
 }
 /**
  * Gets a bypass secret in place for the address Vercel's login stands in front of, and saves only one that opens it. The
@@ -96,46 +145,62 @@ export async function passVercelLogin(deps) {
     const link = await deps.link();
     const project = await readProject(deps.run, link, deps.project);
     const from = project?.name ? { project: project.name } : {};
+    const wait = deps.wait ?? { totalMs: 30_000, everyMs: 3_000 };
     const finish = async (secret, how) => {
         deps.remember(secret);
-        const proof = await deps.prove(secret);
+        // A secret made moments ago may take the edge a few seconds: its proof is tried again while the login stands.
+        const proof = how === 'created' ? await admitted(secret, { ...deps, wait }) : await deps.prove(secret);
         if (!proof.proven)
             return { reason: proof.reason ?? 'The address did not open with the secret.' };
         const failed = await deps.save(secret);
         return failed ? { status: 'save-failed', reason: failed, ...from } : { status: 'saved', secret: how, ...from, value: secret };
     };
-    /** Why the CLI's way ended without a secret that opens the preview, for the paste screen's skip. */
+    /** Why the CLI's way ended without a secret that opens the preview, for the paste screen and its skip. */
     let stopped;
+    /** What the project holds for the person to copy rather than make another: a secret labelled for Impeccable (its own, or one this run made), or one the CLI's own command made without a label. */
+    let held = 'none';
     if (!project)
         stopped = 'The Vercel CLI could not read the project: it is signed out, this folder is not linked to the project, or the role does not allow it.';
     else {
         const own = pick(project.secrets);
         if (own) {
+            held = 'labelled';
             const done = await finish(own.value, 'existing');
             if ('status' in done)
                 return done;
-            stopped = done.reason;
+            stopped = `The project's secret labelled "${SECRET_NOTE}" did not open the preview: ${done.reason}`;
         }
         else {
             if (!(await deps.consent()))
                 return { status: 'skipped', reason: 'The person skipped creating a bypass secret.', ...from };
             const before = new Set(project.secrets.map((s) => s.value));
-            if (!(await make(deps.run, link, deps.project)))
-                stopped = 'The Vercel CLI could not make a bypass secret on the project: that takes the Member role or Project Administrator.';
+            const made = await make(deps.run, link, deps.project);
+            if ('reason' in made)
+                stopped = made.reason;
             else {
-                const ours = pick((await readProject(deps.run, link, deps.project))?.secrets ?? [], before);
+                // The project holds the secret from here on, whatever the reads below say: the screen says to copy it, never to make another.
+                held = made.made;
+                // Read back by its label, again for a few seconds while the settings do not list it yet.
+                let ours;
+                for (const end = Date.now() + wait.totalMs;;) {
+                    ours = pick((await readProject(deps.run, link, deps.project))?.secrets ?? [], before);
+                    if (ours || Date.now() >= end || deps.signal?.aborted)
+                        break;
+                    await sleep(wait.everyMs, undefined, { signal: deps.signal });
+                }
                 if (!ours)
-                    stopped = 'The secret the Vercel CLI made could not be read back.';
+                    stopped = `The Vercel CLI made a bypass secret${held === 'labelled' ? ` labelled "${SECRET_NOTE}"` : ' (without a label)'}, but could not read it back from the project's settings within ${Math.round(wait.totalMs / 1000)} s.`;
                 else {
+                    held = ours.note === SECRET_NOTE ? 'labelled' : 'unlabelled';
                     const done = await finish(ours.value, 'created');
                     if ('status' in done)
                         return done;
-                    stopped = done.reason;
+                    stopped = `The Vercel CLI made a bypass secret${held === 'labelled' ? ` labelled "${SECRET_NOTE}"` : ' (without a label)'}, but the preview did not open with it within ${Math.round(wait.totalMs / 1000)} s: ${done.reason}`;
                 }
             }
         }
     }
-    const typed = await deps.paste();
+    const typed = await deps.paste({ reason: stopped, held });
     if (typed === undefined)
         return { status: 'skipped', reason: stopped, ...from };
     if (!isBypassSecret(typed))

package/dist/vercel.js

@@ -17,20 +17,31 @@ export async function vercelStatus(vercel) {
     }
 }
 /**
- * `vercel teams ls --json`: the teams the person is a member of, each by its slug (what `--team` takes) and name, and
- * which one is the CLI's current scope. The JSON is on stdout; the table the CLI prints otherwise goes to stderr.
+ * `vercel teams ls --json`: the teams the person is a member of, each by its slug (what `--team` takes), its name and
+ * its id, and which one is the CLI's current scope. The JSON is on stdout; the table the CLI prints otherwise goes to
+ * stderr.
  */
 export async function vercelTeams(vercel) {
     try {
         const listed = JSON.parse(await vercel(['teams', 'ls', '--json'])).teams;
         return (Array.isArray(listed) ? listed : []).flatMap((team) => typeof team.slug === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(team.slug)
-            ? [{ value: team.slug, label: typeof team.name === 'string' && team.name ? team.name.slice(0, 100) : team.slug, current: team.current === true }]
+            ? [{ value: team.slug, label: typeof team.name === 'string' && team.name ? team.name.slice(0, 100) : team.slug, current: team.current === true, ...(typeof team.id === 'string' && /^team_[A-Za-z0-9]+$/.test(team.id) ? { id: team.id } : {}) }]
             : []);
     }
     catch {
         return [];
     }
 }
+/**
+ * The scope a project's dashboard pages sit under, `https://vercel.com/<scope>/<project>/…`, for the project `link`
+ * names: its team's slug, as the CLI lists the person's teams, or for a project of the personal scope the username the
+ * CLI is signed in as. Undefined when the CLI cannot say, where the caller falls back to Vercel's picker.
+ */
+export async function vercelDashboardScope(vercel, link, teams) {
+    if (link.orgId.startsWith('team_'))
+        return (teams ?? (await vercelTeams(vercel))).find((team) => team.id === link.orgId)?.value;
+    return (await vercelStatus(vercel)).user;
+}
 /** Where Vercel's GitHub app is installed or given more repositories. */
 export const VERCEL_APP_PAGE = 'https://github.com/apps/vercel/installations/new';
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,

package/dist/playbook/github-previews.js

@@ -1,101 +0,0 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-const execFileAsync = promisify(execFile);
-const LIMIT = 20;
-const COVERAGE = 'Only the 20 newest GitHub deployments, their latest statuses, and the 20 most recently updated pull requests are checked. A missing match does not prove previews are absent. Empty GitHub deployment history does not prove that a live app or host previews do not exist. A deployment URL does not prove the application rendered.';
-const FAILURE = 'GitHub preview evidence could not be read completely.';
-const STATES = ['error', 'failure', 'inactive', 'in_progress', 'queued', 'pending', 'success'];
-function record(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : undefined;
-}
-function positiveInteger(value) {
-    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0;
-}
-function sha(value) {
-    return typeof value === 'string' && /^[a-f0-9]{40}$/.test(value);
-}
-function previewUrl(value) {
-    if (typeof value !== 'string' || value.length > 2048 || !/^https:\/\/[^\s\\?#]+$/i.test(value))
-        return null;
-    try {
-        const url = new URL(value);
-        if (url.username || url.password || url.search || url.hash || /^https:\/\/[^/]*@/i.test(value))
-            return null;
-        return url.href;
-    }
-    catch {
-        return null;
-    }
-}
-/** Read a bounded projection of GitHub evidence; never return response bodies or command errors. */
-export async function readHostedPreviews(owner, repo, dependencies = {}) {
-    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(owner)
-        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(repo) || repo === '.' || repo === '..') {
-        return { coverage: COVERAGE, deployments: [], error: FAILURE };
-    }
-    const runGh = dependencies.runGh ?? (async (args) => {
-        const { stdout } = await execFileAsync('gh', args, {
-            encoding: 'utf8', timeout: 30_000, maxBuffer: 2 * 1024 * 1024, signal: dependencies.signal,
-        });
-        return stdout;
-    });
-    const base = `/repos/${owner}/${repo}`;
-    async function get(route) {
-        if (dependencies.signal?.aborted)
-            throw new Error(FAILURE);
-        const stdout = await runGh(['api', '--hostname', 'github.com', '--method', 'GET', route]);
-        if (dependencies.signal?.aborted)
-            throw new Error(FAILURE);
-        const data = JSON.parse(stdout);
-        if (!Array.isArray(data))
-            throw new Error(FAILURE);
-        return data.slice(0, LIMIT);
-    }
-    try {
-        const [deployments, pulls] = await Promise.all([
-            get(`${base}/deployments?per_page=${LIMIT}`),
-            get(`${base}/pulls?state=all&sort=updated&direction=desc&per_page=${LIMIT}`),
-        ]);
-        let incomplete = false;
-        const evidence = [];
-        for (const entry of deployments) {
-            if (dependencies.signal?.aborted) {
-                incomplete = true;
-                break;
-            }
-            const deployment = record(entry);
-            if (!deployment || !positiveInteger(deployment.id) || !sha(deployment.sha))
-                continue;
-            let latest;
-            try {
-                latest = record((await get(`${base}/deployments/${deployment.id}/statuses?per_page=1`))[0]);
-            }
-            catch {
-                incomplete = true;
-                if (dependencies.signal?.aborted)
-                    break;
-            }
-            const status = STATES.find((state) => state === latest?.state) ?? null;
-            const environment = typeof deployment.environment === 'string' && deployment.environment.length <= 100
-                && !/[\u0000-\u001f\u007f]/.test(deployment.environment) ? deployment.environment : null;
-            const pullRequests = [];
-            for (const item of pulls) {
-                const pull = record(item);
-                if (pull && positiveInteger(pull.number) && (pull.state === 'open' || pull.state === 'closed')
-                    && record(pull.head)?.sha === deployment.sha) {
-                    pullRequests.push({ number: pull.number, state: pull.state });
-                }
-            }
-            evidence.push({ id: deployment.id, sha: deployment.sha, environment, status,
-                previewUrl: status ? previewUrl(latest?.environment_url) : null, pullRequests });
-        }
-        incomplete ||= dependencies.signal?.aborted ?? false;
-        return { coverage: COVERAGE, deployments: evidence,
-            ...(incomplete ? { error: FAILURE } : { emptyDeploymentHistory: deployments.length === 0 }) };
-    }
-    catch {
-        return { coverage: COVERAGE, deployments: [], error: FAILURE };
-    }
-}

package/dist/playbook/netlify-pattern.js

@@ -1,24 +0,0 @@
-/** Keep Netlify's repository-wide pattern tied to successful discovery evidence. */
-export function netlifyPatternError(body, observed) {
-    const pattern = body.previewUrlPattern;
-    if (typeof pattern !== 'string')
-        return null;
-    let netlify = /netlify\.app|<site>/i.test(pattern);
-    try {
-        const hostname = new URL(pattern.replaceAll('{pr}', '1')).hostname;
-        netlify ||= hostname === 'netlify.app' || hostname.endsWith('.netlify.app');
-    }
-    catch { /* The canonical validation below rejects malformed Netlify patterns. */ }
-    if (!netlify)
-        return null;
-    const match = /^https:\/\/deploy-preview-\{pr\}--([a-z0-9](?:[a-z0-9-]*[a-z0-9])?)\.netlify\.app$/.exec(pattern);
-    if (!match || match[1].length > 63)
-        return 'Use a real Netlify site pattern from successful preview evidence; placeholders and malformed patterns are not saved.';
-    if (Object.hasOwn(body, 'appKey'))
-        return 'A Netlify preview URL pattern belongs to the repository; omit appKey.';
-    if (body.intendedMethod !== 'preview-deploy')
-        return 'Save a Netlify pattern with intendedMethod preview-deploy.';
-    if (!observed.has(pattern))
-        return 'Read this repository\'s Netlify previews first and choose a pattern backed by a successful current-head status.';
-    return null;
-}

package/dist/playbook/netlify-previews.js

@@ -1,144 +0,0 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-const execFileAsync = promisify(execFile);
-const FAILURE = 'Netlify preview evidence could not be read completely.';
-const COVERAGE = 'Only the 20 most recently updated pull requests, the newest 100 statuses on each exact head SHA, and the 100 most recently updated repository issue comments are checked. Context-derived URLs do not prove the application rendered. Bot comments are historical candidates, not current-head deployment proof. Missing evidence does not prove previews are absent.';
-const SITE = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
-const CONTEXT = new RegExp(`^netlify/(${SITE})/deploy-preview$`);
-const PREVIEW_HOST = new RegExp(`^deploy-preview-([1-9][0-9]*)--(${SITE})\\.netlify\\.app$`);
-const STATES = ['success', 'pending', 'failure', 'error'];
-function record(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value)
-        ? value : undefined;
-}
-function cleanUrl(value) {
-    if (typeof value !== 'string' || value.length > 2048 || !/^https:\/\/[^\s\\?#@]+$/i.test(value))
-        return;
-    try {
-        const url = new URL(value);
-        if (!url.username && !url.password && !url.port && !url.search && !url.hash)
-            return url;
-    }
-    catch { /* Discard unsafe evidence without returning it. */ }
-}
-function urls(pull, site) {
-    if (`deploy-preview-${pull.number}--${site}`.length > 63)
-        return;
-    return {
-        previewUrl: `https://deploy-preview-${pull.number}--${site}.netlify.app/`,
-        previewUrlPattern: `https://deploy-preview-{pr}--${site}.netlify.app`,
-    };
-}
-function validTarget(value, pull, site) {
-    if (value === null || value === undefined || value === '')
-        return true;
-    const target = cleanUrl(value);
-    if (!target)
-        return false;
-    if (target.hostname === `deploy-preview-${pull.number}--${site}.netlify.app` && target.pathname === '/')
-        return true;
-    return target.hostname === 'app.netlify.com'
-        && new RegExp(`^/(?:sites|projects)/${site}/deploys(?:/[a-zA-Z0-9_-]+)?/?$`).test(target.pathname);
-}
-/** Read a bounded, repository-scoped projection; never expose comments, command errors or credentials. */
-export async function readNetlifyPreviews(owner, repo, dependencies = {}) {
-    const previews = [];
-    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(owner)
-        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(repo) || repo === '.' || repo === '..') {
-        return { coverage: COVERAGE, previews, error: FAILURE };
-    }
-    const runGh = dependencies.runGh ?? (async (args) => {
-        const { stdout } = await execFileAsync('gh', args, {
-            encoding: 'utf8', timeout: 30_000, maxBuffer: 2 * 1024 * 1024, signal: dependencies.signal,
-        });
-        return stdout;
-    });
-    const base = `/repos/${owner}/${repo}`;
-    async function get(route, limit) {
-        if (dependencies.signal?.aborted)
-            throw new Error();
-        const raw = await runGh(['api', '--hostname', 'github.com', '--method', 'GET', route]);
-        if (dependencies.signal?.aborted)
-            throw new Error();
-        const data = JSON.parse(raw);
-        if (!Array.isArray(data))
-            throw new Error();
-        return data.slice(0, limit);
-    }
-    const [pullRead, commentRead] = await Promise.allSettled([
-        get(`${base}/pulls?state=all&sort=updated&direction=desc&per_page=20`, 20),
-        get(`${base}/issues/comments?sort=updated&direction=desc&per_page=100`, 100),
-    ]);
-    if (pullRead.status === 'rejected')
-        return { coverage: COVERAGE, previews, error: FAILURE };
-    let incomplete = false;
-    const warnings = commentRead.status === 'rejected'
-        ? ['Historical Netlify bot comments could not be read. Current-head status evidence is still checked.'] : [];
-    const pulls = new Map();
-    for (const item of pullRead.value) {
-        const pull = record(item);
-        const headSha = record(pull?.head)?.sha;
-        if (!pull || typeof pull.number !== 'number' || !Number.isSafeInteger(pull.number) || pull.number <= 0
-            || (pull.state !== 'open' && pull.state !== 'closed') || typeof headSha !== 'string' || !/^[a-f0-9]{40}$/.test(headSha))
-            continue;
-        const issueUrl = `https://api.github.com${base}/issues/${pull.number}`;
-        if (!pulls.has(issueUrl))
-            pulls.set(issueUrl, { number: pull.number, state: pull.state, headSha });
-    }
-    const seen = new Set();
-    const statusesBySha = new Map();
-    for (const pull of pulls.values()) {
-        if (dependencies.signal?.aborted) {
-            incomplete = true;
-            break;
-        }
-        try {
-            if (!statusesBySha.has(pull.headSha)) {
-                statusesBySha.set(pull.headSha, get(`${base}/commits/${pull.headSha}/statuses?per_page=100`, 100));
-            }
-            for (const item of await statusesBySha.get(pull.headSha)) {
-                const status = record(item);
-                const site = typeof status?.context === 'string' ? CONTEXT.exec(status.context)?.[1] : undefined;
-                if (!site || seen.has(`${pull.number}:${site}`))
-                    continue;
-                // GitHub returns newest first: even an invalid latest entry must hide older success.
-                seen.add(`${pull.number}:${site}`);
-                const state = STATES.find((state) => state === status?.state);
-                const canonical = urls(pull, site);
-                if (!state || !canonical || !validTarget(status?.target_url, pull, site))
-                    continue;
-                previews.push({ pullRequest: pull.number, state: pull.state, headSha: pull.headSha, site,
-                    status: state, ...canonical, source: 'commit-status', matchesHead: true });
-            }
-        }
-        catch {
-            incomplete = true;
-        }
-    }
-    if (!dependencies.signal?.aborted && commentRead.status === 'fulfilled') {
-        for (const item of commentRead.value) {
-            const comment = record(item);
-            const author = record(comment?.user);
-            const pull = typeof comment?.issue_url === 'string' ? pulls.get(comment.issue_url) : undefined;
-            if (!pull || author?.login !== 'netlify[bot]' || author.type !== 'Bot'
-                || typeof comment?.body !== 'string' || comment.body.length > 65_536)
-                continue;
-            for (const match of comment.body.matchAll(/https:\/\/[^\s<>"'()[\]`]+/gi)) {
-                const url = cleanUrl(match[0].replace(/[.,;:]+$/, ''));
-                const parts = url ? PREVIEW_HOST.exec(url.hostname) : null;
-                if (!url || url.pathname !== '/' || !parts || parts[1] !== String(pull.number))
-                    continue;
-                const site = parts[2];
-                const canonical = urls(pull, site);
-                if (!canonical || seen.has(`${pull.number}:${site}`))
-                    continue;
-                seen.add(`${pull.number}:${site}`);
-                previews.push({ pullRequest: pull.number, state: pull.state, headSha: pull.headSha, site,
-                    status: null, ...canonical, source: 'bot-comment', matchesHead: false });
-            }
-        }
-    }
-    if (dependencies.signal?.aborted)
-        incomplete = true;
-    return { coverage: COVERAGE, previews, ...(warnings.length ? { warnings } : {}), ...(incomplete ? { error: FAILURE } : {}) };
-}

package/dist/playbook/probe-preview.js

@@ -1,67 +0,0 @@
-function redirectGate(location, source) {
-    if (!location)
-        return 'redirected';
-    try {
-        const target = new URL(location, source);
-        if (target.protocol !== 'https:')
-            return 'redirected';
-        if (target.origin === 'https://vercel.com' && target.pathname === '/sso-api'
-            && target.searchParams.has('url'))
-            return 'vercel-protection';
-        if ((target.hostname === 'vercel.com' || target.hostname.endsWith('.vercel.com'))
-            && /^\/login(?:\/|$)/.test(target.pathname))
-            return 'vercel-protection';
-        if (target.hostname.endsWith('.cloudflareaccess.com'))
-            return 'cloudflare-access';
-        if (target.origin === source.origin && /^\/(?:login|sign-in|signin)(?:\/|$)/.test(target.pathname)) {
-            return 'app-sign-in';
-        }
-    }
-    catch {
-        // A malformed redirect reveals nothing about preview protection.
-    }
-    return 'redirected';
-}
-/** An unauthenticated HTTP check only: reachable does not prove this is the intended app. */
-export async function probePreview(url, dependencies = {}) {
-    let target;
-    try {
-        target = new URL(url);
-        if (!isPlatformPreview(target)
-            || /[?#\\\s]/.test(url) || !/^https:\/\//i.test(url))
-            throw new Error();
-    }
-    catch {
-        return { status: null, gate: 'unavailable', error: 'invalid-preview-url' };
-    }
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 15_000);
-    const signal = dependencies.signal
-        ? AbortSignal.any([controller.signal, dependencies.signal])
-        : controller.signal;
-    try {
-        signal.throwIfAborted();
-        const response = dependencies.fetch ? await dependencies.fetch(target, {
-            method: 'GET',
-            headers: { accept: 'text/html' },
-            credentials: 'omit',
-            redirect: 'manual',
-            signal,
-        }) : await publicPreviewRequest(target, signal);
-        const status = response.status;
-        const gate = status === 401 && response.headers.get('x-vercel-error') === 'UNAUTHORIZED'
-            ? 'vercel-protection' : status >= 300 && status < 400
-            ? redirectGate(response.headers.get('location'), target)
-            : status >= 200 && status < 300 ? 'reachable' : 'unavailable';
-        // Bodies and redirect details may contain credentials; never read or return them.
-        await response.body?.cancel().catch(() => undefined);
-        return { status, gate };
-    }
-    catch {
-        return { status: null, gate: 'unavailable', error: 'request-failed' };
-    }
-    finally {
-        clearTimeout(timeout);
-    }
-}
-import { isPlatformPreview, publicPreviewRequest } from './public-preview-request.js';

package/dist/playbook/protection-secrets.js

@@ -1,15 +0,0 @@
-/** Register credential-shaped write fields before a message can be recorded.
- * Do not trust the requested path: even a refused or malformed destination must
- * keep its supplied credentials private. Values remain unchanged in memory.
- */
-export function protectionWriteSecrets(input) {
-    if (!input || typeof input !== 'object' || Array.isArray(input))
-        return [];
-    const body = input.body;
-    if (!body || typeof body !== 'object' || Array.isArray(body))
-        return [];
-    return ['value', 'clientId', 'clientSecret']
-        .map((key) => body[key])
-        .filter((value) => typeof value === 'string' && value.length > 0)
-        .sort((a, b) => b.length - a.length);
-}

package/dist/playbook/public-preview-request.js

@@ -1,96 +0,0 @@
-import { lookup } from 'node:dns/promises';
-import { request } from 'node:https';
-import { BlockList, isIP } from 'node:net';
-const blockedV4 = new BlockList();
-for (const [address, prefix] of [
-    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8],
-    ['169.254.0.0', 16], ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.0.2.0', 24],
-    ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15], ['198.51.100.0', 24],
-    ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4],
-])
-    blockedV4.addSubnet(address, prefix, 'ipv4');
-const publicV6 = new BlockList();
-publicV6.addSubnet('2000::', 3, 'ipv6');
-const blockedV6 = new BlockList();
-// Conservatively exclude special-purpose, transition and documentation prefixes.
-for (const [address, prefix] of [
-    ['2001::', 23], ['2001:db8::', 32], ['2002::', 16], ['3fff::', 20],
-])
-    blockedV6.addSubnet(address, prefix, 'ipv6');
-export function isPlatformPreview(target) {
-    return target.protocol === 'https:' && !target.username && !target.password && !target.port
-        && !/[?#]/.test(target.href)
-        && /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+(?:vercel|netlify)\.app$/.test(target.hostname);
-}
-function isPublicAddress(value) {
-    if (!value || typeof value.address !== 'string' || value.address.includes('%'))
-        return false;
-    const family = isIP(value.address);
-    if (family !== value.family)
-        return false;
-    if (family === 4)
-        return !blockedV4.check(value.address, 'ipv4');
-    return family === 6 && publicV6.check(value.address, 'ipv6') && !blockedV6.check(value.address, 'ipv6');
-}
-/** Resolve once, validate every answer, then connect only to the pinned public addresses. */
-export async function publicPreviewRequest(target, signal, dependencies = {}) {
-    try {
-        if (!isPlatformPreview(target))
-            throw new Error();
-        signal.throwIfAborted();
-        let abortDns = () => { };
-        const aborted = new Promise((_resolve, reject) => {
-            abortDns = () => reject(new Error());
-            signal.addEventListener('abort', abortDns, { once: true });
-        });
-        const addresses = await Promise.race([
-            (dependencies.lookup ?? lookup)(target.hostname, { all: true, verbatim: true }), aborted,
-        ]).finally(() => signal.removeEventListener('abort', abortDns));
-        signal.throwIfAborted();
-        if (!Array.isArray(addresses) || !addresses.length || !addresses.every(isPublicAddress))
-            throw new Error();
-        const pinned = addresses.map(({ address, family }) => ({ address, family }));
-        return await new Promise((resolve, reject) => {
-            const options = {
-                method: 'GET', headers: { accept: 'text/html' }, signal,
-                agent: false, autoSelectFamily: true, rejectUnauthorized: true,
-                lookup(hostname, options, callback) {
-                    if (hostname !== target.hostname)
-                        return callback(new Error('Preview request failed'), '');
-                    if (options.all)
-                        callback(null, pinned.map((address) => ({ ...address })));
-                    else
-                        callback(null, pinned[0].address, pinned[0].family);
-                },
-            };
-            const req = (dependencies.request ?? request)(target, options, (response) => {
-                response.once('error', () => { });
-                try {
-                    const status = response.statusCode;
-                    const headers = new Headers();
-                    for (const name of ['location', 'x-vercel-error']) {
-                        const value = response.headers[name];
-                        if (typeof value === 'string')
-                            headers.set(name, value);
-                    }
-                    if (!status)
-                        reject(new Error());
-                    else
-                        resolve({ status, headers, body: null });
-                }
-                catch {
-                    reject(new Error());
-                }
-                finally {
-                    response.destroy();
-                }
-            });
-            req.once('error', () => reject(new Error()));
-            req.once('upgrade', (_response, socket) => { socket.destroy(); reject(new Error()); });
-            req.end();
-        });
-    }
-    catch {
-        throw new Error('Preview request failed');
-    }
-}