@loopress/cli 0.17.0 → 0.19.0

package/dist/lib/push-command.d.ts

@@ -1,6 +1,13 @@
 import { LoopressCommand } from './base.js';
 export declare abstract class PushCommand extends LoopressCommand {
+    protected failedCount: number;
+    private refusedByGuard;
     catch(err: Error): Promise<void>;
+    protected guardProductionPush(): Promise<void>;
+    init(): Promise<void>;
     protected recordDeployment(status: 'failure' | 'success'): Promise<void>;
     protected recordSuccess(): Promise<void>;
+    protected reportTaskFailure(message: string, error: unknown, task?: {
+        output: string;
+    }): never;
 }

package/dist/lib/push-command.js

@@ -1,14 +1,39 @@
+import { confirm } from '@inquirer/prompts';
 import got from 'got';
 import { authManager } from '../config/auth.manager.js';
+import { API_URL } from './api-client.js';
 import { LoopressCommand } from './base.js';
-const API_URL = process.env.LPS_API_URL ?? 'https://api.loopress.dev';
+import { isInteractive } from './interactive.js';
 export class PushCommand extends LoopressCommand {
+    failedCount = 0;
+    // Refusals of the production guard never reach the site, so they must not pollute the
+    // deployment history with failure records.
+    refusedByGuard = false;
     async catch(err) {
-        if (!this.dryRun && this.siteConfig) {
+        if (!this.dryRun && !this.refusedByGuard && this.siteConfig) {
             await this.recordDeployment('failure');
         }
         return super.catch(err);
     }
+    // Pushing to an environment named "production" needs explicit intent: a TTY confirmation
+    // (Enter accepts), or --yes in scripts and CI. Dry runs are exempt, they change nothing.
+    async guardProductionPush() {
+        if (this.siteConfig.name.toLowerCase() !== 'production' || this.dryRun || this.yes)
+            return;
+        if (!isInteractive()) {
+            this.refusedByGuard = true;
+            this.error('Target environment is "production". Pass --yes to confirm the push in a non-interactive run.');
+        }
+        const proceed = await confirm({ default: true, message: `Push to production (${this.siteConfig.url})?` });
+        if (!proceed) {
+            this.refusedByGuard = true;
+            this.error('Aborted.');
+        }
+    }
+    async init() {
+        await super.init();
+        await this.guardProductionPush();
+    }
     async recordDeployment(status) {
         const token = process.env.LOOPRESS_TOKEN ?? authManager.getAuth()?.token ?? null;
         if (!token)
@@ -28,4 +53,17 @@ export class PushCommand extends LoopressCommand {
         if (!this.dryRun)
             await this.recordDeployment('success');
     }
+    // Reports one failed Listr task: status lines go through `task.output` when running inside a
+    // Listr renderer (this.warn would race with the repaint), and fall back to `this.warn` when
+    // called without a task (e.g. directly in tests). Rethrowing is what lets Listr mark the task
+    // failed (red cross) instead of completed; `exitOnError: false` on the list still lets sibling
+    // tasks run, and the accumulated `failedCount` drives the command's final "N failed" error.
+    reportTaskFailure(message, error, task) {
+        if (task)
+            task.output = message;
+        else
+            this.warn(`  ${message}`);
+        this.failedCount++;
+        throw error;
+    }
 }

package/dist/lib/wp-client.d.ts

@@ -7,10 +7,15 @@ export declare class WpClient {
     private readonly siteUrl;
     private readonly client;
     constructor(siteUrl: string, token: string);
-    get<T>(path: string): Promise<T>;
-    post<T = unknown>(path: string, json?: Record<string, unknown>): Promise<T>;
-    put<T = unknown>(path: string, json?: Record<string, unknown>): Promise<T>;
+    get<T>(path: string, options?: RequestOptions): Promise<T>;
+    post<T = unknown>(path: string, json?: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+    put<T = unknown>(path: string, json?: Record<string, unknown>, options?: RequestOptions): Promise<T>;
     private request;
 }
+interface RequestOptions {
+    timeoutMs?: number;
+}
 export declare function isNotFoundError(error: unknown): boolean;
-export declare function formatWpError(error: unknown, url: string): string;
+export declare function isTimeoutError(error: unknown): boolean;
+export declare function formatWpError(error: unknown, url: string, timeoutMs?: number): string;
+export {};

package/dist/lib/wp-client.js

@@ -15,22 +15,23 @@ export class WpClient {
             timeout: { request: REQUEST_TIMEOUT_MS },
         });
     }
-    async get(path) {
-        return this.request('get', path);
+    async get(path, options) {
+        return this.request('get', path, undefined, options);
     }
-    async post(path, json) {
-        return this.request('post', path, json);
+    async post(path, json, options) {
+        return this.request('post', path, json, options);
     }
-    async put(path, json) {
-        return this.request('put', path, json);
+    async put(path, json, options) {
+        return this.request('put', path, json, options);
     }
-    async request(method, path, json) {
+    async request(method, path, json, options) {
+        const timeoutMs = options?.timeoutMs ?? REQUEST_TIMEOUT_MS;
         try {
-            const response = await this.client(path, { json, method });
+            const response = await this.client(path, { json, method, timeout: { request: timeoutMs } });
             return (response.body ? JSON.parse(response.body) : undefined);
         }
         catch (error) {
-            throw new Error(formatWpError(error, `${this.siteUrl}/wp-json/${path}`), { cause: error });
+            throw new Error(formatWpError(error, `${this.siteUrl}/wp-json/${path}`, timeoutMs), { cause: error });
         }
     }
 }
@@ -38,7 +39,11 @@ export function isNotFoundError(error) {
     const cause = error?.cause;
     return cause?.response?.statusCode === 404;
 }
-export function formatWpError(error, url) {
+export function isTimeoutError(error) {
+    const cause = error?.cause;
+    return cause?.name === 'TimeoutError';
+}
+export function formatWpError(error, url, timeoutMs = REQUEST_TIMEOUT_MS) {
     const err = error;
     const status = err.response?.statusCode;
     if (status === 401 || status === 403) {
@@ -52,7 +57,7 @@ export function formatWpError(error, url) {
         return reason ? `Request failed (${status}) on ${url}: ${reason}` : `Request failed (${status}) on ${url}.`;
     }
     if (err.name === 'TimeoutError') {
-        return `Request timed out after ${REQUEST_TIMEOUT_MS / 1000}s on ${url}. Is the site reachable?`;
+        return `Request timed out after ${timeoutMs / 1000}s on ${url}. Is the site reachable?`;
     }
     return `Request to ${url} failed: ${err.message ?? String(error)}`;
 }
@@ -60,13 +65,22 @@ export function formatWpError(error, url) {
 // core response (e.g. an uncaught fatal formatted by WordPress itself) uses `{"message": "..."}`.
 // Surfacing this is what makes a deliberately clear server-side error (e.g. "Multiple snippet
 // plugins are active...") actually reach the user instead of a bare, unhelpful status code.
+//
+// Some controllers (ComposerController::sync(), notably) pair a short, generic `error` (e.g.
+// "Sync failed.") with the real detail in a separate `output` field (the raw Composer trace),
+// specifically so a caller that only reads `error` doesn't see it — which is exactly what this
+// function used to do, hiding the one piece of text that actually explains the failure.
 function extractServerErrorMessage(body) {
     if (!body)
         return undefined;
     try {
         const parsed = JSON.parse(body);
         const reason = parsed.error ?? parsed.message;
-        return typeof reason === 'string' && reason.trim() ? reason : undefined;
+        const summary = typeof reason === 'string' && reason.trim() ? reason : undefined;
+        const detail = typeof parsed.output === 'string' && parsed.output.trim() ? parsed.output.trim() : undefined;
+        if (summary && detail)
+            return `${summary}\n${detail}`;
+        return summary ?? detail;
     }
     catch {
         return undefined;

package/dist/types/project-config.generated.d.ts

@@ -19,6 +19,14 @@ export interface LoopressProjectConfiguration {
      * Directory where SEO settings, post meta, and redirects (RankMath and Yoast SEO, whichever is active) are read from and written to, relative to rootDir.
      */
     seoDir?: string;
+    /**
+     * Directory where forms (WPForms today) are read from and written to, relative to rootDir.
+     */
+    formDir?: string;
+    /**
+     * Directory where custom API route files are read from and written to, relative to rootDir.
+     */
+    apiDir?: string;
     /**
      * Project identifier from the global Loopress config. When set, takes precedence over the currently active project in the global config.
      */

package/dist/utils/composer.d.ts

@@ -1,4 +1,7 @@
 export interface ComposerJson {
+    config?: {
+        'allow-plugins'?: Record<string, boolean>;
+    };
     extra?: {
         'installer-paths'?: Record<string, string[]>;
     };

package/dist/utils/form-format.d.ts

@@ -0,0 +1,3 @@
+export declare const FORM_ENDPOINT = "loopress/v1/forms";
+export declare function getFormId(data: Record<string, unknown>): null | number;
+export declare function getFormTitle(data: Record<string, unknown>): string;

package/dist/utils/form-format.js

@@ -0,0 +1,17 @@
+export const FORM_ENDPOINT = 'loopress/v1/forms';
+// Deliberately loose, same reasoning as getAcfKey in acf-format.ts: a form plugin's own data
+// format (WPForms today: fields, settings, notifications, confirmations, providers, meta; other
+// WordPress form plugins may be supported later, same shape as snippet-format.ts's Code
+// Snippets/WPCode split) is large, deeply nested, and versioned by whichever plugin release
+// wrote it. We only need `id` for filenames/identity and `settings.form_title` for display
+// (the field WPForms itself uses; a future provider may differ), everything else round-trips
+// through pull/push untouched.
+export function getFormId(data) {
+    const id = Number(data.id);
+    return Number.isInteger(id) && id > 0 ? id : null;
+}
+export function getFormTitle(data) {
+    const settings = data.settings;
+    const title = settings?.form_title;
+    return typeof title === 'string' && title.trim() !== '' ? title : '(untitled)';
+}

package/dist/utils/seo-format.d.ts

@@ -18,3 +18,4 @@ export interface SeoRedirect {
     updatedAt: null | string;
     urlTo: string;
 }
+export declare function redirectFileBase(redirect: SeoRedirect): string;

package/dist/utils/seo-format.js

@@ -1,3 +1,4 @@
+import { toSlug } from './to-slug.js';
 // Post types synced by `lps seo pull` when --post-type isn't given.
 export const DEFAULT_POST_TYPES = ['post', 'page'];
 export const SEO_SETTINGS_ENDPOINT = 'loopress/v1/seo/settings';
@@ -8,3 +9,7 @@ export function seoRedirectEndpoint(id) {
 export function seoPostMetaEndpoint(postType) {
     return `loopress/v1/seo/post-meta/${postType}`;
 }
+// The `<id>-<slug>.json` on-disk convention shared by `seo pull` and `seo push`.
+export function redirectFileBase(redirect) {
+    return `${redirect.id}-${toSlug(redirect.urlTo, 'redirect')}`;
+}

package/dist/utils/snippet-format.d.ts

@@ -20,4 +20,6 @@ export declare function parseLocation(raw: unknown): null | SnippetLocation;
 export declare function parseInsertMethod(raw: unknown): null | SnippetInsertMethod;
 export declare function defaultLocationForType(type: SnippetType): SnippetLocation;
 export declare function stripPhpOpeningTag(code: string): string;
+export declare function buildSnippetFile(snippet: NormalizedSnippet): string;
+export declare function buildMetaFile(snippet: NormalizedSnippet): string;
 export declare function normalizeSnippet(data: Record<string, unknown>): NormalizedSnippet;

package/dist/utils/snippet-format.js

@@ -34,10 +34,36 @@ function resolvePriority(raw) {
 }
 // Snippet files on disk keep the <?php opening tag so they're valid, syntax-highlighted PHP files.
 // The WordPress plugin stores just the executable body, so it's stripped before push and restored
-// on pull (see buildSnippetFile in commands/snippet/pull.ts).
+// on pull (see buildSnippetFile below).
 export function stripPhpOpeningTag(code) {
     return code.replace(/^<\?php\s*/i, '');
 }
+export function buildSnippetFile(snippet) {
+    if (snippet.type === 'php' && !snippet.code.trimStart().startsWith('<?')) {
+        return `<?php\n\n${snippet.code}`;
+    }
+    return snippet.code;
+}
+export function buildMetaFile(snippet) {
+    const meta = {
+        id: snippet.id,
+        name: snippet.name,
+        type: snippet.type,
+        active: snippet.active,
+        location: snippet.location,
+    };
+    if (snippet.description)
+        meta.description = snippet.description;
+    if (snippet.tags.length > 0)
+        meta.tags = snippet.tags;
+    if (snippet.insertMethod === 'shortcode')
+        meta.insertMethod = snippet.insertMethod;
+    if (snippet.priority !== 10)
+        meta.priority = snippet.priority;
+    if (snippet.shortcodeAttributes.length > 0)
+        meta.shortcodeAttributes = snippet.shortcodeAttributes;
+    return JSON.stringify(meta, null, 2) + '\n';
+}
 // Defensive coercion for whatever JSON the `loopress/v1/snippets` endpoint returns, in case a
 // field is missing or malformed server-side.
 export function normalizeSnippet(data) {

package/dist/utils/to-slug.d.ts

@@ -0,0 +1 @@
+export declare function toSlug(value: string, fallback?: string): string;

package/dist/utils/to-slug.js

@@ -0,0 +1,7 @@
+import slugify from 'slugify';
+// The one slugification used everywhere a name becomes part of a filename or an api slug.
+// `fallback` covers values that slugify to nothing (empty, punctuation-only); callers that
+// can genuinely live with an empty slug just omit it.
+export function toSlug(value, fallback = '') {
+    return slugify(value, { lower: true, strict: true }) || fallback;
+}