@loopress/cli 0.33.0 → 0.35.0

package/dist/commands/app/push.js

@@ -4,6 +4,7 @@ import { readdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { buildApp } from '../../lib/app-build.js';
 import { APP_CONFIG_FILENAME, diffFiles, loadAppManifest, } from '../../lib/app-manifest.js';
+import { withoutExcluded } from '../../lib/exclude.js';
 import { errorCode, errorMessage } from '../../lib/narrow.js';
 import { PushCommand } from '../../lib/push-command.js';
 import { isNotFoundError } from '../../lib/wp-client.js';
@@ -52,7 +53,7 @@ export default class Push extends PushCommand {
     async appDirNames(path, only) {
         let entries;
         try {
-            entries = await readdir(path, { withFileTypes: true });
+            entries = withoutExcluded(path, await readdir(path, { withFileTypes: true }), (entry) => entry.name);
         }
         catch (error) {
             if (errorCode(error) === 'ENOENT') {

package/dist/commands/block/push.js

@@ -3,7 +3,7 @@ import { isDeepStrictEqual } from 'node:util';
 import { errorMessage } from '../../lib/narrow.js';
 import { PushCommand } from '../../lib/push-command.js';
 import { getResourceStateProvider } from '../../lib/resource-state.js';
-import { BLOCKS_ENDPOINT, formatBlockProblems, readLocalBlocks } from '../../utils/block-format.js';
+import { blockFilesToPush, BLOCKS_ENDPOINT, excludedBlockFiles, formatBlockProblems, readLocalBlocks } from '../../utils/block-format.js';
 import { pluralize } from '../../utils/pluralize.js';
 import { resolveResourceDir } from '../../utils/resource-dirs.js';
 export default class Push extends PushCommand {
@@ -20,9 +20,14 @@ export default class Push extends PushCommand {
         const path = resolveResourceDir('block', this.localConfig, args.path);
         this.log(`Pushing dynamic blocks to ${this.siteConfig.url}`);
         this.log(`Blocks path: ${path}`);
-        const { blocks, problems } = await readLocalBlocks(path);
-        if (problems.length > 0)
-            this.error(formatBlockProblems(problems));
+        const read = await readLocalBlocks(path);
+        if (read.problems.length > 0)
+            this.error(formatBlockProblems(read.problems));
+        // An excluded file inside a block folder: the site's copy is sent back, read here rather than
+        // from the best-effort snapshot so a failed read stops the push instead of deleting it.
+        const withExcluded = read.blocks.some((block) => excludedBlockFiles(path, block.slug).length > 0);
+        const site = withExcluded && !this.dryRun ? new Map((await this.wp.get(BLOCKS_ENDPOINT)).map((block) => [block.slug, block.files])) : undefined;
+        const blocks = site ? read.blocks.map((block) => ({ ...block, files: blockFilesToPush(path, block, site.get(block.slug)) })) : read.blocks;
         this.log(`Found ${pluralize(blocks.length, 'block')} to push`);
         const provider = getResourceStateProvider('block');
         const beforeState = await this.captureBeforePushState(provider, path);

package/dist/commands/dev.d.ts

@@ -3,8 +3,8 @@ export default class Dev extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        only: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        skip: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        only: ReturnType<typeof import("@oclif/core/flags").string>;
+        skip: ReturnType<typeof import("@oclif/core/flags").string>;
     };
     run(): Promise<void>;
     private parseTypeFlag;

package/dist/commands/dev.js

@@ -1,24 +1,27 @@
-import { Command, Flags } from '@oclif/core';
+import { Command } from '@oclif/core';
 import { watch as watchFiles } from 'chokidar';
 import { basename } from 'node:path';
 import { configManager } from '../config/project-config.manager.js';
 import { buildWatchTargets, createDebouncedBatcher, resolveResourceTypes, RESOURCE_TYPES, resourceTypeForPath } from '../lib/dev-watch.js';
+import { disableExclusions } from '../lib/exclude.js';
 import { errorMessage, isOneOf } from '../lib/narrow.js';
+import { parseSelectionFlag, selectionFlags } from '../lib/resource-selection.js';
 import { readLocalConfig } from '../utils/loopress-config.js';
 const DEBOUNCE_MS = 400;
 // Noise no one wants pushed: VCS internals, deps, and editor/OS droppings.
 const IGNORED = /(?:^|[/\\])(?:(?:\.git|node_modules|\.DS_Store)(?:[/\\]|$)|[^/\\]*\.swp$)/;
 export default class Dev extends Command {
     static description = 'Watch project files and push changes to the local WordPress instance as they happen. Always targets the "local" environment, run `lps snippet push` etc. directly for any other environment.';
-    static examples = ['$ lps dev', '$ lps dev --only=snippets,api', '$ lps dev --skip=plugins'];
+    static examples = ['$ lps dev', '$ lps dev --only=snippet,api', '$ lps dev --skip=plugin'];
     static flags = {
-        only: Flags.string({ description: `Only watch these resource types (comma-separated): ${RESOURCE_TYPES.join(', ')}` }),
-        skip: Flags.string({ description: `Skip these resource types (comma-separated): ${RESOURCE_TYPES.join(', ')}` }),
+        ...selectionFlags('watch', RESOURCE_TYPES),
     };
     async run() {
         const { flags } = await this.parse(Dev);
-        const only = flags.only ? this.parseTypeFlag(flags.only, 'only') : undefined;
-        const skip = flags.skip ? this.parseTypeFlag(flags.skip, 'skip') : [];
+        // Dev only targets local, where an excluded feature is being built: it pushes everything.
+        disableExclusions();
+        const only = this.parseTypeFlag(flags.only, 'only');
+        const skip = this.parseTypeFlag(flags.skip, 'skip');
         const types = resolveResourceTypes(only, skip);
         const localConfig = await readLocalConfig();
         const projectId = localConfig.projectId ?? configManager.getCurrentProject()?.id;
@@ -36,16 +39,7 @@ export default class Dev extends Command {
         await this.watch(targets);
     }
     parseTypeFlag(raw, flagName) {
-        return raw
-            .split(',')
-            .map((value) => value.trim())
-            .filter(Boolean)
-            .map((value) => {
-            if (!isOneOf(RESOURCE_TYPES, value)) {
-                this.error(`Unknown resource type "${value}" in --${flagName}. Valid types: ${RESOURCE_TYPES.join(', ')}`);
-            }
-            return value;
-        });
+        return parseSelectionFlag(raw, flagName, RESOURCE_TYPES, (message) => this.error(message)).filter((value) => isOneOf(RESOURCE_TYPES, value));
     }
     // Sequential on purpose (see notes technique: parallelizing push is out of scope). A failed
     // push is logged and swallowed here, never thrown, so one bad batch can't take the watcher down.

package/dist/commands/diff.d.ts

@@ -4,12 +4,14 @@ export default class Diff extends DiffCommand {
     static enableJsonFlag: boolean;
     static examples: string[];
     static flags: {
-        only: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        skip: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        only: ReturnType<typeof import("@oclif/core/flags").string>;
+        skip: ReturnType<typeof import("@oclif/core/flags").string>;
+        'skip-unsupported': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         against: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<DiffJson>;
+    private composerSiteTarget;
     private projectUses;
-    private selectResources;
-    private siteLacks;
+    private siteMissing;
+    private withSiteSkip;
 }

package/dist/commands/diff.js

@@ -1,8 +1,9 @@
-import { Flags } from '@oclif/core';
 import { existsSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { getCapabilities, missingIntegration, missingModule } from '../lib/capabilities.js';
+import { getCapabilities, integrationFix, missingIntegration, missingModule } from '../lib/capabilities.js';
+import { declaredPlugins } from '../lib/declared-plugins.js';
 import { DiffCommand } from '../lib/diff-command.js';
+import { parseSelectionFlag, selectionFlags, selectResources } from '../lib/resource-selection.js';
 import { RESOURCE_STATE_PROVIDERS } from '../lib/resource-state.js';
 import {} from '../lib/wp-client.js';
 import { projectUses, resolveResourceDir } from '../utils/resource-dirs.js';
@@ -26,30 +27,39 @@ export default class Diff extends DiffCommand {
     ];
     static flags = {
         ...DiffCommand.againstFlag,
-        only: Flags.string({ description: 'Only compare these resources', multiple: true, options: [...RESOURCES] }),
-        skip: Flags.string({ description: 'Compare every resource except these', multiple: true, options: [...RESOURCES] }),
+        ...DiffCommand.skipUnsupportedFlag,
+        ...selectionFlags('compare', RESOURCES),
     };
     async run() {
         const { flags } = await this.parse(Diff);
         const sides = this.resolveSides(flags.against);
-        const selected = this.selectResources(flags.only, flags.skip);
+        const selected = new Set(selectResources(RESOURCES, parseSelectionFlag(flags.only, 'only', RESOURCES, (message) => this.error(message)), parseSelectionFlag(flags.skip, 'skip', RESOURCES, (message) => this.error(message))));
         const providers = RESOURCE_STATE_PROVIDERS.filter((provider) => selected.has(provider.resource));
+        const skipUnsupported = flags['skip-unsupported'];
         const targets = [
-            ...(await Promise.all(providers.map(async (provider) => ({
-                ...this.providerTarget(provider, sides),
-                skip: !(await this.projectUses(provider)) && (await this.siteLacks((capabilities) => missingIntegration(provider.dirKind, capabilities), sides)),
-            })))),
-            ...(selected.has('composer')
-                ? [
-                    {
-                        ...this.composerTarget(sides),
-                        skip: !existsSync(resolve(process.cwd(), this.rootDir, 'composer.json')) &&
-                            (await this.siteLacks((capabilities) => missingModule('dependencies', 'Composer files', capabilities), sides)),
-                    },
-                ]
-                : []),
+            ...(await Promise.all(providers.map(async (provider) => {
+                const lacking = await this.siteMissing((capabilities) => missingIntegration(provider.dirKind, capabilities), sides);
+                return this.withSiteSkip(this.providerTarget(provider, sides), lacking, await this.projectUses(provider), skipUnsupported);
+            }))),
+            ...(selected.has('composer') ? [await this.composerSiteTarget(sides, skipUnsupported)] : []),
         ];
-        return this.report(targets, sides);
+        if (skipUnsupported) {
+            const declared = await declaredPlugins({ localConfig: this.localConfig, rootDir: this.rootDir, siteName: this.siteConfig.name });
+            for (const { unsupported } of targets) {
+                if (unsupported)
+                    unsupported.fix = integrationFix(unsupported.missing, declared);
+            }
+        }
+        const result = await this.report(targets, sides);
+        // Only the environment against its local files is drift; two environments differing is not.
+        if (!sides.againstWp)
+            await this.reportDrift(result);
+        return result;
+    }
+    async composerSiteTarget(sides, skipUnsupported) {
+        const lacking = await this.siteMissing((capabilities) => missingModule('dependencies', 'Composer files', capabilities), sides);
+        const used = existsSync(resolve(process.cwd(), this.rootDir, 'composer.json'));
+        return this.withSiteSkip(this.composerTarget(sides), lacking, used, skipUnsupported);
     }
     // Tells apart a resource the project doesn't use from one it does, for the ones a site can lack:
     // a plugin-backed resource without its directory, Global Styles without a tracked file.
@@ -59,25 +69,35 @@ export default class Diff extends DiffCommand {
         }
         return projectUses(provider.dirKind, this.localConfig);
     }
-    // `--only` narrows the default set, `--skip` then removes from whatever that set is, same
-    // precedence a combined `--only=a,b --skip=b` reads as (mirrors dev-watch's resolveResourceTypes).
-    selectResources(only, skip) {
-        const base = only && only.length > 0 ? only : RESOURCES;
-        return new Set(base.filter((resource) => !(skip ?? []).includes(resource)));
-    }
     // Either side can't hold the resource. Capabilities that can't be read (site down, plugin too
     // old) skip nothing: the comparison then reports the failure itself, as inconclusive.
-    async siteLacks(missing, sides) {
+    async siteMissing(missing, sides) {
         try {
             // Inside the try: `this.wp` errors out without credentials, the comparison reports that.
             const sites = [[this.wp, sides.leftLabel]];
             if (sides.againstWp)
                 sites.push([sides.againstWp, sides.rightLabel]);
-            const all = await Promise.all(sites.map(async ([wp, name]) => getCapabilities(wp, name)));
-            return all.some((capabilities) => missing(capabilities) !== undefined);
+            const all = await Promise.all(sites.map(async ([wp, site]) => ({ capabilities: await getCapabilities(wp, site), site })));
+            for (const { capabilities, site } of all) {
+                const found = missing(capabilities);
+                if (found)
+                    return { missing: found, site };
+            }
+            return undefined;
         }
         catch {
-            return false;
+            return undefined;
         }
     }
+    // A resource the site can't hold is skipped when the project doesn't use it, and also when it
+    // does with --skip-unsupported, which then reports why instead of "not configured".
+    withSiteSkip(target, lacking, used, skipUnsupported) {
+        if (!lacking)
+            return target;
+        if (!used)
+            return { ...target, skip: true };
+        if (!skipUnsupported)
+            return target;
+        return { ...target, skip: true, unsupported: { missing: lacking.missing, reason: `${lacking.missing.reason} on ${lacking.site}` } };
+    }
 }

package/dist/commands/doctor.js

@@ -4,7 +4,7 @@ import {} from '../lib/capabilities.js';
 import { errorMessage } from '../lib/narrow.js';
 import { formatRuntimeError, HOOK_FILES_RESOURCE } from '../lib/php-files-command.js';
 import { findTempAdmins } from '../lib/temp-admin.js';
-import { isForbiddenError, isNotFoundError } from '../lib/wp-client.js';
+import { isApplicationPasswordsDisabled, isFirewallBlock, isForbiddenError, isNotFoundError } from '../lib/wp-client.js';
 import { diagnoseWpSite } from '../lib/wp-site-diagnostic.js';
 import { pluralize } from '../utils/pluralize.js';
 export default class Doctor extends LoopressCommand {
@@ -36,7 +36,17 @@ export default class Doctor extends LoopressCommand {
                 const isInstalled = await this.check('Loopress plugin installed (loopress/v1 endpoints)', async () => this.wp.get('loopress/v1'));
                 // wp/v2/users/me is WordPress core and requires authentication, so it validates the
                 // application password without depending on any Loopress feature.
-                const isAuthenticated = await this.check('Credentials accepted (authenticated request)', async () => this.wp.get('wp/v2/users/me'));
+                const isAuthenticated = await this.check('Credentials accepted (authenticated request)', async () => {
+                    try {
+                        await this.wp.get('wp/v2/users/me');
+                    }
+                    catch (error) {
+                        if (isApplicationPasswordsDisabled(error)) {
+                            throw new Error('Application Passwords are disabled for this account. Enable them for this user (a security plugin or the `wp_is_application_passwords_available` filter may turn them off), or use another account.', { cause: error });
+                        }
+                        throw error;
+                    }
+                });
                 // Skipped when the credentials were just rejected: it would only repeat that same 401.
                 if (isAuthenticated) {
                     // Without the plugin it would only repeat that same 404.
@@ -146,7 +156,7 @@ export default class Doctor extends LoopressCommand {
         catch (error) {
             lookup = { error };
         }
-        if ('error' in lookup && isForbiddenError(lookup.error)) {
+        if ('error' in lookup && isForbiddenError(lookup.error) && !isFirewallBlock(lookup.error)) {
             this.out('- Leftover temporary admin accounts: not checked, these credentials cannot list users.');
             return;
         }

package/dist/commands/form/push.js

@@ -1,5 +1,5 @@
 import { Args, Flags } from '@oclif/core';
-import { readFile, rename, writeFile } from 'node:fs/promises';
+import { readFile, writeFile } from 'node:fs/promises';
 import { dirname, extname, join } from 'node:path';
 import { errorMessage, isRecord } from '../../lib/narrow.js';
 import { PushCommand } from '../../lib/push-command.js';
@@ -9,6 +9,7 @@ import { getResourceStateProvider } from '../../lib/resource-state.js';
 import { isNotFoundError } from '../../lib/wp-client.js';
 import { FORM_ENDPOINT, formEndpoint, getFormId, getFormTitle } from '../../utils/form-format.js';
 import { pluralize } from '../../utils/pluralize.js';
+import { renameWithRetry } from '../../utils/rename-retry.js';
 import { toSlug } from '../../utils/to-slug.js';
 export default class Push extends PushCommand {
     static args = {
@@ -66,7 +67,7 @@ export default class Push extends PushCommand {
     async ensureCanonicalFilename(filePath, id, title) {
         const canonicalPath = join(dirname(filePath), `${id}-${toSlug(title, 'untitled')}.json`);
         if (filePath !== canonicalPath)
-            await rename(filePath, canonicalPath);
+            await renameWithRetry(filePath, canonicalPath);
     }
     // One file is read in isolation: a corrupted or hand-broken JSON file must only skip that
     // form, not abort loading the rest of the directory, same principle as loadObjects() in

package/dist/commands/option/list.js

@@ -1,9 +1,14 @@
 import { Flags, ux } from '@oclif/core';
-import ttyTable from 'tty-table';
+import ttyTableModule, {} from 'tty-table';
 import { LoopressCommand } from '../../lib/base.js';
 import { withSpinner } from '../../lib/spinner.js';
 import { OPTIONS_ENDPOINT } from '../../utils/option-format.js';
 import { pluralize } from '../../utils/pluralize.js';
+// tty-table 7 ships CJS-flavored typings (`types` before `import` in its exports map), so under
+// Node16 resolution TS types the default import as the whole CJS namespace, while at runtime the
+// ESM build's default export is the factory itself (it exports no named `Table`).
+// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- see above
+const ttyTable = ttyTableModule;
 // Same green/yellow pairing drives both SOURCE? and PLUGIN, so a row's whole "where did this come
 // from" story reads as one color at a glance instead of requiring the "?" to be spotted in text.
 function confidenceColor(option) {

package/dist/commands/option/push.js

@@ -40,6 +40,7 @@ export default class Push extends PushCommand {
             this.log(`Skipping ${pluralize(skipped.length, 'readonly option')}: ${skipped.map((option) => option.name).join(', ')}`);
         }
         this.log(`Found ${pluralize(writable.length, 'option')} to push`);
+        this.warnEnvironmentUrls(writable.map((option) => ({ id: `options/${option.name}`, value: option.value })));
         const pushed = [];
         await this.runPushTasks(writable, (option) => option.name, async (option, task) => {
             await this.pushOption(option, task);

package/dist/commands/page/push.js

@@ -35,6 +35,7 @@ export default class Push extends PushCommand {
             this.error(`No page "${args.slug}" in ${path} (expected ${args.slug}.html).`);
         }
         this.log(`Found ${pluralize(selected.length, 'page')} to push`);
+        this.warnEnvironmentUrls(selected.map((page) => ({ id: `pages/${page.slug}`, value: page.html })));
         const provider = getResourceStateProvider('page');
         const beforeState = await this.captureBeforePushState(provider, path, args.slug === undefined ? undefined : (id) => id === args.slug);
         const pushed = [];

package/dist/commands/plugin/add.d.ts

@@ -1,5 +1,6 @@
 import { LoopressCommand } from '../../lib/base.js';
 type AddResult = {
+    dependencies: string[];
     slug: string;
     status: 'added' | 'dry-run' | 'unchanged' | 'updated';
     version: string;

package/dist/commands/plugin/add.js

@@ -1,6 +1,7 @@
 import { Args, Flags } from '@oclif/core';
+import got from 'got';
 import { LoopressCommand } from '../../lib/base.js';
-import { pinVersion } from '../../types/plugin.js';
+import { pinActive, pinVersion } from '../../types/plugin.js';
 import { writeLocalConfig } from '../../utils/loopress-config.js';
 import { isExactVersion } from '../../utils/version.js';
 export default class Add extends LoopressCommand {
@@ -26,22 +27,62 @@ export default class Add extends LoopressCommand {
             this.error(`--version must be an exact version like 9.4.2, not a Composer constraint. Got "${version}".`);
         }
         const existing = this.localConfig.plugins ?? {};
+        const required = await requiredPlugins(slug);
+        const dependencies = required.filter((dep) => !Object.hasOwn(existing, dep));
+        // An inactive pin keeps its dependency off, so push could never activate `slug`.
+        const inactive = required.filter((dep) => Object.hasOwn(existing, dep) && !pinActive(existing[dep]));
+        if (inactive.length > 0) {
+            this.warn(`${slug} requires ${inactive.join(', ')}, pinned inactive in loopress.json. Remove \`"active": false\` there, or push cannot activate ${slug}.`);
+        }
         const current = existing[slug];
-        if (current !== undefined && pinVersion(current) === version) {
+        if (current !== undefined && pinVersion(current) === version && dependencies.length === 0) {
             this.log(`${slug} is already pinned to ${version} in loopress.json, nothing to do.`);
-            return { slug, status: 'unchanged', version };
+            return { dependencies, slug, status: 'unchanged', version };
         }
         const isUpdated = current !== undefined;
+        const requires = dependencies.length > 0 ? `, with required ${dependencies.join(', ')} (latest)` : '';
         if (this.dryRun) {
-            this.log(`[dry-run] Would ${isUpdated ? 'update' : 'add'} ${slug} (${version}) in loopress.json`);
-            return { slug, status: 'dry-run', version };
+            this.log(`[dry-run] Would ${isUpdated ? 'update' : 'add'} ${slug} (${version})${requires} in loopress.json`);
+            return { dependencies, slug, status: 'dry-run', version };
         }
         await writeLocalConfig({
             ...this.localConfig,
-            // Re-pinning a plugin recorded as inactive keeps it inactive.
-            plugins: { ...existing, [slug]: typeof current === 'object' ? { ...current, version } : version },
+            plugins: {
+                ...existing,
+                ...Object.fromEntries(dependencies.map((dep) => [dep, 'latest'])),
+                // Re-pinning a plugin recorded as inactive keeps it inactive.
+                [slug]: typeof current === 'object' ? { ...current, version } : version,
+            },
         });
-        this.log(`${isUpdated ? 'Updated' : 'Added'} ${slug} (${version}). Run \`lps plugin push\` to apply.`);
-        return { slug, status: isUpdated ? 'updated' : 'added', version };
+        this.log(`${isUpdated ? 'Updated' : 'Added'} ${slug} (${version})${requires}. Run \`lps plugin push\` to apply.`);
+        return { dependencies, slug, status: isUpdated ? 'updated' : 'added', version };
+    }
+}
+// Every plugin `slug` needs active first, transitively, from the `Requires Plugins` header
+// WordPress.org exposes as `requires_plugins`. Not on WordPress.org or unreachable: none known,
+// and `lps plugin push` still names a missing one when WordPress refuses the activation.
+async function requiredPlugins(slug) {
+    const found = [];
+    const queue = [slug];
+    for (let next = queue.shift(); next !== undefined; next = queue.shift()) {
+        let info;
+        try {
+            info = await got('https://api.wordpress.org/plugins/info/1.2/', {
+                searchParams: { action: 'plugin_information', 'request[slug]': next },
+                timeout: { request: 10_000 },
+            }).json();
+        }
+        catch {
+            continue;
+        }
+        const requires = Array.isArray(info.requires_plugins) ? info.requires_plugins : [];
+        for (const dep of requires) {
+            if (typeof dep !== 'string' || dep === slug || found.includes(dep)) {
+                continue;
+            }
+            found.push(dep);
+            queue.push(dep);
+        }
     }
+    return found;
 }

package/dist/commands/plugin/audit.d.ts

@@ -23,8 +23,8 @@ export default class Audit extends LoopressCommand {
     static flags: {};
     run(): Promise<AuditResult>;
     private auditOne;
-    private fetchHealth;
     private fetchVulnerabilities;
     private report;
+    private reportToConsole;
 }
 export {};

package/dist/commands/plugin/audit.js

@@ -1,11 +1,14 @@
 import got from 'got';
+import { authManager } from '../../config/auth.manager.js';
+import { API_URL } from '../../lib/api-client.js';
 import { LoopressCommand } from '../../lib/base.js';
 import { errorMessage, isRecord } from '../../lib/narrow.js';
 import { withSpinner } from '../../lib/spinner.js';
+import {} from '../../types/config.js';
 import { pinVersion } from '../../types/plugin.js';
 import { compareVersions } from '../../utils/version.js';
+import { fetchPluginInfo } from '../../utils/wporg.js';
 const WPVULN_BASE = 'https://www.wpvulnerability.net/plugin';
-const WPORG_INFO = 'https://api.wordpress.org/plugins/info/1.2/';
 export default class Audit extends LoopressCommand {
     static description = 'Check the plugins in loopress.json for known vulnerabilities (wpvulnerability.net) and health issues';
     static enableJsonFlag = true;
@@ -25,10 +28,20 @@ export default class Audit extends LoopressCommand {
             advisories.push(...found.advisories);
             health.push(...found.health);
         }
-        return this.report(advisories, health, slugs.length);
+        // Print first: report() may set the exit code, and the console request must not delay the output.
+        const result = this.report(advisories, health, slugs.length);
+        await this.reportToConsole(advisories, health, manifest);
+        // exit() throws before oclif prints the --json result, which a CI reading it needs most here.
+        if (advisories.length > 0) {
+            if (this.jsonEnabled())
+                process.exitCode = 1;
+            else
+                this.exit(1);
+        }
+        return result;
     }
     async auditOne(slug, pinned) {
-        const [vulns, info] = await Promise.all([this.fetchVulnerabilities(slug), this.fetchHealth(slug)]);
+        const [vulns, info] = await Promise.all([this.fetchVulnerabilities(slug), fetchPluginInfo(slug)]);
         // "latest" is the newest WordPress.org release, the one a push installs: audit that version.
         // Unknown (WordPress.org unreachable), every advisory is reported, safer than none.
         const version = pinned === 'latest' && typeof info?.version === 'string' ? info.version : pinned;
@@ -38,18 +51,6 @@ export default class Audit extends LoopressCommand {
         const health = info ? describeHealth(slug, pinned, info) : [];
         return { advisories, health };
     }
-    async fetchHealth(slug) {
-        try {
-            const body = await got(WPORG_INFO, {
-                searchParams: { action: 'plugin_information', 'request[slug]': slug },
-                timeout: { request: 10_000 },
-            }).json();
-            return typeof body === 'object' && !('error' in body) ? body : null;
-        }
-        catch {
-            return null;
-        }
-    }
     async fetchVulnerabilities(slug) {
         let body;
         try {
@@ -64,7 +65,8 @@ export default class Audit extends LoopressCommand {
                 'Audit aborted so a service outage is not reported as a clean result.', { cause: error });
         }
         // A 200 with the wrong shape (degraded service) must not read as "no advisories" either.
-        const list = body?.data?.vulnerability;
+        // wpvulnerability.net answers `"vulnerability": null` when it has no advisories: that is an empty list.
+        const list = body?.data?.vulnerability === null ? [] : body?.data?.vulnerability;
         if (!Array.isArray(list) || list.some((raw) => !isRecord(raw))) {
             throw new TypeError(`Unexpected answer from the vulnerability database (wpvulnerability.net) for "${slug}". ` +
                 'Audit aborted so a malformed response is not reported as a clean result.');
@@ -84,15 +86,35 @@ export default class Audit extends LoopressCommand {
         const noun = advisories.length === 1 ? 'advisory' : 'advisories';
         this.log(`\n${advisories.length} vulnerability ${noun}, ${health.length} health note(s). ` +
             'Vulnerability data: wpvulnerability.net.');
-        // exit() throws before oclif prints the --json result, which a CI reading it needs most here.
-        if (advisories.length > 0) {
-            if (this.jsonEnabled())
-                process.exitCode = 1;
-            else
-                this.exit(1);
-        }
         return { advisories, health, status: 'issues' };
     }
+    // Best-effort, like `recordDeployment`: when a token is present, sends the console the advisories
+    // and health notes (slug, version, CVE, severity, fixed version, title). Silent on any failure,
+    // and it never touches the output or the exit code.
+    async reportToConsole(advisories, health, manifest) {
+        try {
+            const token = process.env.LOOPRESS_TOKEN ?? authManager.getAuth()?.token ?? null;
+            const url = this.siteConfig?.url;
+            if (!token || !url)
+                return;
+            const sent = advisories.map(({ cve, fixedIn, severity, slug, title }) => ({
+                cve,
+                fixedIn,
+                severity,
+                slug,
+                title,
+                version: pinVersion(manifest[slug] ?? 'latest'),
+            }));
+            await got.post(`${API_URL}/plugin-audits`, {
+                headers: { Authorization: `Bearer ${token}` },
+                json: { advisories: sent, health, url },
+                timeout: { request: 3000 },
+            });
+        }
+        catch {
+            // non-blocking: reporting must never change the audit's outcome
+        }
+    }
 }
 function advisoryMeta(a) {
     const fixed = a.fixedIn ? `fixed in ${a.fixedIn}` : undefined;

package/dist/commands/plugin/outdated.d.ts

@@ -0,0 +1,22 @@
+import { LoopressCommand } from '../../lib/base.js';
+import { type VersionJump } from '../../utils/version.js';
+export type OutdatedPlugin = {
+    current: string;
+    jump: null | VersionJump;
+    latest: null | string;
+    slug: string;
+    status: 'closed' | 'current' | 'error' | 'outdated' | 'unknown';
+};
+type OutdatedResult = {
+    outdated: number;
+    plugins: OutdatedPlugin[];
+};
+export default class Outdated extends LoopressCommand {
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: string[];
+    static flags: {};
+    run(): Promise<OutdatedResult>;
+    private printTable;
+}
+export {};