@loopress/cli 0.20.0 → 0.21.0

package/dist/lib/local-callback-server.js

@@ -1,3 +1,4 @@
+import { Buffer } from 'node:buffer';
 import { createServer } from 'node:http';
 import { openBrowser } from './open-browser.js';
 async function readBody(req) {
@@ -13,7 +14,7 @@ function parseFormData(body) {
  * Sends the user to a URL in their browser and catches the resulting redirect on a short-lived
  * local server; this factors out the server setup, timeout, and browser-opening boilerplate.
  */
-export function waitForLocalCallback(options) {
+export async function waitForLocalCallback(options) {
     const timeoutMs = options.timeoutMs ?? 5 * 60 * 1000;
     return new Promise((resolve, reject) => {
         function finish(res, page, settle) {
@@ -23,13 +24,13 @@ export function waitForLocalCallback(options) {
             server.close();
             settle();
         }
-        const server = createServer(async (req, res) => {
+        async function handleIncoming(req, res) {
             try {
                 const url = new URL(req.url ?? '/', 'http://localhost');
                 const body = req.method === 'POST' ? parseFormData(await readBody(req)) : {};
                 options.handleRequest(url, {
-                    rejectWithPage: (page, error) => finish(res, page, () => reject(error)),
-                    resolveWithPage: (page, value) => finish(res, page, () => resolve(value)),
+                    rejectWithPage(page, error) { finish(res, page, () => { reject(error); }); },
+                    resolveWithPage(page, value) { finish(res, page, () => { resolve(value); }); },
                     respondBadRequest(message) {
                         res.writeHead(400, { 'Content-Type': 'text/plain' });
                         res.end(message);
@@ -41,9 +42,10 @@ export function waitForLocalCallback(options) {
                 res.writeHead(500);
                 res.end('Internal error');
                 server.close();
-                reject(error);
+                reject(error instanceof Error ? error : new Error(String(error)));
             }
-        });
+        }
+        const server = createServer((req, res) => { void handleIncoming(req, res); });
         server.on('error', (err) => {
             clearTimeout(timer);
             reject(err);

package/dist/lib/plugin-detection.d.ts

@@ -1,4 +1,4 @@
-import { WpClient } from './wp-client.js';
+import { type WpClient } from './wp-client.js';
 /**
  * Checks `wp/v2/plugins` directly rather than through `parseInstalledPlugins`
  * (`src/utils/plugins.ts`), which deliberately filters Loopress's own plugin slugs out of its

package/dist/lib/push-command.js

@@ -24,8 +24,8 @@ export class PushCommand extends LoopressCommand {
             this.refusedByGuard = true;
             this.error('Target environment is "production". Pass --yes to confirm the push in a non-interactive run.');
         }
-        const proceed = await confirm({ default: true, message: `Push to production (${this.siteConfig.url})?` });
-        if (!proceed) {
+        const isProceed = await confirm({ default: true, message: `Push to production (${this.siteConfig.url})?` });
+        if (!isProceed) {
             this.refusedByGuard = true;
             this.error('Aborted.');
         }

package/dist/lib/rotate-app-password.d.ts

@@ -1,4 +1,4 @@
-import { EnvironmentConfig } from '../types/config.js';
+import { type EnvironmentConfig } from '../types/config.js';
 export declare const APP_PASSWORD_MAX_AGE_MS: number;
 export declare function isAppPasswordStale(addedAt: string): boolean;
 export declare function rotateAppPassword(env: EnvironmentConfig & {

package/dist/lib/rotate-app-password.js

@@ -7,7 +7,7 @@ export function isAppPasswordStale(addedAt) {
 // Create the new credential, confirm it actually authenticates on its own, only then revoke
 // the old one. Reversing this order risks locking the user out if the new one is somehow bad.
 export async function rotateAppPassword(env) {
-    const [user] = env.token.split(':');
+    const [user] = env.token.split(':', 1);
     const oldClient = new WpClient(env.url, env.token);
     const old = await oldClient.get(`${APPLICATION_PASSWORDS_PATH}/introspect`);
     const created = await oldClient.post(APPLICATION_PASSWORDS_PATH, { name: 'Loopress' });

package/dist/lib/temp-admin.d.ts

@@ -1,9 +1,9 @@
-import { WpClient } from './wp-client.js';
-export interface TempAdmin {
+import { type WpClient } from './wp-client.js';
+export type TempAdmin = {
     id: number;
     password: string;
     username: string;
-}
+};
 /**
  * Creates a temporary WordPress administrator, the only way to obtain `install_plugins` when
  * all the CLI has is an application password. `.invalid` is the RFC 2606 reserved TLD for

package/dist/lib/temp-admin.js

@@ -32,7 +32,7 @@ export async function deleteTempAdmin(wp, admin) {
     catch (error) {
         throw new Error(`Failed to remove the temporary admin account "${admin.username}" (id ${admin.id}) from the site. Remove it manually from wp-admin.`, { cause: error });
     }
-    const stillExists = await wp
+    const isStillExists = await wp
         .get(`wp/v2/users/${admin.id}`)
         .then(() => true)
         .catch((error) => {
@@ -40,7 +40,7 @@ export async function deleteTempAdmin(wp, admin) {
             return false;
         throw error;
     });
-    if (stillExists) {
+    if (isStillExists) {
         throw new Error(`Temporary admin account "${admin.username}" (id ${admin.id}) still exists after deletion. Remove it manually from wp-admin.`);
     }
 }

package/dist/lib/wp-authorize-flow.js

@@ -16,7 +16,7 @@ import { renderResultPage, waitForLocalCallback } from './local-callback-server.
  *      Application Password to the local callback server.
  *   6. The local server extracts the credentials and resolves the promise.
  */
-export function authorizeWithBrowser(siteUrl, log) {
+export async function authorizeWithBrowser(siteUrl, log) {
     return waitForLocalCallback({
         buildUrl(callbackBaseUrl) {
             const relayUrl = 'https://api.loopress.dev/auth/wp-authorize';
@@ -31,7 +31,11 @@ export function authorizeWithBrowser(siteUrl, log) {
                 rejectWithPage(REJECTED_PAGE, new Error('Authorization rejected in WordPress.'));
                 return;
             }
+            // `||`, not `??`: an empty-string field counts as absent here, same as the `!password`
+            // check below, so falls through to the query-param fallback instead of stopping at "".
+            // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
             const password = body.password || url.searchParams.get('password') || '';
+            // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
             const userLogin = body.user_login || url.searchParams.get('user_login') || '';
             if (!password || !userLogin) {
                 respondBadRequest('Missing password or user_login');

package/dist/lib/wp-client.d.ts

@@ -13,9 +13,9 @@ export declare class WpClient {
     put<T = unknown>(path: string, json?: Record<string, unknown>, options?: RequestOptions): Promise<T>;
     private request;
 }
-interface RequestOptions {
+type RequestOptions = {
     timeoutMs?: number;
-}
+};
 export declare function isNotFoundError(error: unknown): boolean;
 export declare function isTimeoutError(error: unknown): boolean;
 export declare function formatWpError(error: unknown, url: string, timeoutMs?: number): string;

package/dist/lib/wp-client.js

@@ -1,4 +1,5 @@
 import got from 'got';
+import { Buffer } from 'node:buffer';
 export const REQUEST_TIMEOUT_MS = 30_000;
 /**
  * HTTP client for a WordPress site's REST API.
@@ -53,7 +54,10 @@ export function formatWpError(error, url, timeoutMs = REQUEST_TIMEOUT_MS) {
         return `Authentication failed (${status}) on ${url}. Check your credentials with \`lps project config\`.`;
     }
     if (status === 404) {
-        return `Endpoint not found (404) on ${url}. Is the required plugin installed and up to date on the site?`;
+        const reason = extractServerErrorMessage(err.response?.body);
+        return reason
+            ? `Request failed (404) on ${url}: ${reason}`
+            : `Endpoint not found (404) on ${url}. Is the required plugin installed and up to date on the site?`;
     }
     if (status !== undefined) {
         const reason = extractServerErrorMessage(err.response?.body);
@@ -78,6 +82,12 @@ function extractServerErrorMessage(body) {
         return undefined;
     try {
         const parsed = JSON.parse(body);
+        // WP core's own generic body for a route it never registered (e.g. a plugin too old to
+        // expose this endpoint yet) is never more useful than the "is the plugin up to date?"
+        // fallback below; surfacing it verbatim buries a version-skew mismatch behind text that
+        // reads like the endpoint doesn't exist at all, pointing the user in the wrong direction.
+        if (parsed.code === 'rest_no_route')
+            return undefined;
         const reason = parsed.error ?? parsed.message;
         const summary = typeof reason === 'string' && reason.trim() ? reason : undefined;
         const detail = typeof parsed.output === 'string' && parsed.output.trim() ? parsed.output.trim() : undefined;

package/dist/lib/wp-site-diagnostic.d.ts

@@ -7,7 +7,14 @@ export type DiagnosticResult = {
 };
 /**
  * Pre-flight checks run before starting the browser authorization flow, so failures
- * (unreachable site, blocked REST API, WordPress too old) surface as an actionable
- * message instead of a confusing timeout once the browser is already open.
+ * (unreachable site, blocked REST API, Application Passwords disabled) surface as an
+ * actionable message instead of a confusing timeout once the browser is already open.
+ *
+ * Whether Application Passwords are enabled can only be read from the `wp-json/` index:
+ * WordPress adds `authentication['application-passwords']` there when the feature is on
+ * (WP core, rest_add_application_passwords_to_index). The authorize-application.php page
+ * can't be probed for this instead, it sits behind the admin login wall, so an unauthenticated
+ * request just gets redirected to wp-login.php and never reaches the check that would say
+ * whether the feature is disabled.
  */
 export declare function diagnoseWpSite(siteUrl: string): Promise<DiagnosticResult>;

package/dist/lib/wp-site-diagnostic.js

@@ -2,12 +2,20 @@ import got from 'got';
 export const REQUEST_TIMEOUT_MS = 10_000;
 /**
  * Pre-flight checks run before starting the browser authorization flow, so failures
- * (unreachable site, blocked REST API, WordPress too old) surface as an actionable
- * message instead of a confusing timeout once the browser is already open.
+ * (unreachable site, blocked REST API, Application Passwords disabled) surface as an
+ * actionable message instead of a confusing timeout once the browser is already open.
+ *
+ * Whether Application Passwords are enabled can only be read from the `wp-json/` index:
+ * WordPress adds `authentication['application-passwords']` there when the feature is on
+ * (WP core, rest_add_application_passwords_to_index). The authorize-application.php page
+ * can't be probed for this instead, it sits behind the admin login wall, so an unauthenticated
+ * request just gets redirected to wp-login.php and never reaches the check that would say
+ * whether the feature is disabled.
  */
 export async function diagnoseWpSite(siteUrl) {
+    let index;
     try {
-        await got.get(`${siteUrl}/wp-json/`, { timeout: { request: REQUEST_TIMEOUT_MS } });
+        index = await got.get(`${siteUrl}/wp-json/`, { timeout: { request: REQUEST_TIMEOUT_MS } }).json();
     }
     catch (error) {
         return {
@@ -15,28 +23,10 @@ export async function diagnoseWpSite(siteUrl) {
             reason: `Could not reach the WordPress REST API at ${siteUrl}/wp-json/. The site may be unreachable, or a security plugin may be blocking it. (${describe(error)})`,
         };
     }
-    try {
-        const response = await got.head(`${siteUrl}/wp-admin/authorize-application.php`, {
-            throwHttpErrors: false,
-            timeout: { request: REQUEST_TIMEOUT_MS },
-        });
-        if (response.statusCode === 404) {
-            return {
-                ok: false,
-                reason: `The application authorization page was not found on ${siteUrl}. This WordPress site may be older than 5.6, or the feature may be disabled by a plugin.`,
-            };
-        }
-        if (response.statusCode >= 400) {
-            return {
-                ok: false,
-                reason: `The application authorization page at ${siteUrl}/wp-admin/authorize-application.php returned an error (HTTP ${response.statusCode}).`,
-            };
-        }
-    }
-    catch (error) {
+    if (!index?.authentication?.['application-passwords']) {
         return {
             ok: false,
-            reason: `Could not reach ${siteUrl}/wp-admin/authorize-application.php. (${describe(error)})`,
+            reason: `Application Passwords are not available on ${siteUrl}. The site may be older than WordPress 5.6, require HTTPS, or have the feature disabled by a plugin or filter.`,
         };
     }
     return { ok: true };

package/dist/types/plugin.d.ts

@@ -1,14 +1,14 @@
-export interface InstalledPlugin {
+export type InstalledPlugin = {
     active: boolean;
     file: string;
     name: string;
     slug: string;
     version: string;
-}
-export interface WpNativePlugin {
+};
+export type WpNativePlugin = {
     name: string;
     plugin: string;
     status: 'active' | 'inactive' | 'network-active';
     version: string;
-}
+};
 export type PluginManifest = Record<string, string>;

package/dist/types/snippet.d.ts

@@ -1,5 +1,5 @@
-import { SnippetInsertMethod, SnippetLocation, SnippetType } from '../utils/snippet-format.js';
-export interface Snippet {
+import { type SnippetInsertMethod, type SnippetLocation, type SnippetType } from '../utils/snippet-format.js';
+export type Snippet = {
     active: boolean;
     code: string;
     id?: number;
@@ -11,4 +11,4 @@ export interface Snippet {
     shortcodeAttributes: string[];
     tags: string[];
     type: SnippetType;
-}
+};

package/dist/utils/composer.d.ts

@@ -1,4 +1,4 @@
-export interface ComposerJson {
+export type ComposerJson = {
     config?: {
         'allow-plugins'?: Record<string, boolean>;
     };
@@ -12,7 +12,7 @@ export interface ComposerJson {
     }>;
     require?: Record<string, string>;
     'require-dev'?: Record<string, string>;
-}
+};
 export declare function readComposerJson(): Promise<ComposerJson | null>;
 export declare function readComposerLock(): Promise<null | string>;
 export declare function getComposerManagedSlugs(composerJson: ComposerJson): string[];

package/dist/utils/form-format.js

@@ -8,7 +8,7 @@ export const FORM_ENDPOINT = 'loopress/v1/forms';
 // through pull/push untouched.
 export function getFormId(data) {
     const id = Number(data.id);
-    return Number.isInteger(id) && id > 0 ? id : null;
+    return Number.isSafeInteger(id) && id > 0 ? id : null;
 }
 export function getFormTitle(data) {
     const settings = data.settings;

package/dist/utils/loopress-config.d.ts

@@ -1,4 +1,4 @@
-import { LoopressProjectConfiguration } from '../types/project-config.generated.js';
+import { type LoopressProjectConfiguration } from '../types/project-config.generated.js';
 export type LoopressLocalConfig = LoopressProjectConfiguration;
 export declare function readLocalConfig(): Promise<LoopressLocalConfig>;
 export declare function writeLocalConfig(config: LoopressLocalConfig): Promise<void>;

package/dist/utils/page-format.js

@@ -7,7 +7,7 @@ export const PAGE_ENDPOINT = 'wp/v2/pages';
 export const PAGE_LIST_QUERY = 'per_page=100';
 export function getPageId(data) {
     const id = Number(data.id);
-    return Number.isInteger(id) && id > 0 ? id : null;
+    return Number.isSafeInteger(id) && id > 0 ? id : null;
 }
 // `title`/`content`/`excerpt` come back as `{raw, rendered}` from `?context=edit` (what `page
 // pull` requests) but round-trip fine as plain strings too for a hand-created file, same
@@ -56,7 +56,7 @@ const PAGE_META_FIELDS = [
 export function pickPageMeta(data) {
     const meta = {};
     for (const field of PAGE_META_FIELDS) {
-        if (field in data)
+        if (Object.hasOwn(data, field))
             meta[field] = data[field];
     }
     return meta;

package/dist/utils/plugins.d.ts

@@ -1,5 +1,5 @@
-import { InstalledPlugin, PluginManifest, WpNativePlugin } from '../types/plugin.js';
-export interface PluginDiff {
+import { type InstalledPlugin, type PluginManifest, type WpNativePlugin } from '../types/plugin.js';
+export type PluginDiff = {
     toActivate: Array<{
         file: string;
         slug: string;
@@ -8,8 +8,8 @@ export interface PluginDiff {
         slug: string;
     }>;
     upToDate: string[];
-}
-export interface MergeResult {
+};
+export type MergeResult = {
     added: string[];
     merged: PluginManifest;
     updated: Array<{
@@ -17,7 +17,7 @@ export interface MergeResult {
         slug: string;
         to: string;
     }>;
-}
+};
 export declare function mergePluginManifest(existing: PluginManifest, incoming: PluginManifest): MergeResult;
 export declare function parseInstalledPlugins(raw: WpNativePlugin[]): InstalledPlugin[];
 export declare function diffPlugins(manifest: PluginManifest, installed: InstalledPlugin[]): PluginDiff;

package/dist/utils/plugins.js

@@ -6,9 +6,9 @@
 const LOOPRESS_PLUGIN_SLUGS = new Set(['loopress', 'loopress-full', 'loopress-light']);
 export function mergePluginManifest(existing, incoming) {
     const merged = { ...existing, ...incoming };
-    const added = Object.keys(incoming).filter((s) => !(s in existing));
+    const added = Object.keys(incoming).filter((s) => !Object.hasOwn(existing, s));
     const updated = Object.keys(incoming)
-        .filter((s) => s in existing && existing[s] !== incoming[s])
+        .filter((s) => Object.hasOwn(existing, s) && existing[s] !== incoming[s])
         .map((s) => ({ from: existing[s], slug: s, to: incoming[s] }));
     return { added, merged, updated };
 }
@@ -16,7 +16,7 @@ export function mergePluginManifest(existing, incoming) {
 // single-file plugin) with the `.php` extension stripped; the WordPress.org slug is just the
 // folder name (or the bare id itself for a single-file plugin).
 function slugFromPluginFile(file) {
-    return file.split('/')[0];
+    return file.split('/', 1)[0];
 }
 export function parseInstalledPlugins(raw) {
     return raw

package/dist/utils/seo-format.d.ts

@@ -3,19 +3,19 @@ export declare const SEO_SETTINGS_ENDPOINT = "loopress/v1/seo/settings";
 export declare const SEO_REDIRECTS_ENDPOINT = "loopress/v1/seo/redirects";
 export declare function seoRedirectEndpoint(id: number): string;
 export declare function seoPostMetaEndpoint(postType: string): string;
-export interface SeoPostMeta {
+export type SeoPostMeta = {
     meta: Record<string, unknown>;
     slug: string;
     title: string;
-}
-export interface SeoRedirect {
-    createdAt: null | string;
+};
+export type SeoRedirect = {
+    createdAt: string | undefined;
     headerCode: number;
     hits: number;
     id: number;
     sources: unknown;
     status: string;
-    updatedAt: null | string;
+    updatedAt: string | undefined;
     urlTo: string;
-}
+};
 export declare function redirectFileBase(redirect: SeoRedirect): string;

package/dist/utils/snippet-format.d.ts

@@ -2,7 +2,7 @@ export declare const SNIPPETS_ENDPOINT = "loopress/v1/snippets";
 export type SnippetType = 'css' | 'html' | 'js' | 'php' | 'text';
 export type SnippetInsertMethod = 'auto' | 'shortcode';
 export type SnippetLocation = 'admin' | 'body' | 'everywhere' | 'footer' | 'frontend' | 'header' | 'once';
-export interface NormalizedSnippet {
+export type NormalizedSnippet = {
     active: boolean;
     code: string;
     description: string;
@@ -14,7 +14,7 @@ export interface NormalizedSnippet {
     shortcodeAttributes: string[];
     tags: string[];
     type: SnippetType;
-}
+};
 export declare function parseType(raw: unknown): null | SnippetType;
 export declare function parseLocation(raw: unknown): null | SnippetLocation;
 export declare function parseInsertMethod(raw: unknown): null | SnippetInsertMethod;

package/dist/utils/snippet-format.js

@@ -1,12 +1,17 @@
 export const SNIPPETS_ENDPOINT = 'loopress/v1/snippets';
+// Coerces server JSON that should be a string but, being unknown, could in principle be an
+// object; a plain String() on that would print "[object Object]" instead of falling back.
+function coerceString(value, fallback = '') {
+    return typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean' ? String(value) : fallback;
+}
 export function parseType(raw) {
     const valid = ['css', 'html', 'js', 'php', 'text'];
-    const value = String(raw ?? '').toLowerCase();
+    const value = coerceString(raw).toLowerCase();
     return valid.includes(value) ? value : null;
 }
 const VALID_LOCATIONS = new Set(['admin', 'body', 'everywhere', 'footer', 'frontend', 'header', 'once']);
 export function parseLocation(raw) {
-    const value = String(raw ?? '').toLowerCase();
+    const value = coerceString(raw).toLowerCase();
     return VALID_LOCATIONS.has(value) ? value : null;
 }
 export function parseInsertMethod(raw) {
@@ -69,12 +74,12 @@ export function buildMetaFile(snippet) {
 export function normalizeSnippet(data) {
     return {
         active: Boolean(data.active),
-        code: String(data.code ?? ''),
-        description: String(data.description ?? ''),
+        code: coerceString(data.code),
+        description: coerceString(data.description),
         id: Number(data.id),
         insertMethod: parseInsertMethod(data.insertMethod) ?? 'auto',
         location: parseLocation(data.location) ?? defaultLocationForType(parseType(data.type) ?? 'php'),
-        name: String(data.name ?? ''),
+        name: coerceString(data.name),
         priority: resolvePriority(data.priority),
         shortcodeAttributes: Array.isArray(data.shortcodeAttributes) ? data.shortcodeAttributes.map(String) : [],
         tags: Array.isArray(data.tags) ? data.tags : [],