@loopress/cli 0.19.0 → 0.20.0

package/dist/lib/rotate-app-password.js

@@ -0,0 +1,33 @@
+import { WpClient } from './wp-client.js';
+const APPLICATION_PASSWORDS_PATH = 'wp/v2/users/me/application-passwords';
+export const APP_PASSWORD_MAX_AGE_MS = 90 * 24 * 60 * 60 * 1000;
+export function isAppPasswordStale(addedAt) {
+    return Date.now() - new Date(addedAt).getTime() > APP_PASSWORD_MAX_AGE_MS;
+}
+// Create the new credential, confirm it actually authenticates on its own, only then revoke
+// the old one. Reversing this order risks locking the user out if the new one is somehow bad.
+export async function rotateAppPassword(env) {
+    const [user] = env.token.split(':');
+    const oldClient = new WpClient(env.url, env.token);
+    const old = await oldClient.get(`${APPLICATION_PASSWORDS_PATH}/introspect`);
+    const created = await oldClient.post(APPLICATION_PASSWORDS_PATH, { name: 'Loopress' });
+    if (!created.password) {
+        throw new Error(`WordPress did not return a password when creating the new application password on ${env.url}.`);
+    }
+    const newToken = `${user}:${created.password}`;
+    const newClient = new WpClient(env.url, newToken);
+    try {
+        await newClient.get(`${APPLICATION_PASSWORDS_PATH}/introspect`);
+    }
+    catch (error) {
+        // The new credential exists on WordPress but was never confirmed to work: clean it up with
+        // the still-valid old credentials instead of leaving an orphan behind. maybeAutoRotate
+        // retries on every subsequent run, so a persistent failure here would otherwise pile up
+        // one abandoned 'Loopress' entry per attempt. Best-effort: a failure here shouldn't hide
+        // the original, more informative error.
+        await oldClient.delete(`${APPLICATION_PASSWORDS_PATH}/${created.uuid}`).catch(() => { });
+        throw error;
+    }
+    await newClient.delete(`${APPLICATION_PASSWORDS_PATH}/${old.uuid}`);
+    return { ...env, addedAt: new Date().toISOString(), token: newToken };
+}

package/dist/lib/temp-admin.d.ts

@@ -0,0 +1,19 @@
+import { WpClient } from './wp-client.js';
+export interface TempAdmin {
+    id: number;
+    password: string;
+    username: string;
+}
+/**
+ * Creates a temporary WordPress administrator, the only way to obtain `install_plugins` when
+ * all the CLI has is an application password. `.invalid` is the RFC 2606 reserved TLD for
+ * addresses guaranteed not to be real, appropriate for an account that has no real mailbox.
+ */
+export declare function createTempAdmin(wp: WpClient): Promise<TempAdmin>;
+/**
+ * Deletes the temporary admin, reassigning any content it might own to the real user behind
+ * the app password. Failure here throws rather than warns, naming the leftover account: a
+ * cleanup that silently fails would leave a live administrator with a random password on the
+ * target site, discoverable only by someone reading logs closely.
+ */
+export declare function deleteTempAdmin(wp: WpClient, admin: TempAdmin): Promise<void>;

package/dist/lib/temp-admin.js

@@ -0,0 +1,46 @@
+import { randomBytes } from 'node:crypto';
+import { isNotFoundError } from './wp-client.js';
+// Only role that carries `install_plugins`/`activate_plugins`; there's nothing narrower to grant.
+const TEMP_ADMIN_ROLE = 'administrator';
+/**
+ * Creates a temporary WordPress administrator, the only way to obtain `install_plugins` when
+ * all the CLI has is an application password. `.invalid` is the RFC 2606 reserved TLD for
+ * addresses guaranteed not to be real, appropriate for an account that has no real mailbox.
+ */
+export async function createTempAdmin(wp) {
+    const username = `lps-temp-${Date.now().toString(36)}`;
+    const password = randomBytes(24).toString('base64url');
+    const user = await wp.post('wp/v2/users', {
+        email: `${username}@lps-temp.invalid`,
+        password,
+        roles: [TEMP_ADMIN_ROLE],
+        username,
+    });
+    return { id: user.id, password, username };
+}
+/**
+ * Deletes the temporary admin, reassigning any content it might own to the real user behind
+ * the app password. Failure here throws rather than warns, naming the leftover account: a
+ * cleanup that silently fails would leave a live administrator with a random password on the
+ * target site, discoverable only by someone reading logs closely.
+ */
+export async function deleteTempAdmin(wp, admin) {
+    const me = await wp.get('wp/v2/users/me');
+    try {
+        await wp.delete(`wp/v2/users/${admin.id}?reassign=${me.id}&force=true`);
+    }
+    catch (error) {
+        throw new Error(`Failed to remove the temporary admin account "${admin.username}" (id ${admin.id}) from the site. Remove it manually from wp-admin.`, { cause: error });
+    }
+    const stillExists = await wp
+        .get(`wp/v2/users/${admin.id}`)
+        .then(() => true)
+        .catch((error) => {
+        if (isNotFoundError(error))
+            return false;
+        throw error;
+    });
+    if (stillExists) {
+        throw new Error(`Temporary admin account "${admin.username}" (id ${admin.id}) still exists after deletion. Remove it manually from wp-admin.`);
+    }
+}

package/dist/lib/wp-client.d.ts

@@ -7,6 +7,7 @@ export declare class WpClient {
     private readonly siteUrl;
     private readonly client;
     constructor(siteUrl: string, token: string);
+    delete<T = unknown>(path: string, options?: RequestOptions): Promise<T>;
     get<T>(path: string, options?: RequestOptions): Promise<T>;
     post<T = unknown>(path: string, json?: Record<string, unknown>, options?: RequestOptions): Promise<T>;
     put<T = unknown>(path: string, json?: Record<string, unknown>, options?: RequestOptions): Promise<T>;

package/dist/lib/wp-client.js

@@ -15,6 +15,9 @@ export class WpClient {
             timeout: { request: REQUEST_TIMEOUT_MS },
         });
     }
+    async delete(path, options) {
+        return this.request('delete', path, undefined, options);
+    }
     async get(path, options) {
         return this.request('get', path, undefined, options);
     }

package/dist/types/project-config.generated.d.ts

@@ -23,6 +23,10 @@ export interface LoopressProjectConfiguration {
      * Directory where forms (WPForms today) are read from and written to, relative to rootDir.
      */
     formDir?: string;
+    /**
+     * Directory where WordPress pages are read from and written to, relative to rootDir.
+     */
+    pageDir?: string;
     /**
      * Directory where custom API route files are read from and written to, relative to rootDir.
      */

package/dist/utils/page-format.d.ts

@@ -0,0 +1,7 @@
+export declare const PAGE_ENDPOINT = "wp/v2/pages";
+export declare const PAGE_LIST_QUERY = "per_page=100";
+export declare function getPageId(data: Record<string, unknown>): null | number;
+export declare function getPageTitle(data: Record<string, unknown>): string;
+export declare function pageFileBase(id: number, title: string): string;
+export declare function pickPageMeta(data: Record<string, unknown>): Record<string, unknown>;
+export declare function getPageContent(data: Record<string, unknown>): string;

package/dist/utils/page-format.js

@@ -0,0 +1,78 @@
+import { toSlug } from './to-slug.js';
+// WordPress core's own REST endpoint (`wp/v2/pages`), unlike acf/form/seo/snippet there is no
+// Loopress-plugin controller behind this one, same principle as `wp/v2/plugins` in plugin push/pull.
+export const PAGE_ENDPOINT = 'wp/v2/pages';
+// ponytail: fixed cap, not a paged loop; fine for typical page counts, revisit with real
+// pagination (X-WP-TotalPages) if a site ever has more than 100 pages.
+export const PAGE_LIST_QUERY = 'per_page=100';
+export function getPageId(data) {
+    const id = Number(data.id);
+    return Number.isInteger(id) && id > 0 ? id : null;
+}
+// `title`/`content`/`excerpt` come back as `{raw, rendered}` from `?context=edit` (what `page
+// pull` requests) but round-trip fine as plain strings too for a hand-created file, same
+// looseness as getFormTitle in form-format.ts.
+export function getPageTitle(data) {
+    const { title } = data;
+    if (typeof title === 'string' && title.trim() !== '')
+        return title;
+    if (title && typeof title === 'object') {
+        const { raw, rendered } = title;
+        if (typeof raw === 'string' && raw.trim() !== '')
+            return raw;
+        if (typeof rendered === 'string' && rendered.trim() !== '')
+            return rendered;
+    }
+    return '(untitled)';
+}
+export function pageFileBase(id, title) {
+    return `${id}-${toSlug(title, 'untitled')}`;
+}
+// The fields WordPress core actually accepts on write to `wp/v2/pages` (confirmed via
+// `OPTIONS wp/v2/pages`), plus `id` for local identity. A GET response carries a lot more:
+// `guid`, `link`, `modified`/`modified_gmt`, `permalink_template`, `generated_slug`,
+// `class_list`, `type`, `_links`, all of it readonly/computed by WordPress, most of it
+// domain- or revision-specific. `_links` alone is the bulk of the file and, like
+// `modified`/`modified_gmt`, changes on every edit regardless of whether the page's actual
+// content changed, which would make every `page pull` produce a spurious git diff if kept.
+const PAGE_META_FIELDS = [
+    'id',
+    'date',
+    'date_gmt',
+    'slug',
+    'status',
+    'password',
+    'parent',
+    'title',
+    'author',
+    'excerpt',
+    'featured_media',
+    'comment_status',
+    'ping_status',
+    'menu_order',
+    'meta',
+    'template',
+];
+export function pickPageMeta(data) {
+    const meta = {};
+    for (const field of PAGE_META_FIELDS) {
+        if (field in data)
+            meta[field] = data[field];
+    }
+    return meta;
+}
+// `content` comes back as `{raw, rendered}` from `?context=edit` (what `page pull` requests);
+// a hand-created file only has the plain string. This is the one field split out into its own
+// `.html` file by pull/push: raw Gutenberg block markup escaped inside a JSON string is neither
+// readable nor safely hand-editable, same reasoning as the code/meta split in snippet-format.ts.
+export function getPageContent(data) {
+    const { content } = data;
+    if (typeof content === 'string')
+        return content;
+    if (content && typeof content === 'object') {
+        const { raw } = content;
+        if (typeof raw === 'string')
+            return raw;
+    }
+    return '';
+}

package/oclif.manifest.json

@@ -439,6 +439,36 @@
         "list.js"
       ]
     },
+    "api:publish": {
+      "aliases": [],
+      "args": {
+        "path": {
+          "description": "Path to api directory (overrides project config)",
+          "name": "path"
+        }
+      },
+      "description": "Publish custom API routes to your Loopress account so they can be deployed to other projects. Does not touch any WordPress site.",
+      "examples": [
+        "$ lps api publish",
+        "$ lps api publish --path ./api"
+      ],
+      "flags": {},
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "api:publish",
+      "pluginAlias": "@loopress/cli",
+      "pluginName": "@loopress/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "api",
+        "publish.js"
+      ]
+    },
     "api:pull": {
       "aliases": [],
       "args": {
@@ -888,6 +918,178 @@
         "push.js"
       ]
     },
+    "page:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List pages from WordPress",
+      "examples": [
+        "$ lps page list"
+      ],
+      "flags": {
+        "env": {
+          "description": "Target environment by name, overriding the globally active one (lps project switch)",
+          "name": "env",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "char": "j",
+          "description": "Output in JSON format",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "page:list",
+      "pluginAlias": "@loopress/cli",
+      "pluginName": "@loopress/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "dryRunFlag": {
+        "dry-run": {
+          "char": "d",
+          "description": "Show what would change without making changes",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "yesFlag": {
+        "yes": {
+          "char": "y",
+          "description": "Answer yes to confirmation prompts",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "page",
+        "list.js"
+      ]
+    },
+    "page:pull": {
+      "aliases": [],
+      "args": {
+        "path": {
+          "description": "Path to pages directory (overrides project config)",
+          "name": "path"
+        }
+      },
+      "description": "Pull pages from WordPress",
+      "examples": [
+        "$ lps page pull"
+      ],
+      "flags": {
+        "env": {
+          "description": "Target environment by name, overriding the globally active one (lps project switch)",
+          "name": "env",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "dry-run": {
+          "char": "d",
+          "description": "Show what would change without making changes",
+          "name": "dry-run",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "yes": {
+          "char": "y",
+          "description": "Answer yes to confirmation prompts",
+          "name": "yes",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "page:pull",
+      "pluginAlias": "@loopress/cli",
+      "pluginName": "@loopress/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "dryRunFlag": {
+        "dry-run": {
+          "char": "d",
+          "description": "Show what would change without making changes",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "yesFlag": {
+        "yes": {
+          "char": "y",
+          "description": "Answer yes to confirmation prompts",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "page",
+        "pull.js"
+      ]
+    },
+    "page:push": {
+      "aliases": [],
+      "args": {
+        "path": {
+          "description": "Path to pages directory (overrides project config)",
+          "name": "path"
+        }
+      },
+      "description": "Push pages to WordPress. Local files created or updated remotely are renamed on disk to the `<id>-<slug>` convention.",
+      "examples": [
+        "$ lps page push"
+      ],
+      "flags": {
+        "env": {
+          "description": "Target environment by name, overriding the globally active one (lps project switch)",
+          "name": "env",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "dry-run": {
+          "char": "d",
+          "description": "Show what would change without making changes",
+          "name": "dry-run",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "yes": {
+          "char": "y",
+          "description": "Answer yes to confirmation prompts",
+          "name": "yes",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "page:push",
+      "pluginAlias": "@loopress/cli",
+      "pluginName": "@loopress/cli",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "page",
+        "push.js"
+      ]
+    },
     "plugin:add": {
       "aliases": [],
       "args": {
@@ -1180,6 +1382,55 @@
         "remove.js"
       ]
     },
+    "project:rotate": {
+      "aliases": [],
+      "args": {},
+      "description": "Rotate the WordPress application password for the current (or --env) environment",
+      "examples": [
+        "$ lps project rotate",
+        "$ lps project rotate --env staging"
+      ],
+      "flags": {
+        "env": {
+          "description": "Target environment by name, overriding the globally active one (lps project switch)",
+          "name": "env",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "project:rotate",
+      "pluginAlias": "@loopress/cli",
+      "pluginName": "@loopress/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "dryRunFlag": {
+        "dry-run": {
+          "char": "d",
+          "description": "Show what would change without making changes",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "yesFlag": {
+        "yes": {
+          "char": "y",
+          "description": "Answer yes to confirmation prompts",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "project",
+        "rotate.js"
+      ]
+    },
     "project:switch": {
       "aliases": [],
       "args": {},
@@ -1645,5 +1896,5 @@
       ]
     }
   },
-  "version": "0.19.0"
+  "version": "0.20.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@loopress/cli",
   "description": "CLI tool for syncing WordPress code snippets, plugins, and Composer dependencies via the REST API",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "author": "jean-smaug",
   "bin": {
     "loopress": "bin/run.js",
@@ -13,13 +13,14 @@
   "dependencies": {
     "@inquirer/prompts": "^8.5.2",
     "@oclif/core": "^4.13.0",
-    "@oclif/plugin-help": "^6.2.53",
-    "@oclif/plugin-warn-if-update-available": "^3.1.68",
-    "@sentry/node": "^10.67.0",
+    "@oclif/plugin-help": "^6.2.55",
+    "@oclif/plugin-warn-if-update-available": "^3.1.70",
+    "@sentry/node": "^10.68.0",
     "glob": "13.0.6",
     "got": "^15.1.0",
     "listr2": "^11.0.0",
     "open": "^11.0.0",
+    "playwright-core": "^1.56.0",
     "slugify": "^1.6.9",
     "write-file-atomic": "^8.0.0"
   },
@@ -31,11 +32,11 @@
     "@types/node": "26.1.1",
     "@types/write-file-atomic": "^4.0.3",
     "@vitest/coverage-v8": "4.1.10",
-    "eslint": "^9",
-    "eslint-config-oclif": "^6.0.177",
+    "eslint": "^10.8.0",
+    "eslint-config-oclif": "^6.0.179",
     "eslint-config-prettier": "^10",
     "json-schema-to-typescript": "^15.0.4",
-    "oclif": "^4.23.28",
+    "oclif": "^4.23.29",
     "prettier": "3.9.6",
     "shx": "^0.4.0",
     "ts-node": "10.9.2",

package/schemas/project-config.schema.json

@@ -34,6 +34,11 @@
       "description": "Directory where forms (WPForms today) are read from and written to, relative to rootDir.",
       "default": "forms"
     },
+    "pageDir": {
+      "type": "string",
+      "description": "Directory where WordPress pages are read from and written to, relative to rootDir.",
+      "default": "pages"
+    },
     "apiDir": {
       "type": "string",
       "description": "Directory where custom API route files are read from and written to, relative to rootDir.",