@mapled/cli 0.8.0 → 0.9.0

package/README.md

@@ -175,7 +175,7 @@ Mapled doctor — Dolphin Landing
 ✓ Environment          MAPLED_KEY and MAPLED_WEBHOOK_SECRET in .env.local
 ✓ Secrets in git       No env files or Mapled secrets are tracked.
 ✓ @mapled/next         0.8.0 (current)
-✓ mapled CLI           0.8.0 (current)
+✓ mapled CLI           0.9.0 (current)
 ✓ Revalidation route   app/api/mapled/revalidate/route.ts
 ⚠ Preview route        app/api/mapled/preview/route.ts is missing — mount createPreviewHandler from "@mapled/next/server" so Preview from Mapled works.
 ✓ Site reads content   Last read 3m ago
@@ -188,7 +188,7 @@ Mapled doctor — Dolphin Landing
 
 The repository side: the link, the sign-in, the generated types, the schema pin, the site manifest (and whether it matches what was pushed), the integration hash — one line saying whether the pin and the manifest here describe the same integration Mapled holds, and if not, what moved (the schema, the bindings, or edits made in Mapled) and which command catches up — `MAPLED.md` (and whether it is what Mapled would render now), `MAPLED_KEY` and `MAPLED_WEBHOOK_SECRET` in your env files (names only — values are never read out), env files or Mapled secrets tracked by git, the installed `@mapled/next` and CLI versions, the revalidation and preview routes of a Next.js site. The Mapled side, from the same status the AI agent's `check_integration` tool reads: whether the site has read content with the delivery key, the publish webhook and its last delivery, the preview route on the deployed site, the bindings health.
 
-A site rendered in the visitor's browser — a React single-page app (Vite and the like), plain HTML — is checked for what it has: the package line is `@mapled/react` (or `@mapled/client`), Environment wants `VITE_MAPLED_KEY` and no webhook secret, and the routes and the webhook read ○ «Not needed» — such a site shows a publish on its next load and trades Mapled's preview link on the page itself. doctor takes the framework from `mapled.json`, or works it out from `package.json`. Whatever the framework, a server key or a signing secret under a public prefix (`VITE_…`, `NEXT_PUBLIC_…`) is a ✗: it would ship to every visitor.
+A site rendered in the visitor's browser — a React single-page app (Vite and the like), plain HTML — is checked for what it has: the package line is `@mapled/react`, Environment wants `VITE_MAPLED_KEY` and no webhook secret, and the routes and the webhook read ○ «Not needed» — such a site shows a publish on its next load and trades Mapled's preview link on the page itself. Plain HTML installs nothing: the line is `@mapled/vanilla`, read from the script tag in the pages (or from a copy of the file next to them) — ⚠ when the address has no version or an older one — and Generated types and Environment read ○: the fields are named in attributes, the delivery key sits in the page. doctor takes the framework from `mapled.json`, or works it out from `package.json` (no `package.json` and an `index.html` is plain HTML). Whatever the framework, a server key or a signing secret under a public prefix (`VITE_…`, `NEXT_PUBLIC_…`) is a ✗: it would ship to every visitor.
 
 Exit code 1 when something is marked ✗; `--json` prints the checks for scripts and agents.
 

package/dist/commands.js

@@ -581,9 +581,10 @@ export async function doctor(ctx, flags) {
     const checks = [];
     checks.push(dr.checkLink(found ? { path: path.relative(ctx.cwd, found.path) || CONFIG_FILE } : null, status?.project.name ?? conn?.projectName ?? null));
     checks.push(dr.checkAuth({ conn: conn ?? null, status, error: authError }));
+    const framework = found?.config.framework ?? (await dr.detectFramework(dir));
     const typesPath = found?.config.types ?? DEFAULT_TYPES_PATH;
     const existing = await readFile(path.join(dir, typesPath), "utf8").catch(() => null);
-    checks.push(dr.checkTypes(existing, schema ? generateTypes(schema, { projectName: status?.project.name, sdk: dr.sdkOf(found?.config.framework ?? (await dr.detectFramework(dir))) }) : null, typesPath));
+    checks.push(dr.checkTypes(existing, schema ? generateTypes(schema, { projectName: status?.project.name, sdk: dr.sdkOf(framework) }) : null, typesPath, framework));
     const pin = found ? await readPin(dir).catch(() => null) : null;
     const livePin = schema && found ? pinSchema(schema, found.config.project) : null;
     const pinChanges = pin && livePin ? diffSchema(pin.pin.collections, livePin.collections) : null;
@@ -601,13 +602,13 @@ export async function doctor(ctx, flags) {
     checks.push(dr.checkManifestFile(localManifest ? { manifest: localManifest.manifest, problems: localManifest.problems } : null, remoteManifest));
     checks.push(dr.checkIntegration({ pin: pin?.pin ?? null, manifest: localManifest?.manifest ?? null }, conn && status ? { integration: status.integration, manifest: remoteManifest } : null));
     checks.push(checkMapledMd(await readFile(path.join(dir, MD_FILE), "utf8").catch(() => null), guide));
-    const framework = found?.config.framework ?? (await dr.detectFramework(dir));
     // a site rendered in the browser has no webhook, no routes and no secret to check
     const browser = dr.rendersInBrowser(framework);
     const sdk = dr.sdkOf(framework);
     checks.push(dr.checkEnv(await dr.envNames(dir), ctx.env, framework));
     checks.push(dr.checkSecrets(await dr.gitFacts(dir)));
-    checks.push(dr.checkSdk(await dr.installedVersion(dir, sdk), status?.sdk[sdk], sdk));
+    // plain HTML installs nothing: the runtime comes with a script tag
+    checks.push(framework === "plain-html" ? dr.checkScriptTag(await dr.findScriptTag(dir), status?.sdk[sdk]) : dr.checkSdk(await dr.installedVersion(dir, sdk), status?.sdk[sdk], sdk));
     checks.push(dr.checkCli(ctx.version, status?.sdk["@mapled/cli"]));
     checks.push(dr.checkRoute("revalidate", await dr.findRoute(dir, "revalidate"), framework));
     checks.push(dr.checkRoute("preview", await dr.findRoute(dir, "preview"), framework));

package/dist/doctor.d.ts

@@ -100,6 +100,18 @@ export declare function installedVersion(dir: string, pkg: string): Promise<Pack
 export declare const rendersInBrowser: (framework: string | null | undefined) => boolean;
 /** The first-party package a site of this framework reads through. */
 export declare const sdkOf: (framework: string | null | undefined) => string;
+/** How a plain HTML site loads "@mapled/vanilla": a script tag in its
+    pages — from a CDN, where the version is in the address, or a copy of
+    the single file next to the pages, where it is in the file's first
+    line. */
+export type ScriptTag = {
+    /** the page or the copy the version was read from */
+    file: string;
+    /** null — a CDN address without a version: it follows every release */
+    version: string | null;
+};
+export declare function findScriptTag(dir: string): Promise<ScriptTag | null>;
+export declare function checkScriptTag(tag: ScriptTag | null, latest: string | undefined): Check;
 export declare function detectFramework(dir: string): Promise<string | undefined>;
 /** -1, 0 or 1 comparing dotted numeric versions; anything else compares by number. */
 export declare function compareVersions(a: string, b: string): number;
@@ -127,7 +139,7 @@ export declare function checkAuth(state: {
     status: IntegrationStatus | null;
     error: string | null;
 }): Check;
-export declare function checkTypes(existing: string | null, generated: Generated | null, typesPath: string): Check;
+export declare function checkTypes(existing: string | null, generated: Generated | null, typesPath: string, framework?: string | null): Check;
 export declare function checkEnv(names: Map<string, string>, env: NodeJS.ProcessEnv, framework?: string | null): Check;
 export declare function checkSecrets(facts: GitFacts): Check;
 export declare function checkSdk(pkg: PackageVersion, latest: string | undefined, name?: string): Check;

package/dist/doctor.js

@@ -1,5 +1,5 @@
 import { execFile } from "node:child_process";
-import { access, readFile } from "node:fs/promises";
+import { access, readdir, readFile } from "node:fs/promises";
 import path from "node:path";
 import { promisify } from "node:util";
 import { integrationHash } from "./integrationHash.js";
@@ -108,7 +108,65 @@ export async function installedVersion(dir, pkg) {
     keys are the ones Mapled knows by (lib/siteStack.ts of the API). */
 export const rendersInBrowser = (framework) => framework === "react-spa" || framework === "plain-html";
 /** The first-party package a site of this framework reads through. */
-export const sdkOf = (framework) => !framework || framework === "nextjs" ? "@mapled/next" : framework === "react-spa" ? "@mapled/react" : "@mapled/client";
+export const sdkOf = (framework) => !framework || framework === "nextjs" ? "@mapled/next" : framework === "react-spa" ? "@mapled/react" : framework === "plain-html" ? "@mapled/vanilla" : "@mapled/client";
+const SKIPPED_DIRS = new Set(["node_modules", ".git", ".next", ".vercel", ".netlify", "vendor"]);
+export async function findScriptTag(dir) {
+    // pages first, breadth first, and not forever: a site's pages sit near its root
+    const queue = [{ abs: dir, rel: "", depth: 0 }];
+    const copies = [];
+    let unpinned = null;
+    let seen = 0;
+    while (queue.length > 0 && seen < 2000) {
+        const at = queue.shift();
+        const entries = await readdir(at.abs, { withFileTypes: true }).catch(() => []);
+        for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+            seen += 1;
+            const rel = at.rel ? `${at.rel}/${entry.name}` : entry.name;
+            if (entry.isDirectory()) {
+                if (at.depth < 3 && !SKIPPED_DIRS.has(entry.name) && !entry.name.startsWith("."))
+                    queue.push({ abs: path.join(at.abs, entry.name), rel, depth: at.depth + 1 });
+                continue;
+            }
+            if (/^mapled(\.min)?\.js$/.test(entry.name))
+                copies.push(rel);
+            if (!/\.html?$/i.test(entry.name))
+                continue;
+            const text = await readFile(path.join(at.abs, entry.name), "utf8").catch(() => "");
+            const pinned = /@mapled\/vanilla@(\d+\.\d+\.\d+)/.exec(text);
+            if (pinned)
+                return { file: rel, version: pinned[1] };
+            if (unpinned === null && /@mapled\/vanilla(@latest)?\//.test(text))
+                unpinned = rel;
+        }
+    }
+    for (const rel of copies) {
+        const head = (await readFile(path.join(dir, rel), "utf8").catch(() => "")).slice(0, 200);
+        const banner = /^\/\*! @mapled\/vanilla (\d+\.\d+\.\d+) /.exec(head);
+        if (banner)
+            return { file: rel, version: banner[1] };
+    }
+    return unpinned === null ? null : { file: unpinned, version: null };
+}
+export function checkScriptTag(tag, latest) {
+    const key = "sdk";
+    const label = "@mapled/vanilla";
+    const at = latest ?? "x.y.z";
+    if (!tag) {
+        return {
+            key,
+            label,
+            status: "failed",
+            detail: `No page loads it yet. Put <script src="https://cdn.jsdelivr.net/npm/@mapled/vanilla@${at}/dist/mapled.js" data-mapled-key="…" defer></script> into the pages.`,
+        };
+    }
+    if (tag.version === null) {
+        return { key, label, status: "warning", detail: `${tag.file} loads it without a version — that address follows every release. Pin it: @mapled/vanilla@${at}.` };
+    }
+    if (latest && compareVersions(tag.version, latest) < 0) {
+        return { key, label, status: "warning", detail: `${tag.version} in ${tag.file}, ${latest} available — change the version in the script tag.` };
+    }
+    return { key, label, status: "passed", detail: latest ? `${tag.version} in ${tag.file} (current)` : `${tag.version} in ${tag.file}` };
+}
 export async function detectFramework(dir) {
     const hasIndexHtml = () => access(path.join(dir, "index.html")).then(() => true, () => false);
     let deps;
@@ -234,8 +292,11 @@ export function checkAuth(state) {
         detail: `${state.status.connection.name} • ${state.status.project.name}`,
     };
 }
-export function checkTypes(existing, generated, typesPath) {
+export function checkTypes(existing, generated, typesPath, framework) {
     const label = "Generated types";
+    if (framework === "plain-html" && existing === null) {
+        return { key: "types", label, status: "skipped", detail: "Not needed: plain HTML names its fields in attributes, not in TypeScript." };
+    }
     if (!generated)
         return { key: "types", label, status: "skipped", detail: "Sign in to compare with the schema." };
     if (existing === null) {

package/dist/types.js

@@ -179,8 +179,8 @@ export function typeNames(collections) {
 export function generateTypes(schema, opts = {}) {
     // the package the site reads through: "@mapled/next" unless the framework says otherwise
     const sdk = opts.sdk ?? "@mapled/next";
-    // a React app's assetUrl comes from the client its hooks are built on
-    const assets = sdk === "@mapled/react" ? "@mapled/client" : sdk;
+    // a React app's assetUrl comes from the client its hooks are built on; the HTML runtime has none to call
+    const assets = sdk === "@mapled/react" || sdk === "@mapled/vanilla" ? "@mapled/client" : sdk;
     const hash = schemaHash(schema);
     const names = typeNames(schema.collections);
     const blocks = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mapled/cli",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Mapled CLI — sign in, link a project, generate TypeScript types for its content, create forms and check the site's integration.",
   "license": "MIT",
   "homepage": "https://mapled.io",