@mapled/cli 0.16.0 → 0.17.1

package/README.md

@@ -35,6 +35,8 @@ npx @mapled/cli tool get_setup_run '{"runId":"…"}' --wait
 
 `tools` lists every tool with its input (`--json` for the schemas). `tool <name>` calls one — the same tools the [MCP server](https://www.npmjs.com/package/@mapled/mcp) offers, through the same connection: the input is a JSON object, inline or in a file with `--input`; the answer is printed as Mapled worded it, and a refusal exits 1. `tool get_setup_run '{"runId":"…"}' --wait` waits while the plan is still waiting for approval and prints the run once the person has decided on the Mapled screen — the agent carries on without being asked; it waits 90 seconds by default (`--wait=<seconds>`, up to 600) and then prints the run as it stands, so the agent runs the same command again.
 
+Images are content: a setup plan names each picture in an image field (its path in the repository or its public address). Once the plan is approved, `npx @mapled/cli media upload --run <runId>` uploads every one of them into the project's Media — `tool apply_setup_plan` does it first by itself — and the records point at the files, which the owner can replace in Mapled.
+
 Do the work yourself: the person approves on Mapled screens (the connection, the plan, a destructive change) and is never sent to a terminal or to GitHub. Never ask for a token or a key in the conversation.
 
 ## Sign in
@@ -71,7 +73,7 @@ Only public values live here — the project id, where the generated types go, t
 npx @mapled/cli types generate
 ```
 
-Reads the project's schema and writes `mapled-types.ts` (the path from `mapled.json`, or `--out <file>`): one interface per collection and single, keyed maps, a `MapledSchema` that ties them together, and doc comments with the field types. Sensitive fields never reach the site and are left out. A group field is typed by an interface of its items; the project's component types become one interface each (`HeroComponent`, with `_type: "hero"` and the item's `_key`), a `components` field a list of the union of the types it allows, and `MapledComponent` the union of them all — switch on `_type` to render an item.
+Reads the project's schema and writes `mapled-types.ts` (the path from `mapled.json`, or `--out <file>`): one interface per collection and single, keyed maps, a `MapledSchema` that ties them together, and doc comments with the field types. Sensitive fields never reach the site and are left out. A group field is typed by an interface of its items; the project's component types become one interface each (`HeroComponent`, with `_type: "hero"` and the item's `_key`; a group inside a type, a list of its items' interface — `PricingTiersItem[]`), a `components` field a list of the union of the types it allows, and `MapledComponent` the union of them all — switch on `_type` to render an item.
 
 ```ts
 import type { MapledSchema } from "./mapled-types";
@@ -186,6 +188,15 @@ Submissions show up in Mapled under Forms.
 
 The key comes from the name; `--key <key>` chooses it (lowercase letters, digits and dashes), `--no-spam-protection` turns the honeypot off. Creating a form changes structure, so it needs the builder plan. `forms list` shows every form with the URL the site posts to (`--json` for scripts). The component that posts to it is in the [`@mapled/next` README](https://www.npmjs.com/package/@mapled/next#forms).
 
+## Upload media
+
+```bash
+npx @mapled/cli media upload public/products/hoodie.jpg https://example.com/cover.png
+npx @mapled/cli media upload --run <runId>
+```
+
+`media upload` puts images and files into the project's Media: a path is read from this repository (a path from the site's root, `/images/a.png`, is looked for under `public/` and `static/` too; nothing outside the repository is read), an address is downloaded by Mapled. PNG, JPEG, WebP, GIF and SVG up to 10 MB, PDF and 3D models (GLB, or glTF as one file) up to 25 MB; the same bytes uploaded twice are one file. Each line names the asset id an image or file field holds. `--run <runId>` uploads every file an approved setup plan names that isn't in Mapled yet, for `apply_setup_plan` to put into the records (`--json` for scripts); a file that didn't upload is named with the reason and the command exits 1.
+
 ## Leave a guide for the next agent
 
 ```bash
@@ -288,6 +299,16 @@ npx @mapled/cli preview articles hello-world --locale ru
 
 Prints a Preview link — the one the **Preview** button in Mapled opens: the site in draft mode, with every saved change that isn't published yet. Name a collection and a record's slug (or id) and the link lands on the record's page, the one the pushed site manifest says shows it; a collection alone opens the page that lists it, a single its page, nothing at all the home page. Mapled makes the link after checking that the site answers and mounts its preview route; it works once, for five minutes. A plain HTML site whose pages are built with the content in them has no page for a record it wasn't built with: for such a record the command says so instead of printing a link — its page appears once the site is built with it. `--locale <code>` opens the page in that language — the address Mapled builds from the manifest's `locales` (a translated slug is the address in its language); a language the project doesn't have is refused. `--open` opens it in your browser instead of printing it; `--json` prints the link with the page, the language when one was asked, and when it expires.
 
+## Put the server key on the host
+
+```bash
+npx @mapled/cli env push --host vercel
+npx @mapled/cli env push --host netlify
+npx @mapled/cli env push --host cloudflare
+```
+
+Gives the site on that host a server key of its own (Live data, the Application Data API) and sets it as `MAPLED_SERVER_KEY` there, without the key passing through you or your agent. Run it from the site's repository, with the host's CLI signed in and the directory linked (`vercel link`, `netlify link`, or a `wrangler.toml`); a CLI that isn't installed runs through `npx`. The command prints a link: an owner of the project confirms the key there, in Mapled. Once they do, the command claims the key — only the process that asked can, once, within ten minutes — and hands it to the host's CLI: Vercel for production and preview, Netlify as a site variable, Cloudflare as a Worker secret (a Worker whose configuration has environments needs `--env <name>`, the one the site is deployed to). The key is never printed, logged, written to a file or included in `--json`; you see its prefix. A new key for the same host replaces the old one, which keeps working for 24 hours while the host redeploys; the project's main key and the other hosts' keep working, and an owner revokes a host's key in Mapled. Redeploy the site afterwards. `--json` prints the host, the variable, the prefix and the confirmation.
+
 ## Options
 
 - `--api <origin>` — a Mapled API other than `https://api.mapled.io` (or set `MAPLED_API_URL`); `project link` remembers it in `mapled.json`
@@ -295,7 +316,9 @@ Prints a Preview link — the one the **Preview** button in Mapled opens: the si
 - `--project <id>` — the project `connect` and `auth login` open the consent on, and the one `project link` links
 - `--input <file>` — `tool` only: the tool's input as a JSON file
 - `--wait[=<seconds>]` — `tool get_setup_run` only: wait while the plan awaits approval (90 seconds by default, up to 600)
-- `--json` — machine-readable output (`tools`, `doctor`, `integration report`, `schema diff`, `scan`, `manifest validate`, `forms list`, `preview`)
+- `--host <vercel|netlify|cloudflare>` — `env push` only: the host the site runs on
+- `--env <name>` — `env push --host cloudflare` only: the Wrangler environment the Worker is deployed as
+- `--json` — machine-readable output (`tools`, `doctor`, `integration report`, `schema diff`, `scan`, `manifest validate`, `forms list`, `media upload`, `preview`, `env push`)
 - `--load-config` — `doctor` only: let the site's installed Next load a next.config doctor can't read; runs the site's code, as `next build` does
 - `MAPLED_CONFIG_DIR` — where credentials live (default: `$XDG_CONFIG_HOME/mapled` or `~/.config/mapled`)
 

package/dist/args.js

@@ -2,7 +2,7 @@ import { CliError } from "./errors.js";
 /** Minimal argument parsing: the leading words name the command;
     `--flag`, `--flag=value` and `--flag value` (for the flags that take
     one) follow. Nothing here is user content beyond the command line. */
-const VALUE_FLAGS = new Set(["api", "project", "out", "key", "locale", "input"]);
+const VALUE_FLAGS = new Set(["api", "project", "out", "key", "locale", "input", "host", "env"]);
 export function parseArgs(argv) {
     const words = [];
     const flags = {};

package/dist/callbackPage.d.ts

@@ -0,0 +1,50 @@
+/** The page the browser shows at the end of `mapled auth login` — the
+    loopback redirect on 127.0.0.1. One template for every outcome, drawn
+    after the S-56 service pages of the app (Figma 570:9128): the logo in
+    the top corner of a page panel, a centred heading and subtitle, at
+    most one primary action. The page loads nothing — no fonts, no
+    images, no scripts from anywhere: styles and the logo are inline, the
+    one script carries this response's nonce. The values are the app's
+    tokens (apps/web/src/app/globals.css), copied: the page can't read
+    them from here. Dark only, as the app. */
+export type CallbackView = 
+/** Signed in; `url` is the project in Mapled, where the tab goes on. */
+{
+    kind: "signed-in";
+    project: string;
+    url: string | null;
+}
+/** The code came, but the sign-in didn't complete (exchange, API). */
+ | {
+    kind: "failed";
+}
+/** The person cancelled or denied on the consent screen. */
+ | {
+    kind: "cancelled";
+}
+/** A redirect that isn't the running command's — an older sign-in. */
+ | {
+    kind: "expired";
+}
+/** A redirect without its code. */
+ | {
+    kind: "incomplete";
+}
+/** Nobody told the page how the sign-in ended — the command stopped
+    waiting for it (`HOLD_MS` in oauth.ts). */
+ | {
+    kind: "handed-over";
+};
+/** Seconds before a signed-in tab opens the project by itself. */
+export declare const REDIRECT_SECONDS = 5;
+/** Only a web address goes into the page: Mapled's answer names it, and
+    anything else (`javascript:`, a bare word) leaves the tab where it is. */
+export declare function safeUrl(value: unknown): string | null;
+export type RenderedPage = {
+    status: number;
+    html: string;
+    csp: string;
+};
+/** The whole response for a view. The project's name is the person's own
+    text and is escaped like everything else that goes in. */
+export declare function callbackPage(view: CallbackView): RenderedPage;

package/dist/callbackPage.js

@@ -0,0 +1,141 @@
+import { randomBytes } from "node:crypto";
+import { LOGO_SVG } from "./logo.js";
+/** Seconds before a signed-in tab opens the project by itself. */
+export const REDIRECT_SECONDS = 5;
+const text = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+/** Only a web address goes into the page: Mapled's answer names it, and
+    anything else (`javascript:`, a bare word) leaves the tab where it is. */
+export function safeUrl(value) {
+    if (typeof value !== "string")
+        return null;
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" || url.protocol === "http:" ? url.toString() : null;
+    }
+    catch {
+        return null;
+    }
+}
+function copyOf(view) {
+    switch (view.kind) {
+        case "signed-in":
+            return view.url
+                ? {
+                    status: 200,
+                    title: "You're signed in",
+                    body: `Your AI agent is connected to ${view.project}. Follow the setup in Mapled.`,
+                    action: { label: "Open setup status", href: view.url },
+                }
+                : {
+                    status: 200,
+                    title: "You're signed in",
+                    body: `Your AI agent is connected to ${view.project}. You can close this tab and go back to your agent.`,
+                };
+        case "failed":
+            return {
+                status: 200,
+                title: "Sign-in didn't finish",
+                body: "Mapled couldn't complete the sign-in. Go back to your AI agent and try again.",
+            };
+        case "cancelled":
+            return {
+                status: 200,
+                title: "Sign-in cancelled",
+                body: "Your AI agent isn't connected. You can close this tab and go back to your agent.",
+            };
+        case "expired":
+            return {
+                status: 400,
+                title: "This sign-in link has expired",
+                body: "It belongs to an earlier sign-in. Go back to your AI agent and start again.",
+            };
+        case "incomplete":
+            return {
+                status: 400,
+                title: "This sign-in link is incomplete",
+                body: "Go back to your AI agent and start the sign-in again.",
+            };
+        case "handed-over":
+            return {
+                status: 200,
+                title: "Back to your AI agent",
+                body: "Your AI agent finishes the sign-in. You can close this tab.",
+            };
+    }
+}
+/* The app's tokens, by name: --bg-page #010101, --surface-page #0a0a0a,
+   --text-primary #fefefe, --text-secondary #989898, --accent #eb5c1a,
+   --accent-hover #d54908, --shadow-bevel, --focus-glow, --radius-panel 16,
+   --control-lg 48; heading 32 Medium / 1 / -0.04em, subtitle 16 / 1.48 /
+   -0.02em, note 14 (FormHeading, accept.note). */
+const STYLE = "*{box-sizing:border-box;margin:0}" +
+    ":root{color-scheme:dark}" +
+    "html,body{min-height:100%}" +
+    "body{min-height:100vh;min-height:100dvh;display:flex;padding:16px;background:#010101;color:#fefefe;" +
+    "font-family:Inter,system-ui,-apple-system,'Segoe UI',Roboto,sans-serif;-webkit-font-smoothing:antialiased}" +
+    "main{flex:1;min-width:0;display:flex;flex-direction:column;padding:20px;border-radius:16px;background:#0a0a0a}" +
+    "header{display:flex;align-items:center;min-height:32px}" +
+    "header svg{display:block;width:122px;height:32px}" +
+    ".box{flex:1;display:flex;flex-direction:column;align-items:center;justify-content:center;gap:40px;" +
+    "width:100%;max-width:528px;margin:0 auto;padding:0 8px 32px;text-align:center}" +
+    ".heading{display:flex;flex-direction:column;gap:8px}" +
+    "h1{font-size:32px;font-weight:500;line-height:1;letter-spacing:-0.04em;text-wrap:balance}" +
+    "p{font-size:16px;line-height:1.48;letter-spacing:-0.02em;color:#989898;text-wrap:pretty;overflow-wrap:break-word}" +
+    ".group{display:flex;flex-direction:column;align-items:center;gap:16px}" +
+    ".button{display:inline-flex;align-items:center;justify-content:center;min-height:48px;padding:0 24px;" +
+    "border-radius:1000px;background:#eb5c1a;color:#fefefe;font-size:14px;font-weight:500;line-height:1;" +
+    "text-decoration:none;white-space:nowrap;transition:background-color .2s ease;" +
+    "box-shadow:inset 0 0 0 1px rgb(255 255 255/8%),inset -2px -2px 2px 0 rgb(255 255 255/25%),inset 2px 2px 2px 0 rgb(255 255 255/25%)}" +
+    ".button:hover{background:#d54908}" +
+    ".button:focus-visible{outline:0;box-shadow:inset 0 0 0 1px rgb(255 255 255/8%),inset -2px -2px 2px 0 rgb(255 255 255/25%)," +
+    "inset 2px 2px 2px 0 rgb(255 255 255/25%),0 0 4px 0 #2d82cc}" +
+    ".note{font-size:14px;line-height:normal;letter-spacing:0}" +
+    "@media (max-width:600px){h1{font-size:28px}}" +
+    "@media (prefers-reduced-motion:reduce){.button{transition:none}}";
+/** The countdown: one line updated each second, then the same address
+    the button has. `replace`: Back doesn't land on the loopback, which is
+    gone by then. */
+const SCRIPT = "(function(){var s=document.currentScript,to=s.getAttribute('data-to'),n=Number(s.getAttribute('data-seconds')),c=document.getElementById('count');" +
+    "function tick(){if(n<=0){location.replace(to);return}if(c)c.textContent=n+(n===1?' second':' seconds');n-=1;setTimeout(tick,1000)}tick()})()";
+const seconds = (n) => `${n} ${n === 1 ? "second" : "seconds"}`;
+/** The whole response for a view. The project's name is the person's own
+    text and is escaped like everything else that goes in. */
+export function callbackPage(view) {
+    const copy = copyOf(view);
+    const nonce = randomBytes(16).toString("base64");
+    const action = copy.action;
+    const html = "<!doctype html>" +
+        '<html lang="en"><head><meta charset="utf-8">' +
+        '<meta name="viewport" content="width=device-width, initial-scale=1">' +
+        '<meta name="robots" content="noindex, nofollow">' +
+        '<meta name="referrer" content="no-referrer">' +
+        `<title>${text(copy.title)} · Mapled</title>` +
+        // without scripts the tab still moves on, after the same pause
+        (action ? `<noscript><meta http-equiv="refresh" content="${REDIRECT_SECONDS};url=${text(action.href)}"></noscript>` : "") +
+        `<style>${STYLE}</style>` +
+        "</head><body><main>" +
+        `<header>${LOGO_SVG}</header>` +
+        '<div class="box">' +
+        `<div class="heading"><h1>${text(copy.title)}</h1><p>${text(copy.body)}</p></div>` +
+        (action
+            ? '<div class="group">' +
+                `<a class="button" href="${text(action.href)}">${text(action.label)}</a>` +
+                `<p class="note">Opening automatically in <span id="count">${seconds(REDIRECT_SECONDS)}</span></p>` +
+                "</div>"
+            : "") +
+        "</div></main>" +
+        (action
+            ? `<script nonce="${nonce}" data-to="${text(action.href)}" data-seconds="${REDIRECT_SECONDS}">${SCRIPT}</script>`
+            : "") +
+        "</body></html>";
+    const csp = [
+        "default-src 'none'",
+        `script-src 'nonce-${nonce}'`,
+        "style-src 'unsafe-inline'",
+        "img-src data:",
+        "base-uri 'none'",
+        "form-action 'none'",
+        "frame-ancestors 'none'",
+    ].join("; ");
+    return { status: copy.status, html, csp };
+}

package/dist/commands.d.ts

@@ -1,7 +1,9 @@
+import { Session } from "./api.js";
 import { type ParsedArgs } from "./args.js";
 import { type FoundConfig } from "./config.js";
 import { type Connection } from "./credentials.js";
 import { type Fetch } from "./oauth.js";
+import type { Runner } from "./envPush.js";
 /** The commands of waves 1 and 2 (§31), MAPLED.md (§21.3) and forms.
     Everything that talks to the world comes in through `Ctx`, so the
     commands run in tests against a fake API and a temp directory. */
@@ -19,6 +21,8 @@ export type Ctx = {
     loginTimeoutMs?: number;
     /** How often `tool get_setup_run --wait` asks again (tests shorten it). */
     pollMs?: number;
+    /** Runs a host's CLI for `env push` (tests replace it). */
+    run?: Runner;
 };
 type Flags = ParsedArgs["flags"];
 export declare function login(ctx: Ctx, flags: Flags): Promise<Connection>;
@@ -37,6 +41,16 @@ export declare function tools(ctx: Ctx, flags: Flags): Promise<void>;
     way an MCP client makes it: the answer is printed as Mapled worded
     it, a refusal exits 1. */
 export declare function tool(ctx: Ctx, flags: Flags, words: string[]): Promise<number>;
+/** `mapled media upload [<path | url>…] [--run <runId>] [--json]` — files
+    of this repository or public addresses into the project's Media.
+    With --run, every media file of that approved setup plan (or the ones
+    named) is uploaded as the plan's, for apply_setup_plan to put into
+    the records. */
+export declare function mediaUpload(ctx: Ctx, flags: Flags, sources: string[]): Promise<number>;
+export declare function openSession(ctx: Ctx, flags: Flags): Promise<{
+    found: FoundConfig;
+    session: Session;
+}>;
 export declare function generate(ctx: Ctx, flags: Flags): Promise<void>;
 export declare function schemaPull(ctx: Ctx, flags: Flags): Promise<void>;
 export declare function schemaDiff(ctx: Ctx, flags: Flags): Promise<number>;

package/dist/commands.js

@@ -7,6 +7,7 @@ import { connectionsFor, findConnection, readCredentials, removeConnection, upse
 import * as dr from "./doctor.js";
 import { CliError, SignInNeeded } from "./errors.js";
 import { checkManifest, compareManifests, fileExistsIn, MANIFEST_FILE, manifestSummary, orderManifest, parseManifest, plural, readManifestFile, writeManifestFile, } from "./manifest.js";
+import { safeUrl } from "./callbackPage.js";
 import { authorize, clientKnown, exchangeCode, registerClient, revokeToken } from "./oauth.js";
 import { formatChecks, GLYPH, paint, summarize, useColor } from "./output.js";
 import { diffSchema, formatChanges, pinSchema, readPin, SCHEMA_FILE, summarizeChanges, writePin } from "./pin.js";
@@ -16,6 +17,7 @@ import { capabilitiesOf, findLive, liveState } from "./live.js";
 import { loadTypeScript, mergeManifest, scanRepository } from "./scan.js";
 import { scanHtml } from "./scanHtml.js";
 import { generateTypes } from "./types.js";
+import { pendingOf, uploadAll, uploadLine, uploadSource } from "./media.js";
 /** The OAuth client id for this API — registered once per machine, and
     again when the server no longer knows it. */
 async function ensureClient(store, api, f) {
@@ -48,18 +50,31 @@ export async function login(ctx, flags) {
         timeoutMs: ctx.loginTimeoutMs,
         project: projectFlag(flags),
     });
-    const tokens = await exchangeCode(api, client.clientId, grant, ctx.fetch);
-    const status = await apiGet(api, "/v1/agent/integration", tokens.accessToken, ctx.fetch);
-    const conn = {
-        api,
-        projectId: status.project.id,
-        projectName: status.project.name,
-        clientId: client.clientId,
-        ...tokens,
-        createdAt: new Date().toISOString(),
-    };
-    store = upsertConnection(store, conn);
-    await writeCredentials(ctx.credentialsFile, store);
+    // the tab says "signed in" only once the tokens are kept: until then
+    // anything that fails (exchange, API, the credentials file) is a
+    // sign-in that didn't finish
+    let conn;
+    let status;
+    try {
+        const tokens = await exchangeCode(api, client.clientId, grant, ctx.fetch);
+        status = await apiGet(api, "/v1/agent/integration", tokens.accessToken, ctx.fetch);
+        conn = {
+            api,
+            projectId: status.project.id,
+            projectName: status.project.name,
+            clientId: client.clientId,
+            ...tokens,
+            createdAt: new Date().toISOString(),
+        };
+        store = upsertConnection(store, conn);
+        await writeCredentials(ctx.credentialsFile, store);
+    }
+    catch (err) {
+        grant.tab.show({ kind: "failed" });
+        throw err;
+    }
+    // the tab goes on to the project in Mapled, where the setup shows
+    grant.tab.show({ kind: "signed-in", project: status.project.name, url: safeUrl(status.project.dashboardUrl) });
     ctx.out(`Signed in to ${clean(conn.projectName, 80)}.`);
     if (!found)
         ctx.out("Next: run `mapled project link` in the site's repository.");
@@ -250,7 +265,23 @@ export async function tool(ctx, flags, words) {
     if (args === null || typeof args !== "object" || Array.isArray(args))
         throw new CliError("The input must be a JSON object.");
     const wait = waitSeconds(flags, name);
-    const { session } = await openSession(ctx, flags);
+    const { found, session } = await openSession(ctx, flags);
+    const input = args;
+    // a file on this machine: the hosted tool can't read it, the CLI uploads it
+    if (name === "upload_media" && typeof input.path === "string" && input.url === undefined) {
+        const runId = typeof input.runId === "string" ? input.runId : undefined;
+        const done = await uploadSource(session, ctx.fetch, found.dir, typeof input.source === "string" ? input.source : input.path, runId);
+        if (!done.ok) {
+            ctx.out(`${done.source}: ${done.error}`);
+            return 1;
+        }
+        ctx.out(JSON.stringify({ asset: done.asset, deduplicated: done.deduplicated }, null, 2));
+        return 0;
+    }
+    // the plan's media goes up before the apply that puts it into the records
+    if (name === "apply_setup_plan" && typeof input.runId === "string" && input.skipMissingMedia !== true) {
+        await uploadRunMedia(ctx, session, found.dir, input.runId);
+    }
     const deadline = Date.now() + wait * 1000;
     let answer = await session.rpc("tools/call", { name, arguments: args });
     // the person approves on a Mapled screen, not in the agent's chat: the
@@ -265,6 +296,62 @@ export async function tool(ctx, flags, words) {
             ctx.out(part.text);
     return answer.isError ? 1 : 0;
 }
+/** The media a setup run's plan names and Mapled doesn't have yet, from
+    this repository or the public addresses it names; a line per file.
+    Nothing to do unless the plan is approved. */
+async function uploadRunMedia(ctx, session, root, runId) {
+    const { status, pending } = await pendingOf(session, runId);
+    if (status !== "approved" || pending.length === 0)
+        return { failed: 0, done: 0 };
+    ctx.out(`Uploading ${plural(pending.length, "media file")} of the plan to Mapled…`);
+    const results = await uploadAll(session, ctx.fetch, root, pending, runId);
+    for (const r of results)
+        ctx.out(uploadLine(r));
+    const failed = results.filter((r) => !r.ok).length;
+    return { failed, done: results.length - failed };
+}
+/** `mapled media upload [<path | url>…] [--run <runId>] [--json]` — files
+    of this repository or public addresses into the project's Media.
+    With --run, every media file of that approved setup plan (or the ones
+    named) is uploaded as the plan's, for apply_setup_plan to put into
+    the records. */
+export async function mediaUpload(ctx, flags, sources) {
+    const runId = stringFlag(flags, "run");
+    if (runId !== undefined && !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(runId)) {
+        throw new CliError("--run takes the id of a setup run — the runId propose_setup_plan answered.", 2);
+    }
+    if (runId === undefined && sources.length === 0) {
+        throw new CliError("What to upload? Name files of this repository or public addresses, or pass --run <runId> for a setup plan's media.", 2);
+    }
+    const { found, session } = await openSession(ctx, flags);
+    let list = sources;
+    if (runId !== undefined && list.length === 0) {
+        const run = await pendingOf(session, runId);
+        if (run.status !== "approved") {
+            throw new CliError(run.status === "awaiting_approval"
+                ? "The plan is still waiting for approval. Upload its media once the person approves it."
+                : "This run takes no more media: its plan isn't approved or was applied already.");
+        }
+        if (run.pending.length === 0) {
+            ctx.out(run.total === 0 ? "The plan names no media." : `Every media file of the plan is in Mapled (${run.total}). Apply the plan next.`);
+            return 0;
+        }
+        list = run.pending;
+    }
+    const results = await uploadAll(session, ctx.fetch, found.dir, list, runId);
+    if (flags.json) {
+        ctx.out(JSON.stringify(results, null, 2));
+    }
+    else {
+        for (const r of results)
+            ctx.out(uploadLine(r));
+        const failed = results.filter((r) => !r.ok).length;
+        ctx.out(failed === 0
+            ? `Uploaded ${plural(results.length, "file")} to Mapled's Media.${runId ? " Apply the plan next." : ""}`
+            : `${plural(failed, "file")} didn't upload. Fix ${failed === 1 ? "it" : "them"} and run this again${runId ? ", or apply with skipMissingMedia: true to leave those fields empty" : ""}.`);
+    }
+    return results.every((r) => r.ok) ? 0 : 1;
+}
 /** `--wait` waits this long by default: under the two minutes an agent's
     shell gives a command unless it asks for more. */
 const WAIT_SECONDS = 90;
@@ -294,7 +381,7 @@ function awaitingApproval(answer) {
         return false;
     }
 }
-async function openSession(ctx, flags) {
+export async function openSession(ctx, flags) {
     const found = await findConfig(ctx.cwd);
     if (!found)
         throw new CliError(`No ${CONFIG_FILE} here or above. Run \`mapled project link\` first.`);
@@ -393,8 +480,9 @@ async function loadManifest(dir) {
     keeps one, otherwise the live schema of a signed-in project. */
 async function schemaForChecks(ctx, flags, found) {
     const pin = await readPin(found.dir);
+    // the pin's component types too: the blocks' templates and bindings name their sub-fields
     if (pin)
-        return { schema: { collections: pin.pin.collections }, note: null };
+        return { schema: { collections: pin.pin.collections, ...(pin.pin.componentTypes ? { componentTypes: pin.pin.componentTypes } : {}) }, note: null };
     try {
         const { session } = await openSession(ctx, flags);
         return { schema: await session.get("/v1/agent/schema"), note: null };
@@ -870,7 +958,7 @@ export async function doctor(ctx, flags) {
     checks.push(dr.checkTypes(existing, schema ? generateTypes(schema, { projectName: status?.project.name, sdk: dr.sdkOf(framework) }) : null, typesPath, framework));
     const pin = found ? await readPin(dir).catch(() => null) : null;
     const livePin = schema && found ? pinSchema(schema, found.config.project) : null;
-    const pinChanges = pin && livePin ? diffSchema(pin.pin.collections, livePin.collections) : null;
+    const pinChanges = pin && livePin ? diffSchema(pin.pin.collections, livePin.collections, { before: pin.pin.componentTypes, after: livePin.componentTypes }) : null;
     checks.push(dr.checkSchemaPin(pin?.pin ?? null, livePin?.hash ?? null, pinChanges));
     const localManifest = await loadManifest(dir).catch(() => null);
     let remoteManifest = "unknown";

package/dist/doctor.d.ts

@@ -18,11 +18,13 @@ export type Check = {
 };
 /** GET /v1/agent/integration */
 export type IntegrationStatus = {
+    /** `dashboardUrl` — the project in Mapled; missing from an older API */
     project: {
         id: string;
         name: string;
         slug: string;
         productionDomain: string | null;
+        dashboardUrl?: string;
     };
     connection: {
         id: string;

package/dist/envPush.d.ts

@@ -0,0 +1,44 @@
+import { type ParsedArgs } from "./args.js";
+import { type Ctx } from "./commands.js";
+/** `mapled env push --host vercel|netlify|cloudflare` — the site's server
+    key (Live data, the Application Data API) put on its host without
+    passing through the agent that runs this. The command asks Mapled for
+    a key of that host with the SHA-256 of a verifier it keeps in memory,
+    prints the link an owner of the project confirms on (the trusted
+    screen, S-44), waits for the decision, claims the key with the
+    verifier and hands it to the host's own CLI — on stdin where the CLI
+    takes it so, as an argument only where it has no other form.
+
+    The key is never printed, logged, written to disk, put in an
+    environment or included in `--json`: the host CLI's output is kept and
+    shown only when it fails, every occurrence of the key replaced by its
+    prefix. The agent sees the link, the decision and the prefix. */
+export type Host = "vercel" | "netlify" | "cloudflare";
+export declare const ENV_NAME = "MAPLED_SERVER_KEY";
+/** A process run to its end: its exit code and what it wrote. `missing` —
+    the program isn't there to run (ENOENT). */
+export type RunResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+    missing?: boolean;
+};
+export type Runner = (cmd: string, args: string[], opts: {
+    cwd: string;
+    input?: string;
+}) => Promise<RunResult>;
+/** The default runner: no shell (but on Windows, where the CLIs are
+    `.cmd` shims), the parent's environment untouched, stdin closed after
+    `input`, output kept — never streamed to the terminal. */
+export declare const runProcess: Runner;
+/** Every occurrence of the key in a text, as its prefix and an ellipsis. */
+export declare function redact(text: string, key: string, prefix: string): string;
+/** The environments wrangler.toml names, in each form TOML allows:
+    `[env.<name>]` headers, keys of an `[env]` table (`<name> = {…}`) and
+    dotted keys (`env.<name>.vars = …`). `opaque` — it has an `env` this
+    reading can't name (`env = {…}` inline). */
+export declare function tomlEnvs(toml: string): {
+    names: string[];
+    opaque: boolean;
+};
+export declare function envPush(ctx: Ctx, flags: ParsedArgs["flags"], run?: Runner): Promise<number>;