@loopress/cli 0.20.1 → 0.22.0

package/dist/lib/local-callback-server.js

@@ -1,3 +1,4 @@
+import { Buffer } from 'node:buffer';
 import { createServer } from 'node:http';
 import { openBrowser } from './open-browser.js';
 async function readBody(req) {
@@ -13,23 +14,28 @@ function parseFormData(body) {
  * Sends the user to a URL in their browser and catches the resulting redirect on a short-lived
  * local server; this factors out the server setup, timeout, and browser-opening boilerplate.
  */
-export function waitForLocalCallback(options) {
+export async function waitForLocalCallback(options) {
     const timeoutMs = options.timeoutMs ?? 5 * 60 * 1000;
     return new Promise((resolve, reject) => {
-        function finish(res, page, settle) {
+        function finish(res, page) {
             res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
             res.end(page);
             clearTimeout(timer);
             server.close();
-            settle();
         }
-        const server = createServer(async (req, res) => {
+        async function handleIncoming(req, res) {
             try {
                 const url = new URL(req.url ?? '/', 'http://localhost');
                 const body = req.method === 'POST' ? parseFormData(await readBody(req)) : {};
                 options.handleRequest(url, {
-                    rejectWithPage: (page, error) => finish(res, page, () => reject(error)),
-                    resolveWithPage: (page, value) => finish(res, page, () => resolve(value)),
+                    rejectWithPage(page, error) {
+                        finish(res, page);
+                        reject(error);
+                    },
+                    resolveWithPage(page, value) {
+                        finish(res, page);
+                        resolve(value);
+                    },
                     respondBadRequest(message) {
                         res.writeHead(400, { 'Content-Type': 'text/plain' });
                         res.end(message);
@@ -41,9 +47,10 @@ export function waitForLocalCallback(options) {
                 res.writeHead(500);
                 res.end('Internal error');
                 server.close();
-                reject(error);
+                reject(error instanceof Error ? error : new Error(String(error)));
             }
-        });
+        }
+        const server = createServer((req, res) => { void handleIncoming(req, res); });
         server.on('error', (err) => {
             clearTimeout(timer);
             reject(err);

package/dist/lib/plugin-detection.d.ts

@@ -1,4 +1,4 @@
-import { WpClient } from './wp-client.js';
+import { type WpClient } from './wp-client.js';
 /**
  * Checks `wp/v2/plugins` directly rather than through `parseInstalledPlugins`
  * (`src/utils/plugins.ts`), which deliberately filters Loopress's own plugin slugs out of its

package/dist/lib/push-command.d.ts

@@ -10,4 +10,7 @@ export declare abstract class PushCommand extends LoopressCommand {
     protected reportTaskFailure(message: string, error: unknown, task?: {
         output: string;
     }): never;
+    protected runPushTasks<T>(items: T[], label: (item: T) => string, task: (item: T, task?: {
+        output: string;
+    }) => Promise<void>): Promise<void>;
 }

package/dist/lib/push-command.js

@@ -1,9 +1,9 @@
-import { confirm } from '@inquirer/prompts';
 import got from 'got';
+import { Listr } from 'listr2';
 import { authManager } from '../config/auth.manager.js';
 import { API_URL } from './api-client.js';
 import { LoopressCommand } from './base.js';
-import { isInteractive } from './interactive.js';
+import { guardProductionPush } from './guard-production-push.js';
 export class PushCommand extends LoopressCommand {
     failedCount = 0;
     // Refusals of the production guard never reach the site, so they must not pollute the
@@ -15,20 +15,16 @@ export class PushCommand extends LoopressCommand {
         }
         return super.catch(err);
     }
-    // Pushing to an environment named "production" needs explicit intent: a TTY confirmation
-    // (Enter accepts), or --yes in scripts and CI. Dry runs are exempt, they change nothing.
     async guardProductionPush() {
-        if (this.siteConfig.name.toLowerCase() !== 'production' || this.dryRun || this.yes)
-            return;
-        if (!isInteractive()) {
-            this.refusedByGuard = true;
-            this.error('Target environment is "production". Pass --yes to confirm the push in a non-interactive run.');
-        }
-        const proceed = await confirm({ default: true, message: `Push to production (${this.siteConfig.url})?` });
-        if (!proceed) {
-            this.refusedByGuard = true;
-            this.error('Aborted.');
-        }
+        await guardProductionPush({
+            dryRun: this.dryRun,
+            error: (message) => this.error(message),
+            onRefuse: () => {
+                this.refusedByGuard = true;
+            },
+            siteConfig: this.siteConfig,
+            yes: this.yes,
+        });
     }
     async init() {
         await super.init();
@@ -66,4 +62,15 @@ export class PushCommand extends LoopressCommand {
         this.failedCount++;
         throw error;
     }
+    // Shared shape of every resource's push list: sequential (`concurrent: false` avoids
+    // clobbering `failedCount` and interleaving WordPress writes), and a failing item never
+    // stops its siblings (`exitOnError: false`) so `failedCount` reflects every failure, not
+    // just the first. `label` feeds the "Push <label>" task title; `task` does the actual work
+    // and reports its own failure through `reportTaskFailure`.
+    async runPushTasks(items, label, task) {
+        await new Listr(items.map((item) => ({
+            task: async (_ctx, taskCtx) => task(item, taskCtx),
+            title: `Push ${label(item)}`,
+        })), { concurrent: false, exitOnError: false, renderer: this.jsonEnabled() ? 'silent' : 'default' }).run();
+    }
 }

package/dist/lib/put-or-create.d.ts

@@ -0,0 +1,13 @@
+import { type WpClient } from './wp-client.js';
+type PutOrCreateOptions = {
+    id: null | number;
+    payload: Record<string, unknown>;
+    postEndpoint: string;
+    postPayload?: Record<string, unknown>;
+    putEndpoint: (id: number) => string;
+};
+export declare function putOrCreate<T>(wp: WpClient, options: PutOrCreateOptions): Promise<{
+    body: T;
+    created: boolean;
+}>;
+export {};

package/dist/lib/put-or-create.js

@@ -0,0 +1,19 @@
+import { isNotFoundError } from './wp-client.js';
+// Update-or-create dance shared by every id-based resource (form, page, seo redirect,
+// snippet, unlike ACF which is key-based and only ever POSTs): PUT to the known id, and only
+// fall back to POST when the site doesn't recognize that id (404), e.g. a fresh install or a
+// database reset.
+export async function putOrCreate(wp, options) {
+    const { id, payload, postEndpoint, postPayload = payload, putEndpoint } = options;
+    if (id !== null) {
+        try {
+            const body = await wp.put(putEndpoint(id), payload);
+            return { body, created: false };
+        }
+        catch (error) {
+            if (!isNotFoundError(error))
+                throw error;
+        }
+    }
+    return { body: await wp.post(postEndpoint, postPayload), created: true };
+}

package/dist/lib/readdir-tolerant.d.ts

@@ -0,0 +1,5 @@
+import { type Dirent } from 'node:fs';
+export declare function readdirTolerant(dir: string): Promise<string[]>;
+export declare function readdirTolerant(dir: string, options: {
+    withFileTypes: true;
+}): Promise<Dirent[]>;

package/dist/lib/readdir-tolerant.js

@@ -0,0 +1,11 @@
+import { readdir } from 'node:fs/promises';
+export async function readdirTolerant(dir, options) {
+    try {
+        return options?.withFileTypes ? await readdir(dir, { withFileTypes: true }) : await readdir(dir);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+}

package/dist/lib/resolve-linked-project.d.ts

@@ -0,0 +1,8 @@
+import { type LoopressLocalConfig } from '../utils/loopress-config.js';
+type LinkedProject = {
+    apiProjectId: string;
+    localConfig: LoopressLocalConfig;
+    token: string;
+};
+export declare function resolveLinkedProject(fail: (message: string) => never): Promise<LinkedProject>;
+export {};

package/dist/lib/resolve-linked-project.js

@@ -0,0 +1,27 @@
+import { authManager } from '../config/auth.manager.js';
+import { configManager } from '../config/project-config.manager.js';
+import { readLocalConfig } from '../utils/loopress-config.js';
+// Shared preamble for `api publish` and `snippet publish`. Both target the Loopress cloud (never
+// a WordPress site), so neither extends `LoopressCommand`/`PushCommand` and neither needs an
+// environment resolved, but both need a logged-in user and a project already linked to the
+// account (`lps project push`). `fail` is the caller's `this.error`, so its messages keep
+// oclif's formatting and exit code; typed `=> never` so callers still narrow after the guards.
+export async function resolveLinkedProject(fail) {
+    const token = process.env.LOOPRESS_TOKEN ?? authManager.getAuth()?.token;
+    if (!token) {
+        fail('Not logged in. Run `lps login` first.');
+    }
+    const localConfig = await readLocalConfig();
+    const projectId = localConfig.projectId ?? configManager.getCurrentProject()?.id;
+    if (!projectId) {
+        fail('No project configured. Run `lps project config` first.');
+    }
+    const project = configManager.getProject(projectId);
+    if (!project) {
+        fail(`Project "${projectId}" (from loopress.json) not found. Run \`lps project config\` to configure it.`);
+    }
+    if (!project.apiProjectId) {
+        fail(`Project "${project.name}" is not linked to your Loopress account yet. Run \`lps project push\` first.`);
+    }
+    return { apiProjectId: project.apiProjectId, localConfig, token };
+}

package/dist/lib/rotate-app-password.d.ts

@@ -1,4 +1,4 @@
-import { EnvironmentConfig } from '../types/config.js';
+import { type EnvironmentConfig } from '../types/config.js';
 export declare const APP_PASSWORD_MAX_AGE_MS: number;
 export declare function isAppPasswordStale(addedAt: string): boolean;
 export declare function rotateAppPassword(env: EnvironmentConfig & {

package/dist/lib/rotate-app-password.js

@@ -7,7 +7,7 @@ export function isAppPasswordStale(addedAt) {
 // Create the new credential, confirm it actually authenticates on its own, only then revoke
 // the old one. Reversing this order risks locking the user out if the new one is somehow bad.
 export async function rotateAppPassword(env) {
-    const [user] = env.token.split(':');
+    const [user] = env.token.split(':', 1);
     const oldClient = new WpClient(env.url, env.token);
     const old = await oldClient.get(`${APPLICATION_PASSWORDS_PATH}/introspect`);
     const created = await oldClient.post(APPLICATION_PASSWORDS_PATH, { name: 'Loopress' });

package/dist/lib/temp-admin.d.ts

@@ -1,9 +1,9 @@
-import { WpClient } from './wp-client.js';
-export interface TempAdmin {
+import { type WpClient } from './wp-client.js';
+export type TempAdmin = {
     id: number;
     password: string;
     username: string;
-}
+};
 /**
  * Creates a temporary WordPress administrator, the only way to obtain `install_plugins` when
  * all the CLI has is an application password. `.invalid` is the RFC 2606 reserved TLD for

package/dist/lib/temp-admin.js

@@ -32,7 +32,7 @@ export async function deleteTempAdmin(wp, admin) {
     catch (error) {
         throw new Error(`Failed to remove the temporary admin account "${admin.username}" (id ${admin.id}) from the site. Remove it manually from wp-admin.`, { cause: error });
     }
-    const stillExists = await wp
+    const isStillExists = await wp
         .get(`wp/v2/users/${admin.id}`)
         .then(() => true)
         .catch((error) => {
@@ -40,7 +40,7 @@ export async function deleteTempAdmin(wp, admin) {
             return false;
         throw error;
     });
-    if (stillExists) {
+    if (isStillExists) {
         throw new Error(`Temporary admin account "${admin.username}" (id ${admin.id}) still exists after deletion. Remove it manually from wp-admin.`);
     }
 }

package/dist/lib/validate-local.d.ts

@@ -0,0 +1,10 @@
+export type Problem = {
+    file: string;
+    message: string;
+};
+export type ValidateResult = {
+    checked: number;
+    problems: Problem[];
+    valid: boolean;
+};
+export declare function validateLocal(cwd: string): Promise<ValidateResult>;

package/dist/lib/validate-local.js

@@ -0,0 +1,183 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { configManager } from '../config/project-config.manager.js';
+import { parseType } from '../utils/snippet-format.js';
+import { loadSnippets } from './load-snippets.js';
+import { readdirTolerant } from './readdir-tolerant.js';
+// Directories holding one JSON document per resource. Snippets (code file plus JSON sidecar)
+// and api routes (`.php`, not JSON) are checked separately.
+const JSON_RESOURCE_DIRS = ['acfDir', 'formDir', 'pageDir', 'seoDir'];
+const DEFAULT_DIR = {
+    acfDir: 'acf',
+    apiDir: 'api',
+    formDir: 'forms',
+    pageDir: 'pages',
+    seoDir: 'seo',
+    snippetsDir: 'snippets',
+};
+// Inspects the local tracked files under `cwd` without contacting WordPress: JSON files parse
+// and have the right shape, snippet sidecars use a known type, `loopress.json` points at a
+// real project, `composer.json` is well formed. Never throws for a bad file, it collects the
+// problem and moves on.
+export async function validateLocal(cwd) {
+    const problems = [];
+    let checked = 0;
+    const localConfig = await readConfig(cwd, problems);
+    const rootDir = typeof localConfig.rootDir === 'string' ? localConfig.rootDir : '.';
+    const resolve = (key) => {
+        const override = localConfig[key];
+        return join(cwd, rootDir, typeof override === 'string' ? override : DEFAULT_DIR[key]);
+    };
+    checkLoopressJson(localConfig, problems);
+    checked += 1;
+    checked += await checkComposerJson(cwd, problems);
+    for (const key of JSON_RESOURCE_DIRS) {
+        checked += await checkJsonDir(resolve(key), problems);
+    }
+    checked += await checkSnippets(resolve('snippetsDir'), problems);
+    checked += await checkApiDir(resolve('apiDir'), problems);
+    return { checked, problems, valid: problems.length === 0 };
+}
+async function checkApiDir(dir, problems) {
+    const entries = await readdirTolerant(dir, { withFileTypes: true });
+    let checked = 0;
+    for (const entry of entries) {
+        if (!entry.isFile() || !entry.name.endsWith('.php'))
+            continue;
+        checked += 1;
+        const filePath = join(dir, entry.name);
+        const content = await readFile(filePath, 'utf8');
+        if (content.trim() === '')
+            problems.push({ file: filePath, message: 'API route file is empty' });
+    }
+    return checked;
+}
+async function checkComposerJson(cwd, problems) {
+    let raw;
+    try {
+        raw = await readFile(join(cwd, 'composer.json'), 'utf8');
+    }
+    catch {
+        // No composer.json is fine, Composer sync is optional.
+        return 0;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        problems.push({ file: 'composer.json', message: `not valid JSON: ${error.message}` });
+        return 1;
+    }
+    for (const key of ['require', 'require-dev']) {
+        const section = parsed[key];
+        if (section !== undefined && (typeof section !== 'object' || section === null || Array.isArray(section))) {
+            problems.push({ file: 'composer.json', message: `"${key}" must be an object` });
+        }
+    }
+    return 1;
+}
+async function checkJsonDir(dir, problems) {
+    const files = (await readdirTolerant(dir)).filter((file) => file.endsWith('.json'));
+    let checked = 0;
+    for (const file of files) {
+        checked += 1;
+        const filePath = join(dir, file);
+        let parsed;
+        try {
+            parsed = JSON.parse(await readFile(filePath, 'utf8'));
+        }
+        catch (error) {
+            problems.push({ file: filePath, message: `not valid JSON: ${error.message}` });
+            continue;
+        }
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            problems.push({ file: filePath, message: 'expected a JSON object' });
+        }
+    }
+    return checked;
+}
+function checkLoopressJson(localConfig, problems) {
+    const { projectId } = localConfig;
+    if (typeof projectId === 'string') {
+        const project = configManager.getProject(projectId);
+        if (!project) {
+            problems.push({
+                file: 'loopress.json',
+                message: `projectId "${projectId}" is not a configured project (run \`lps project config\`)`,
+            });
+        }
+        else if (Object.keys(project.environments).length === 0) {
+            problems.push({ file: 'loopress.json', message: `project "${project.name}" has no environments configured` });
+        }
+    }
+    const { plugins } = localConfig;
+    if (plugins === undefined)
+        return;
+    if (typeof plugins !== 'object' || plugins === null || Array.isArray(plugins)) {
+        problems.push({ file: 'loopress.json', message: '"plugins" must be an object of slug -> version string' });
+        return;
+    }
+    for (const [slug, version] of Object.entries(plugins)) {
+        if (typeof version !== 'string')
+            problems.push({ file: 'loopress.json', message: `plugin "${slug}" must map to a string` });
+    }
+}
+async function checkSnippets(dir, problems) {
+    const listing = await readdirTolerant(dir);
+    if (listing.length === 0)
+        return 0;
+    // loadSnippets reports unreadable files and unparseable sidecars through onSkip.
+    let snippets;
+    try {
+        snippets = await loadSnippets(dir, (message) => {
+            problems.push({ file: dir, message });
+        });
+    }
+    catch (error) {
+        problems.push({ file: dir, message: error.message });
+        return 0;
+    }
+    // loadSnippets coerces an invalid `type` to the extension default rather than failing, so
+    // check the raw sidecars for a bogus enum value the schema would reject.
+    const sidecars = listing.filter((file) => file.endsWith('.json'));
+    for (const file of sidecars) {
+        const filePath = join(dir, file);
+        let meta;
+        try {
+            meta = JSON.parse(await readFile(filePath, 'utf8'));
+        }
+        catch {
+            problems.push({ file: filePath, message: 'not valid JSON' });
+            continue;
+        }
+        if (meta.type !== undefined && parseType(meta.type) === null) {
+            problems.push({ file: filePath, message: `"type": ${JSON.stringify(meta.type)} is not one of css, html, js, php, text` });
+        }
+        if (meta.id !== undefined && !Number.isSafeInteger(meta.id)) {
+            problems.push({ file: filePath, message: '"id" must be an integer' });
+        }
+    }
+    return snippets.length + sidecars.length;
+}
+// Mirrors utils/loopress-config.ts:readLocalConfig, but rooted at an explicit directory rather
+// than process.cwd() so the whole check is driveable from a test without process.chdir(), which
+// vitest's worker threads forbid. A missing file just means "no config".
+async function readConfig(cwd, problems) {
+    let raw;
+    try {
+        raw = await readFile(join(cwd, 'loopress.json'), 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return {};
+        throw error;
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        problems.push({ file: 'loopress.json', message: 'loopress.json is not valid JSON. Fix or delete it, then run `lps init` again.' });
+        return {};
+    }
+}

package/dist/lib/wp-authorize-flow.js

@@ -16,7 +16,7 @@ import { renderResultPage, waitForLocalCallback } from './local-callback-server.
  *      Application Password to the local callback server.
  *   6. The local server extracts the credentials and resolves the promise.
  */
-export function authorizeWithBrowser(siteUrl, log) {
+export async function authorizeWithBrowser(siteUrl, log) {
     return waitForLocalCallback({
         buildUrl(callbackBaseUrl) {
             const relayUrl = 'https://api.loopress.dev/auth/wp-authorize';
@@ -31,7 +31,11 @@ export function authorizeWithBrowser(siteUrl, log) {
                 rejectWithPage(REJECTED_PAGE, new Error('Authorization rejected in WordPress.'));
                 return;
             }
+            // `||`, not `??`: an empty-string field counts as absent here, same as the `!password`
+            // check below, so falls through to the query-param fallback instead of stopping at "".
+            // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
             const password = body.password || url.searchParams.get('password') || '';
+            // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
             const userLogin = body.user_login || url.searchParams.get('user_login') || '';
             if (!password || !userLogin) {
                 respondBadRequest('Missing password or user_login');

package/dist/lib/wp-client.d.ts

@@ -13,9 +13,9 @@ export declare class WpClient {
     put<T = unknown>(path: string, json?: Record<string, unknown>, options?: RequestOptions): Promise<T>;
     private request;
 }
-interface RequestOptions {
+type RequestOptions = {
     timeoutMs?: number;
-}
+};
 export declare function isNotFoundError(error: unknown): boolean;
 export declare function isTimeoutError(error: unknown): boolean;
 export declare function formatWpError(error: unknown, url: string, timeoutMs?: number): string;

package/dist/lib/wp-client.js

@@ -1,4 +1,5 @@
 import got from 'got';
+import { Buffer } from 'node:buffer';
 export const REQUEST_TIMEOUT_MS = 30_000;
 /**
  * HTTP client for a WordPress site's REST API.
@@ -81,6 +82,12 @@ function extractServerErrorMessage(body) {
         return undefined;
     try {
         const parsed = JSON.parse(body);
+        // WP core's own generic body for a route it never registered (e.g. a plugin too old to
+        // expose this endpoint yet) is never more useful than the "is the plugin up to date?"
+        // fallback below; surfacing it verbatim buries a version-skew mismatch behind text that
+        // reads like the endpoint doesn't exist at all, pointing the user in the wrong direction.
+        if (parsed.code === 'rest_no_route')
+            return undefined;
         const reason = parsed.error ?? parsed.message;
         const summary = typeof reason === 'string' && reason.trim() ? reason : undefined;
         const detail = typeof parsed.output === 'string' && parsed.output.trim() ? parsed.output.trim() : undefined;

package/dist/types/plugin.d.ts

@@ -1,14 +1,14 @@
-export interface InstalledPlugin {
+export type InstalledPlugin = {
     active: boolean;
     file: string;
     name: string;
     slug: string;
     version: string;
-}
-export interface WpNativePlugin {
+};
+export type WpNativePlugin = {
     name: string;
     plugin: string;
     status: 'active' | 'inactive' | 'network-active';
     version: string;
-}
+};
 export type PluginManifest = Record<string, string>;

package/dist/types/snippet.d.ts

@@ -1,5 +1,5 @@
-import { SnippetInsertMethod, SnippetLocation, SnippetType } from '../utils/snippet-format.js';
-export interface Snippet {
+import { type SnippetInsertMethod, type SnippetLocation, type SnippetType } from '../utils/snippet-format.js';
+export type Snippet = {
     active: boolean;
     code: string;
     id?: number;
@@ -11,4 +11,4 @@ export interface Snippet {
     shortcodeAttributes: string[];
     tags: string[];
     type: SnippetType;
-}
+};

package/dist/utils/composer.d.ts

@@ -1,4 +1,4 @@
-export interface ComposerJson {
+export type ComposerJson = {
     config?: {
         'allow-plugins'?: Record<string, boolean>;
     };
@@ -12,7 +12,7 @@ export interface ComposerJson {
     }>;
     require?: Record<string, string>;
     'require-dev'?: Record<string, string>;
-}
+};
 export declare function readComposerJson(): Promise<ComposerJson | null>;
 export declare function readComposerLock(): Promise<null | string>;
 export declare function getComposerManagedSlugs(composerJson: ComposerJson): string[];

package/dist/utils/form-format.js

@@ -8,7 +8,7 @@ export const FORM_ENDPOINT = 'loopress/v1/forms';
 // through pull/push untouched.
 export function getFormId(data) {
     const id = Number(data.id);
-    return Number.isInteger(id) && id > 0 ? id : null;
+    return Number.isSafeInteger(id) && id > 0 ? id : null;
 }
 export function getFormTitle(data) {
     const settings = data.settings;

package/dist/utils/loopress-config.d.ts

@@ -1,4 +1,4 @@
-import { LoopressProjectConfiguration } from '../types/project-config.generated.js';
+import { type LoopressProjectConfiguration } from '../types/project-config.generated.js';
 export type LoopressLocalConfig = LoopressProjectConfiguration;
 export declare function readLocalConfig(): Promise<LoopressLocalConfig>;
 export declare function writeLocalConfig(config: LoopressLocalConfig): Promise<void>;

package/dist/utils/page-format.js

@@ -7,7 +7,7 @@ export const PAGE_ENDPOINT = 'wp/v2/pages';
 export const PAGE_LIST_QUERY = 'per_page=100';
 export function getPageId(data) {
     const id = Number(data.id);
-    return Number.isInteger(id) && id > 0 ? id : null;
+    return Number.isSafeInteger(id) && id > 0 ? id : null;
 }
 // `title`/`content`/`excerpt` come back as `{raw, rendered}` from `?context=edit` (what `page
 // pull` requests) but round-trip fine as plain strings too for a hand-created file, same
@@ -56,7 +56,7 @@ const PAGE_META_FIELDS = [
 export function pickPageMeta(data) {
     const meta = {};
     for (const field of PAGE_META_FIELDS) {
-        if (field in data)
+        if (Object.hasOwn(data, field))
             meta[field] = data[field];
     }
     return meta;

package/dist/utils/plugins.d.ts

@@ -1,5 +1,5 @@
-import { InstalledPlugin, PluginManifest, WpNativePlugin } from '../types/plugin.js';
-export interface PluginDiff {
+import { type InstalledPlugin, type PluginManifest, type WpNativePlugin } from '../types/plugin.js';
+export type PluginDiff = {
     toActivate: Array<{
         file: string;
         slug: string;
@@ -8,8 +8,8 @@ export interface PluginDiff {
         slug: string;
     }>;
     upToDate: string[];
-}
-export interface MergeResult {
+};
+export type MergeResult = {
     added: string[];
     merged: PluginManifest;
     updated: Array<{
@@ -17,7 +17,7 @@ export interface MergeResult {
         slug: string;
         to: string;
     }>;
-}
+};
 export declare function mergePluginManifest(existing: PluginManifest, incoming: PluginManifest): MergeResult;
 export declare function parseInstalledPlugins(raw: WpNativePlugin[]): InstalledPlugin[];
 export declare function diffPlugins(manifest: PluginManifest, installed: InstalledPlugin[]): PluginDiff;

package/dist/utils/plugins.js

@@ -6,9 +6,9 @@
 const LOOPRESS_PLUGIN_SLUGS = new Set(['loopress', 'loopress-full', 'loopress-light']);
 export function mergePluginManifest(existing, incoming) {
     const merged = { ...existing, ...incoming };
-    const added = Object.keys(incoming).filter((s) => !(s in existing));
+    const added = Object.keys(incoming).filter((s) => !Object.hasOwn(existing, s));
     const updated = Object.keys(incoming)
-        .filter((s) => s in existing && existing[s] !== incoming[s])
+        .filter((s) => Object.hasOwn(existing, s) && existing[s] !== incoming[s])
         .map((s) => ({ from: existing[s], slug: s, to: incoming[s] }));
     return { added, merged, updated };
 }
@@ -16,7 +16,7 @@ export function mergePluginManifest(existing, incoming) {
 // single-file plugin) with the `.php` extension stripped; the WordPress.org slug is just the
 // folder name (or the bare id itself for a single-file plugin).
 function slugFromPluginFile(file) {
-    return file.split('/')[0];
+    return file.split('/', 1)[0];
 }
 export function parseInstalledPlugins(raw) {
     return raw