@lionrapid/cli 0.2.0 → 0.2.2

package/dist/api-client.js

@@ -10,11 +10,21 @@
  */
 /** Default number of retries for transient failures. */
 export const DEFAULT_RETRIES = 3;
+/** Default per-attempt request timeout. */
+export const DEFAULT_TIMEOUT_MS = 30_000;
 /** Base backoff in ms; grows exponentially per attempt, capped at {@link MAX_BACKOFF_MS}. */
 const BASE_BACKOFF_MS = 300;
 const MAX_BACKOFF_MS = 10_000;
 /** Cap on an honored `Retry-After` so a hostile/misconfigured header can't hang the CLI. */
 const MAX_RETRY_AFTER_MS = 30_000;
+/**
+ * Wait for a 429 that carries no `Retry-After` header. tm-server's rate-limit
+ * responses send none, and its limits are per-minute windows — the jittered
+ * sub-second backoff below can never outlive one, so without this floor every
+ * 429 exhausted its retries and was effectively fatal (e.g. a push past the
+ * 30/min sync limit died at namespace 31).
+ */
+const RATE_LIMIT_FALLBACK_MS = 30_000;
 /** Transient statuses worth retrying: rate-limit (429) and any 5xx. */
 function isRetryableStatus(status) {
     return status === 429 || status >= 500;
@@ -69,6 +79,18 @@ export class ApiError extends Error {
         return this.status >= 500;
     }
 }
+/**
+ * True when a fetch rejection (or anything in its `cause` chain) reports a
+ * redirect — with `redirect: 'error'` pinned, that means the server answered
+ * with a 3xx we refused to follow.
+ */
+function isRedirectFailure(err) {
+    for (let e = err; e instanceof Error; e = e.cause) {
+        if (/redirect/i.test(e.message))
+            return true;
+    }
+    return false;
+}
 /**
  * Thrown when the request never reached the server — DNS/connection/TLS failure
  * or an abort. Distinct from {@link ApiError} (which means the server answered
@@ -76,13 +98,59 @@ export class ApiError extends Error {
  */
 export class NetworkError extends Error {
     constructor(method, path, cause) {
-        super(`tm-server ${method} ${path} → network error: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+        const detail = cause instanceof Error ? cause.message : String(cause);
+        super(isRedirectFailure(cause)
+            ? `tm-server ${method} ${path} → unexpected redirect (refused, so the API key stays on the configured server): ${detail}`
+            : `tm-server ${method} ${path} → network error: ${detail}`, { cause });
         this.name = 'NetworkError';
     }
 }
 function compositeKey(locale, namespace, key) {
     return `${locale}:${namespace}:${key}`;
 }
+/**
+ * Coerce a namespace payload into flat `dotted.key` → {@link ContentUnit}.
+ *
+ * The endpoint takes flat keys on write but answers **nested** on read
+ * (`{"nav": {"cart": …}}` for a pushed `nav.cart`), because the SDK resolves
+ * nested paths. Every CLI adapter is built on flat dotted keys, so the tree
+ * has to be flattened back here or whole subtrees silently vanish. The leaf
+ * rule mirrors the server's: a string, or an object carrying `text`, is a
+ * value; any other object is a container to descend into. Bare strings are
+ * wrapped, a missing `styles` defaults to `{}`, and a genuinely unusable leaf
+ * is dropped with a warning rather than crashing the run.
+ */
+export function normalizeTranslations(raw) {
+    const out = {};
+    const walk = (node, prefix) => {
+        if (node === null || typeof node !== 'object') {
+            console.error(`warning: skipped key "${prefix}" — server returned no usable text`);
+            return;
+        }
+        for (const [key, value] of Object.entries(node)) {
+            const path = prefix ? `${prefix}.${key}` : key;
+            if (typeof value === 'string') {
+                out[path] = { text: value, styles: {} };
+                continue;
+            }
+            if (value !== null && typeof value === 'object') {
+                const unit = value;
+                if (typeof unit.text === 'string') {
+                    out[path] = { text: unit.text, styles: (unit.styles ?? {}) };
+                }
+                else {
+                    walk(value, path); // a container, not a value
+                }
+                continue;
+            }
+            console.error(`warning: skipped key "${path}" — server returned no usable text`);
+        }
+    };
+    if (raw === null || typeof raw !== 'object')
+        return {};
+    walk(raw, '');
+    return out;
+}
 export class LionRapidApiClient {
     baseUrl;
     apiKey;
@@ -90,6 +158,7 @@ export class LionRapidApiClient {
     fetchImpl;
     retries;
     sleep;
+    timeoutMs;
     constructor(opts) {
         this.baseUrl = opts.baseUrl.replace(/\/$/, '');
         this.apiKey = opts.apiKey;
@@ -98,6 +167,7 @@ export class LionRapidApiClient {
         this.retries = Math.max(0, opts.retries ?? DEFAULT_RETRIES);
         this.sleep =
             opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+        this.timeoutMs = Math.max(1, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
     }
     /** True when this client holds an editor token and can publish (mark-ready). */
     get canPublish() {
@@ -108,6 +178,21 @@ export class LionRapidApiClient {
         const res = (await this.request('GET', '/api/integrations/editor/workflow'));
         return { isPmAdmin: !!res?.is_pm_admin };
     }
+    /**
+     * The project's dashboard-configured locales (for `init` prefill).
+     * GET /api/integrations/project-config — flat `{ defaultLocale, languages }`;
+     * `languages` includes the default locale. Malformed bodies normalize to
+     * empty values rather than throwing.
+     */
+    async getProjectConfig() {
+        const res = (await this.request('GET', '/api/integrations/project-config'));
+        return {
+            defaultLocale: typeof res?.defaultLocale === 'string' ? res.defaultLocale : '',
+            languages: Array.isArray(res?.languages)
+                ? res.languages.filter((l) => typeof l === 'string')
+                : [],
+        };
+    }
     /**
      * Register source-row text for `sourceLocale`. Mirrors what the edge does on
      * first visit when it encounters a missing key. POST /api/integrations/sync/batch.
@@ -172,7 +257,7 @@ export class LionRapidApiClient {
         }
         const data = (await res.json());
         return {
-            translations: data.translations ?? {},
+            translations: normalizeTranslations(data.translations),
             version: data.meta?.version != null ? String(data.meta.version) : undefined,
             notModified: false,
             locked: false,
@@ -214,10 +299,22 @@ export class LionRapidApiClient {
             let res;
             let netErr;
             try {
-                res = await this.fetchImpl(`${this.baseUrl}${path}`, init);
+                // `redirect: 'error'` pins every request to the configured host: a 3xx
+                // fails loudly instead of relying on the runtime to strip the
+                // Authorization header on a cross-origin redirect. The timeout signal
+                // is per-attempt, so every retry gets a fresh budget.
+                res = await this.fetchImpl(`${this.baseUrl}${path}`, {
+                    ...init,
+                    redirect: 'error',
+                    signal: AbortSignal.timeout(this.timeoutMs),
+                });
             }
             catch (err) {
-                netErr = new NetworkError(method, path, err);
+                const isTimeout = err instanceof Error && err.name === 'TimeoutError';
+                netErr = new NetworkError(method, path, isTimeout ? new Error(`timed out after ${this.timeoutMs}ms`, { cause: err }) : err);
+                // A refused redirect is the server's answer, not a transient failure.
+                if (isRedirectFailure(err))
+                    throw netErr;
             }
             // A non-transient response is the answer — let the caller interpret it.
             if (res && !isRetryableStatus(res.status)) {
@@ -240,8 +337,11 @@ export class LionRapidApiClient {
                     return res;
                 throw netErr;
             }
-            const retryAfter = res?.status === 429 ? parseRetryAfter(res.headers.get('retry-after'), Date.now()) : null;
-            const delay = retryAfter ?? backoffMs(attempt, Math.random);
+            // A 429 is a rate-limit window, not a blip: honor `Retry-After` when the
+            // server sent one, else wait window-sized instead of jittering.
+            const delay = res?.status === 429
+                ? (parseRetryAfter(res.headers.get('retry-after'), Date.now()) ?? RATE_LIMIT_FALLBACK_MS)
+                : backoffMs(attempt, Math.random);
             await this.sleep(delay);
         }
     }

package/dist/cli.d.ts

@@ -4,8 +4,7 @@
  * PO) with the LionRapid backend.
  *
  * This file wires up the command surface. Each command's behaviour lives in
- * `src/commands/*`; commands not yet implemented print a clear "not implemented
- * yet" notice and exit non-zero so scripts never silently succeed.
+ * `src/commands/*`.
  */
 import { Command } from 'commander';
 /**

package/dist/cli.js

@@ -4,19 +4,20 @@
  * PO) with the LionRapid backend.
  *
  * This file wires up the command surface. Each command's behaviour lives in
- * `src/commands/*`; commands not yet implemented print a clear "not implemented
- * yet" notice and exit non-zero so scripts never silently succeed.
+ * `src/commands/*`.
  */
 import { Command } from 'commander';
 import { readFileSync, realpathSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { basename, dirname, join } from 'node:path';
+import { createInterface } from 'node:readline';
 import { fileURLToPath, pathToFileURL } from 'node:url';
-import { ConfigError, ApiKeyError } from './config.js';
-import { ApiError, NetworkError } from './api-client.js';
+import { ConfigError, ApiKeyError, resolveApiKey, listCredentialServers, findConfigPath, loadConfig, } from './config.js';
+import { ApiError, NetworkError, LionRapidApiClient } from './api-client.js';
 import { ExitCode, exitCodeForError } from './exit-codes.js';
 import { emitJson, errorEnvelope } from './output.js';
 import { loadContext, loadOfflineContext } from './commands/context.js';
-import { runInit } from './commands/init.js';
+import { runInit, fetchLocaleDefaults, detectLocalesOnDisk } from './commands/init.js';
+import { runLogin, runLogout, promptHidden, DEFAULT_SERVER } from './commands/login.js';
 import { runPush } from './commands/push.js';
 import { runPull } from './commands/pull.js';
 import { runValidate } from './commands/validate.js';
@@ -62,6 +63,21 @@ function fail(err, ctx = {}) {
     }
     process.exit(exitCodeForError(err));
 }
+/**
+ * One-line interactive prompt on stderr with a default. Non-TTY (CI, pipes)
+ * never blocks — it returns the default immediately.
+ */
+function askText(question, def) {
+    if (!process.stdin.isTTY)
+        return Promise.resolve(def);
+    return new Promise((resolve) => {
+        const rl = createInterface({ input: process.stdin, output: process.stderr });
+        rl.question(`${question} [${def}]: `, (answer) => {
+            rl.close();
+            resolve(answer.trim() || def);
+        });
+    });
+}
 /**
  * Build the commander program. Exported (rather than parsed inline) so tests
  * can construct and inspect the program without executing it.
@@ -71,7 +87,14 @@ export function buildProgram() {
     program
         .name('lionrapid')
         .description('Sync translation files (iOS, Android, Flutter, JSON, YAML, PO) with the LionRapid backend')
-        .version(readVersion(), '-v, --version', 'output the current version');
+        .version(readVersion(), '-v, --version', 'output the current version')
+        .option('--timeout <ms>', 'per-attempt request timeout in ms (default 30000)')
+        // Global flag → env, so loadContext picks it up uniformly in every command.
+        .hook('preAction', (thisCommand) => {
+        const timeout = thisCommand.opts().timeout;
+        if (timeout)
+            process.env['LIONRAPID_TIMEOUT'] = timeout;
+    });
     program
         .command('init')
         .description('Scaffold a lionrapid.yml config in the current project')
@@ -79,24 +102,190 @@ export function buildProgram() {
         .option('--server <url>', 'API server URL')
         .option('--source <locale>', 'source locale')
         .option('--targets <list>', 'comma-separated target locales')
+        .option('--key <key>', 'API key used to prefill locales from the project config')
         .option('--force', 'overwrite an existing lionrapid.yml')
-        .action((options) => {
+        .action(async (options) => {
         try {
+            // Reuse what's already known before asking: the repo's own config,
+            // then the server you logged into. Re-running `init` should not make
+            // you re-type things you've already told the CLI.
+            const existingServer = (() => {
+                const path = findConfigPath(process.cwd());
+                try {
+                    return path ? loadConfig(path).server : undefined;
+                }
+                catch {
+                    return undefined;
+                }
+            })();
+            const loggedIn = listCredentialServers();
+            const known = existingServer ?? (loggedIn.length === 1 ? loggedIn[0] : undefined);
+            // Only ask when there's genuinely nothing to go on. After a `login`,
+            // `lionrapid init` should be a single silent command.
+            const server = options.server ?? known ?? (await askText('Server URL', DEFAULT_SERVER));
+            // The project field is a local label (the API key selects the real
+            // project) — the directory name is a better default than a question.
+            const project = options.project ?? basename(process.cwd());
+            // Locale resolution ladder: explicit flags → the project's server
+            // config → locales already present in the repo → static placeholders.
+            // Every rung degrades quietly, so init still works fully offline.
+            let source = options.source;
+            let targets = options.targets?.split(',').map((s) => s.trim());
+            const notes = [];
+            if (!source || !targets) {
+                let key = options.key;
+                if (!key) {
+                    try {
+                        key = resolveApiKey({ server });
+                    }
+                    catch {
+                        // no stored key for this server — prefill stays optional
+                    }
+                }
+                if (!key && process.stdin.isTTY) {
+                    key =
+                        (await promptHidden('API key to prefill locales (Enter to skip): ')).trim() ||
+                            undefined;
+                }
+                let serverStatus = 'no-key';
+                let serverTargets;
+                if (key) {
+                    const client = new LionRapidApiClient({
+                        baseUrl: server,
+                        apiKey: key,
+                        retries: 0,
+                        timeoutMs: 5000,
+                    });
+                    const prefill = await fetchLocaleDefaults(client);
+                    serverStatus = prefill.status;
+                    if (prefill.status === 'ok') {
+                        source ??= prefill.sourceLocale;
+                        serverTargets = prefill.targetLocales;
+                        targets ??= prefill.targetLocales;
+                    }
+                    else if (prefill.status === 'no-targets') {
+                        source ??= prefill.sourceLocale; // the source locale IS real
+                    }
+                }
+                const onDisk = detectLocalesOnDisk(process.cwd(), source ?? 'en');
+                if (serverStatus === 'ok' && serverTargets) {
+                    notes.push(`locales from ${server}: ${source} → ${serverTargets.join(', ')}`);
+                    // The project decides what actually gets delivered — a locale
+                    // that exists only on disk is a real mismatch, worth saying out
+                    // loud rather than silently merging into the scaffold.
+                    const extra = onDisk.filter((l) => !serverTargets.includes(l));
+                    if (extra.length > 0) {
+                        notes.push(`note: ${extra.join(', ')} present in your files but not configured on the project —\n` +
+                            '    add them in the dashboard, or pull will never fill those files.');
+                    }
+                }
+                else if (onDisk.length > 0) {
+                    targets ??= onDisk;
+                    notes.push(serverStatus === 'no-targets'
+                        ? `⚠ the project has no target languages configured (source: ${source}) — used ${onDisk.join(', ')} from the files in your repo.\n` +
+                            '    Add them in the dashboard, then re-run `lionrapid init`.'
+                        : `locales from your files: ${source ?? 'en'} → ${onDisk.join(', ')}`);
+                }
+                else if (serverStatus === 'no-targets') {
+                    // Nothing invented: an empty targetLocales is honest, and the
+                    // config stays invalid until the real languages exist.
+                    notes.push(`⚠ the project has no target languages configured (source: ${source}), and none\n` +
+                        '    were found in your files — targetLocales is empty and the config is not\n' +
+                        '    usable yet. Add your languages in the dashboard, then re-run `lionrapid init`.');
+                }
+                else if (serverStatus === 'unavailable') {
+                    notes.push('⚠ could not reach the project config — targetLocales left empty.\n' +
+                        '    Fill it in by hand, or re-run `lionrapid init` once the server is reachable.');
+                }
+                else {
+                    notes.push('⚠ no API key, so no project config to read — targetLocales left empty.\n' +
+                        '    Run `lionrapid login`, then re-run `lionrapid init`.');
+                }
+            }
             const res = runInit(process.cwd(), {
-                project: options.project,
-                server: options.server,
-                sourceLocale: options.source,
-                targetLocales: options.targets?.split(',').map((s) => s.trim()),
+                project,
+                server,
+                sourceLocale: source,
+                targetLocales: targets,
                 force: options.force,
             });
-            console.log(`✓ wrote ${res.configPath}`);
+            if (res.created || options.force) {
+                console.log(`✓ wrote ${res.configPath}`);
+            }
+            else if (res.applied.length > 0) {
+                console.log(`✓ updated ${res.configPath}`);
+                for (const c of res.applied)
+                    console.log(`    + ${c.path}: ${c.to}`);
+            }
+            else {
+                console.log(`✓ ${res.configPath} is already up to date`);
+            }
             console.log(`  detected: ${res.detected.stacks.join(', ')}`);
-            console.log('  edit the project id + locales, then run `lionrapid push`.');
+            for (const note of notes)
+                console.log(`  ${note}`);
+            if (res.conflicts.length > 0) {
+                // Never silently overwrite a value the developer set. Show the
+                // difference and let them resolve it in the file.
+                console.log(`  ⚠ ${res.conflicts.length} value(s) differ from the project — left as-is:`);
+                for (const c of res.conflicts) {
+                    console.log(`    ${c.path}`);
+                    console.log(`      yours:   ${c.from}`);
+                    console.log(`      project: ${c.to}`);
+                }
+                console.log('    Edit lionrapid.yml to resolve, or re-run with --force to take the');
+                console.log('    project values wholesale.');
+            }
+            const ready = res.conflicts.length === 0 && (targets?.length ?? 0) > 0;
+            console.log(ready
+                ? '  next: `lionrapid doctor` to check the setup, then `lionrapid push`.'
+                : '  next: fix the above in lionrapid.yml, then run `lionrapid doctor`.');
         }
         catch (err) {
             fail(err);
         }
     });
+    program
+        .command('login')
+        .description('Verify an API key against the server and save it to ~/.lionrapid/credentials')
+        .option('--server <url>', 'save the key scoped to this server URL (default: save as "default")')
+        .option('--key <key>', 'the API key (omit for a hidden interactive prompt)')
+        .option('--json', 'emit the result as JSON on stdout (prose to stderr)')
+        .action(async (options) => {
+        try {
+            const res = await runLogin({
+                server: options.server,
+                key: options.key,
+                cwd: process.cwd(),
+            });
+            const out = options.json ? console.error : console.log;
+            out(`✓ key verified against ${res.server}`);
+            out(`  saved ${res.scope === 'server' ? `for ${res.server}` : 'as default'} → ${res.credentialsPath}`);
+            // Never echo the key — the envelope carries scope + server only.
+            if (options.json)
+                emitJson('login', true, { server: res.server, scope: res.scope });
+        }
+        catch (err) {
+            fail(err, { json: options.json, command: 'login' });
+        }
+    });
+    program
+        .command('logout')
+        .description('Remove a saved API key from ~/.lionrapid/credentials')
+        .option('--server <url>', 'remove the key scoped to this server URL (default: "default")')
+        .option('--json', 'emit the result as JSON on stdout (prose to stderr)')
+        .action((options) => {
+        try {
+            const res = runLogout({ server: options.server });
+            const out = options.json ? console.error : console.log;
+            const what = res.scope === 'server' ? `key for ${options.server}` : 'default key';
+            out(res.removed ? `✓ removed ${what}` : `· no ${what} was saved`);
+            if (options.json)
+                emitJson('logout', true, { scope: res.scope, removed: res.removed });
+        }
+        catch (err) {
+            fail(err, { json: options.json, command: 'logout' });
+        }
+    });
     program
         .command('push')
         .description('Upload source strings to the LionRapid backend')
@@ -118,14 +307,25 @@ export function buildProgram() {
             const tag = res.dryRun ? '[dry-run] would push' : '✓ pushed';
             out(`${tag} ${res.pushed} ${res.mode} string(s) across ${res.files.length} file(s)`);
             for (const f of res.files) {
+                if (f.error) {
+                    out(`  · ${f.file}: ✖ ${f.error}`);
+                    continue;
+                }
                 out(`  ${f.skipped ? '· skipped (missing)' : '·'} ${f.file}: ${f.count}`);
             }
+            const failed = res.files.filter((f) => f.error);
+            if (failed.length > 0) {
+                out(`⚠ ${failed.length} file(s) failed — the rest were pushed. Re-run push to retry\n` +
+                    '  the failures (already-pushed strings are simply upserted again).');
+            }
             if (res.publishSkipped) {
                 out('⚠ uploaded as drafts but not published — publishing needs an editor session token.\n' +
                     '  Set LIONRAPID_EDITOR_TOKEN, or publish in the dashboard.');
             }
             if (options.json)
-                emitJson('push', true, res);
+                emitJson('push', failed.length === 0, res);
+            if (failed.length > 0)
+                process.exit(ExitCode.PARTIAL);
         }
         catch (err) {
             fail(err, { json: options.json, command: 'push' });
@@ -137,6 +337,7 @@ export function buildProgram() {
         .option('-c, --config <path>', 'path to lionrapid.yml')
         .option('--types', 'regenerate TypeScript types after pulling')
         .option('--dry-run', 'fetch + count what would be written, but write no files')
+        .option('--force', 'overwrite target files wholesale instead of merging (drops local-only keys)')
         .option('--json', 'emit the result as JSON on stdout (prose to stderr)')
         .action(async (options) => {
         try {
@@ -144,6 +345,7 @@ export function buildProgram() {
             const res = await runPull(ctx.config, ctx.client, {
                 cwd: ctx.cwd,
                 dryRun: options.dryRun,
+                force: options.force,
                 onProgress: (done, total) => {
                     // Interactive feedback only — never pollute CI logs or --json stdout.
                     if (process.stderr.isTTY && total > 1) {
@@ -159,16 +361,29 @@ export function buildProgram() {
                 const pending = loc.pending > 0 ? ` (${loc.pending} pending)` : '';
                 out(`${mark} ${loc.locale}${pending}`);
                 for (const f of loc.files) {
-                    out(`  · ${f.target}: ${f.count}${res.dryRun ? ' (not written)' : ''}`);
+                    if (f.error) {
+                        out(`  · ${f.target}: ✖ ${f.error}`);
+                        continue;
+                    }
+                    const diff = f.added !== undefined
+                        ? ` (+${f.added} new, ~${f.updated} updated, ${f.keptLocal} local kept)`
+                        : '';
+                    out(`  · ${f.target}: ${f.count}${diff}${res.dryRun ? ' (not written)' : ''}`);
                 }
             }
+            const failed = res.locales.flatMap((l) => l.files).filter((f) => f.error);
+            if (failed.length > 0) {
+                out(`⚠ ${failed.length} file(s) failed — the successful files were still written`);
+            }
             let types;
             if ((options.types || ctx.config.generateTypes) && !options.dryRun) {
                 types = runTypesGenerate(ctx.config, { cwd: ctx.cwd });
                 out(`✓ types: ${types.keys} key(s) → ${types.output}`);
             }
             if (options.json)
-                emitJson('pull', true, { ...res, types });
+                emitJson('pull', failed.length === 0, { ...res, types });
+            if (failed.length > 0)
+                process.exit(ExitCode.PARTIAL);
         }
         catch (err) {
             fail(err, { json: options.json, command: 'pull' });
@@ -179,19 +394,23 @@ export function buildProgram() {
         .description('Check local files against the backend for missing/extra keys')
         .option('-c, --config <path>', 'path to lionrapid.yml')
         .option('--ci', 'exit non-zero if any issue is found')
+        .option('--allow-locked', 'treat locked (unapproved) namespaces as a warning, not a failure')
         .option('--json', 'emit the result as JSON on stdout (prose to stderr)')
         .action(async (options) => {
         try {
             const ctx = loadContext({ config: options.config });
-            const res = await runValidate(ctx.config, ctx.client, { cwd: ctx.cwd });
+            const res = await runValidate(ctx.config, ctx.client, {
+                cwd: ctx.cwd,
+                allowLocked: options.allowLocked,
+            });
             const out = options.json ? console.error : console.log;
-            if (res.ok) {
+            if (res.issues.length === 0) {
                 out(`✓ all ${res.sourceKeys} source key(s) translated across target locales`);
             }
             else {
-                out(`✖ ${res.issues.length} issue(s):`);
+                out(`${res.ok ? '⚠' : '✖'} ${res.issues.length} issue(s):`);
                 for (const i of res.issues) {
-                    out(`  [${i.type}] ${i.locale}/${i.namespace} ${i.key}`);
+                    out(`  [${i.type}] ${i.locale}/${i.namespace}${i.key ? ` ${i.key}` : ''}`);
                 }
             }
             if (options.json)

package/dist/commands/context.d.ts

@@ -22,8 +22,17 @@ export interface OfflineContext {
 export declare function loadOfflineContext(opts?: ContextOptions): OfflineContext;
 /** Load config + resolve the API key + build the client — for networked commands. */
 export declare function loadContext(opts?: ContextOptions): CliContext;
+/** Read LIONRAPID_TIMEOUT (a positive integer, ms) if set; otherwise the client default. */
+export declare function resolveTimeout(): number | undefined;
 /** Read LIONRAPID_RETRIES (a non-negative integer) if set; otherwise the client default. */
 export declare function resolveRetries(): number | undefined;
+/**
+ * Resolve `rel` against `cwd`, refusing paths that escape it. Every
+ * config-derived file *write* goes through this — defense-in-depth so a
+ * `../`-authored target/output in lionrapid.yml can't write outside the
+ * project directory. Returns the absolute path.
+ */
+export declare function assertInside(cwd: string, rel: string): string;
 export declare function chunk<T>(items: T[], size: number): T[][];
 /** Default parallel in-flight requests for fan-out work (pull). */
 export declare const DEFAULT_CONCURRENCY = 6;

package/dist/commands/context.js

@@ -3,7 +3,8 @@
  * build the API client. Kept separate from the commander wiring so command
  * logic can be driven with a fake client in tests.
  */
-import { findConfigPath, loadConfig, resolveApiKey, ConfigError, } from '../config.js';
+import { isAbsolute, relative, resolve } from 'node:path';
+import { expandGlobEntries, findConfigPath, loadConfig, resolveApiKey, ConfigError, } from '../config.js';
 import { LionRapidApiClient } from '../api-client.js';
 /** Load + validate config only (no API key) — for offline commands like `types`. */
 export function loadOfflineContext(opts = {}) {
@@ -12,7 +13,9 @@ export function loadOfflineContext(opts = {}) {
     if (!path) {
         throw new ConfigError('No lionrapid.yml found in this directory. Run `lionrapid init` to create one.');
     }
-    return { config: loadConfig(path), cwd };
+    const config = loadConfig(path);
+    // Glob entries expand here, once — commands only ever see concrete files.
+    return { config: { ...config, files: expandGlobEntries(config.files, cwd) }, cwd };
 }
 /** Load config + resolve the API key + build the client — for networked commands. */
 export function loadContext(opts = {}) {
@@ -25,9 +28,18 @@ export function loadContext(opts = {}) {
         apiKey,
         editorToken,
         retries: resolveRetries(),
+        timeoutMs: resolveTimeout(),
     });
     return { config, client, cwd };
 }
+/** Read LIONRAPID_TIMEOUT (a positive integer, ms) if set; otherwise the client default. */
+export function resolveTimeout() {
+    const raw = process.env['LIONRAPID_TIMEOUT']?.trim();
+    if (!raw)
+        return undefined;
+    const n = Number(raw);
+    return Number.isInteger(n) && n > 0 ? n : undefined;
+}
 /** Read LIONRAPID_RETRIES (a non-negative integer) if set; otherwise the client default. */
 export function resolveRetries() {
     const raw = process.env['LIONRAPID_RETRIES']?.trim();
@@ -36,6 +48,20 @@ export function resolveRetries() {
     const n = Number(raw);
     return Number.isInteger(n) && n >= 0 ? n : undefined;
 }
+/**
+ * Resolve `rel` against `cwd`, refusing paths that escape it. Every
+ * config-derived file *write* goes through this — defense-in-depth so a
+ * `../`-authored target/output in lionrapid.yml can't write outside the
+ * project directory. Returns the absolute path.
+ */
+export function assertInside(cwd, rel) {
+    const abs = resolve(cwd, rel);
+    const r = relative(cwd, abs);
+    if (r.startsWith('..') || isAbsolute(r)) {
+        throw new ConfigError(`Path escapes the project directory: ${rel}`);
+    }
+    return abs;
+}
 export function chunk(items, size) {
     const out = [];
     for (let i = 0; i < items.length; i += size)

package/dist/commands/doctor.d.ts

@@ -5,7 +5,8 @@
  * turned into a failed check.
  *
  * Checks: config found + valid → API key resolvable → server reachable + the
- * token works (ping) → declared source files present.
+ * token works (config:read probe — pk_-compatible) → declared source files
+ * present.
  */
 import { type FetchImpl } from '../api-client.js';
 export interface DoctorCheck {