@loopress/cli 0.19.0 → 0.20.1

package/dist/commands/page/list.js

@@ -0,0 +1,26 @@
+import { Flags } from '@oclif/core';
+import { LoopressCommand } from '../../lib/base.js';
+import { getPageId, getPageTitle, PAGE_ENDPOINT, PAGE_LIST_QUERY } from '../../utils/page-format.js';
+export default class List extends LoopressCommand {
+    static description = 'List pages from WordPress';
+    static examples = ['$ lps page list'];
+    static flags = {
+        json: Flags.boolean({ char: 'j', description: 'Output in JSON format' }),
+    };
+    async run() {
+        const { flags } = await this.parse(List);
+        const pages = await this.wp.get(`${PAGE_ENDPOINT}?${PAGE_LIST_QUERY}`);
+        if (flags.json) {
+            this.log(JSON.stringify(pages, null, 2));
+            return;
+        }
+        this.log(`Pages (${pages.length}):`);
+        if (pages.length === 0) {
+            this.log('  (none)');
+            return;
+        }
+        for (const page of pages) {
+            this.log(`  ${getPageId(page) ?? '(no id)'}. ${getPageTitle(page)}`);
+        }
+    }
+}

package/dist/commands/page/pull.d.ts

@@ -0,0 +1,13 @@
+import { LoopressCommand } from '../../lib/base.js';
+export default class Pull extends LoopressCommand {
+    static args: {
+        path: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/page/pull.js

@@ -0,0 +1,65 @@
+import { Args } from '@oclif/core';
+import { Listr } from 'listr2';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { LoopressCommand } from '../../lib/base.js';
+import { findOrphanedFiles, numericPrefixKey } from '../../lib/find-orphaned-files.js';
+import { getPageContent, getPageId, getPageTitle, PAGE_ENDPOINT, PAGE_LIST_QUERY, pageFileBase, pickPageMeta } from '../../utils/page-format.js';
+export default class Pull extends LoopressCommand {
+    static args = {
+        path: Args.string({ description: 'Path to pages directory (overrides project config)' }),
+    };
+    static description = 'Pull pages from WordPress';
+    static examples = ['$ lps page pull'];
+    static flags = {
+        ...LoopressCommand.dryRunFlag,
+        ...LoopressCommand.yesFlag,
+    };
+    async run() {
+        const { args } = await this.parse(Pull);
+        const { url } = this.siteConfig;
+        const path = this.resolvePagePath(args.path);
+        this.log(`Pulling pages from ${url}`);
+        this.log(`Pages path: ${path}`);
+        // context=edit returns title/content/excerpt as raw editable source instead of rendered
+        // HTML, needed for the file to be a faithful, re-pushable copy (requires edit_pages).
+        const remoteList = await this.wp.get(`${PAGE_ENDPOINT}?${PAGE_LIST_QUERY}&context=edit`);
+        const withId = remoteList.filter((page) => getPageId(page) !== null);
+        const skipped = remoteList.length - withId.length;
+        // Every page writes an `.html` (content) and `.json` (everything else) pair; both
+        // extensions are candidates for orphan cleanup, same principle as `snippet pull`.
+        const orphans = await findOrphanedFiles(path, new Set(withId.map((page) => String(getPageId(page)))), {
+            extensions: ['.json', '.html'],
+            key: numericPrefixKey,
+        });
+        if (this.dryRun) {
+            this.log(`[dry-run] Would pull ${withId.length} page${withId.length === 1 ? '' : 's'} to ${path}`);
+            if (orphans.length > 0) {
+                this.log(`[dry-run] Would remove ${orphans.length} local file${orphans.length === 1 ? '' : 's'} in ${path} no longer present on WordPress: ${orphans.join(', ')}`);
+            }
+            return;
+        }
+        if (withId.length > 0)
+            await mkdir(path, { recursive: true });
+        await new Listr(withId.map((page) => {
+            const id = getPageId(page);
+            const title = getPageTitle(page);
+            return {
+                async task(_ctx, task) {
+                    const base = pageFileBase(id, title);
+                    // `content` lives entirely in the `.html` file; the `.json` sidecar keeps only the
+                    // fields WordPress actually accepts back on write, see pickPageMeta.
+                    await writeFile(join(path, `${base}.html`), getPageContent(page));
+                    await writeFile(join(path, `${base}.json`), JSON.stringify(pickPageMeta(page), null, 2) + '\n');
+                    task.output = `Pulled: ${title}`;
+                },
+                title: `Pull ${title}`,
+            };
+        })).run();
+        await this.removeOrphanedFiles(path, orphans, `in ${path} no longer present on WordPress`);
+        this.log(`Pulled ${withId.length} page${withId.length === 1 ? '' : 's'} to ${path}`);
+        if (skipped > 0) {
+            this.warn(`${skipped} page${skipped === 1 ? '' : 's'} skipped because they have no id`);
+        }
+    }
+}

package/dist/commands/page/push.d.ts

@@ -0,0 +1,16 @@
+import { PushCommand } from '../../lib/push-command.js';
+export default class Push extends PushCommand {
+    static args: {
+        path: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    private ensureCanonicalFilename;
+    private loadFiles;
+    private pushPage;
+}

package/dist/commands/page/push.js

@@ -0,0 +1,150 @@
+import { Args } from '@oclif/core';
+import { Listr } from 'listr2';
+import { readdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { basename, dirname, extname, join } from 'node:path';
+import { PushCommand } from '../../lib/push-command.js';
+import { isNotFoundError } from '../../lib/wp-client.js';
+import { getPageId, getPageTitle, PAGE_ENDPOINT, pageFileBase } from '../../utils/page-format.js';
+export default class Push extends PushCommand {
+    static args = {
+        path: Args.string({ description: 'Path to pages directory (overrides project config)' }),
+    };
+    static description = 'Push pages to WordPress. Local files created or updated remotely are renamed on disk to the `<id>-<slug>` convention.';
+    static examples = ['$ lps page push'];
+    static flags = {
+        ...PushCommand.dryRunFlag,
+        ...PushCommand.yesFlag,
+    };
+    async run() {
+        const { args } = await this.parse(Push);
+        const { url } = this.siteConfig;
+        const path = this.resolvePagePath(args.path);
+        this.log(`Pushing pages to ${url}`);
+        this.log(`Pages path: ${path}`);
+        const pages = await this.loadFiles(path);
+        this.log(`Found ${pages.length} page${pages.length === 1 ? '' : 's'} to push`);
+        await new Listr(pages.map((page) => ({
+            task: async (_ctx, task) => this.pushPage(page, task),
+            title: `Push ${getPageTitle(page.meta)}`,
+        })), { concurrent: false, exitOnError: false }).run();
+        if (this.failedCount > 0) {
+            this.error(`${this.failedCount} page${this.failedCount === 1 ? '' : 's'} failed to push.`);
+        }
+        if (this.dryRun)
+            return;
+        await this.recordSuccess();
+        this.log('All pages pushed.');
+    }
+    // Renames the local file pair to the `<id>-<slug>` convention used by `page pull` whenever it
+    // doesn't already match, same principle as ensureCanonicalFilename in commands/snippet/push.ts:
+    // the id is persisted into the sidecar before any rename, so a crash mid-rename still leaves a
+    // valid, matchable pair on disk instead of an orphaned one that would be recreated as a duplicate.
+    async ensureCanonicalFilename(page, id, title) {
+        const dir = dirname(page.contentPath);
+        const canonicalBase = pageFileBase(id, title);
+        const currentBase = basename(page.contentPath, '.html');
+        const meta = { ...page.meta, id };
+        await writeFile(page.metaPath, JSON.stringify(meta, null, 2) + '\n');
+        if (currentBase === canonicalBase)
+            return;
+        await rename(page.contentPath, join(dir, `${canonicalBase}.html`));
+        await rename(page.metaPath, join(dir, `${canonicalBase}.json`));
+    }
+    // A page is its `.html` content file plus an optional `.json` sidecar for everything else
+    // (a fresh hand-created page may have no sidecar yet). One page is read in isolation: a
+    // corrupted or hand-broken sidecar must only skip that page, not abort loading the rest of
+    // the directory, same principle as commands/form/push.ts.
+    async loadFiles(dir) {
+        let files;
+        try {
+            files = await readdir(dir);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return [];
+            throw error;
+        }
+        const pages = [];
+        for (const file of files) {
+            if (extname(file) !== '.html')
+                continue;
+            const contentPath = join(dir, file);
+            const metaPath = join(dir, `${basename(file, '.html')}.json`);
+            let meta = {};
+            try {
+                const parsed = JSON.parse(await readFile(metaPath, 'utf8'));
+                if (typeof parsed !== 'object' || parsed === null) {
+                    this.warn(`Skipping "${metaPath}": not a JSON object`);
+                    continue;
+                }
+                meta = parsed;
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT') {
+                    this.warn(`Skipping "${metaPath}": ${error.message}`);
+                    continue;
+                }
+            }
+            let content;
+            try {
+                content = await readFile(contentPath, 'utf8');
+            }
+            catch (error) {
+                this.warn(`Skipping "${contentPath}": ${error.message}`);
+                continue;
+            }
+            pages.push({ content, contentPath, meta, metaPath });
+        }
+        return pages;
+    }
+    // PUT-then-404-fallback-POST, same dance as commands/form/push.ts: pages are id-based.
+    //
+    // ponytail: `parent` round-trips as the source site's numeric page id untouched, so pushing
+    // to a site where that id belongs to a different page (or nothing) silently mis-parents or
+    // orphans the page. No id-remapping across sites here; fine for same-hierarchy environments,
+    // revisit if pushing across sites with divergent page trees becomes a real workflow.
+    async pushPage(page, task) {
+        const title = getPageTitle(page.meta);
+        if (this.dryRun) {
+            if (task)
+                task.output = `[dry-run] Would push: ${title}`;
+            return;
+        }
+        try {
+            const id = getPageId(page.meta);
+            const payload = { ...page.meta, content: page.content };
+            if (id === null) {
+                const created = await this.wp.post(PAGE_ENDPOINT, payload);
+                const newId = getPageId(created);
+                if (newId !== null)
+                    await this.ensureCanonicalFilename(page, newId, title);
+            }
+            else {
+                try {
+                    await this.wp.put(`${PAGE_ENDPOINT}/${id}`, payload);
+                    await this.ensureCanonicalFilename(page, id, title);
+                }
+                catch (error) {
+                    // The id recorded locally doesn't exist on this site (e.g. a fresh install): create
+                    // it instead of failing, and adopt whatever id the site assigns. WordPress core
+                    // rejects any POST that still carries a (now stale) `id` field with a 400 "Cannot
+                    // create existing post", regardless of whether that id actually exists, so it must
+                    // be stripped before falling back to create.
+                    if (!isNotFoundError(error))
+                        throw error;
+                    const createPayload = { ...payload };
+                    delete createPayload.id;
+                    const created = await this.wp.post(PAGE_ENDPOINT, createPayload);
+                    const newId = getPageId(created);
+                    if (newId !== null)
+                        await this.ensureCanonicalFilename(page, newId, title);
+                }
+            }
+            if (task)
+                task.output = `Pushed: ${title}`;
+        }
+        catch (error) {
+            this.reportTaskFailure(`Failed to push ${title}: ${error.message}`, error, task);
+        }
+    }
+}

package/dist/commands/project/config.d.ts

@@ -3,6 +3,7 @@ export default class Config extends Command {
     static description: string;
     static examples: string[];
     run(): Promise<void>;
+    private maybeBootstrapLoopressFull;
     private promptManualCredentials;
     private resolveCredentials;
     private resolveProject;

package/dist/commands/project/config.js

@@ -1,8 +1,11 @@
 import { confirm, input, password as passwordPrompt, select } from '@inquirer/prompts';
 import { Command } from '@oclif/core';
 import { configManager } from '../../config/project-config.manager.js';
+import { bootstrapLoopressFull } from '../../lib/bootstrap-full-install.js';
 import { isInteractive } from '../../lib/interactive.js';
+import { isLoopressFullActive } from '../../lib/plugin-detection.js';
 import { authorizeWithBrowser } from '../../lib/wp-authorize-flow.js';
+import { WpClient } from '../../lib/wp-client.js';
 import { diagnoseWpSite } from '../../lib/wp-site-diagnostic.js';
 const NEW_PROJECT = '__new__';
 const AUTH_BROWSER = 'browser';
@@ -78,8 +81,33 @@ export default class Config extends Command {
             configManager.setProject(projectId, project);
         }
         this.log(`✓ "${projectName}/${envName}" configured`);
+        await this.maybeBootstrapLoopressFull(env);
         this.log('→ Run `lps project switch` to change the active project or environment');
     }
+    async maybeBootstrapLoopressFull(env) {
+        const { token, url } = env;
+        if (!token)
+            return; // env was just built with one a few lines up; guard only narrows the type
+        const wp = new WpClient(url, token);
+        // A detection failure (network hiccup, plugins REST disabled) is treated as "assume it's
+        // there" rather than surprising the user with an account-creating prompt they didn't ask
+        // for; `lps project config` can simply be re-run if it genuinely isn't installed.
+        const alreadyActive = await isLoopressFullActive(wp).catch(() => true);
+        if (alreadyActive)
+            return;
+        const proceed = await confirm({
+            default: true,
+            message: 'Loopress Full was not detected on this site. Install it now? (creates a temporary admin account, removed automatically afterward)',
+        });
+        if (!proceed)
+            return;
+        try {
+            await bootstrapLoopressFull(wp, url, (message) => this.log(message));
+        }
+        catch (error) {
+            this.warn(error.message);
+        }
+    }
     async promptManualCredentials() {
         const user = await input({
             message: 'Username',

package/dist/commands/project/rotate.d.ts

@@ -0,0 +1,7 @@
+import { LoopressCommand } from '../../lib/base.js';
+export default class Rotate extends LoopressCommand {
+    static description: string;
+    static examples: string[];
+    protected maybeAutoRotate(): Promise<void>;
+    run(): Promise<void>;
+}

package/dist/commands/project/rotate.js

@@ -0,0 +1,20 @@
+import { configManager } from '../../config/project-config.manager.js';
+import { LoopressCommand } from '../../lib/base.js';
+import { rotateAppPassword } from '../../lib/rotate-app-password.js';
+export default class Rotate extends LoopressCommand {
+    static description = 'Rotate the WordPress application password for the current (or --env) environment';
+    static examples = ['$ lps project rotate', '$ lps project rotate --env staging'];
+    // The rotation above always runs, regardless of age; the background age-check in
+    // LoopressCommand would just redo the same work a second time right after.
+    async maybeAutoRotate() { }
+    async run() {
+        const { name, token, url } = this.siteConfig;
+        if (!token) {
+            this.error(`No credentials configured for ${url}. Run \`lps project config\` first.`);
+        }
+        this.log(`Rotating application password for ${url}...`);
+        const rotated = await rotateAppPassword({ ...this.siteConfig, token });
+        configManager.setEnvironment(this.projectId, name, rotated);
+        this.log('✓ New application password created and verified, previous one revoked.');
+    }
+}

package/dist/lib/base.d.ts

@@ -14,16 +14,19 @@ export declare abstract class LoopressCommand extends Command {
     };
     protected dryRun: boolean;
     protected localConfig: LoopressLocalConfig;
+    protected projectId: string;
     protected siteConfig: EnvironmentConfig;
     protected yes: boolean;
     private wpClient?;
     protected get rootDir(): string;
     protected get wp(): WpClient;
     init(): Promise<void>;
+    protected maybeAutoRotate(): Promise<void>;
     protected removeOrphanedFiles(dir: string, orphans: string[], reason: string): Promise<void>;
     protected resolveAcfPath(override?: string): string;
     protected resolveApiPath(override?: string): string;
     protected resolveFormPath(override?: string): string;
+    protected resolvePagePath(override?: string): string;
     protected resolveSeoPath(override?: string): string;
     protected resolveSnippetsPath(override?: string): string;
     private pickEnvironment;

package/dist/lib/base.js

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import { configManager } from '../config/project-config.manager.js';
 import { readLocalConfig } from '../utils/loopress-config.js';
 import { isInteractive } from './interactive.js';
+import { isAppPasswordStale, rotateAppPassword } from './rotate-app-password.js';
 import { WpClient } from './wp-client.js';
 export class LoopressCommand extends Command {
     // On every subclass without opt-in: targeting an environment explicitly beats depending on
@@ -22,6 +23,7 @@ export class LoopressCommand extends Command {
     };
     dryRun = false;
     localConfig = {};
+    projectId;
     siteConfig;
     yes = false;
     wpClient;
@@ -49,7 +51,30 @@ export class LoopressCommand extends Command {
         this.dryRun = Boolean(flags['dry-run']);
         this.yes = Boolean(flags.yes);
         this.localConfig = await readLocalConfig();
-        this.siteConfig = this.resolveEnvironment(flags.env);
+        const resolved = this.resolveEnvironment(flags.env);
+        this.siteConfig = resolved.env;
+        this.projectId = resolved.projectId;
+        await this.maybeAutoRotate();
+    }
+    // Silent, best-effort: a stale app password still works, so a failed rotation attempt
+    // (offline, site down) just tries again on the next command instead of blocking this one.
+    // `dryRun` is excluded since rotating writes a new credential, a real side effect a
+    // --dry-run run promises not to cause. `Rotate` overrides this to a no-op: its own `run()`
+    // already rotates unconditionally, so the background check would only redo the same work.
+    async maybeAutoRotate() {
+        if (this.dryRun)
+            return;
+        const { token } = this.siteConfig;
+        if (!token || !isAppPasswordStale(this.siteConfig.addedAt))
+            return;
+        try {
+            const rotated = await rotateAppPassword({ ...this.siteConfig, token });
+            this.siteConfig = rotated;
+            configManager.setEnvironment(this.projectId, rotated.name, rotated);
+        }
+        catch {
+            // swallowed: see comment above
+        }
     }
     // Orphan cleanup shared by every pull command (see Push Deletion Rules in the product docs):
     // in a TTY the list is shown and confirmed first (Enter accepts), --yes skips the prompt, and
@@ -93,6 +118,11 @@ export class LoopressCommand extends Command {
             return override;
         return join(this.rootDir, this.localConfig.formDir ?? 'forms');
     }
+    resolvePagePath(override) {
+        if (override)
+            return override;
+        return join(this.rootDir, this.localConfig.pageDir ?? 'pages');
+    }
     resolveSeoPath(override) {
         if (override)
             return override;
@@ -112,36 +142,38 @@ export class LoopressCommand extends Command {
     }
     resolveEnvironment(envName) {
         if (this.localConfig.projectId) {
-            const project = configManager.getProject(this.localConfig.projectId);
+            const { projectId } = this.localConfig;
+            const project = configManager.getProject(projectId);
             if (!project) {
-                this.error(`Project "${this.localConfig.projectId}" (from loopress.json) not found. Run \`lps project config\` to configure it.`);
+                this.error(`Project "${projectId}" (from loopress.json) not found. Run \`lps project config\` to configure it.`);
             }
             const envNames = Object.keys(project.environments);
             if (envNames.length === 0) {
                 this.error(`Project "${project.name}" has no environments configured. Run \`lps project config\` to add one.`);
             }
             if (envName)
-                return this.pickEnvironment(project, envName);
+                return { env: this.pickEnvironment(project, envName), projectId };
             if (envNames.length === 1) {
-                return project.environments[envNames[0]];
+                return { env: project.environments[envNames[0]], projectId };
             }
             const current = configManager.getCurrentProject();
-            const currentEnv = current?.id === this.localConfig.projectId ? configManager.getCurrentEnv() : null;
+            const currentEnv = current?.id === projectId ? configManager.getCurrentEnv() : null;
             if (!currentEnv) {
                 this.error(`Project "${project.name}" has multiple environments. Run \`lps project switch\` to pick one.`);
             }
-            return currentEnv;
+            return { env: currentEnv, projectId };
         }
         if (envName) {
             const current = configManager.getCurrentProject();
             if (!current) {
                 this.error('No project configured. Run `lps project config` first.');
             }
-            return this.pickEnvironment(current, envName);
+            return { env: this.pickEnvironment(current, envName), projectId: current.id };
         }
         const env = configManager.getCurrentEnv();
-        if (env)
-            return env;
+        const current = configManager.getCurrentProject();
+        if (env && current)
+            return { env, projectId: current.id };
         this.error('No environment configured. Run `lps project config` first.');
     }
 }

package/dist/lib/bootstrap-full-install.d.ts

@@ -0,0 +1,10 @@
+import { WpClient } from './wp-client.js';
+/**
+ * Installs and activates Loopress Full on a site that doesn't have it yet: downloads the
+ * latest release zip, creates a temporary admin (the only way to get `install_plugins` from
+ * just an app password), drives the wp-admin upload UI headlessly, then removes the temp
+ * account. Cleanup always runs, whether the install succeeded or not: the temp account never
+ * stays alive waiting on a human, the fallback for a failed install is manual instructions
+ * using the real user's own credentials, not the temp account.
+ */
+export declare function bootstrapLoopressFull(wp: WpClient, siteUrl: string, log: (message: string) => void): Promise<void>;

package/dist/lib/bootstrap-full-install.js

@@ -0,0 +1,66 @@
+import { launchLocalBrowser } from './browser-launch.js';
+import { downloadLatestFullZip } from './github-release.js';
+import { createTempAdmin, deleteTempAdmin } from './temp-admin.js';
+/**
+ * Installs and activates Loopress Full on a site that doesn't have it yet: downloads the
+ * latest release zip, creates a temporary admin (the only way to get `install_plugins` from
+ * just an app password), drives the wp-admin upload UI headlessly, then removes the temp
+ * account. Cleanup always runs, whether the install succeeded or not: the temp account never
+ * stays alive waiting on a human, the fallback for a failed install is manual instructions
+ * using the real user's own credentials, not the temp account.
+ */
+export async function bootstrapLoopressFull(wp, siteUrl, log) {
+    log('Downloading the latest Loopress Full release...');
+    const zipPath = await downloadLatestFullZip();
+    log('Creating a temporary admin account to install it...');
+    const admin = await createTempAdmin(wp);
+    let installError;
+    try {
+        log('Installing and activating Loopress Full...');
+        await runBrowserInstall(admin, siteUrl, zipPath);
+    }
+    catch (error) {
+        installError = error;
+    }
+    if (!installError) {
+        log('Loopress Full installed and activated.');
+    }
+    log('Removing the temporary admin account...');
+    let cleanupError;
+    try {
+        await deleteTempAdmin(wp, admin);
+    }
+    catch (error) {
+        cleanupError = error;
+    }
+    const manualFallback = `Install it manually: upload ${zipPath} at ${siteUrl}/wp-admin/plugin-install.php?tab=upload`;
+    if (installError && cleanupError) {
+        throw new Error(`Could not install Loopress Full automatically, and the temporary admin account could not be removed (${cleanupError.message}). ${manualFallback}`, { cause: installError });
+    }
+    if (cleanupError)
+        throw cleanupError;
+    if (installError) {
+        throw new Error(`Could not install Loopress Full automatically. ${manualFallback}`, { cause: installError });
+    }
+}
+async function runBrowserInstall(admin, siteUrl, zipPath) {
+    const browser = await launchLocalBrowser();
+    try {
+        const page = await browser.newPage();
+        await page.goto(`${siteUrl}/wp-login.php`, { waitUntil: 'domcontentloaded' });
+        await page.fill('#user_login', admin.username);
+        await page.fill('#user_pass', admin.password);
+        await Promise.all([page.waitForLoadState('domcontentloaded'), page.click('#wp-submit')]);
+        await page.goto(`${siteUrl}/wp-admin/plugin-install.php?tab=upload`, { waitUntil: 'domcontentloaded' });
+        await page.setInputFiles('#pluginzip', zipPath);
+        await Promise.all([page.waitForLoadState('domcontentloaded'), page.click('input[name="install-plugin-submit"]')]);
+        // The activate link only appears after a successful install; its absence (a moved
+        // selector, DISALLOW_FILE_MODS, an unexpected wp-admin state) means the install didn't
+        // go through, not that activation is a separate optional step.
+        const activateLink = await page.waitForSelector('a[href*="action=activate"]', { timeout: 15_000 });
+        await Promise.all([page.waitForLoadState('domcontentloaded'), activateLink.click()]);
+    }
+    finally {
+        await browser.close();
+    }
+}

package/dist/lib/browser-launch.d.ts

@@ -0,0 +1,8 @@
+import { type Browser } from 'playwright-core';
+/**
+ * Launches a locally installed Chrome/Edge/Chromium via `playwright-core`, which ships no
+ * bundled browser (unlike `playwright`, ~300MB of Chromium): it drives whatever's already on
+ * the machine, tried in this order. Always headless: this flow has no click for a human to
+ * make, so there's nothing a visible window would let anyone do differently.
+ */
+export declare function launchLocalBrowser(): Promise<Browser>;

package/dist/lib/browser-launch.js

@@ -0,0 +1,20 @@
+import { chromium } from 'playwright-core';
+const CHANNELS = ['chrome', 'msedge', 'chromium'];
+/**
+ * Launches a locally installed Chrome/Edge/Chromium via `playwright-core`, which ships no
+ * bundled browser (unlike `playwright`, ~300MB of Chromium): it drives whatever's already on
+ * the machine, tried in this order. Always headless: this flow has no click for a human to
+ * make, so there's nothing a visible window would let anyone do differently.
+ */
+export async function launchLocalBrowser() {
+    let lastError;
+    for (const channel of CHANNELS) {
+        try {
+            return await chromium.launch({ channel, headless: true });
+        }
+        catch (error) {
+            lastError = error;
+        }
+    }
+    throw new Error('No local Chrome, Edge, or Chromium install found. Install one of these browsers to install Loopress Full automatically, or install it manually from wp-admin.', { cause: lastError });
+}

package/dist/lib/github-release.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Downloads `loopress-full.zip` from the most recent `wordpress-plugin@*` release of
+ * `loopress/loopress`, returning the local path to the downloaded file.
+ *
+ * `releases/latest` isn't used on purpose: this repo's releases interleave
+ * `wordpress-plugin@X.Y.Z` and `@loopress/cli@X.Y.Z` tags, so "latest" can be a CLI release
+ * with no plugin assets at all. Every `wordpress-plugin@*` release always ships both
+ * `loopress-full.zip` and `loopress-light.zip`, so the asset is matched by exact name, not by
+ * "the one zip asset".
+ */
+export declare function downloadLatestFullZip(): Promise<string>;

package/dist/lib/github-release.js

@@ -0,0 +1,37 @@
+import got from 'got';
+import { createWriteStream } from 'node:fs';
+import { mkdtemp } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pipeline } from 'node:stream/promises';
+const REPO = 'loopress/loopress';
+const RELEASE_TAG_PATTERN = /^wordpress-plugin@/;
+const ASSET_NAME = 'loopress-full.zip';
+/**
+ * Downloads `loopress-full.zip` from the most recent `wordpress-plugin@*` release of
+ * `loopress/loopress`, returning the local path to the downloaded file.
+ *
+ * `releases/latest` isn't used on purpose: this repo's releases interleave
+ * `wordpress-plugin@X.Y.Z` and `@loopress/cli@X.Y.Z` tags, so "latest" can be a CLI release
+ * with no plugin assets at all. Every `wordpress-plugin@*` release always ships both
+ * `loopress-full.zip` and `loopress-light.zip`, so the asset is matched by exact name, not by
+ * "the one zip asset".
+ */
+export async function downloadLatestFullZip() {
+    const releases = await got(`https://api.github.com/repos/${REPO}/releases`, {
+        headers: { accept: 'application/vnd.github+json', 'user-agent': 'loopress-cli' },
+        searchParams: { 'per_page': 30 },
+    }).json();
+    const pluginRelease = releases.find((release) => RELEASE_TAG_PATTERN.test(release.tag_name));
+    if (!pluginRelease) {
+        throw new Error(`No "wordpress-plugin@*" release found in ${REPO}.`);
+    }
+    const asset = pluginRelease.assets.find((candidate) => candidate.name === ASSET_NAME);
+    if (!asset) {
+        throw new Error(`Release "${pluginRelease.tag_name}" has no "${ASSET_NAME}" asset.`);
+    }
+    const dir = await mkdtemp(join(tmpdir(), 'lps-loopress-full-'));
+    const zipPath = join(dir, ASSET_NAME);
+    await pipeline(got.stream(asset.browser_download_url), createWriteStream(zipPath));
+    return zipPath;
+}