@loopress/cli 0.32.2 → 0.33.0

package/dist/lib/load-snippets.js

@@ -1,6 +1,8 @@
 import { readdir, readFile } from 'node:fs/promises';
 import { basename, extname, join } from 'node:path';
+import {} from '../types/snippet.js';
 import { defaultLocationForType, parseInsertMethod, parseLocation, parseType, } from '../utils/snippet-format.js';
+import { errorCode, errorMessage, isRecord } from './narrow.js';
 const TYPE_BY_EXTENSION = {
     '.css': 'css',
     '.html': 'html',
@@ -21,58 +23,51 @@ async function loadSnippet(path, file, onSkip) {
         content = await readFile(filePath, 'utf8');
     }
     catch (error) {
-        onSkip?.(`Skipping "${filePath}": ${error.message}`);
+        onSkip?.(`Skipping "${filePath}": ${errorMessage(error)}`);
         return undefined;
     }
-    let id;
-    let name;
-    let description;
-    let type;
-    let isActive = false;
-    let tags = [];
-    let location = null;
-    let insertMethod = null;
-    let priority = 10;
-    let shortcodeAttributes = [];
+    let meta;
     try {
-        const metaContent = await readFile(metaPath, 'utf8');
-        const meta = JSON.parse(metaContent);
-        id = meta.id;
-        // `||`, not `??`: an empty-string name in the sidecar JSON counts as absent too.
-        // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
-        name = meta.name || undefined;
-        // Kept even when empty: a description cleared on purpose, not one to replace with "Imported from <path>".
-        description = meta.description;
-        type = parseType(meta.type) ?? undefined;
-        isActive = Boolean(meta.active);
-        tags = Array.isArray(meta.tags) ? meta.tags.map(String) : [];
-        location = parseLocation(meta.location);
-        insertMethod = parseInsertMethod(meta.insertMethod);
-        priority = meta.priority ?? 10;
-        shortcodeAttributes = Array.isArray(meta.shortcodeAttributes) ? meta.shortcodeAttributes.map(String) : [];
+        meta = await readSidecar(metaPath);
     }
     catch (error) {
-        if (error.code !== 'ENOENT') {
-            onSkip?.(`Skipping "${metaPath}": ${error.message}`);
-            return undefined;
-        }
+        onSkip?.(`Skipping "${metaPath}": ${errorMessage(error)}`);
+        return undefined;
     }
-    const resolvedType = type ?? (Object.hasOwn(TYPE_BY_EXTENSION, ext) ? TYPE_BY_EXTENSION[ext] : 'php');
+    const type = parseType(meta.type) ?? TYPE_BY_EXTENSION[ext] ?? 'php';
     return {
-        active: isActive,
+        active: Boolean(meta.active),
         code: content,
-        description,
-        id,
-        insertMethod: insertMethod ?? 'auto',
-        location: location ?? defaultLocationForType(resolvedType),
-        name: name ?? basename(file, ext),
+        // Kept even when empty: a description cleared on purpose, not one to replace with "Imported from <path>".
+        description: typeof meta.description === 'string' ? meta.description : undefined,
+        id: typeof meta.id === 'number' ? meta.id : undefined,
+        insertMethod: parseInsertMethod(meta.insertMethod) ?? 'auto',
+        location: parseLocation(meta.location) ?? defaultLocationForType(type),
+        // An empty-string name in the sidecar JSON counts as absent too.
+        name: typeof meta.name === 'string' && meta.name !== '' ? meta.name : basename(file, ext),
         path: filePath,
-        priority,
-        shortcodeAttributes,
-        tags,
-        type: resolvedType,
+        priority: typeof meta.priority === 'number' ? meta.priority : 10,
+        shortcodeAttributes: Array.isArray(meta.shortcodeAttributes) ? meta.shortcodeAttributes.map(String) : [],
+        tags: Array.isArray(meta.tags) ? meta.tags.map(String) : [],
+        type,
     };
 }
+// The sidecar's JSON object, or no fields when the snippet has no sidecar (yet).
+async function readSidecar(metaPath) {
+    let raw;
+    try {
+        raw = await readFile(metaPath, 'utf8');
+    }
+    catch (error) {
+        if (errorCode(error) === 'ENOENT')
+            return {};
+        throw error;
+    }
+    const meta = JSON.parse(raw);
+    if (!isRecord(meta))
+        throw new Error('not a JSON object');
+    return meta;
+}
 // Shared by `snippet push` (pushes to the project's own WordPress site) and `snippet publish`
 // (publishes to the Loopress api as a shared source): both read the same local `snippets/`
 // directory the same way. `onSkip` is optional so callers that don't care about per-file
@@ -83,7 +78,7 @@ export async function loadSnippets(path, onSkip) {
         files = await readdir(path);
     }
     catch (error) {
-        throw new Error(`Error loading snippets: ${error.message}`, { cause: error });
+        throw new Error(`Error loading snippets: ${errorMessage(error)}`, { cause: error });
     }
     const snippets = [];
     for (const file of files) {

package/dist/lib/local-callback-server.js

@@ -94,7 +94,13 @@ export async function waitForLocalCallback(options) {
             reject(new Error(options.timeoutMessage));
         }, timeoutMs);
         server.listen(0, '127.0.0.1', () => {
-            const { port } = server.address();
+            const address = server.address();
+            // Only a pipe or a closed server has no AddressInfo, never a TCP listen that just succeeded.
+            if (address === null || typeof address === 'string') {
+                reject(new Error('The local callback server has no TCP port'));
+                return;
+            }
+            const { port } = address;
             const targetUrl = options.buildUrl(`http://${options.callbackHost ?? 'localhost'}:${port}`, state);
             options.log(options.openingMessage);
             options.log(`\nIf it doesn't open automatically, visit:\n${targetUrl}\n`);

package/dist/lib/narrow.d.ts

@@ -0,0 +1,5 @@
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function isOneOf<T extends string>(values: Iterable<T>, value: unknown): value is T;
+export declare function errorMessage(error: unknown): string;
+export declare function causeOf(error: unknown): unknown;
+export declare function errorCode(error: unknown): string | undefined;

package/dist/lib/narrow.js

@@ -0,0 +1,26 @@
+// Type guards for values that arrive as `unknown`: a caught error, a parsed JSON document.
+// Arrays pass isRecord, same as a bare `typeof value === 'object' && value !== null` check.
+export function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+// Membership in a closed list of literals, narrowing `value` to that union.
+export function isOneOf(values, value) {
+    for (const candidate of values)
+        if (candidate === value)
+            return true;
+    return false;
+}
+// `.message` of anything thrown: an Error, or an object shaped like one (got and oclif errors
+// are both). Anything else is stringified rather than read as `undefined`.
+export function errorMessage(error) {
+    return isRecord(error) && typeof error.message === 'string' ? error.message : String(error);
+}
+// The error a rethrown one wraps (`new Error(message, {cause})`), e.g. the got error behind
+// WpClient's formatted one.
+export function causeOf(error) {
+    return isRecord(error) ? error.cause : undefined;
+}
+// Node's errno code ('ENOENT', 'EEXIST', ...) when the thrown value carries one.
+export function errorCode(error) {
+    return isRecord(error) && typeof error.code === 'string' ? error.code : undefined;
+}

package/dist/lib/php-files-command.js

@@ -4,14 +4,17 @@ import { createHash } from 'node:crypto';
 import { mkdir, writeFile } from 'node:fs/promises';
 import { dirname, join, relative, sep } from 'node:path';
 import { authManager } from '../config/auth.manager.js';
+import {} from '../types/config.js';
 import { firstTopLevelSideEffect, startsWithStrictTypes } from '../utils/php-top-level.js';
 import { pluralize } from '../utils/pluralize.js';
 import { resolveResourceDir, RESOURCE_DIR_DEFAULTS } from '../utils/resource-dirs.js';
 import { ApiClient } from './api-client.js';
 import { LoopressCommand } from './base.js';
+import {} from './diff-state.js';
 import { basenameKey, findOrphanedFiles } from './find-orphaned-files.js';
 import { isInteractive } from './interactive.js';
 import { loadFiles as loadDirectoryFiles } from './load-files.js';
+import { errorMessage } from './narrow.js';
 import { PushCommand } from './push-command.js';
 import { getResourceStateProvider } from './resource-state.js';
 import { isApplicative404 } from './wp-client.js';
@@ -82,7 +85,7 @@ export function resourcePushCommand(spec) {
         static enableJsonFlag = true;
         static examples = [
             `$ lps ${spec.cliName} push`,
-            `$ lps ${spec.cliName} push --path ./${RESOURCE_DIR_DEFAULTS[spec.dirKind]}`,
+            `$ lps ${spec.cliName} push ./${RESOURCE_DIR_DEFAULTS[spec.dirKind]}`,
             `$ lps ${spec.cliName} push --prune`,
         ];
         static flags = {
@@ -158,14 +161,14 @@ export function resourcePushCommand(spec) {
                 result = await this.wp.post(`${spec.endpoint}/batch`, body);
             }
             catch (error) {
-                this.error(`Push failed, nothing was changed on ${this.siteConfig.url}: ${error.message}`);
+                this.error(`Push failed, nothing was changed on ${this.siteConfig.url}: ${errorMessage(error)}`);
             }
             for (const file of result.files) {
                 this.log(file.syntax_check === 'skipped'
                     ? `Pushed: ${file.filename} (syntax check skipped, unavailable on this host)`
                     : `Pushed: ${file.filename}`);
                 if (file.public) {
-                    this.warn(`${file.filename}: PUBLIC route, no authentication required. Anyone on the internet can call it. See https://loopress.dev/api/routes/#authentication-and-permissions`);
+                    this.warn(`${file.filename}: PUBLIC route, no authentication required. Anyone on the internet can call it. See https://docs.loopress.dev/api/routes/#authentication-and-permissions`);
                 }
             }
             for (const filename of result.pruned)
@@ -216,7 +219,7 @@ export function resourcePullCommand(spec) {
         static args = pathArg(spec.pathNoun);
         static description = spec.pullDescription;
         static enableJsonFlag = true;
-        static examples = [`$ lps ${spec.cliName} pull`, `$ lps ${spec.cliName} pull --path ./${RESOURCE_DIR_DEFAULTS[spec.dirKind]}`];
+        static examples = [`$ lps ${spec.cliName} pull`, `$ lps ${spec.cliName} pull ./${RESOURCE_DIR_DEFAULTS[spec.dirKind]}`];
         static flags = { ...LoopressCommand.dryRunFlag, ...LoopressCommand.yesFlag };
         async run() {
             const { args } = await this.parse(ResourcePull);
@@ -294,7 +297,7 @@ export function resourceListCommand(spec) {
 }
 export function resourceRmCommand(spec) {
     class ResourceRm extends LoopressCommand {
-        // `remove` matches `lps app remove` and `lps option remove`, `rm` stays for existing scripts.
+        // `rm` is canonical everywhere, `remove` stays an alias for existing scripts.
         static aliases = [`${spec.cliName}:remove`];
         static args = {
             filename: Args.string({

package/dist/lib/plugin-detection.d.ts

@@ -6,4 +6,3 @@ import { type WpClient } from './wp-client.js';
  * see Loopress Full itself.
  */
 export declare function isLoopressFullActive(wp: WpClient): Promise<boolean>;
-export declare const INTEGRATION_MISSING: RegExp;

package/dist/lib/plugin-detection.js

@@ -1,3 +1,5 @@
+import {} from '../types/plugin.js';
+import {} from './wp-client.js';
 const FULL_PLUGIN_PREFIX = 'loopress-full/';
 /**
  * Checks `wp/v2/plugins` directly rather than through `parseInstalledPlugins`
@@ -9,7 +11,3 @@ export async function isLoopressFullActive(wp) {
     const plugins = await wp.get('wp/v2/plugins');
     return plugins.some((plugin) => plugin.plugin.startsWith(FULL_PLUGIN_PREFIX) && plugin.status === 'active');
 }
-// How the Loopress plugin reports a resource's integration missing: "ACF is not active", "No
-// supported form plugin is active", "No supported snippet plugin is active". Global Styles say a
-// classic theme is active. The aggregate commands skip such a resource the project doesn't use.
-export const INTEGRATION_MISSING = /\bis not active\b|\bNo supported .+ plugin is active\b|\bis a classic theme\b/;

package/dist/lib/push-command.d.ts

@@ -7,7 +7,7 @@ export type PushChange = {
 };
 export declare function pushChanges(local: ResourceState, remote: ResourceState, options?: {
     mirror?: boolean;
-    writes?: (id: string) => boolean;
+    writes?: ((id: string) => boolean) | undefined;
 }): PushChange[];
 export declare function logChanges(log: (message: string) => void, changes: Array<{
     id: string;

package/dist/lib/push-command.js

@@ -5,10 +5,14 @@ import { Listr } from 'listr2';
 import { resolve } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { authManager } from '../config/auth.manager.js';
+import {} from '../types/config.js';
 import { API_URL } from './api-client.js';
 import { LoopressCommand } from './base.js';
+import {} from './diff-state.js';
 import { guardProductionPush } from './guard-production-push.js';
 import { isInteractive } from './interactive.js';
+import { errorMessage } from './narrow.js';
+import {} from './resource-state.js';
 import { readSnapshot, recordToState, writeSnapshot } from './snapshot-store.js';
 import { withoutSpinner, withSpinner } from './spinner.js';
 export function pushChanges(local, remote, options = {}) {
@@ -72,7 +76,7 @@ export class PushCommand extends LoopressCommand {
             catch (error) {
                 // The push reports the unreadable files itself, but an empty `changes` must not read as
                 // "nothing changes".
-                this.warn(`Could not list what this push would change: ${error.message}`);
+                this.warn(`Could not list what this push would change: ${errorMessage(error)}`);
             }
             logChanges((message) => { this.log(message); }, this.previewChanges);
             return undefined;
@@ -84,13 +88,14 @@ export class PushCommand extends LoopressCommand {
             }, dir);
         }
         catch (error) {
-            this.warn(`Could not read remote state for a rollback snapshot: ${error.message}`);
+            this.warn(`Could not read remote state for a rollback snapshot: ${errorMessage(error)}`);
             return undefined;
         }
         await this.guardOutsideEdits(provider, dir, remote, writes);
         return remote;
     }
     async catch(err) {
+        // Unset when init() failed before resolving the environment, despite its declared type.
         if (!this.dryRun && !this.refusedByGuard && this.siteConfig) {
             await this.recordDeployment('failure');
         }
@@ -120,7 +125,7 @@ export class PushCommand extends LoopressCommand {
             return await provider.remote(this.wp, () => { }, dir);
         }
         catch (error) {
-            this.error(`The site would refuse this push: ${error.message}`);
+            this.error(`The site would refuse this push: ${errorMessage(error)}`);
         }
     }
     async recordDeployment(status) {
@@ -211,7 +216,7 @@ export class PushCommand extends LoopressCommand {
             });
         }
         catch (error) {
-            this.warn(`Could not save a rollback snapshot after this push: ${error.message}`);
+            this.warn(`Could not save a rollback snapshot after this push: ${errorMessage(error)}`);
         }
     }
     // Refuses to silently overwrite a change made on the site outside Loopress (wp-admin, another
@@ -247,7 +252,7 @@ export class PushCommand extends LoopressCommand {
             local = await provider.local(dir, () => { }, this.wp);
         }
         catch (error) {
-            this.error(`Could not check for changes made on ${this.siteConfig.url} outside Loopress: ${error.message}. Retry, or pass --overwrite.`);
+            this.error(`Could not check for changes made on ${this.siteConfig.url} outside Loopress: ${errorMessage(error)}. Retry, or pass --overwrite.`);
         }
         const overwritten = [...local.keys()].filter((id) => (writes?.(id) ?? true) &&
             remote.get(id) !== undefined &&

package/dist/lib/put-or-create.d.ts

@@ -6,8 +6,8 @@ type PutOrCreateOptions = {
     postPayload?: Record<string, unknown>;
     putEndpoint: (id: number) => string;
 };
-export declare function putOrCreate<T>(wp: WpClient, options: PutOrCreateOptions): Promise<{
-    body: T;
+export declare function putOrCreate(wp: WpClient, options: PutOrCreateOptions): Promise<{
+    body: Record<string, unknown>;
     created: boolean;
 }>;
 export {};

package/dist/lib/readdir-tolerant.js

@@ -1,5 +1,7 @@
+import {} from 'node:fs';
 import { readdir, stat } from 'node:fs/promises';
 import { join, relative, sep } from 'node:path';
+import { errorCode } from './narrow.js';
 export async function readdirTolerant(dir, options) {
     try {
         return options?.withFileTypes
@@ -7,7 +9,7 @@ export async function readdirTolerant(dir, options) {
             : await readdir(dir, { recursive: options?.recursive });
     }
     catch (error) {
-        if (error.code === 'ENOENT')
+        if (errorCode(error) === 'ENOENT')
             return [];
         throw error;
     }

package/dist/lib/resource-state.js

@@ -1,20 +1,24 @@
 import { readFile } from 'node:fs/promises';
 import { basename, join, relative, sep } from 'node:path';
 import { ACF_OBJECT_TYPES, acfEndpoint, acfNormalizeEndpoint, getAcfKey } from '../utils/acf-format.js';
+import { BLOCKS_ENDPOINT, formatBlockProblems, readLocalBlocks } from '../utils/block-format.js';
 import { CPT_SPEC, fileExtension, META_SPEC, parseDeclaredFile, PATTERN_SPEC, ROLE_SPEC, TAXONOMY_SPEC, } from '../utils/declared-type-format.js';
 import { FORM_ENDPOINT, getFormId } from '../utils/form-format.js';
 import { getMenuSlug, MENU_ENDPOINT, MENU_LOCATIONS_ENDPOINT } from '../utils/menu-format.js';
 import { optionEndpoint, parseLocalOption } from '../utils/option-format.js';
 import { formatPageProblems, PAGES_ENDPOINT, readLocalHtmlFiles, readLocalPages } from '../utils/page-format.js';
+import {} from '../utils/resource-dirs.js';
 import { normalizeSnippet, SNIPPETS_ENDPOINT, stripPhpOpeningTag } from '../utils/snippet-format.js';
 import { CHILD_THEME_ENDPOINT, parsePartFile, parseTemplateFile, TEMPLATE_SLUG_RULE } from '../utils/template-format.js';
 import { canonicalGlobalStyles, getActiveThemeGlobalStyles, globalStylesEndpoint, THEME_STYLES_FILE_SUFFIX, } from '../utils/theme-styles-format.js';
+import {} from './diff-state.js';
 import { loadFiles } from './load-files.js';
 import { loadSnippets } from './load-snippets.js';
+import { causeOf, errorCode, isRecord } from './narrow.js';
 import { isApplicative404, isNotFoundError } from './wp-client.js';
 function readJson(raw) {
     const parsed = JSON.parse(raw);
-    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+    if (!isRecord(parsed) || Array.isArray(parsed)) {
         throw new Error('not a JSON object');
     }
     return parsed;
@@ -59,7 +63,7 @@ const snippetProvider = {
         catch (error) {
             // A directory that was never created is "nothing tracked locally", the same tolerance
             // loadFiles/readdirTolerant already have; loadSnippets wraps the ENOENT in its own Error.
-            if (error.cause?.code === 'ENOENT')
+            if (errorCode(causeOf(error)) === 'ENOENT')
                 return state;
             throw error;
         }
@@ -166,20 +170,20 @@ const acfProvider = {
     title: 'ACF',
 };
 // ---- PHP file directories (API routes, hooks) -----------------------------------------
+function filesToState(files) {
+    const state = new Map();
+    for (const file of files)
+        state.set(file.filename, file.content);
+    return state;
+}
 // api/ and hooks/ are both just a recursive directory of PHP files whose text is compared
 // verbatim (line diff on change), no server-side normalization to undo. Only the directory
 // kind, the endpoint and the labels differ.
 function phpFilesProvider(spec) {
-    const toState = (files) => {
-        const state = new Map();
-        for (const file of files)
-            state.set(file.filename, file.content);
-        return state;
-    };
     return {
         dirKind: spec.dirKind,
         async local(dir, onWarn) {
-            return toState(await loadFiles(dir, {
+            return filesToState(await loadFiles(dir, {
                 extension: '.php',
                 onSkip: onWarn,
                 parse: (raw, filePath) => ({
@@ -190,7 +194,7 @@ function phpFilesProvider(spec) {
             }));
         },
         async remote(wp) {
-            return toState(await wp.get(spec.endpoint));
+            return filesToState(await wp.get(spec.endpoint));
         },
         resource: spec.resource,
         title: spec.title,
@@ -208,6 +212,24 @@ const hookProvider = phpFilesProvider({
     resource: 'hook',
     title: 'Hooks',
 });
+// ---- Dynamic blocks -------------------------------------------------------------------
+// Keyed by slug, compared on the whole folder (file name => text). A local problem fails the
+// resource, the same stance as pages: pushing would stop on it anyway.
+const blockProvider = {
+    dirKind: 'block',
+    async local(dir) {
+        const { blocks, problems } = await readLocalBlocks(dir);
+        if (problems.length > 0)
+            throw new Error(formatBlockProblems(problems));
+        return new Map(blocks.map((block) => [block.slug, block.files]));
+    },
+    async remote(wp) {
+        const blocks = await wp.get(BLOCKS_ENDPOINT);
+        return new Map(blocks.map((block) => [block.slug, block.files]));
+    },
+    resource: 'block',
+    title: 'Dynamic blocks',
+};
 // ---- Pages ------------------------------------------------------------------------------
 // Keyed by slug (the page's identity on both sides). `link` is server-derived and never
 // compared. A local problem (a `.php` in pages/, a bad header) fails the whole resource rather
@@ -240,8 +262,10 @@ async function childThemeState(wp, kind) {
     const state = new Map(files.map(({ slug, ...rest }) => [slug, rest]));
     for (const entry of child.customized) {
         const [dir, slug] = entry.split('/', 2);
-        if (dir === kind)
-            state.set(slug, { ...state.get(slug), siteEditor: 'customized' });
+        if (dir === kind && slug !== undefined) {
+            const existing = state.get(slug);
+            state.set(slug, { ...(isRecord(existing) && existing), siteEditor: 'customized' });
+        }
     }
     return state;
 }
@@ -430,6 +454,7 @@ export const RESOURCE_STATE_PROVIDERS = [
     acfProvider,
     apiProvider,
     hookProvider,
+    blockProvider,
     templateProvider,
     partProvider,
     pageProvider,
@@ -476,7 +501,7 @@ export async function composerLocalState(rootDir) {
             state.set(file, await readFile(join(rootDir, file), 'utf8'));
         }
         catch (error) {
-            if (error.code !== 'ENOENT')
+            if (errorCode(error) !== 'ENOENT')
                 throw error;
         }
     }

package/dist/lib/rollback-command.d.ts

@@ -1,7 +1,7 @@
 import { LoopressCommand } from './base.js';
 import { type SnapshotSummary } from './snapshot-store.js';
 export type RollbackResult = {
-    drift?: {
+    drift?: undefined | {
         added: string[];
         changed: string[];
         removed: string[];

package/dist/lib/rollback-command.js

@@ -9,6 +9,7 @@ import { LoopressCommand } from './base.js';
 import { compareStates, isEmptyDiff } from './diff-state.js';
 import { guardProductionPush } from './guard-production-push.js';
 import { isInteractive } from './interactive.js';
+import { errorMessage } from './narrow.js';
 import { getResourceStateProvider } from './resource-state.js';
 import { materializeSnapshot } from './rollback-materialize.js';
 import { listSnapshots, readSnapshot, recordToState } from './snapshot-store.js';
@@ -69,7 +70,7 @@ export function resourceRollbackCommand(resource, options) {
                 snapshot = await readSnapshot(rootDir, resource, this.siteConfig.name, flags.to);
             }
             catch (error) {
-                this.error(error.message);
+                this.error(errorMessage(error));
             }
             await guardProductionPush({
                 dryRun: this.dryRun,
@@ -140,7 +141,7 @@ export function resourceRollbackCommand(resource, options) {
                 // A cleanup failure here must never hide a real error from the push above: warn about
                 // it and let the original error (if any) keep propagating instead of being replaced.
                 await rm(tmpDir, { force: true, recursive: true }).catch((error) => {
-                    this.warn(`Could not remove the temporary directory "${tmpDir}": ${error.message}`);
+                    this.warn(`Could not remove the temporary directory "${tmpDir}": ${errorMessage(error)}`);
                 });
             }
             this.log(`Rolled back ${provider.title} to the snapshot from ${snapshot.createdAt}.`);

package/dist/lib/rollback-materialize.js

@@ -1,13 +1,16 @@
 import { mkdir, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
+import { z } from 'zod';
 import { getAcfKey } from '../utils/acf-format.js';
+import { writeBlock } from '../utils/block-format.js';
 import { CPT_SPEC, fileExtension, formatDeclaredFile, META_SPEC, PATTERN_SPEC, ROLE_SPEC, TAXONOMY_SPEC } from '../utils/declared-type-format.js';
 import { getFormId, getFormTitle } from '../utils/form-format.js';
 import { getMenuSlug } from '../utils/menu-format.js';
 import { defaultReadonlyFor, optionFileName } from '../utils/option-format.js';
-import { buildMetaFile, buildSnippetFile } from '../utils/snippet-format.js';
+import { buildMetaFile, buildSnippetFile, normalizeSnippet } from '../utils/snippet-format.js';
 import { themeStylesFileName } from '../utils/theme-styles-format.js';
 import { toSlug } from '../utils/to-slug.js';
+import { isRecord } from './narrow.js';
 const SNIPPET_EXTENSIONS = { css: 'css', html: 'html', js: 'js', php: 'php', text: 'txt' };
 async function writeJson(path, value) {
     await mkdir(dirname(path), { recursive: true });
@@ -19,9 +22,20 @@ async function writeJson(path, value) {
 // compares (no `id`, no `description`, `code` with its `<?php` tag already stripped), exactly
 // what `normalizeSnippet` + `stripPhpOpeningTag` produce, so it plugs straight into the same
 // `buildSnippetFile`/`buildMetaFile` pair `snippet pull` uses to write files.
+// A snapshot entry that should be an object: anything else is a corrupted snapshot file.
+function snapshotRecord(id, value) {
+    if (!isRecord(value))
+        throw new Error(`Snapshot entry "${id}" is not an object.`);
+    return value;
+}
+const SNAPSHOT_OPTION = z.object({ autoload: z.string(), value: z.unknown() });
 async function snippet(id, value, dir) {
-    const fields = value;
-    const normalized = { ...fields, description: '', id: Number(id) };
+    const data = snapshotRecord(id, value);
+    // normalizeSnippet would coerce it, writing a corrupted entry's code over the live snippet.
+    if (typeof data.code !== 'string')
+        throw new Error(`Snapshot entry "${id}" has a non-string "code".`);
+    // normalizeSnippet is idempotent on its own output, so it narrows `data` without changing it.
+    const normalized = { ...normalizeSnippet(data), description: '', id: Number(id) };
     const ext = SNIPPET_EXTENSIONS[normalized.type];
     const base = `${normalized.id}-${toSlug(normalized.name)}`;
     await mkdir(dir, { recursive: true });
@@ -31,7 +45,7 @@ async function snippet(id, value, dir) {
 // value is the whole form JSON (minus `modified`/`modified_gmt`), the same shape `form pull`
 // writes verbatim; `form push` re-sends it as-is.
 async function form(id, value, dir) {
-    const data = value;
+    const data = snapshotRecord(id, value);
     const formId = getFormId(data) ?? Number(id);
     const slug = toSlug(getFormTitle(data), 'untitled');
     await writeJson(join(dir, `${formId}-${slug}.json`), data);
@@ -41,7 +55,7 @@ async function form(id, value, dir) {
 async function acf(id, value, dir) {
     const separator = id.indexOf('/');
     const type = id.slice(0, separator);
-    const data = value;
+    const data = snapshotRecord(id, value);
     const key = getAcfKey(data) ?? id.slice(separator + 1);
     await writeJson(join(dir, type, `${key}.json`), data);
 }
@@ -51,13 +65,18 @@ async function phpFile(id, value, dir) {
     await mkdir(dirname(filePath), { recursive: true });
     await writeFile(filePath, String(value));
 }
+// block: id is the slug, value the folder's files (file name => text).
+async function block(id, value, dir) {
+    const files = snapshotRecord(id, value);
+    await writeBlock(dir, { files: Object.fromEntries(Object.entries(files).map(([name, content]) => [name, String(content)])), slug: id });
+}
 // ids are 'menu-locations' or `menu/<slug>` (see resource-state.ts's menuProvider).
 async function menu(id, value, dir) {
     if (id === 'menu-locations') {
         await writeJson(join(dir, 'menu-locations.json'), value);
         return;
     }
-    const data = value;
+    const data = snapshotRecord(id, value);
     const slug = getMenuSlug(data) ?? id.slice('menu/'.length);
     await writeJson(join(dir, `${slug}.json`), data);
 }
@@ -67,7 +86,7 @@ async function menu(id, value, dir) {
 // dangerous option (siteurl, home, ...); defaulting to the same policy `option add` itself uses
 // keeps a rolled-back option exactly as protected as a freshly tracked one, never less.
 async function option(id, value, dir) {
-    const { autoload, value: optionValue } = value;
+    const { autoload, value: optionValue } = SNAPSHOT_OPTION.parse(value);
     const local = { autoload, name: id, readonly: defaultReadonlyFor(id), value: optionValue };
     await writeJson(join(dir, optionFileName(id)), local);
 }
@@ -79,12 +98,13 @@ async function themeStyles(id, value, dir) {
 // written in the spec's file format like `<resource> pull` does.
 function declaredType(spec) {
     return async (id, value, dir) => {
-        await writeFile(join(dir, `${id}${fileExtension(spec)}`), formatDeclaredFile(spec, value));
+        await writeFile(join(dir, `${id}${fileExtension(spec)}`), formatDeclaredFile(spec, snapshotRecord(id, value)));
     };
 }
 const MATERIALIZERS = {
     acf,
     api: phpFile,
+    block,
     cpt: declaredType(CPT_SPEC),
     form,
     hook: phpFile,

package/dist/lib/rotate-app-password.js

@@ -1,3 +1,4 @@
+import {} from '../types/config.js';
 import { WpClient } from './wp-client.js';
 const APPLICATION_PASSWORDS_PATH = 'wp/v2/users/me/application-passwords';
 export const APP_PASSWORD_MAX_AGE_MS = 90 * 24 * 60 * 60 * 1000;

package/dist/lib/sentry.js

@@ -20,8 +20,8 @@ export function runtimeContext() {
         os: `${platform()} ${release()}`,
     };
 }
-// Positional args and flag values can carry WordPress URLs, usernames, application passwords,
-// or tokens (e.g. `lps login --token xxx`, `lps project config <url>`). Only flag names are
+// Positional args and flag values are user input: environment names, local paths, slugs, and
+// anything else typed after a command, possibly a URL or a credential. Only flag names are
 // safe to report, they help tell which code path crashed without leaking what was passed to it.
 export function redactArgv(argv) {
     return argv.map((arg) => {