@loopress/cli 0.27.0 → 0.28.0

package/dist/commands/project/config.js

@@ -5,7 +5,7 @@ import { bootstrapLoopressFull } from '../../lib/bootstrap-full-install.js';
 import { isInteractive } from '../../lib/interactive.js';
 import { isLoopressFullActive } from '../../lib/plugin-detection.js';
 import { authorizeWithBrowser } from '../../lib/wp-authorize-flow.js';
-import { WpClient } from '../../lib/wp-client.js';
+import { isLocalEnvironment, WpClient } from '../../lib/wp-client.js';
 import { diagnoseWpSite } from '../../lib/wp-site-diagnostic.js';
 const NEW_PROJECT = '__new__';
 const AUTH_BROWSER = 'browser';
@@ -48,16 +48,20 @@ export default class Config extends Command {
         const rawUrl = await input({
             message: 'WordPress URL',
             validate(value) {
+                let parsed;
                 try {
-                    const parsed = new URL(value);
-                    if (!['http:', 'https:'].includes(parsed.protocol)) {
-                        return 'URL must start with http:// or https://';
-                    }
-                    return true;
+                    parsed = new URL(value);
                 }
                 catch {
                     return 'Invalid URL';
                 }
+                if (!['http:', 'https:'].includes(parsed.protocol)) {
+                    return 'URL must start with http:// or https://';
+                }
+                if (parsed.protocol === 'http:' && !isLocalEnvironment(envName)) {
+                    return `Plain HTTP would send the Application Password in cleartext. Use HTTPS. Plain HTTP is allowed only for the "local" environment (this one is "${envName}").`;
+                }
+                return true;
             },
         });
         let url = rawUrl;
@@ -88,10 +92,10 @@ export default class Config extends Command {
         this.log('→ Run `lps project switch` to change the active project or environment');
     }
     async maybeBootstrapLoopressFull(env) {
-        const { token, url } = env;
+        const { name, token, url } = env;
         if (!token)
             return; // env was just built with one a few lines up; guard only narrows the type
-        const wp = new WpClient(url, token);
+        const wp = new WpClient(url, token, name);
         // A detection failure (network hiccup, plugins REST disabled) is treated as "assume it's
         // there" rather than surprising the user with an account-creating prompt they didn't ask
         // for; `lps project config` can simply be re-run if it genuinely isn't installed.

package/dist/commands/promote.d.ts

@@ -17,8 +17,10 @@ export default class Promote extends Command {
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<PromoteResult>;
+    private assertDirsInsideProject;
     private confirmPromotion;
     private delegateArgv;
+    private enterScratchCopy;
     private requireEnvironment;
     private resolveProject;
 }

package/dist/commands/promote.js

@@ -1,16 +1,21 @@
 import { confirm } from '@inquirer/prompts';
 import { Args, Command } from '@oclif/core';
+// eslint-disable-next-line n/no-unsupported-features/node-builtins -- stable since 22.3, works unflagged on 22.0+
+import { cp, mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { basename, isAbsolute, join, relative, resolve } from 'node:path';
 import { configManager } from '../config/project-config.manager.js';
 import { LoopressCommand } from '../lib/base.js';
 import { isInteractive } from '../lib/interactive.js';
 import { stdoutToStderr } from '../lib/json-delegation.js';
 import { readLocalConfig } from '../utils/loopress-config.js';
+import { resolveResourceDir, RESOURCE_DIR_DEFAULTS } from '../utils/resource-dirs.js';
 export default class Promote extends Command {
     static args = {
         from: Args.string({ description: 'Environment to copy the configuration from', required: true }),
         to: Args.string({ description: 'Environment to copy the configuration to', required: true }),
     };
-    static description = 'Copy every tracked resource from one environment to another by pulling from <from> then pushing to <to>. Local tracked files are overwritten with <from> in the process.';
+    static description = 'Copy every tracked resource from one environment to another by pulling from <from> then pushing to <to>. Local tracked files are overwritten with <from> in the process. With --dry-run, <from> is pulled into a throwaway copy of the project instead, and the push is only previewed.';
     static enableJsonFlag = true;
     static examples = ['$ lps promote staging production', '$ lps promote production staging --dry-run'];
     static flags = {
@@ -29,19 +34,55 @@ export default class Promote extends Command {
         }
         if (!dryRun)
             await this.confirmPromotion(from.name, to.name, to.url, yes);
-        this.log(`\n=== Pulling from ${from.name} (${from.url}) ===`);
+        // A dry-run pull writes nothing, so a dry-run push right after would preview the current
+        // local files instead of <from>. Instead, really pull into a throwaway copy of the project
+        // and dry-run the push from there: the preview is what a real promotion would push, and the
+        // user's own files stay untouched.
+        const originalCwd = process.cwd();
+        const scratch = dryRun ? await this.enterScratchCopy(originalCwd) : undefined;
+        // The delegated pull is real, so without this its auto-rotation could revoke a stale app
+        // password during what the user asked to be a preview (see LoopressCommand.maybeAutoRotate).
+        const previousNoRotate = process.env.LOOPRESS_NO_AUTO_ROTATE;
+        if (scratch)
+            process.env.LOOPRESS_NO_AUTO_ROTATE = '1';
         try {
-            await stdoutToStderr(this.jsonEnabled(), async () => this.config.runCommand('pull', this.delegateArgv(from.name, dryRun)));
+            this.log(`\n=== Pulling from ${from.name} (${from.url}) ===`);
+            try {
+                await stdoutToStderr(this.jsonEnabled(), async () => this.config.runCommand('pull', this.delegateArgv(from.name, false)));
+            }
+            catch (error) {
+                // A partial pull must never be pushed onward: stop before touching <to>.
+                this.error(`Pull from ${from.name} failed, ${to.name} left untouched: ${error.message}`);
+            }
+            this.log(`\n=== Pushing to ${to.name} (${to.url}) ===`);
+            await stdoutToStderr(this.jsonEnabled(), async () => this.config.runCommand('push', this.delegateArgv(to.name, dryRun)));
         }
-        catch (error) {
-            // A partial pull must never be pushed onward: stop before touching <to>.
-            this.error(`Pull from ${from.name} failed, ${to.name} left untouched: ${error.message}`);
+        finally {
+            if (scratch) {
+                if (previousNoRotate === undefined)
+                    delete process.env.LOOPRESS_NO_AUTO_ROTATE;
+                else
+                    process.env.LOOPRESS_NO_AUTO_ROTATE = previousNoRotate;
+                process.chdir(originalCwd);
+                await rm(scratch, { force: true, recursive: true });
+            }
         }
-        this.log(`\n=== Pushing to ${to.name} (${to.url}) ===`);
-        await stdoutToStderr(this.jsonEnabled(), async () => this.config.runCommand('push', this.delegateArgv(to.name, dryRun)));
         this.log(dryRun ? `\n[dry-run] ${from.name} would be promoted to ${to.name}.` : `\n${from.name} promoted to ${to.name}.`);
         return { from: from.name, status: dryRun ? 'dry-run' : 'promoted', to: to.name };
     }
+    // The scratch pull writes wherever loopress.json points. An absolute or `../` rootDir or
+    // resource dir would land outside the copy, in the user's real files, during a dry run.
+    async assertDirsInsideProject(projectDir) {
+        const localConfig = await readLocalConfig();
+        const dirs = [localConfig.rootDir ?? '.', ...Object.keys(RESOURCE_DIR_DEFAULTS).map((kind) => resolveResourceDir(kind, localConfig))];
+        const outside = dirs.find((dir) => {
+            const rel = relative(projectDir, resolve(projectDir, dir));
+            return rel.startsWith('..') || isAbsolute(rel);
+        });
+        if (outside !== undefined) {
+            this.error(`--dry-run can't preview safely: "${outside}" in loopress.json is outside the project. Run \`lps diff --env <from> --against <to>\` instead.`);
+        }
+    }
     // Deliberately not `guardProductionPush`: promote overwrites local tracked files for every
     // target, not just production, so it needs its own confirmation regardless of the name. That
     // prompt also calls out production when relevant, making a second production-only guard
@@ -70,6 +111,26 @@ export default class Promote extends Command {
             argv.push('--dry-run');
         return argv;
     }
+    // Copies the whole project (not just what `pull` rewrites): push also reads files pull never
+    // touches, and a real promotion pushes those as they are locally. node_modules and .git are
+    // never read by push. Returns the scratch root, cwd is left inside the copy.
+    async enterScratchCopy(projectDir) {
+        await this.assertDirsInsideProject(projectDir);
+        const scratch = await mkdtemp(join(tmpdir(), 'lps-promote-'));
+        try {
+            const copy = join(scratch, basename(projectDir));
+            await cp(projectDir, copy, {
+                filter: (source) => !['.git', 'node_modules'].includes(basename(source)),
+                recursive: true,
+            });
+            process.chdir(copy);
+        }
+        catch (error) {
+            await rm(scratch, { force: true, recursive: true });
+            throw error;
+        }
+        return scratch;
+    }
     requireEnvironment(environments, projectName, name) {
         const env = environments[name];
         if (!env) {

package/dist/commands/pull.js

@@ -1,8 +1,8 @@
 import { LoopressCommand } from '../lib/base.js';
 import { stdoutToStderr } from '../lib/json-delegation.js';
 import { pluralize } from '../utils/pluralize.js';
-// composer before plugins: `plugin:pull` reads the local composer.json to skip
-// Composer-managed plugins, so it needs the freshly pulled one. The rest write to independent
+// composer before plugins: when a composer.json exists, `plugin:pull` merges the live plugins
+// into it, so it must run on the freshly pulled one or `composer:pull` would overwrite its work. The rest write to independent
 // directories and their order does not matter, it mirrors `lps push` for familiarity.
 const PULL_TARGETS = [
     { commandId: 'composer:pull', label: 'composer' },

package/dist/commands/push.d.ts

@@ -18,6 +18,7 @@ export default class Push extends LoopressCommand {
     private failedCount;
     run(): Promise<PushResult>;
     private buildArgv;
+    private composerDeclaresPlugins;
     private guardProductionPush;
 }
 export {};

package/dist/commands/push.js

@@ -1,6 +1,10 @@
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
 import { LoopressCommand } from '../lib/base.js';
 import { guardProductionPush } from '../lib/guard-production-push.js';
 import { stdoutToStderr } from '../lib/json-delegation.js';
+import { wpackagistRequire } from '../utils/composer.js';
 import { pluralize } from '../utils/pluralize.js';
 // Dependency-ish order: code first (plugins, composer), then the ACF definitions content
 // relies on, then content itself.
@@ -11,6 +15,8 @@ const PUSH_TARGETS = [
     { commandId: 'api:push', label: 'API routes' },
     { commandId: 'hook:push', label: 'hooks' },
     { commandId: 'form:push', label: 'forms' },
+    // Before pages: WordPress refuses a page whose `template` it doesn't know yet.
+    { commandId: 'template:push', label: 'templates and parts' },
     { commandId: 'page:push', label: 'pages' },
     { commandId: 'seo:push', label: 'SEO' },
     { commandId: 'menu:push', label: 'menus' },
@@ -18,7 +24,7 @@ const PUSH_TARGETS = [
     { commandId: 'snippet:push', label: 'snippets' },
 ];
 export default class Push extends LoopressCommand {
-    static description = 'Push all local content, plugins, composer dependencies, ACF, API routes, hooks, forms, pages, SEO, menus, options, and snippets, to WordPress';
+    static description = 'Push all local content, plugins, composer dependencies, ACF, API routes, hooks, forms, templates, pages, SEO, menus, options, and snippets, to WordPress';
     static enableJsonFlag = true;
     static examples = ['$ lps push', '$ lps push --env staging', '$ lps push --dry-run'];
     static flags = {
@@ -30,7 +36,13 @@ export default class Push extends LoopressCommand {
         await this.guardProductionPush();
         const argv = this.buildArgv();
         const results = [];
+        const composerPushedByPlugins = await this.composerDeclaresPlugins();
         for (const target of PUSH_TARGETS) {
+            if (composerPushedByPlugins && target.commandId === 'composer:push') {
+                this.log('\n→ composer: already pushed whole by plugins');
+                results.push({ label: target.label, status: 'pushed' });
+                continue;
+            }
             this.log(`\n→ Pushing ${target.label}...`);
             try {
                 await stdoutToStderr(this.jsonEnabled(), async () => this.config.runCommand(target.commandId, argv));
@@ -47,7 +59,9 @@ export default class Push extends LoopressCommand {
         if (this.failedCount > 0) {
             // Each failure's own reason, not just the count: under --json the per-resource lines above
             // never reach stdout, and this message is all an MCP caller or a script gets to see.
-            const failures = results.filter((result) => result.status === 'failed').map((result) => `${result.label}: ${result.error}`);
+            const failures = results
+                .filter((result) => result.status === 'failed')
+                .map((result) => `${result.label}: ${result.error}`);
             this.error(`${pluralize(this.failedCount, 'resource')} failed to push. ${failures.join('; ')}`);
         }
         this.log('\nAll resources pushed.');
@@ -62,9 +76,29 @@ export default class Push extends LoopressCommand {
             argv.push('--dry-run');
         return argv;
     }
+    // A composer.json that declares plugins is pushed whole by `plugin:push` (with its activation
+    // safety), so `composer:push` would only run Composer on the server a second time.
+    async composerDeclaresPlugins() {
+        const path = join(process.cwd(), this.rootDir, 'composer.json');
+        if (!existsSync(path))
+            return false;
+        try {
+            const composerJson = JSON.parse(await readFile(path, 'utf8'));
+            return Object.keys(wpackagistRequire(composerJson, 'plugin')).length > 0;
+        }
+        catch {
+            // Unreadable: let both commands run and report the parse error themselves.
+            return false;
+        }
+    }
     // Guards once here (shared with PushCommand, lib/push-command.ts) rather than once per
     // delegated command.
     async guardProductionPush() {
-        await guardProductionPush({ dryRun: this.dryRun, error: (message) => this.error(message), siteConfig: this.siteConfig, yes: this.yes });
+        await guardProductionPush({
+            dryRun: this.dryRun,
+            error: (message) => this.error(message),
+            siteConfig: this.siteConfig,
+            yes: this.yes,
+        });
     }
 }

package/dist/commands/template/diff.d.ts

@@ -0,0 +1,10 @@
+import { DiffCommand, type DiffJson } from '../../lib/diff-command.js';
+export default class Diff extends DiffCommand {
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: string[];
+    static flags: {
+        against: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<DiffJson>;
+}

package/dist/commands/template/diff.js

@@ -0,0 +1,13 @@
+import { DiffCommand } from '../../lib/diff-command.js';
+import { getResourceStateProvider } from '../../lib/resource-state.js';
+export default class Diff extends DiffCommand {
+    static description = 'Show what differs in block templates and parts between your local files and a WordPress environment, or between two environments. Templates and parts edited in the Site Editor show up too.';
+    static enableJsonFlag = true;
+    static examples = ['$ lps template diff', '$ lps template diff --env staging', '$ lps template diff --env staging --against production'];
+    static flags = { ...DiffCommand.againstFlag };
+    async run() {
+        const { flags } = await this.parse(Diff);
+        const sides = this.resolveSides(flags.against);
+        return this.report(['template', 'part'].map((resource) => this.providerTarget(getResourceStateProvider(resource), sides)), sides);
+    }
+}

package/dist/commands/template/list.d.ts

@@ -0,0 +1,13 @@
+import { LoopressCommand } from '../../lib/base.js';
+import { type ChildTheme } from '../../utils/template-format.js';
+type ListResult = Omit<ChildTheme, 'parts' | 'templates'> & {
+    parts: string[];
+    templates: string[];
+};
+export default class List extends LoopressCommand {
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: string[];
+    run(): Promise<ListResult>;
+}
+export {};

package/dist/commands/template/list.js

@@ -0,0 +1,23 @@
+import { LoopressCommand } from '../../lib/base.js';
+import { pluralize } from '../../utils/pluralize.js';
+import { CHILD_THEME_ENDPOINT } from '../../utils/template-format.js';
+export default class List extends LoopressCommand {
+    static description = 'Show the Loopress child theme of the active block theme: its templates, parts, and those edited in the Site Editor';
+    static enableJsonFlag = true;
+    static examples = ['$ lps template list'];
+    async run() {
+        const child = await this.wp.get(CHILD_THEME_ENDPOINT);
+        // The markup is only needed by `template diff`, it would drown the JSON output here.
+        const result = { ...child, parts: child.parts.map((part) => part.slug), templates: child.templates.map((template) => template.slug) };
+        if (!child.exists) {
+            this.log(`No Loopress child theme yet (${child.stylesheet}), run lps template push.`);
+            return result;
+        }
+        this.log(`${child.stylesheet} (child of ${child.parent}, ${child.active ? 'active' : 'not active'})`);
+        this.log(`  ${pluralize(result.templates.length, 'template')}: ${result.templates.join(', ') || 'none'}`);
+        this.log(`  ${pluralize(result.parts.length, 'part')}: ${result.parts.join(', ') || 'none'}`);
+        if (child.customized.length > 0)
+            this.log(`  Edited in the Site Editor: ${child.customized.join(', ')}`);
+        return result;
+    }
+}

package/dist/commands/template/push.d.ts

@@ -0,0 +1,20 @@
+import { PushCommand } from '../../lib/push-command.js';
+type PushResult = {
+    active?: boolean;
+    customized?: string[];
+    parts: string[];
+    status: 'dry-run' | 'success';
+    stylesheet?: string;
+    templates: string[];
+};
+export default class Push extends PushCommand {
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: string[];
+    static flags: {
+        yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<PushResult>;
+}
+export {};

package/dist/commands/template/push.js

@@ -0,0 +1,42 @@
+import { PushCommand } from '../../lib/push-command.js';
+import { formatPageProblems } from '../../utils/page-format.js';
+import { pluralize } from '../../utils/pluralize.js';
+import { resolveResourceDir } from '../../utils/resource-dirs.js';
+import { CHILD_THEME_ENDPOINT, readLocalTemplates } from '../../utils/template-format.js';
+export default class Push extends PushCommand {
+    static description = 'Push block templates (templates/<slug>.html) and template parts (parts/<slug>.html) as the files of a child theme of the active block theme, <parent>-loopress. The child mirrors the project: files removed locally are removed from it. It is never activated for you.';
+    static enableJsonFlag = true;
+    static examples = ['$ lps template push', '$ lps template push --dry-run'];
+    static flags = {
+        ...PushCommand.dryRunFlag,
+        ...PushCommand.yesFlag,
+    };
+    async run() {
+        await this.parse(Push);
+        const templatesPath = resolveResourceDir('template', this.localConfig);
+        const partsPath = resolveResourceDir('part', this.localConfig);
+        this.log(`Pushing templates and parts to ${this.siteConfig.url}`);
+        this.log(`Templates path: ${templatesPath}, parts path: ${partsPath}`);
+        const { parts, problems, templates } = await readLocalTemplates(templatesPath, partsPath);
+        if (problems.length > 0) {
+            this.error(`Nothing was pushed, fix these files first:\n  ${formatPageProblems(problems)}`);
+        }
+        const names = { parts: parts.map((part) => part.slug), templates: templates.map((template) => template.slug) };
+        this.log(`Found ${pluralize(templates.length, 'template')} and ${pluralize(parts.length, 'part')}`);
+        if (this.dryRun) {
+            this.log('[dry-run] Would rewrite the child theme with them.');
+            return { ...names, status: 'dry-run' };
+        }
+        const child = await this.wp.put(CHILD_THEME_ENDPOINT, { parts, templates });
+        await this.recordSuccess();
+        this.log(`Child theme ${child.stylesheet} written.`);
+        if (!child.active) {
+            this.warn(`${child.stylesheet} is not the active theme, so nothing changed on the site yet. Activate it in Appearance > Themes.`);
+        }
+        if (child.customized.length > 0) {
+            this.warn(`Edited in the Site Editor, their database copy still wins over the pushed file: ${child.customized.join(', ')}. ` +
+                'Clear their customizations in Appearance > Editor to use the pushed version.');
+        }
+        return { ...names, active: child.active, customized: child.customized, status: 'success', stylesheet: child.stylesheet };
+    }
+}

package/dist/commands/theme/pull.d.ts

@@ -1,8 +1,10 @@
 import { LoopressCommand } from '../../lib/base.js';
+import { type ComposerPullResult } from '../../utils/composer.js';
 type PullResult = {
     added: string[];
     merged: Record<string, string>;
-    status: 'composer-managed' | 'dry-run' | 'success';
+    skipped?: ComposerPullResult['skipped'];
+    status: 'dry-run' | 'success';
     updated: Array<{
         from: string;
         slug: string;

package/dist/commands/theme/pull.js

@@ -1,6 +1,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { LoopressCommand } from '../../lib/base.js';
+import { pullIntoComposerJson } from '../../utils/composer.js';
 import { writeLocalConfig } from '../../utils/loopress-config.js';
 import { mergePluginManifest } from '../../utils/plugins.js';
 import { parseInstalledThemes } from '../../utils/themes.js';
@@ -13,14 +14,19 @@ export default class Pull extends LoopressCommand {
     };
     async run() {
         const { url } = this.siteConfig;
-        if (existsSync(join(process.cwd(), this.rootDir, 'composer.json'))) {
-            this.warn('This project has a composer.json, which is authoritative. Run `lps composer pull` instead.');
-            return { added: [], merged: this.localConfig.themes ?? {}, status: 'composer-managed', updated: [] };
-        }
         this.log(`Pulling themes from ${url}`);
         const raw = await this.wp.get('wp/v2/themes');
         const installed = parseInstalledThemes(raw);
         const incoming = Object.fromEntries(installed.map((t) => [t.slug, t.version]));
+        // A composer.json is authoritative over loopress.json: pin the live versions there instead.
+        const composerJsonPath = join(process.cwd(), this.rootDir, 'composer.json');
+        if (existsSync(composerJsonPath)) {
+            const result = await pullIntoComposerJson(composerJsonPath, 'theme', incoming, {
+                dryRun: this.dryRun,
+                log: this.log.bind(this),
+            });
+            return { ...result, status: this.dryRun ? 'dry-run' : 'success' };
+        }
         const { added, merged, updated } = mergePluginManifest(this.localConfig.themes ?? {}, incoming);
         if (this.dryRun) {
             this.log(`[dry-run] Would write ${Object.keys(merged).length} themes to loopress.json`);

package/dist/commands/theme/style/diff.d.ts

@@ -0,0 +1,2 @@
+declare const _default: typeof import("../../../lib/diff-command.js").DiffCommand;
+export default _default;

package/dist/commands/{theme-styles → theme/style}/diff.js

@@ -1,5 +1,6 @@
-import { resourceDiffCommand } from '../../lib/diff-command.js';
+import { resourceDiffCommand } from '../../../lib/diff-command.js';
 export default resourceDiffCommand('theme-styles', {
     description: "Show what differs in the active block theme's Global Styles (Site Editor > Styles) between your local file and a WordPress environment, or between two environments",
+    command: 'theme style',
     pathNoun: 'theme styles directory',
 });

package/dist/commands/{theme-styles → theme/style}/pull.d.ts

@@ -1,4 +1,4 @@
-import { LoopressCommand } from '../../lib/base.js';
+import { LoopressCommand } from '../../../lib/base.js';
 export default class Pull extends LoopressCommand {
     static args: {
         path: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;

package/dist/commands/{theme-styles → theme/style}/pull.js

@@ -1,14 +1,14 @@
 import { Args } from '@oclif/core';
 import { mkdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { LoopressCommand } from '../../lib/base.js';
-import { canonicalGlobalStyles, getActiveThemeGlobalStyles, globalStylesEndpoint, themeStylesFileName, } from '../../utils/theme-styles-format.js';
+import { LoopressCommand } from '../../../lib/base.js';
+import { canonicalGlobalStyles, getActiveThemeGlobalStyles, globalStylesEndpoint, themeStylesFileName, } from '../../../utils/theme-styles-format.js';
 export default class Pull extends LoopressCommand {
     static args = {
         path: Args.string({ description: 'Path to theme styles directory (overrides project config)' }),
     };
     static description = "Pull the active block theme's Global Styles customizations (Site Editor > Styles) from WordPress into a local file";
-    static examples = ['$ lps theme-styles pull'];
+    static examples = ['$ lps theme style pull'];
     static flags = {
         ...LoopressCommand.dryRunFlag,
     };

package/dist/commands/{theme-styles → theme/style}/push.d.ts

@@ -1,4 +1,4 @@
-import { PushCommand } from '../../lib/push-command.js';
+import { PushCommand } from '../../../lib/push-command.js';
 export default class Push extends PushCommand {
     static args: {
         path: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;

package/dist/commands/{theme-styles → theme/style}/push.js

@@ -1,15 +1,15 @@
 import { Args } from '@oclif/core';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { PushCommand } from '../../lib/push-command.js';
-import { getResourceStateProvider } from '../../lib/resource-state.js';
-import { getActiveThemeGlobalStyles, globalStylesEndpoint, themeStylesFileName } from '../../utils/theme-styles-format.js';
+import { PushCommand } from '../../../lib/push-command.js';
+import { getResourceStateProvider } from '../../../lib/resource-state.js';
+import { getActiveThemeGlobalStyles, globalStylesEndpoint, themeStylesFileName } from '../../../utils/theme-styles-format.js';
 export default class Push extends PushCommand {
     static args = {
         path: Args.string({ description: 'Path to theme styles directory (overrides project config)' }),
     };
     static description = "Push the local Global Styles file to the active block theme's Site Editor > Styles on WordPress";
-    static examples = ['$ lps theme-styles push'];
+    static examples = ['$ lps theme style push'];
     static flags = {
         ...PushCommand.dryRunFlag,
     };
@@ -26,7 +26,7 @@ export default class Push extends PushCommand {
         }
         catch (error) {
             if (error.code === 'ENOENT') {
-                this.error(`No local Global Styles file found for the active theme ("${file}"). Run \`lps theme-styles pull\` first.`);
+                this.error(`No local Global Styles file found for the active theme ("${file}"). Run \`lps theme style pull\` first.`);
             }
             throw error;
         }

package/dist/commands/theme/style/rollback.d.ts

@@ -0,0 +1,2 @@
+declare const _default: typeof import("../../../lib/base.js").LoopressCommand;
+export default _default;

package/dist/commands/theme/style/rollback.js

@@ -0,0 +1,6 @@
+import { resourceRollbackCommand } from '../../../lib/rollback-command.js';
+export default resourceRollbackCommand('theme-styles', {
+    description: "Restore the active theme's Global Styles to a snapshot taken automatically before an earlier `lps theme style push`",
+    command: 'theme style',
+    pathNoun: 'theme styles directory',
+});

package/dist/lib/api-client.js

@@ -45,7 +45,9 @@ function formatApiError(error, url, timeoutMs) {
     }
     const reason = nestErrorMessage(err.response?.body);
     if (status === 403) {
-        return `Request rejected (${status}) on ${url}: ${reason ?? err.response?.body ?? err.message}`;
+        // An empty body (not just a missing one) falls back to got's message too, never a bare ": ".
+        const body = err.response?.body === '' ? undefined : err.response?.body;
+        return `Request rejected (${status}) on ${url}: ${reason ?? body ?? err.message}`;
     }
     // Any other API refusal (a 400 validation error, a 409 conflict) carries its explanation in
     // the body; got's own message ("Request failed with status code 400") never does.

package/dist/lib/app-build.d.ts

@@ -0,0 +1,5 @@
+declare const PACKAGE_MANAGERS: readonly ["bun", "npm", "pnpm", "yarn"];
+type PackageManager = (typeof PACKAGE_MANAGERS)[number];
+export declare function detectPackageManager(appDir: string, packageManagerField?: string): PackageManager;
+export declare function buildApp(appDir: string, onStart?: (command: string) => void): Promise<string | undefined>;
+export {};

package/dist/lib/app-build.js

@@ -0,0 +1,69 @@
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+// The package managers `lps app push` may spawn. An allowlist, not the raw `packageManager`
+// field: the name ends up as a process to run.
+const PACKAGE_MANAGERS = ['bun', 'npm', 'pnpm', 'yarn'];
+const LOCKFILES = [
+    ['pnpm-lock.yaml', 'pnpm'],
+    ['yarn.lock', 'yarn'],
+    ['bun.lock', 'bun'],
+    ['bun.lockb', 'bun'],
+    ['package-lock.json', 'npm'],
+];
+// How many trailing lines of build output a failure message carries.
+const OUTPUT_TAIL_LINES = 20;
+// `packageManager` field first (corepack's own source of truth), then the nearest lockfile
+// walking up to the repository root (an app inside a workspace shares the root lockfile),
+// then npm.
+export function detectPackageManager(appDir, packageManagerField) {
+    const fromField = packageManagerField?.split('@', 1)[0];
+    if (PACKAGE_MANAGERS.includes(fromField))
+        return fromField;
+    for (let dir = appDir;; dir = dirname(dir)) {
+        const lockfile = LOCKFILES.find(([file]) => existsSync(join(dir, file)));
+        if (lockfile)
+            return lockfile[1];
+        if (existsSync(join(dir, '.git')) || dirname(dir) === dir)
+            return 'npm';
+    }
+}
+// Runs the app's own `build` script, if its package.json declares one. Returns the command it
+// ran, or undefined when there is nothing to build (no package.json, or no build script: the
+// dist/ folder is then taken as is). Throws with the tail of the output when the build fails,
+// so a broken build never ships the stale dist/ left over from the previous one.
+export async function buildApp(appDir, onStart) {
+    const packageJsonPath = join(appDir, 'package.json');
+    if (!existsSync(packageJsonPath))
+        return undefined;
+    const pkg = JSON.parse(await readFile(packageJsonPath, 'utf8'));
+    if (!pkg.scripts?.build)
+        return undefined;
+    const pm = detectPackageManager(appDir, pkg.packageManager);
+    const command = `${pm} run build`;
+    onStart?.(command);
+    const { code, output } = await new Promise((resolve, reject) => {
+        // Windows resolves `npm` to `npm.cmd`, which only a shell finds. `pm` comes from the
+        // allowlist above, so the shell never sees user input.
+        const child = spawn(pm, ['run', 'build'], { cwd: appDir, shell: process.platform === 'win32' });
+        let out = '';
+        const collect = (chunk) => {
+            out += chunk;
+        };
+        child.stdout.setEncoding('utf8').on('data', collect);
+        child.stderr.setEncoding('utf8').on('data', collect);
+        child.on('error', reject);
+        child.on('close', (exitCode) => {
+            resolve({ code: exitCode, output: out });
+        });
+    });
+    if (code !== 0) {
+        const tail = output.trimEnd().split('\n').slice(-OUTPUT_TAIL_LINES).join('\n');
+        const hint = existsSync(join(appDir, 'node_modules'))
+            ? ''
+            : `\nnode_modules is missing: run \`${pm} install\` in ${appDir} first.`;
+        throw new Error(`\`${command}\` failed (exit code ${code}):\n${tail}${hint}`);
+    }
+    return command;
+}