@loopress/cli 0.28.0 → 0.30.0

package/dist/lib/resource-state.js

@@ -1,13 +1,13 @@
 import { readFile } from 'node:fs/promises';
 import { basename, join, relative, sep } from 'node:path';
 import { ACF_OBJECT_TYPES, acfEndpoint, getAcfKey } from '../utils/acf-format.js';
+import { CPT_SPEC, fileExtension, META_SPEC, parseDeclaredFile, PATTERN_SPEC, ROLE_SPEC, TAXONOMY_SPEC, } from '../utils/declared-type-format.js';
 import { FORM_ENDPOINT, getFormId } from '../utils/form-format.js';
 import { getMenuSlug, MENU_ENDPOINT, MENU_LOCATIONS_ENDPOINT } from '../utils/menu-format.js';
 import { optionEndpoint, parseLocalOption } from '../utils/option-format.js';
 import { formatPageProblems, PAGES_ENDPOINT, readLocalHtmlFiles, readLocalPages } from '../utils/page-format.js';
-import { DEFAULT_POST_TYPES, SEO_REDIRECTS_ENDPOINT, SEO_SETTINGS_ENDPOINT, seoPostMetaEndpoint, } from '../utils/seo-format.js';
 import { normalizeSnippet, SNIPPETS_ENDPOINT, stripPhpOpeningTag } from '../utils/snippet-format.js';
-import { CHILD_THEME_ENDPOINT, parsePartFile, parseTemplateFile } from '../utils/template-format.js';
+import { CHILD_THEME_ENDPOINT, parsePartFile, parseTemplateFile, TEMPLATE_SLUG_RULE } from '../utils/template-format.js';
 import { canonicalGlobalStyles, getActiveThemeGlobalStyles, globalStylesEndpoint, THEME_STYLES_FILE_SUFFIX, } from '../utils/theme-styles-format.js';
 import { loadFiles } from './load-files.js';
 import { loadSnippets } from './load-snippets.js';
@@ -30,8 +30,6 @@ function omit(object, keys) {
 const ACF_VOLATILE_KEYS = ['modified'];
 // A WPForms form is a WP post; `modified`/`modified_gmt` move on every edit.
 const FORM_VOLATILE_KEYS = ['modified', 'modified_gmt'];
-// A RankMath redirect's `hits` is a live visit counter.
-const REDIRECT_VOLATILE_KEYS = ['hits'];
 // ---- snippets -------------------------------------------------------------------------------
 // `description` is dropped: `snippet push` overwrites it with "Imported from <path>" on every
 // push and `loadSnippets` never reads it back, so it is not part of the synced state. `id`
@@ -236,7 +234,7 @@ async function childThemeState(wp, kind) {
 const templateProvider = {
     dirKind: 'template',
     async local(dir) {
-        const { files, problems } = await readLocalHtmlFiles(dir, parseTemplateFile);
+        const { files, problems } = await readLocalHtmlFiles(dir, parseTemplateFile, TEMPLATE_SLUG_RULE);
         if (problems.length > 0)
             throw new Error(formatPageProblems(problems));
         return new Map(files.map(({ slug, ...rest }) => [slug, rest]));
@@ -248,7 +246,7 @@ const templateProvider = {
 const partProvider = {
     dirKind: 'part',
     async local(dir) {
-        const { files, problems } = await readLocalHtmlFiles(dir, parsePartFile);
+        const { files, problems } = await readLocalHtmlFiles(dir, parsePartFile, TEMPLATE_SLUG_RULE);
         if (problems.length > 0)
             throw new Error(formatPageProblems(problems));
         return new Map(files.map(({ slug, ...rest }) => [slug, rest]));
@@ -257,82 +255,6 @@ const partProvider = {
     resource: 'part',
     title: 'Template parts',
 };
-// ---- SEO --------------------------------------------------------------------------------
-function canonicalRedirect(redirect) {
-    return omit(redirect, REDIRECT_VOLATILE_KEYS);
-}
-const seoProvider = {
-    dirKind: 'seo',
-    async local(dir, onWarn) {
-        const state = new Map();
-        // The provider settings blob (Yoast / RankMath) is compared whole. If a real payload turns
-        // out to carry install-specific noise (a plugin version, a license hash), add those keys
-        // to an omit() list here, the e2e round-trip is what will surface them.
-        const settingsPath = join(dir, 'settings.json');
-        try {
-            const settings = readJson(await readFile(settingsPath, 'utf8'));
-            state.set('settings', settings);
-        }
-        catch (error) {
-            if (error.code !== 'ENOENT') {
-                onWarn(`Skipping "${settingsPath}": ${error.message}`);
-            }
-        }
-        for (const postType of DEFAULT_POST_TYPES) {
-            const metaDir = join(dir, 'post-meta', postType);
-            const entries = await loadFiles(metaDir, {
-                extension: '.json',
-                onSkip: onWarn,
-                parse: (raw, filePath) => ({ file: basename(filePath, '.json'), value: readJson(raw) }),
-            });
-            for (const { file, value } of entries) {
-                const slug = typeof value.slug === 'string' && value.slug !== '' ? value.slug : `local:${file}`;
-                state.set(`post-meta/${postType}/${slug}`, value);
-            }
-        }
-        const redirects = await loadFiles(join(dir, 'redirects'), {
-            extension: '.json',
-            onSkip: onWarn,
-            parse: readJson,
-        });
-        for (const redirect of redirects) {
-            const id = Number(redirect.id);
-            if (Number.isSafeInteger(id) && id > 0)
-                state.set(`redirects/${id}`, canonicalRedirect(redirect));
-        }
-        return state;
-    },
-    async remote(wp, onWarn) {
-        const state = new Map();
-        // `revision` (#234) is dropped from both, same as optionsProvider.remote() does for
-        // RemoteOption.revision below: it's bookkeeping for the conditional-write precondition, not
-        // configuration, and comparing it here would flag drift whenever the mere act of reading
-        // changed nothing meaningful.
-        const { settings } = await wp.get(SEO_SETTINGS_ENDPOINT);
-        state.set('settings', settings);
-        for (const postType of DEFAULT_POST_TYPES) {
-            const posts = await wp.get(seoPostMetaEndpoint(postType));
-            for (const { meta, slug, title } of posts)
-                state.set(`post-meta/${postType}/${slug}`, { meta, slug, title });
-        }
-        // Redirects are a RankMath-only feature; on Yoast the endpoint 404s, same graceful skip
-        // as `seo pull`.
-        try {
-            const redirects = await wp.get(SEO_REDIRECTS_ENDPOINT);
-            for (const redirect of redirects) {
-                state.set(`redirects/${redirect.id}`, canonicalRedirect(redirect));
-            }
-        }
-        catch (error) {
-            if (!isNotFoundError(error))
-                throw error;
-            onWarn(`Skipping redirects: not supported by the active SEO plugin`);
-        }
-        return state;
-    },
-    resource: 'seo',
-    title: 'SEO',
-};
 // ---- Menus --------------------------------------------------------------------------------
 // Every item's post_type/taxonomy target is already resolved to `object`/`objectSlug` by the
 // REST layer (MenuService), never a raw `_menu_item_object_id`, so the exported tree is already
@@ -382,6 +304,33 @@ const menuProvider = {
     resource: 'menu',
     title: 'Menus',
 };
+// ---- Custom post types, taxonomies, post meta, roles and patterns ---------------------------------------
+// Keyed by slug (the local file name), compared on the bare arguments: `revision` is push
+// bookkeeping, never part of the file.
+function declaredTypeProvider(spec, title) {
+    return {
+        dirKind: spec.dirKind,
+        async local(dir, onWarn) {
+            const entries = await loadFiles(dir, {
+                extension: fileExtension(spec),
+                onSkip: onWarn,
+                parse: (raw, filePath) => parseDeclaredFile(spec, filePath, raw),
+            });
+            return new Map(entries.map(({ args, slug }) => [slug, args]));
+        },
+        async remote(wp) {
+            const items = await wp.get(spec.endpoint);
+            return new Map(items.map(({ args, slug }) => [slug, args]));
+        },
+        resource: spec.cliName,
+        title,
+    };
+}
+const cptProvider = declaredTypeProvider(CPT_SPEC, 'Post types');
+const taxonomyProvider = declaredTypeProvider(TAXONOMY_SPEC, 'Taxonomies');
+const metaProvider = declaredTypeProvider(META_SPEC, 'Post meta');
+const roleProvider = declaredTypeProvider(ROLE_SPEC, 'Roles');
+const patternProvider = declaredTypeProvider(PATTERN_SPEC, 'Patterns');
 // ---- Options ------------------------------------------------------------------------------
 // Unlike every provider above, remote() has no "everything" endpoint to read: GET /options only
 // lists names, never values (by design, see OptionsController), so both sides compare exactly
@@ -408,12 +357,13 @@ const optionsProvider = {
         const tracked = await loadFiles(dir, {
             extension: '.json',
             onSkip: onWarn,
-            parse: (raw) => parseLocalOption(raw).name,
+            parse: parseLocalOption,
         });
         const state = new Map();
-        for (const name of tracked) {
+        for (const { name, refs } of tracked) {
             try {
-                const option = await wp.get(optionEndpoint(name));
+                // With the file's refs, so post references compare as paths on both sides.
+                const option = await wp.get(optionEndpoint(name, refs));
                 state.set(name, { autoload: option.autoload, value: option.value });
             }
             catch (error) {
@@ -469,8 +419,12 @@ export const RESOURCE_STATE_PROVIDERS = [
     templateProvider,
     partProvider,
     pageProvider,
-    seoProvider,
     menuProvider,
+    cptProvider,
+    taxonomyProvider,
+    metaProvider,
+    roleProvider,
+    patternProvider,
     optionsProvider,
     themeStylesProvider,
 ];

package/dist/lib/rollback-materialize.js

@@ -1,10 +1,10 @@
 import { mkdir, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { getAcfKey } from '../utils/acf-format.js';
+import { CPT_SPEC, fileExtension, formatDeclaredFile, META_SPEC, PATTERN_SPEC, ROLE_SPEC, TAXONOMY_SPEC } from '../utils/declared-type-format.js';
 import { getFormId, getFormTitle } from '../utils/form-format.js';
 import { getMenuSlug } from '../utils/menu-format.js';
 import { defaultReadonlyFor, optionFileName } from '../utils/option-format.js';
-import { redirectFileBase } from '../utils/seo-format.js';
 import { buildMetaFile, buildSnippetFile } from '../utils/snippet-format.js';
 import { themeStylesFileName } from '../utils/theme-styles-format.js';
 import { toSlug } from '../utils/to-slug.js';
@@ -51,28 +51,6 @@ async function phpFile(id, value, dir) {
     await mkdir(dirname(filePath), { recursive: true });
     await writeFile(filePath, String(value));
 }
-// ids are 'settings', `post-meta/<postType>/<slug>`, or `redirects/<id>` (see resource-state.ts's
-// seoProvider). Each value round-trips to the exact file `seo pull` would have written.
-async function seo(id, value, dir) {
-    if (id === 'settings') {
-        await writeJson(join(dir, 'settings.json'), value);
-        return;
-    }
-    if (id.startsWith('post-meta/')) {
-        const rest = id.slice('post-meta/'.length);
-        const separator = rest.indexOf('/');
-        const postType = rest.slice(0, separator);
-        const slug = rest.slice(separator + 1);
-        await writeJson(join(dir, 'post-meta', postType, `${slug}.json`), value);
-        return;
-    }
-    if (id.startsWith('redirects/')) {
-        const redirect = value;
-        await writeJson(join(dir, 'redirects', `${redirectFileBase(redirect)}.json`), redirect);
-        return;
-    }
-    throw new Error(`Unrecognized SEO snapshot id "${id}"`);
-}
 // ids are 'menu-locations' or `menu/<slug>` (see resource-state.ts's menuProvider).
 async function menu(id, value, dir) {
     if (id === 'menu-locations') {
@@ -97,15 +75,26 @@ async function option(id, value, dir) {
 async function themeStyles(id, value, dir) {
     await writeJson(join(dir, themeStylesFileName(id)), value);
 }
+// id is the slug, value the bare register_*() arguments (resource-state.ts's declaredTypeProvider),
+// written in the spec's file format like `<resource> pull` does.
+function declaredType(spec) {
+    return async (id, value, dir) => {
+        await writeFile(join(dir, `${id}${fileExtension(spec)}`), formatDeclaredFile(spec, value));
+    };
+}
 const MATERIALIZERS = {
     acf,
     api: phpFile,
+    cpt: declaredType(CPT_SPEC),
     form,
     hook: phpFile,
     menu,
+    meta: declaredType(META_SPEC),
     option,
-    seo,
+    pattern: declaredType(PATTERN_SPEC),
+    role: declaredType(ROLE_SPEC),
     snippet,
+    taxonomy: declaredType(TAXONOMY_SPEC),
     'theme-styles': themeStyles,
 };
 // Writes a snapshot's state back to `dir` in the exact on-disk layout `<resource> pull` would

package/dist/lib/snapshot-store.js

@@ -7,7 +7,7 @@ export const SNAPSHOT_RETENTION = 10;
 // representation; snapshots round-trip through a plain object instead. Keys are sorted so two
 // snapshots of the same state serialize identically (stable diffs, deterministic tests).
 export function stateToRecord(state) {
-    return Object.fromEntries([...state].sort(([a], [b]) => a.localeCompare(b)));
+    return Object.fromEntries([...state].toSorted(([a], [b]) => a.localeCompare(b)));
 }
 export function recordToState(record) {
     return new Map(Object.entries(record));
@@ -113,7 +113,7 @@ export async function listSnapshots(rootDir, resource, environment) {
             // rather than failing the whole listing; it stays on disk for a human to inspect.
         }
     }
-    return summaries.sort((a, b) => Number(b.id) - Number(a.id));
+    return summaries.toSorted((a, b) => Number(b.id) - Number(a.id));
 }
 // `id` undefined reads the most recent snapshot for this environment (the common
 // `lps <resource> rollback` case). Throws a message ready to show the user directly: no

package/dist/lib/spinner.d.ts

@@ -0,0 +1,2 @@
+export declare function withSpinner<T>(message: string, work: () => Promise<T>): Promise<T>;
+export declare function withoutSpinner<T>(work: () => Promise<T>): Promise<T>;

package/dist/lib/spinner.js

@@ -0,0 +1,72 @@
+// The one spinner behind every pending wait: WpClient and ApiClient requests, the browser
+// callback, a build, a third-party lookup. Refcounted so overlapping waits share one line (the
+// outermost label wins), on stderr and only on an interactive one, so `--json`, pipes and CI
+// output never see a frame. While it spins, every stdout/stderr write clears the line first and
+// redraws it after, so a this.log() mid-wait lands above it instead of on it.
+const FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+let depth = 0;
+let paused = 0;
+let label = '';
+let frame = 0;
+let stopSpinning;
+function isEnabled() {
+    return process.stderr.isTTY && !process.env.CI;
+}
+function start() {
+    const rawOut = process.stdout.write;
+    const rawErr = process.stderr.write;
+    const draw = () => {
+        const text = `${FRAMES[frame]} ${label}`.slice(0, (process.stderr.columns ?? 80) - 1);
+        rawErr.call(process.stderr, `\r\u{1B}[2K${text}`);
+    };
+    const clear = () => rawErr.call(process.stderr, '\r\u{1B}[2K');
+    const intercept = (stream, raw) => (...args) => {
+        clear();
+        const result = raw.apply(stream, args);
+        draw();
+        return result;
+    };
+    process.stdout.write = intercept(process.stdout, rawOut);
+    process.stderr.write = intercept(process.stderr, rawErr);
+    draw();
+    const timer = setInterval(() => {
+        frame = (frame + 1) % FRAMES.length;
+        draw();
+    }, 80);
+    timer.unref();
+    stopSpinning = () => {
+        clearInterval(timer);
+        process.stdout.write = rawOut;
+        process.stderr.write = rawErr;
+        clear();
+        stopSpinning = undefined;
+    };
+}
+export async function withSpinner(message, work) {
+    if (!isEnabled())
+        return work();
+    if (depth++ === 0)
+        label = message;
+    if (paused === 0 && !stopSpinning)
+        start();
+    try {
+        return await work();
+    }
+    finally {
+        if (--depth === 0)
+            stopSpinning?.();
+    }
+}
+// For code that draws its own progress (Listr renderers, which already spin per task) or reads
+// from the terminal (prompts): the spinner steps aside, then comes back if a wait is still pending.
+export async function withoutSpinner(work) {
+    paused++;
+    stopSpinning?.();
+    try {
+        return await work();
+    }
+    finally {
+        if (--paused === 0 && depth > 0 && isEnabled())
+            start();
+    }
+}

package/dist/lib/temp-admin.d.ts

@@ -16,4 +16,13 @@ export declare function createTempAdmin(wp: WpClient): Promise<TempAdmin>;
  * cleanup that silently fails would leave a live administrator with a random password on the
  * target site, discoverable only by someone reading logs closely.
  */
-export declare function deleteTempAdmin(wp: WpClient, admin: TempAdmin): Promise<void>;
+export declare function deleteTempAdmin(wp: WpClient, admin: Pick<TempAdmin, 'id' | 'username'>): Promise<void>;
+/**
+ * Lists temporary admins a previous bootstrap left behind: a process killed with SIGKILL, a
+ * machine that lost power, or a network drop during deleteTempAdmin() skips every cleanup path.
+ * Matching both the username prefix and the `.invalid` email keeps a real user who happens to
+ * be named `lps-temp-...` out of it. `context=edit` exposes `username` and `email` and lists
+ * every user, not only those with published posts.
+ */
+export declare function findTempAdmins(wp: WpClient): Promise<Array<Pick<TempAdmin, 'id' | 'username'>>>;
+export declare function sweepTempAdmins(wp: WpClient): Promise<string[]>;

package/dist/lib/temp-admin.js

@@ -1,5 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { isNotFoundError } from './wp-client.js';
+const TEMP_ADMIN_PREFIX = 'lps-temp-';
+const TEMP_ADMIN_EMAIL_DOMAIN = '@lps-temp.invalid';
 // Only role that carries `install_plugins`/`activate_plugins`; there's nothing narrower to grant.
 const TEMP_ADMIN_ROLE = 'administrator';
 /**
@@ -8,10 +10,10 @@ const TEMP_ADMIN_ROLE = 'administrator';
  * addresses guaranteed not to be real, appropriate for an account that has no real mailbox.
  */
 export async function createTempAdmin(wp) {
-    const username = `lps-temp-${Date.now().toString(36)}`;
+    const username = `${TEMP_ADMIN_PREFIX}${Date.now().toString(36)}`;
     const password = randomBytes(24).toString('base64url');
     const user = await wp.post('wp/v2/users', {
-        email: `${username}@lps-temp.invalid`,
+        email: `${username}${TEMP_ADMIN_EMAIL_DOMAIN}`,
         password,
         roles: [TEMP_ADMIN_ROLE],
         username,
@@ -44,3 +46,26 @@ export async function deleteTempAdmin(wp, admin) {
         throw new Error(`Temporary admin account "${admin.username}" (id ${admin.id}) still exists after deletion. Remove it manually from wp-admin.`);
     }
 }
+/**
+ * Lists temporary admins a previous bootstrap left behind: a process killed with SIGKILL, a
+ * machine that lost power, or a network drop during deleteTempAdmin() skips every cleanup path.
+ * Matching both the username prefix and the `.invalid` email keeps a real user who happens to
+ * be named `lps-temp-...` out of it. `context=edit` exposes `username` and `email` and lists
+ * every user, not only those with published posts.
+ */
+export async function findTempAdmins(wp) {
+    const users = await wp.getAll(`wp/v2/users?context=edit&search=${TEMP_ADMIN_PREFIX}`);
+    return users
+        .filter((user) => user.username.startsWith(TEMP_ADMIN_PREFIX) && user.email.endsWith(TEMP_ADMIN_EMAIL_DOMAIN))
+        .map(({ id, username }) => ({ id, username }));
+}
+// Deletes every leftover temp admin, returning the usernames removed. Throws on the first one
+// that can't be removed, naming it (deleteTempAdmin's own error).
+export async function sweepTempAdmins(wp) {
+    const leftovers = await findTempAdmins(wp);
+    for (const admin of leftovers) {
+        // Sequential on purpose: the first failure stops the sweep, naming its account.
+        await deleteTempAdmin(wp, admin);
+    }
+    return leftovers.map((admin) => admin.username);
+}

package/dist/lib/validate-local.js

@@ -1,27 +1,33 @@
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { configManager } from '../config/project-config.manager.js';
+import { CPT_SPEC, declaredFileChecker, META_SPEC, PATTERN_SPEC, ROLE_SPEC, TAXONOMY_SPEC } from '../utils/declared-type-format.js';
 import { parseLocalOption } from '../utils/option-format.js';
-import { readLocalPages } from '../utils/page-format.js';
+import { readLocalHtmlFiles, readLocalPages } from '../utils/page-format.js';
+import { RESOURCE_DIR_DEFAULTS } from '../utils/resource-dirs.js';
 import { parseType } from '../utils/snippet-format.js';
 import { readLocalTemplates } from '../utils/template-format.js';
 import { loadSnippets } from './load-snippets.js';
 import { readdirTolerant } from './readdir-tolerant.js';
 // Directories holding one JSON document per resource. Snippets (code file plus JSON sidecar)
 // and api routes (`.php`, not JSON) are checked separately, options too (a stricter shape).
-const JSON_RESOURCE_DIRS = ['acfDir', 'formDir', 'seoDir', 'menuDir', 'themeStylesDir'];
+const JSON_RESOURCE_DIRS = ['acfDir', 'formDir', 'menuDir', 'themeStylesDir'];
 const DEFAULT_DIR = {
     acfDir: 'acf',
     apiDir: 'api',
+    cptDir: 'cpt',
     formDir: 'forms',
     hooksDir: 'hooks',
     menuDir: 'menus',
+    metaDir: 'meta',
     optionsDir: 'options',
     pageDir: 'pages',
-    partDir: 'parts',
-    seoDir: 'seo',
+    partDir: RESOURCE_DIR_DEFAULTS.part,
+    patternDir: RESOURCE_DIR_DEFAULTS.pattern,
+    roleDir: RESOURCE_DIR_DEFAULTS.role,
     snippetsDir: 'snippets',
-    templateDir: 'templates',
+    taxonomyDir: 'taxonomies',
+    templateDir: RESOURCE_DIR_DEFAULTS.template,
     themeStylesDir: 'theme',
 };
 // Inspects the local tracked files under `cwd` without contacting WordPress: JSON files parse
@@ -46,6 +52,11 @@ export async function validateLocal(cwd) {
     // Same reader `option push` uses: a file missing "name", "autoload" or "value" is skipped
     // there with a warning, so it's a problem here.
     checked += await checkJsonDir(resolve('optionsDir'), problems, parseLocalOption);
+    checked += await checkJsonDir(resolve('cptDir'), problems, declaredFileChecker(CPT_SPEC));
+    checked += await checkJsonDir(resolve('taxonomyDir'), problems, declaredFileChecker(TAXONOMY_SPEC));
+    checked += await checkJsonDir(resolve('metaDir'), problems, declaredFileChecker(META_SPEC));
+    checked += await checkJsonDir(resolve('roleDir'), problems, declaredFileChecker(ROLE_SPEC));
+    checked += await checkPatterns(resolve('patternDir'), problems);
     checked += await checkSnippets(resolve('snippetsDir'), problems);
     checked += await checkPhpDir(resolve('apiDir'), problems, 'API route file is empty');
     checked += await checkPhpDir(resolve('hooksDir'), problems, 'Hook file is empty');
@@ -57,6 +68,18 @@ export async function validateLocal(cwd) {
     problems.push(...templates.problems);
     return { checked, problems, valid: problems.length === 0 };
 }
+// Same directory rules as pages (flat, .html only), then the same checks as `pattern push`.
+async function checkPatterns(dir, problems) {
+    const check = declaredFileChecker(PATTERN_SPEC);
+    const { files, problems: found } = await readLocalHtmlFiles(dir, (slug, raw) => {
+        check(raw, join(dir, `${slug}.html`));
+    }, {
+        message: `the file name must be 1 to ${PATTERN_SPEC.slugMaxLength} lowercase letters, digits, "_" or "-"`,
+        pattern: new RegExp(`^[a-z0-9_-]{1,${PATTERN_SPEC.slugMaxLength}}$`),
+    });
+    problems.push(...found);
+    return files.length + found.length;
+}
 // Recursive: both api/ and hooks/ files can live in a nested path-segment directory
 // (invoice-pdf/[order_id].php, content/filters.php), a non-recursive scan would silently
 // never check those.
@@ -103,9 +126,8 @@ async function checkComposerJson(cwd, problems) {
     }
     return 1;
 }
-// Recursive: ACF keeps one subdirectory per object type (acf/field-groups/*.json) and SEO its
-// post meta and redirects (seo/post-meta/<type>/*.json, seo/redirects/*.json); a top-level-only
-// scan silently never checked any of those. `shape` runs on files that are JSON objects and
+// Recursive: ACF keeps one subdirectory per object type (acf/field-groups/*.json); a
+// top-level-only scan silently never checked those. `shape` runs on files that are JSON objects and
 // throws to report a resource-specific problem.
 async function checkJsonDir(dir, problems, shape) {
     const entries = await readdirTolerant(dir, { recursive: true, withFileTypes: true });
@@ -130,7 +152,7 @@ async function checkJsonDir(dir, problems, shape) {
             continue;
         }
         try {
-            shape?.(raw);
+            shape?.(raw, filePath);
         }
         catch (error) {
             problems.push({ file: filePath, message: error.message });

package/dist/lib/wp-authorize-flow.d.ts

@@ -3,24 +3,17 @@ export type AuthorizeResult = {
     userLogin: string;
 };
 /**
- * Relays the authorization through the Loopress API so that WordPress's
- * `success_url` / `reject_url` can be valid HTTPS URLs.  The API receives the
- * redirect from WordPress and forwards the credentials back to a local callback
- * server via a form POST (keeping them out of the browser's address bar).
+ * Asks WordPress for an Application Password through its own authorize-application.php page,
+ * with the CLI's loopback server as `success_url` / `reject_url`:
  *
- * Flow:
- *   1. Start a local HTTP server on `127.0.0.1`.
- *   2. Open the browser to `https://api.loopress.dev/auth/wp-authorize` with the local
- *      callback URL and the target WordPress site as query params.
- *   3. That page redirects the user to WordPress's authorize-application.php,
- *      passing the API's callback endpoint as `success_url` (HTTPS).
- *   4. After the user approves, WordPress redirects to the API callback.
- *   5. The API callback returns an HTML page that POSTs a form with the
- *      Application Password to the local callback server.
- *   6. The local server extracts the credentials and resolves the promise.
+ *   1. Start a local HTTP server on 127.0.0.1.
+ *   2. Open the browser on `<site>/wp-admin/authorize-application.php`.
+ *   3. After the user approves, WordPress redirects to the loopback URL with `user_login` and
+ *      `password` appended to its query string (`state` is kept, WordPress only adds params).
  *
- * The `state` value is threaded through `callbackUrl` (the relay copies it verbatim into the
- * form's POST target), so it comes back as a query param on the credential POST and
- * `waitForLocalCallback` can match it before this handler runs.
+ * The callback host must be the literal `127.0.0.1`, not `localhost`: WordPress 7.0+ only exempts
+ * `127.0.0.1` and `[::1]` from its HTTPS requirement on these URLs. Older versions are screened
+ * out beforehand by `diagnoseWpSite`. The credentials land in the browser history as part of the
+ * callback URL, so the result page rewrites that history entry (see `renderResultPage`).
  */
 export declare function authorizeWithBrowser(siteUrl: string, log: (message: string) => void): Promise<AuthorizeResult>;

package/dist/lib/wp-authorize-flow.js

@@ -1,44 +1,40 @@
 import { renderResultPage, waitForLocalCallback } from './local-callback-server.js';
 /**
- * Relays the authorization through the Loopress API so that WordPress's
- * `success_url` / `reject_url` can be valid HTTPS URLs.  The API receives the
- * redirect from WordPress and forwards the credentials back to a local callback
- * server via a form POST (keeping them out of the browser's address bar).
+ * Asks WordPress for an Application Password through its own authorize-application.php page,
+ * with the CLI's loopback server as `success_url` / `reject_url`:
  *
- * Flow:
- *   1. Start a local HTTP server on `127.0.0.1`.
- *   2. Open the browser to `https://api.loopress.dev/auth/wp-authorize` with the local
- *      callback URL and the target WordPress site as query params.
- *   3. That page redirects the user to WordPress's authorize-application.php,
- *      passing the API's callback endpoint as `success_url` (HTTPS).
- *   4. After the user approves, WordPress redirects to the API callback.
- *   5. The API callback returns an HTML page that POSTs a form with the
- *      Application Password to the local callback server.
- *   6. The local server extracts the credentials and resolves the promise.
+ *   1. Start a local HTTP server on 127.0.0.1.
+ *   2. Open the browser on `<site>/wp-admin/authorize-application.php`.
+ *   3. After the user approves, WordPress redirects to the loopback URL with `user_login` and
+ *      `password` appended to its query string (`state` is kept, WordPress only adds params).
  *
- * The `state` value is threaded through `callbackUrl` (the relay copies it verbatim into the
- * form's POST target), so it comes back as a query param on the credential POST and
- * `waitForLocalCallback` can match it before this handler runs.
+ * The callback host must be the literal `127.0.0.1`, not `localhost`: WordPress 7.0+ only exempts
+ * `127.0.0.1` and `[::1]` from its HTTPS requirement on these URLs. Older versions are screened
+ * out beforehand by `diagnoseWpSite`. The credentials land in the browser history as part of the
+ * callback URL, so the result page rewrites that history entry (see `renderResultPage`).
  */
 export async function authorizeWithBrowser(siteUrl, log) {
     return waitForLocalCallback({
-        allowedOrigins: ['https://api.loopress.dev'],
+        // WordPress reaches the callback through a top-level GET redirect, which carries no Origin,
+        // so any request that does carry one isn't WordPress.
+        allowedOrigins: [],
         buildUrl(callbackBaseUrl, state) {
-            const relayUrl = 'https://api.loopress.dev/auth/wp-authorize';
+            const callbackUrl = `${callbackBaseUrl}/?state=${state}`;
             const params = new URLSearchParams({
-                callbackUrl: `${callbackBaseUrl}?state=${state}`,
-                wpUrl: siteUrl,
+                app_name: 'Loopress',
+                reject_url: `${callbackUrl}&cancelled=1`,
+                success_url: callbackUrl,
             });
-            return `${relayUrl}?${params}`;
+            return `${siteUrl}/wp-admin/authorize-application.php?${params}`;
         },
-        handleRequest(url, { resolveWithPage, rejectWithPage, respondBadRequest, body }) {
-            if (url.searchParams.has('cancelled') || body.cancelled) {
+        callbackHost: '127.0.0.1',
+        handleRequest(url, { resolveWithPage, rejectWithPage, respondBadRequest }) {
+            if (url.searchParams.has('cancelled')) {
                 rejectWithPage(REJECTED_PAGE, new Error('Authorization rejected in WordPress.'));
                 return;
             }
-            // Credentials come from the relay's form POST only. Reading them from the query string
-            // would let them land in shell history, proxy logs and the browser address bar (F24).
-            const { password, user_login: userLogin } = body;
+            const password = url.searchParams.get('password');
+            const userLogin = url.searchParams.get('user_login');
             if (!password || !userLogin) {
                 respondBadRequest('Missing password or user_login');
                 return;
@@ -46,7 +42,7 @@ export async function authorizeWithBrowser(siteUrl, log) {
             resolveWithPage(SUCCESS_PAGE, { password, userLogin });
         },
         log,
-        openingMessage: 'Opening WordPress in your browser to authorize Loopress...',
+        openingMessage: 'Opening WordPress in your browser to authorize Loopress...\nIf WordPress says the URL must be served over a secure connection (WordPress older than 7.0), press Ctrl-C and run `lps project config` again, choosing manual entry.',
         timeoutMessage: 'Authorization timed out after 5 minutes.',
     });
 }

package/dist/lib/wp-client.d.ts

@@ -23,6 +23,7 @@ type RequestOptions = {
     timeoutMs?: number;
 };
 export declare function isNotFoundError(error: unknown): boolean;
+export declare function isForbiddenError(error: unknown): boolean;
 export declare function isApplicative404(error: unknown, marker: string): boolean;
 export declare function isTimeoutError(error: unknown): boolean;
 export declare function isInvalidPageNumber(error: unknown): boolean;