@loopress/cli 0.32.2 → 0.34.0

package/dist/utils/composer.js

@@ -2,17 +2,41 @@ import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import writeFileAtomic from 'write-file-atomic';
+import { z } from 'zod';
+import { errorMessage } from '../lib/narrow.js';
 import { withSpinner } from '../lib/spinner.js';
+import {} from './plugin-sync.js';
+import {} from './plugins.js';
 import { isExactVersion } from './version.js';
 // Why pullIntoComposerJson skips a plugin it can't install: premium or custom, not on WPackagist.
 export const NOT_ON_WORDPRESS_ORG = 'not on WordPress.org';
+// Only the sections the CLI reads are checked: the rest is Composer's own business, and goes
+// back to disk untouched.
+export const COMPOSER_JSON = z.looseObject({
+    require: z.record(z.string(), z.string('"require" must map each package to a version constraint'), '"require" must be an object').optional(),
+    'require-dev': z
+        .record(z.string(), z.string('"require-dev" must map each package to a version constraint'), '"require-dev" must be an object')
+        .optional(),
+}, 'expected a JSON object');
+// Returns the parsed object itself, not zod's copy: zod's output moves the checked keys first, and
+// pullIntoComposerJson writes this object back to the user's composer.json.
+export function parseComposerJson(raw) {
+    const parsed = JSON.parse(raw);
+    if (isComposerJson(parsed))
+        return parsed;
+    const issues = COMPOSER_JSON.safeParse(parsed).error?.issues ?? [];
+    throw new Error(`Invalid composer.json: ${issues.map(({ message }) => message).join(', ')}`);
+}
+function isComposerJson(value) {
+    return COMPOSER_JSON.safeParse(value).success;
+}
 export async function readComposerJson() {
     const path = join(process.cwd(), 'composer.json');
     if (!existsSync(path))
         return null;
     try {
         const content = await readFile(path, 'utf8');
-        return JSON.parse(content);
+        return parseComposerJson(content);
     }
     catch {
         return null;
@@ -48,7 +72,7 @@ async function isOnWordPressOrg(kind, slug) {
         response = await withSpinner(`Checking WordPress.org for ${slug}`, async () => fetch(url));
     }
     catch (error) {
-        throw fail(`network error: ${error.message}`);
+        throw fail(`network error: ${errorMessage(error)}`);
     }
     if (response.status === 404)
         return false;
@@ -77,15 +101,16 @@ function planComposerPull(composerJson, prefix, incoming) {
     const require = composerJson.require ?? {};
     const allPackages = { ...require, ...composerJson['require-dev'] };
     const providedBy = new Map(Object.keys(allPackages)
-        .filter((name) => !name.startsWith(prefix) && name.includes('/'))
+        .filter((name) => !name.startsWith('wpackagist-plugin/') && !name.startsWith('wpackagist-theme/') && name.includes('/'))
         .map((name) => [name.split('/', 2)[1], name]));
     const result = { added: [], merged: {}, skipped: [], updated: [] };
     const candidates = [];
     for (const [slug, version] of Object.entries(incoming)) {
         const name = prefix + slug;
         const provider = providedBy.get(slug);
-        if (Object.hasOwn(allPackages, name)) {
-            const outcome = classifyDeclared(allPackages[name], version, Object.hasOwn(require, name));
+        const declared = Object.hasOwn(allPackages, name) ? allPackages[name] : undefined;
+        if (declared !== undefined) {
+            const outcome = classifyDeclared(declared, version, Object.hasOwn(require, name));
             if ('skip' in outcome) {
                 result.skipped.push({ reason: outcome.skip, slug });
                 continue;
@@ -98,7 +123,7 @@ function planComposerPull(composerJson, prefix, incoming) {
             result.skipped.push({ reason: `provided by ${provider}`, slug });
         }
         else {
-            candidates.push(slug);
+            candidates.push([slug, version]);
         }
     }
     return { candidates, result };
@@ -112,14 +137,14 @@ function planComposerPull(composerJson, prefix, incoming) {
 // - A slug provided by another package (acme/<slug>) or absent from WordPress.org is skipped.
 export async function pullIntoComposerJson(path, kind, incoming, { dryRun, log }) {
     const raw = await readFile(path, 'utf8');
-    const composerJson = JSON.parse(raw);
+    const composerJson = parseComposerJson(raw);
     const prefix = `wpackagist-${kind}/`;
     const { candidates, result } = planComposerPull(composerJson, prefix, incoming);
-    const found = await Promise.all(candidates.map(async (slug) => isOnWordPressOrg(kind, slug)));
-    for (const [i, slug] of candidates.entries()) {
-        if (found[i]) {
+    const checked = await Promise.all(candidates.map(async ([slug, version]) => ({ onWordPressOrg: await isOnWordPressOrg(kind, slug), slug, version })));
+    for (const { onWordPressOrg, slug, version } of checked) {
+        if (onWordPressOrg) {
             result.added.push(slug);
-            result.merged[slug] = incoming[slug];
+            result.merged[slug] = version;
         }
         else {
             result.skipped.push({ reason: NOT_ON_WORDPRESS_ORG, slug });
@@ -146,21 +171,23 @@ export async function pullIntoComposerJson(path, kind, incoming, { dryRun, log }
 // Split a composer.json `require` map into the three intent namespaces the sync endpoint
 // understands. `composer/installers` is owned by the server scaffold, never sent.
 export function toIntent(require) {
-    const intent = { libraries: {}, plugins: {}, themes: {} };
+    const plugins = {};
+    const themes = {};
+    const libraries = {};
     for (const [name, constraint] of Object.entries(require)) {
         if (name === 'composer/installers')
             continue;
         if (name.startsWith('wpackagist-plugin/')) {
-            intent.plugins[name.slice('wpackagist-plugin/'.length)] = constraint;
+            plugins[name.slice('wpackagist-plugin/'.length)] = constraint;
         }
         else if (name.startsWith('wpackagist-theme/')) {
-            intent.themes[name.slice('wpackagist-theme/'.length)] = constraint;
+            themes[name.slice('wpackagist-theme/'.length)] = constraint;
         }
         else {
-            intent.libraries[name] = constraint;
+            libraries[name] = constraint;
         }
     }
-    return intent;
+    return { libraries, plugins, themes };
 }
 // What a push installs: `require`, plus `require-dev` on the local environment only (Query
 // Monitor, or a premium plugin's free edition to develop against). A remote site never gets

package/dist/utils/declared-type-format.js

@@ -1,5 +1,7 @@
 import { basename } from 'node:path';
+import { z } from 'zod';
 import { parseHtmlHeader, titleFromSlug } from './page-format.js';
+import {} from './resource-dirs.js';
 export const CPT_SPEC = {
     arrayArgs: { capabilities: [], labels: [], rewrite: [true, false], supports: [false], taxonomies: [], template: [] },
     cliName: 'cpt',
@@ -31,15 +33,16 @@ export const TAXONOMY_SPEC = {
     // register_taxonomy() creates the default term when it doesn't exist yet.
     termArgs: ['default_term'],
 };
-const isObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
-// register_post_meta()'s `type` values, each with the check its `default` must pass.
+const JSON_OBJECT = z.record(z.string(), z.unknown());
+const isObject = (value) => JSON_OBJECT.safeParse(value).success;
+// register_post_meta()'s `type` values, each with the schema its `default` must pass.
 const META_TYPES = {
-    array: Array.isArray,
-    boolean: (value) => typeof value === 'boolean',
-    integer: Number.isSafeInteger,
-    number: (value) => typeof value === 'number',
-    object: isObject,
-    string: (value) => typeof value === 'string',
+    array: z.array(z.unknown()),
+    boolean: z.boolean(),
+    integer: z.int(),
+    number: z.number(),
+    object: JSON_OBJECT,
+    string: z.string(),
 };
 function checkMetaRest(key, type, rest) {
     if (typeof rest !== 'boolean' && !isObject(rest))
@@ -54,7 +57,7 @@ function checkMetaRest(key, type, rest) {
     }
 }
 function checkMetaKey(key, meta) {
-    if (!/^[a-zA-Z0-9_-]{1,255}$/.test(key))
+    if (!/^[\w-]{1,255}$/.test(key))
         throw new Error(`"${key}" is not a valid meta key: 1 to 255 letters, digits, "_" or "-"`);
     if (!isObject(meta))
         throw new Error(`"${key}" must be a JSON object of register_post_meta() arguments`);
@@ -62,13 +65,14 @@ function checkMetaKey(key, meta) {
     if (code)
         throw new Error(`"${key}": "${code}" runs PHP code, use a hook instead of a file for it`);
     const { type } = meta;
-    if (typeof type !== 'string' || !Object.hasOwn(META_TYPES, type)) {
+    const schema = typeof type === 'string' && Object.hasOwn(META_TYPES, type) ? META_TYPES[type] : undefined;
+    if (typeof type !== 'string' || !schema) {
         throw new Error(`"${key}": "type" must be one of ${Object.keys(META_TYPES).join(', ')}`);
     }
     if (Object.hasOwn(meta, 'single') && typeof meta.single !== 'boolean')
         throw new Error(`"${key}": "single" must be true or false`);
-    checkMetaRest(key, type, meta.show_in_rest ?? false);
-    if (Object.hasOwn(meta, 'default') && !META_TYPES[type](meta.default))
+    checkMetaRest(key, type, Object.hasOwn(meta, 'show_in_rest') ? meta.show_in_rest : false);
+    if (Object.hasOwn(meta, 'default') && !schema.safeParse(meta.default).success)
         throw new Error(`"${key}": "default" must be a ${type}`);
 }
 // Same checks as the plugin's PostMetaService::assertArgs(): the file is `key => register_post_meta()
@@ -99,7 +103,7 @@ function checkRoleArgs(args) {
     if (typeof args.name !== 'string' || args.name.trim() === '')
         throw new Error('"name" must be a non-empty string');
     const capabilities = args.capabilities ?? {};
-    if (!isObject(capabilities) || Object.values(capabilities).some((granted) => typeof granted !== 'boolean')) {
+    if (!z.record(z.string(), z.boolean()).safeParse(capabilities).success) {
         throw new Error('"capabilities" must map each capability name to true or false');
     }
 }
@@ -132,6 +136,8 @@ const PATTERN_HEADER = {
     title: { key: 'title', type: 'text' },
     'viewport-width': { key: 'viewportWidth', type: 'integer' },
 };
+// Typed lookups by header name: a plain object index needs `keyof typeof` on a string.
+const PATTERN_HEADER_BY_NAME = new Map(Object.entries(PATTERN_HEADER));
 function readPatternValue(header, type, value) {
     if (type === 'list')
         return value.split(',').map((item) => item.trim()).filter(Boolean);
@@ -152,8 +158,10 @@ export function parsePatternFile(slug, raw) {
     const { body, meta } = parseHtmlHeader(raw, Object.keys(PATTERN_HEADER));
     const args = { title: titleFromSlug(slug) };
     for (const [header, value] of Object.entries(meta)) {
-        const { key, type } = PATTERN_HEADER[header];
-        args[key] = readPatternValue(header, type, value);
+        // parseHtmlHeader already refuses any other header name.
+        const spec = PATTERN_HEADER_BY_NAME.get(header);
+        if (spec)
+            args[spec.key] = readPatternValue(header, spec.type, value);
     }
     args.content = body;
     return args;
@@ -199,11 +207,10 @@ export function itemEndpoint(spec, slug) {
     return `${spec.endpoint}/${encodeURIComponent(slug)}`;
 }
 export function parseDeclaredArgs(raw) {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+    const result = JSON_OBJECT.safeParse(JSON.parse(raw));
+    if (!result.success)
         throw new Error('not a JSON object of arguments');
-    }
-    return parsed;
+    return result.data;
 }
 // `lps validate`'s check of one file: the file name is a valid slug, array arguments are arrays,
 // and no argument is code.

package/dist/utils/form-format.js

@@ -1,3 +1,4 @@
+import { isRecord } from '../lib/narrow.js';
 export const FORM_ENDPOINT = 'loopress/v1/forms';
 export function formEndpoint(id) {
     return `${FORM_ENDPOINT}/${id}`;
@@ -7,7 +8,6 @@ export function getFormId(data) {
     return Number.isSafeInteger(id) && id > 0 ? id : null;
 }
 export function getFormTitle(data) {
-    const settings = data.settings;
-    const title = settings?.form_title;
+    const title = isRecord(data.settings) ? data.settings.form_title : undefined;
     return typeof title === 'string' && title.trim() !== '' ? title : '(untitled)';
 }

package/dist/utils/loopress-config.js

@@ -1,6 +1,8 @@
 import { existsSync } from 'node:fs';
 import { readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { isRecord } from '../lib/narrow.js';
+import {} from '../types/project-config.generated.js';
 // Only a missing file is treated as "no config" (returns {}). A file that exists but
 // fails to read or parse throws, so callers don't silently fall back to the global
 // current environment when loopress.json is actually broken.
@@ -9,12 +11,18 @@ export async function readLocalConfig() {
     if (!existsSync(configPath))
         return {};
     const content = await readFile(configPath, 'utf8');
+    let parsed;
     try {
-        return JSON.parse(content);
+        parsed = JSON.parse(content);
     }
     catch {
         throw new Error('loopress.json is not valid JSON. Fix or delete it, then run `lps init` again.');
     }
+    if (!isRecord(parsed) || Array.isArray(parsed))
+        throw new Error('loopress.json must be a JSON object. Fix or delete it, then run `lps init` again.');
+    // Its keys are checked by `lps validate` (lib/validate-local.ts), not here: schemas/project-config.schema.json
+    // refuses unknown keys, which would stop every command over one stray key.
+    return parsed;
 }
 export async function writeLocalConfig(config) {
     const configPath = join(process.cwd(), 'loopress.json');

package/dist/utils/menu-format.d.ts

@@ -1,3 +1,4 @@
+import { z } from 'zod';
 export declare const MENU_ENDPOINT = "loopress/v1/menus";
 export declare const MENU_LOCATIONS_ENDPOINT = "loopress/v1/menu-locations";
 export declare function menuEndpoint(slug: string): string;
@@ -20,5 +21,6 @@ export type Menu = {
     slug: string;
     warnings: string[];
 };
-export type MenuLocations = Record<string, null | string>;
+export declare const MENU_LOCATIONS: z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>;
+export type MenuLocations = z.infer<typeof MENU_LOCATIONS>;
 export declare function getMenuSlug(data: Record<string, unknown>): null | string;

package/dist/utils/menu-format.js

@@ -1,8 +1,13 @@
+import { z } from 'zod';
 export const MENU_ENDPOINT = 'loopress/v1/menus';
 export const MENU_LOCATIONS_ENDPOINT = 'loopress/v1/menu-locations';
 export function menuEndpoint(slug) {
     return `${MENU_ENDPOINT}/${encodeURIComponent(slug)}`;
 }
+// location => menu slug, or null when unassigned. Scoped to whichever theme is active on
+// whichever environment answered the request (a theme_mod, see MenuService::getLocations()).
+// Location slug -> assigned menu slug, null for an unassigned location.
+export const MENU_LOCATIONS = z.record(z.string(), z.string().nullable());
 export function getMenuSlug(data) {
     return typeof data.slug === 'string' && data.slug.trim() !== '' ? data.slug : null;
 }

package/dist/utils/option-format.d.ts

@@ -6,8 +6,8 @@ export type OptionRefs = Record<string, string>;
 export type LocalOption = {
     autoload: string;
     name: string;
-    readonly?: boolean;
-    refs?: OptionRefs;
+    readonly?: boolean | undefined;
+    refs?: OptionRefs | undefined;
     value: unknown;
 };
 export type RemoteOption = {

package/dist/utils/option-format.js

@@ -1,3 +1,4 @@
+import { z } from 'zod';
 export const OPTIONS_ENDPOINT = 'loopress/v1/options';
 // `refs` asks WordPress to return the declared post references as paths (see OptionRefs).
 export function optionEndpoint(name, refs) {
@@ -49,32 +50,21 @@ export function partitionByReadonly(tracked) {
         (option.readonly ? skipped : writable).push(option);
     return { skipped, writable };
 }
-export function parseLocalOption(raw) {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
-        throw new Error('not a JSON object');
-    }
-    const { autoload, name, refs, value } = parsed;
-    if (typeof name !== 'string' || name === '') {
-        throw new Error('missing a "name" string');
-    }
-    if (typeof autoload !== 'string') {
-        throw new TypeError('missing an "autoload" string');
-    }
+const REFS_ERROR = '"refs" must map a value path to a post type, e.g. {"purchase_page": "page"}';
+// Each check's message is the error thrown for it, the first failing one wins. Loose: unknown
+// keys (`readonly`, future ones) pass through untouched.
+const LOCAL_OPTION = z.looseObject({
+    name: z.string('missing a "name" string').min(1, 'missing a "name" string'),
+    autoload: z.string('missing an "autoload" string'),
     // `value` itself is deliberately untyped (a WP option can hold any JSON-safe value, including
     // null); only the key's presence is checked, so a hand-edited file that dropped it entirely is
     // rejected here rather than silently pushing an `undefined` value to WordPress.
-    if (value === undefined) {
-        throw new Error('missing a "value" field');
-    }
-    if (refs !== undefined && !isOptionRefs(refs)) {
-        throw new TypeError('"refs" must map a value path to a post type, e.g. {"purchase_page": "page"}');
-    }
-    return parsed;
-}
-function isOptionRefs(refs) {
-    return (typeof refs === 'object' &&
-        refs !== null &&
-        !Array.isArray(refs) &&
-        Object.entries(refs).every(([path, postType]) => path !== '' && typeof postType === 'string' && postType !== ''));
+    value: z.custom((value) => value !== undefined, 'missing a "value" field'),
+    refs: z.record(z.string().min(1, REFS_ERROR), z.string(REFS_ERROR).min(1, REFS_ERROR), REFS_ERROR).optional(),
+}, 'not a JSON object');
+export function parseLocalOption(raw) {
+    const result = LOCAL_OPTION.safeParse(JSON.parse(raw));
+    if (!result.success)
+        throw new TypeError(result.error.issues[0]?.message);
+    return result.data;
 }

package/dist/utils/page-format.js

@@ -1,5 +1,7 @@
 import { readdir, readFile } from 'node:fs/promises';
 import { basename, extname, join } from 'node:path';
+import { withoutExcluded } from '../lib/exclude.js';
+import { errorCode, errorMessage, isOneOf } from '../lib/narrow.js';
 export const PAGES_ENDPOINT = 'loopress/v1/pages';
 // Mirrored server-side in PagesController. No leading, trailing or doubled hyphen: WordPress's
 // sanitize_title() would rewrite those, and the page would no longer match its file name.
@@ -45,7 +47,7 @@ export function titleFromSlug(slug) {
 export function parsePageFile(slug, raw) {
     const { body, meta } = parseHtmlHeader(raw, HEADER_KEYS);
     const status = meta.status ?? 'draft';
-    if (!PAGE_STATUSES.includes(status)) {
+    if (!isOneOf(PAGE_STATUSES, status)) {
         throw new Error(`status "${status}" is not one of ${PAGE_STATUSES.join(', ')}`);
     }
     return {
@@ -53,9 +55,9 @@ export function parsePageFile(slug, raw) {
         hideTitle: parseBoolean('hide-title', meta['hide-title']),
         html: body,
         slug,
-        status: status,
+        status,
         template: meta.template ?? '',
-        title: meta.title || titleFromSlug(slug),
+        title: (meta.title ?? '') || titleFromSlug(slug),
     };
 }
 // Splits the optional `key: value` HTML comment header off `raw`. Shared with templates/.
@@ -64,7 +66,7 @@ export function parseHtmlHeader(raw, keys) {
     const meta = {};
     if (!header)
         return { body: raw, meta };
-    for (const line of header[1].split(/\r?\n/)) {
+    for (const line of (header[1] ?? '').split(/\r?\n/)) {
         if (line.trim() === '')
             continue;
         const colon = line.indexOf(':');
@@ -89,10 +91,10 @@ export async function readLocalPages(dir) {
 export async function readLocalHtmlFiles(dir, parse, slugRule = PAGE_SLUG_RULE) {
     let entries;
     try {
-        entries = await readdir(dir, { withFileTypes: true });
+        entries = withoutExcluded(dir, await readdir(dir, { withFileTypes: true }), (entry) => entry.name);
     }
     catch (error) {
-        if (error.code === 'ENOENT')
+        if (errorCode(error) === 'ENOENT')
             return { files: [], problems: [] };
         throw error;
     }
@@ -120,7 +122,7 @@ export async function readLocalHtmlFiles(dir, parse, slugRule = PAGE_SLUG_RULE)
             files.push(parse(slug, await readFile(filePath, 'utf8')));
         }
         catch (error) {
-            problems.push({ file: filePath, message: error.message });
+            problems.push({ file: filePath, message: errorMessage(error) });
         }
     }
     return { files, problems };

package/dist/utils/php-top-level.js

@@ -10,7 +10,7 @@ const OPEN_TAG = /<\?php\b/i;
 export function firstTopLevelSideEffect(content) {
     if (content.search(OPEN_TAG) !== 0)
         return 'inline HTML before <?php';
-    const state = { atStart: true, braces: [], depth: 0, namespaceHeader: false };
+    const state = { atStart: true, attribute: 0, braces: [], depth: 0, namespaceHeader: false };
     for (const token of lex(content.slice(5))) {
         const found = step(state, token);
         if (found !== null)
@@ -36,6 +36,8 @@ export function startsWithStrictTypes(content) {
 function step(state, token) {
     if (token.type === 'html')
         return inlineHtml(state, token);
+    if (state.attribute > 0 || token.type === 'attribute')
+        return skipAttribute(state, token);
     const statementStart = state.depth === 0 && state.atStart;
     switch (token.text) {
         case ';': {
@@ -64,6 +66,15 @@ function step(state, token) {
         }
     }
 }
+// An attribute (`#[Attr(...)]`) only decorates what follows it, so the statement still starts
+// after its closing `]`: `#[Attr] foo();` must report `foo`.
+function skipAttribute(state, token) {
+    if (token.type === 'attribute' || token.text === '[')
+        state.attribute += 1;
+    else if (token.text === ']')
+        state.attribute -= 1;
+    return null;
+}
 // A template inside a class or function body (`?> <p>...</p> <?php`) only runs when it is called.
 function inlineHtml(state, token) {
     if (state.depth > 0)
@@ -86,7 +97,7 @@ function openBrace(state, statementStart) {
     return null;
 }
 function isDeclaration(token) {
-    return token.type === 'attribute' || (token.type === 'word' && ALLOWED.has(token.text.toLowerCase()));
+    return token.type === 'word' && ALLOWED.has(token.text.toLowerCase());
 }
 function* lex(source) {
     let i = skipTrivia(source, 0);
@@ -126,13 +137,13 @@ function readToken(source, i) {
     }
     if (source.startsWith('#[', i))
         return [{ text: '#[', type: 'attribute' }, i + 2];
-    if (source.startsWith('<<<', i) || `'"\``.includes(source[i])) {
+    if (source.startsWith('<<<', i) || `'"\``.includes(source.charAt(i))) {
         return [{ text: source[i] === '`' ? '`' : 'a string', type: 'string' }, skipString(source, i)];
     }
     const word = /^[\w$\\]+/.exec(source.slice(i));
     if (word)
         return [{ text: word[0], type: 'word' }, i + word[0].length];
-    return [{ text: source[i], type: 'punct' }, i + 1];
+    return [{ text: source.charAt(i), type: 'punct' }, i + 1];
 }
 // Index right after the string (quoted, backtick, heredoc or nowdoc) starting at `i`.
 function skipString(source, i) {

package/dist/utils/plugin-sync.d.ts

@@ -1,3 +1,4 @@
+import { z } from 'zod';
 export declare const SYNC_TIMEOUT_MS = 600000;
 export type SyncIntent = {
     libraries?: Record<string, string>;
@@ -20,13 +21,12 @@ export type SyncResponse = {
     lockDrift?: LockDriftEntry[];
     message: string;
     output: string;
-    removed: string[];
-};
-export type Collision = {
-    installedVersion: string;
-    path: string;
-    slug: string;
-    type: 'plugin' | 'theme';
+    removed?: string[];
 };
+declare const COLLISIONS: z.ZodArray<z.ZodObject<{
+    slug: z.ZodString;
+}, z.core.$loose>>;
+export type Collision = z.infer<typeof COLLISIONS>[number];
 export declare function parseCollisions(error: unknown): Collision[] | null;
 export declare function isDowngrade(from: string, to: string): boolean;
+export {};

package/dist/utils/plugin-sync.js

@@ -2,26 +2,26 @@
 // `lps plugin push`, `lps theme version push` and `lps composer push`. The endpoint runs Composer +
 // WPackagist inside WordPress; the CLI only ever sends intent (which slugs at which versions),
 // never a composer.json, so the plugin stays the single authority on that file's shape.
+import { z } from 'zod';
+import { causeOf } from '../lib/narrow.js';
+import { parseBody, responseOf } from '../lib/wp-client.js';
 import { compareVersions } from './version.js';
 // A cold `composer update` on a fresh site easily exceeds the global 30s WpClient timeout.
 export const SYNC_TIMEOUT_MS = 600_000;
+// The server also sends installedVersion, path and type, only the slug is read here.
+const COLLISIONS = z.array(z.looseObject({ slug: z.string() }));
 // 422 from the sync endpoint when the intent references a plugin/theme whose folder already
 // exists on the site but isn't tracked in composer.lock (installed by hand through wp-admin).
 // Re-running with --force lets the server remove the folder so Composer can take it over.
 export function parseCollisions(error) {
-    const body = error.cause?.response;
-    if (body?.statusCode !== 422 || !body.body)
+    const { body, statusCode } = responseOf(causeOf(error));
+    if (statusCode !== 422)
         return null;
-    try {
-        const parsed = JSON.parse(body.body);
-        if (parsed.error === 'unmanaged_plugins_present' && Array.isArray(parsed.collisions)) {
-            return parsed.collisions;
-        }
-    }
-    catch {
+    const parsed = parseBody(body);
+    if (parsed.error !== 'unmanaged_plugins_present')
         return null;
-    }
-    return null;
+    const collisions = COLLISIONS.safeParse(parsed.collisions);
+    return collisions.success ? collisions.data : null;
 }
 // Only gates whether a version change needs --force. Unorderable inputs ("latest", a
 // constraint) count as "not a downgrade" so they don't block the push.

package/dist/utils/plugins.js

@@ -1,3 +1,4 @@
+import { isRecord } from '../lib/narrow.js';
 import { pinActive, pinVersion, } from '../types/plugin.js';
 import { isExactVersion } from './version.js';
 // "1.7.2", or "1.7.2 (inactive)" for a pin that keeps the plugin inactive.
@@ -13,9 +14,10 @@ const LOOPRESS_PLUGIN_SLUGS = new Set(['loopress', 'loopress-full', 'loopress-li
 export function mergePluginManifest(existing, incoming) {
     const merged = { ...existing, ...incoming };
     const added = Object.keys(incoming).filter((s) => !Object.hasOwn(existing, s));
-    const updated = Object.keys(incoming)
-        .filter((s) => Object.hasOwn(existing, s) && describePin(existing[s]) !== describePin(incoming[s]))
-        .map((s) => ({ from: describePin(existing[s]), slug: s, to: describePin(incoming[s]) }));
+    const updated = Object.entries(incoming).flatMap(([slug, pin]) => {
+        const before = Object.hasOwn(existing, slug) ? existing[slug] : undefined;
+        return before !== undefined && describePin(before) !== describePin(pin) ? [{ from: describePin(before), slug, to: describePin(pin) }] : [];
+    });
     return { added, merged, updated };
 }
 // WordPress core identifies each plugin by a `<folder>/<file>` id (or a bare `<file>` for a
@@ -30,7 +32,7 @@ export function mergePluginManifest(existing, incoming) {
 const WP_ORG_PLUGIN_URI = /^https?:\/\/wordpress\.org\/plugins\/([^/]+)\/?$/;
 function slugFromPluginFile(file, pluginUri) {
     if (file.includes('/'))
-        return file.split('/', 1)[0];
+        return file.slice(0, file.indexOf('/'));
     return WP_ORG_PLUGIN_URI.exec(pluginUri)?.[1] ?? file;
 }
 export function parseInstalledPlugins(raw) {
@@ -93,8 +95,9 @@ export function lockedWpackagistSlugs(composerLock, kind) {
     const prefix = `wpackagist-${kind}/`;
     try {
         const parsed = JSON.parse(composerLock);
-        return new Set((parsed.packages ?? [])
-            .map((p) => p.name ?? '')
+        const packages = isRecord(parsed) && Array.isArray(parsed.packages) ? parsed.packages : [];
+        return new Set(packages
+            .map((p) => (isRecord(p) && typeof p.name === 'string' ? p.name : ''))
             .filter((name) => name.startsWith(prefix))
             .map((name) => name.slice(prefix.length)));
     }

package/dist/utils/resource-dirs.d.ts

@@ -3,6 +3,7 @@ export declare const RESOURCE_DIR_DEFAULTS: {
     readonly acf: "acf";
     readonly api: "api";
     readonly apps: "apps";
+    readonly block: "blocks";
     readonly blockCss: "theme/blocks";
     readonly cpt: "cpt";
     readonly css: "theme/css";
@@ -23,3 +24,4 @@ export declare const RESOURCE_DIR_DEFAULTS: {
 export type ResourceDirKind = keyof typeof RESOURCE_DIR_DEFAULTS;
 export declare function resolveResourceDir(kind: ResourceDirKind, localConfig: LoopressLocalConfig, override?: string): string;
 export declare function projectUses(kind: ResourceDirKind, localConfig: LoopressLocalConfig): boolean;
+export declare function projectHasChildThemeFiles(localConfig: LoopressLocalConfig): boolean;