@micropage-sh/cli 2.5.0 → 2.6.2

package/README.md

@@ -19,7 +19,7 @@ brew install micropage
 ### npm
 
 ```bash
-npm install -g micropage
+npm install -g @micropage-sh/cli
 ```
 
 ## Authentication
@@ -32,6 +32,8 @@ micropage whoami       # show the currently logged-in user and subscription
 micropage logout       # clear the stored session
 ```
 
+The CLI requires a paid plan (Pro or Pro+). Some features need a specific tier, such as deploy tokens (Pro+). The server enforces these limits. When a command needs a higher plan, the CLI prints the server's reason and an upgrade link.
+
 ## Project workflow
 
 ```bash
@@ -175,9 +177,9 @@ When you create a new project, the CLI also scaffolds:
 
 | Command | Description |
 |---|---|
-| `micropage submissions list [--json]` | List form submissions for the project |
-| `micropage submissions show <id> [--json]` | Show a single submission in detail |
-| `micropage submissions export [--format csv|json] [-o file]` | Export all form submissions for the current project |
+| `micropage submissions list [--json] [--spam]` | List form submissions for the project. Spam is excluded; `--spam` lists only submissions flagged as spam, with the reason |
+| `micropage submissions show <id> [--json]` | Show a single submission in detail, including a `Spam:` line with the reason when it was flagged |
+| `micropage submissions export [--format csv|json] [-o file] [--spam]` | Export form submissions for the current project. Spam is excluded; `--spam` exports only flagged submissions (default file `submissions-spam.<format>`, CSV gets a trailing `spam_reason` column) |
 
 **Examples:**
 
@@ -199,6 +201,12 @@ When you create a new project, the CLI also scaffolds:
   micropage submissions export --format json --output submissions.json
   ```
 
+- Export only submissions flagged as spam:
+
+  ```bash
+  micropage submissions export --spam
+  ```
+
 ## Local content model
 
 The CLI uses one or more `*.page` files in the working directory as the source of truth for project content.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@micropage-sh/cli",
-  "version": "2.5.0",
+  "version": "2.6.2",
   "description": "CLI for micropage.sh - create, sync, and publish microsites",
   "main": "src/index.js",
   "bin": {
@@ -13,7 +13,7 @@
     "README.md"
   ],
   "scripts": {
-    "test": "node -e \"require('./src/index.js')\"; node --test test/",
+    "test": "node -e \"require('./src/index.js')\"; node --test test/*.test.js test/*_test.mjs",
     "build:bin": "pkg . --targets node18-linux-x64,node18-macos-x64,node18-macos-arm64 --output dist/micropage",
     "build:linux": "pkg . --target node18-linux-x64 --output dist/micropage-linux-amd64",
     "build:macos-amd64": "pkg . --target node18-macos-x64 --output dist/micropage-darwin-amd64",

package/src/commands/forms.js

@@ -52,13 +52,14 @@ async function list(options = {}) {
     return;
   }
 
-  // Count submissions per form_id
+  // Count non-spam submissions per form_id
   let submissions;
   try {
     submissions = await db
       .from('form_submissions')
       .select('form_id')
       .eq('project_id', config.projectId)
+      .is('flagged_at', 'null')
       .get();
   } catch (err) {
     handleAuthError(err);

package/src/commands/posts.js

@@ -9,7 +9,7 @@ const {
   fn,
   handleAuthError,
   getValidAccessToken,
-  getMaxDeployEventIdForBuild,
+  getMaxDeployEventIdForProject,
   streamDeployEventsUntilDone,
 } = require('../supabase');
 const { getProjectConfig } = require('../auth');
@@ -478,6 +478,18 @@ function localSlugsFromPostsDir(postsDir) {
   return slugs;
 }
 
+/**
+ * The build the publish-post rebuilds redeploy. Servers that report
+ * rebuild_build_id rebuild the live build, never a page draft; older ones
+ * leave it out and rebuild the project's active build.
+ */
+function rebuildTarget(responses, activeBuildId) {
+  const reported = responses.filter((r) => r && Object.prototype.hasOwnProperty.call(r, 'rebuild_build_id'));
+  if (reported.length === 0) return { buildId: activeBuildId || null, serverReported: false };
+  const ids = reported.map((r) => r.rebuild_build_id).filter((id) => id != null);
+  return { buildId: ids.length > 0 ? ids[ids.length - 1] : null, serverReported: true };
+}
+
 async function publish(slugArg, options = {}) {
   const cwd = process.cwd();
   const config = requireProjectConfig(cwd);
@@ -498,10 +510,11 @@ async function publish(slugArg, options = {}) {
     'Publishing sends (or re-sends) email to the active subscriber list for any email-configured post.',
   );
 
-  // Publishing a post makes the publisher auto-rebuild the site's active build so
-  // the /content archive picks it up — no separate `micropage publish` needed.
-  // Resolve that build up front so we can report accurately and (with --watch)
-  // capture an event cursor before the rebuild is queued.
+  // Publishing a post makes the publisher auto-rebuild the live site so the
+  // /content archive picks it up — no separate `micropage publish` needed.
+  // publish-post reports which build it rebuilds; active_build_id is only the
+  // fallback for servers that don't. The --watch cursor is project-wide and
+  // taken before the rebuild is queued, since the build isn't known yet.
   let activeBuildId = null;
   try {
     const proj = await db
@@ -515,9 +528,9 @@ async function publish(slugArg, options = {}) {
   }
 
   let eventCursor = 0;
-  if (options.watch && activeBuildId) {
+  if (options.watch) {
     try {
-      eventCursor = await getMaxDeployEventIdForBuild(activeBuildId);
+      eventCursor = await getMaxDeployEventIdForProject(config.projectId);
     } catch {
       eventCursor = 0;
     }
@@ -525,10 +538,12 @@ async function publish(slugArg, options = {}) {
 
   let hadError = false;
   let publishedCount = 0;
+  const responses = [];
 
   for (const slug of targetSlugs) {
     try {
       const result = await fn.invoke('publish-post', { project_id: config.projectId, slug });
+      responses.push(result);
       const bits = [`published_at ${result.published_at}`];
       bits.push(result.emailed ? `emailed ${result.recipient_count} recipient(s)` : 'no email');
       console.log(`"${slug}": ${bits.join(', ')}`);
@@ -545,17 +560,22 @@ async function publish(slugArg, options = {}) {
   console.log(`Published ${publishedCount}/${targetSlugs.length} post(s).`);
 
   if (publishedCount > 0) {
-    if (activeBuildId) {
+    const { buildId: rebuildBuildId, serverReported } = rebuildTarget(responses, activeBuildId);
+    if (rebuildBuildId) {
       console.log(
         'A site rebuild was queued automatically; the /content archive updates once it deploys (usually a minute or two).',
       );
+    } else if (serverReported) {
+      console.log(
+        "No site rebuild was queued: the project has no deployed build yet (run 'micropage publish'), or the post is email-only.",
+      );
     } else {
       console.log(
         "Note: this project hasn't been published yet, so the post won't appear until you run 'micropage publish'.",
       );
     }
 
-    if (options.watch && activeBuildId) {
+    if (options.watch && rebuildBuildId) {
       console.log('');
       console.log('Build / deploy events:');
       try {
@@ -563,7 +583,7 @@ async function publish(slugArg, options = {}) {
         const { terminalEvent } = await streamDeployEventsUntilDone(
           accessToken,
           config.projectId,
-          activeBuildId,
+          rebuildBuildId,
           { afterId: eventCursor },
         );
         if (terminalEvent?.event_type === 'build.failed') {
@@ -619,6 +639,7 @@ module.exports = {
   rm,
   publish,
   unpublish,
+  rebuildTarget,
   slugify,
   defaultSlugFromFilename,
   frontMatterFromPost,

package/src/commands/projects.js

@@ -607,6 +607,7 @@ async function deploy(projectUuid, deployToken, options = {}) {
       }
     }
   } catch (err) {
+    handleAuthError(err);
     console.error('Deploy failed:', err.message);
     process.exit(1);
   }

package/src/commands/submissions.js

@@ -13,6 +13,11 @@ function formatCliFieldValue(value) {
   return String(value);
 }
 
+/** Spam is `flagged_at IS NOT NULL`; the inbox is everything else. */
+function applySpamFilter(query, spam) {
+  return spam ? query.not('flagged_at', 'is', 'null') : query.is('flagged_at', 'null');
+}
+
 async function list(options = {}) {
   const cwd = process.cwd();
   const config = getProjectConfig(cwd);
@@ -21,12 +26,17 @@ async function list(options = {}) {
     process.exit(1);
   }
 
+  const spam = Boolean(options.spam);
+  const columns = spam
+    ? 'id,form_id,form_name,page_url,created_at,form_index,spam_reason,flagged_at,flagged_by'
+    : 'id,form_id,form_name,page_url,created_at,form_index';
+
   let submissions;
   try {
-    submissions = await db
-      .from('form_submissions')
-      .select('id,form_id,form_name,page_url,created_at,form_index')
-      .eq('project_id', config.projectId)
+    submissions = await applySpamFilter(
+      db.from('form_submissions').select(columns).eq('project_id', config.projectId),
+      spam,
+    )
       .order('created_at', 'desc')
       .get();
   } catch (err) {
@@ -36,7 +46,7 @@ async function list(options = {}) {
   }
 
   if (!Array.isArray(submissions) || submissions.length === 0) {
-    console.log('No form submissions.');
+    console.log(spam ? 'No spam submissions.' : 'No form submissions.');
     return;
   }
 
@@ -45,14 +55,20 @@ async function list(options = {}) {
     return;
   }
 
-  const rows = submissions.map((s) => [
-    s.id.slice(0, 8) + '…',
-    s.form_id ? s.form_id.slice(0, 8) + '…' : '-',
-    s.form_name || '-',
-    s.page_url || '-',
-    formatDate(s.created_at),
-  ]);
-  formatTable(rows, ['ID (short)', 'Form ID', 'Form', 'Page URL', 'Submitted']);
+  const rows = submissions.map((s) => {
+    const row = [
+      s.id.slice(0, 8) + '…',
+      s.form_id ? s.form_id.slice(0, 8) + '…' : '-',
+      s.form_name || '-',
+      s.page_url || '-',
+      formatDate(s.created_at),
+    ];
+    if (spam) row.push(s.spam_reason || '-');
+    return row;
+  });
+  const headers = ['ID (short)', 'Form ID', 'Form', 'Page URL', 'Submitted'];
+  if (spam) headers.push('Spam reason');
+  formatTable(rows, headers);
 }
 
 async function show(id, options = {}) {
@@ -85,6 +101,9 @@ async function show(id, options = {}) {
   }
 
   console.log('ID:         ', submission.id);
+  if (submission.flagged_at) {
+    console.log('Spam:       ', submission.spam_reason || 'yes');
+  }
   console.log('Form ID:    ', submission.form_id || '-');
   console.log('Form:       ', submission.form_name || '-');
   console.log('Page URL:   ', submission.page_url || '-');
@@ -112,12 +131,14 @@ async function exportSubmissions(options = {}) {
     process.exit(1);
   }
 
+  const spam = Boolean(options.spam);
+
   let submissions;
   try {
-    submissions = await db
-      .from('form_submissions')
-      .select('*')
-      .eq('project_id', config.projectId)
+    submissions = await applySpamFilter(
+      db.from('form_submissions').select('*').eq('project_id', config.projectId),
+      spam,
+    )
       .order('created_at', 'desc')
       .get();
   } catch (err) {
@@ -127,7 +148,7 @@ async function exportSubmissions(options = {}) {
   }
 
   if (!Array.isArray(submissions) || submissions.length === 0) {
-    console.log('No form submissions to export.');
+    console.log(spam ? 'No spam submissions to export.' : 'No form submissions to export.');
     return;
   }
 
@@ -137,7 +158,7 @@ async function exportSubmissions(options = {}) {
     process.exit(1);
   }
 
-  const defaultName = `submissions.${format}`;
+  const defaultName = spam ? `submissions-spam.${format}` : `submissions.${format}`;
   const outFile = options.output
     ? path.isAbsolute(options.output)
       ? options.output
@@ -158,6 +179,7 @@ async function exportSubmissions(options = {}) {
         'build_id',
         'payload_json',
       ];
+      if (spam) header.push('spam_reason');
       const escapeCell = (value) => {
         if (value === null || value === undefined) return '';
         const str = String(value);
@@ -168,8 +190,8 @@ async function exportSubmissions(options = {}) {
       };
       const lines = [
         header.join(','),
-        ...submissions.map((s) =>
-          [
+        ...submissions.map((s) => {
+          const cells = [
             s.id,
             s.created_at,
             s.page_url || '',
@@ -178,8 +200,10 @@ async function exportSubmissions(options = {}) {
             s.form_index ?? '',
             s.build_id || '',
             JSON.stringify(s.payload || {}),
-          ].map(escapeCell).join(','),
-        ),
+          ];
+          if (spam) cells.push(s.spam_reason || '');
+          return cells.map(escapeCell).join(',');
+        }),
       ];
       fs.writeFileSync(outFile, lines.join('\n'), 'utf8');
     }
@@ -188,7 +212,8 @@ async function exportSubmissions(options = {}) {
     process.exit(1);
   }
 
-  console.log(`Exported ${submissions.length} submission(s) → ${outFile}`);
+  const noun = spam ? 'spam submission(s)' : 'submission(s)';
+  console.log(`Exported ${submissions.length} ${noun} → ${outFile}`);
 }
 
-module.exports = { list, show, exportSubmissions };
+module.exports = { list, show, exportSubmissions, applySpamFilter };

package/src/index.js

@@ -219,8 +219,9 @@ const subCmd = program.command('submissions').description('View form submissions
 
 subCmd
   .command('list')
-  .description('List form submissions for the current project')
+  .description('List form submissions for the current project (spam excluded)')
   .option('--json', 'Output as JSON')
+  .option('--spam', 'List only submissions flagged as spam')
   .action((opts) => submissions.list(opts));
 
 subCmd
@@ -231,14 +232,15 @@ subCmd
 
 subCmd
   .command('export')
-  .description('Export form submissions for the current project to a file')
+  .description('Export form submissions for the current project to a file (spam excluded)')
+  .option('--spam', 'Export only submissions flagged as spam')
   .option(
     '-f, --format <format>',
     'Output format: csv or json (default: csv)',
   )
   .option(
     '-o, --output <file>',
-    'Output file path (default: submissions.<format>)',
+    'Output file path (default: submissions.<format>, or submissions-spam.<format> with --spam)',
   )
   .action((opts) => submissions.exportSubmissions(opts));
 

package/src/plan.js

@@ -2,13 +2,37 @@
 
 const { SUPABASE_URL, SUPABASE_ANON_KEY } = require('./config');
 
+const PRICING_URL = 'https://micropage.sh/pricing';
+
 const UPGRADE_MESSAGE = [
   'The micropage CLI is available on paid plans only.',
   'Your account is currently on the free plan.',
   '',
-  'Upgrade at: https://micropage.sh/pricing',
+  `Upgrade at: ${PRICING_URL}`,
 ].join('\n');
 
+const TIER_LABELS = { pro: 'Pro', pro_plus: 'Pro+' };
+
+// Message for a server refusal tagged PLAN_REQUIRED (see attachPlanRequired in
+// supabase.js). Leads with the server's own explanation, then the upgrade hint.
+function formatPlanRequiredMessage(err) {
+  const label = TIER_LABELS[err?.requiredTier];
+  const lines = [];
+  // Server messages written for the editor may end in a relative "Upgrade at /pricing.";
+  // drop it so the absolute link below is the only one.
+  const reason = (err?.message || '').replace(/\s*Upgrade at \S+$/i, '').trim();
+  if (reason) lines.push(reason, '');
+  lines.push(`This requires ${label ? `the ${label} plan` : 'a paid plan'}.`);
+  lines.push('');
+  lines.push(`Upgrade at: ${err?.upgradeUrl || PRICING_URL}`);
+  return lines.join('\n');
+}
+
+// The login gate below (and in whoami) is a product gate, not a security
+// boundary: anyone can call the Supabase API directly with an editor session.
+// The server enforces the per-feature gates (project limits via RLS, storage
+// quota, custom domains, archives, posts, deploy-token creation and exchange)
+// and answers with `code: "plan_required"` when a tier is missing.
 function isPaidTier(tier) {
   return tier === 'pro' || tier === 'pro_plus';
 }
@@ -37,4 +61,4 @@ async function getPlanTierWithToken(userId, accessToken) {
   }
 }
 
-module.exports = { UPGRADE_MESSAGE, isPaidTier, getPlanTierWithToken };
+module.exports = { UPGRADE_MESSAGE, isPaidTier, getPlanTierWithToken, formatPlanRequiredMessage };

package/src/supabase.js

@@ -13,6 +13,7 @@
 
 const { getSession, setSession, clearSession } = require('./auth');
 const { SUPABASE_URL, SUPABASE_ANON_KEY } = require('./config');
+const { formatPlanRequiredMessage } = require('./plan');
 
 // ---------------------------------------------------------------------------
 // JWT helpers
@@ -97,6 +98,18 @@ async function getValidAccessToken() {
 // Base request
 // ---------------------------------------------------------------------------
 
+// Server tier refusals carry `code: "plan_required"` in the JSON body, reusing
+// 402/403. Tag the error so callers can tell "upgrade needed" apart from
+// "not yours" / "invalid token", which share those statuses.
+function attachPlanRequired(err, data) {
+  if (data && typeof data === 'object' && data.code === 'plan_required') {
+    err.code = 'PLAN_REQUIRED';
+    err.requiredTier = data.required_tier || null;
+    err.upgradeUrl = data.upgrade_url || null;
+  }
+  return err;
+}
+
 async function requestWithToken(method, url, body, accessToken, extraHeaders = {}) {
   const headers = {
     'apikey': SUPABASE_ANON_KEY,
@@ -123,6 +136,7 @@ async function requestWithToken(method, url, body, accessToken, extraHeaders = {
     const err = new Error(msg);
     err.status = res.status;
     err.data = data;
+    attachPlanRequired(err, data);
     throw err;
   }
 
@@ -172,6 +186,7 @@ async function request(method, url, body, extraHeaders = {}) {
     err.status = res.status;
     err.data = data;
     if (res.status === 401) err.code = 'SESSION_EXPIRED';
+    attachPlanRequired(err, data);
     throw err;
   }
 
@@ -207,6 +222,8 @@ function buildQuery(table) {
     select(cols) { _select = cols; return q; },
     eq(col, val) { filters.push(`${col}=eq.${val}`); return q; },
     in(col, vals) { filters.push(`${col}=in.(${vals.join(',')})`); return q; },
+    is(col, val) { filters.push(`${col}=is.${val}`); return q; },
+    not(col, op, val) { filters.push(`${col}=not.${op}.${val}`); return q; },
     order(col, dir = 'asc') { _order = `${col}.${dir}`; return q; },
     limit(n) { _limit = n; return q; },
 
@@ -286,6 +303,10 @@ function handleAuthError(err) {
     console.error(err.message);
     process.exit(1);
   }
+  if (err.code === 'PLAN_REQUIRED') {
+    console.error(formatPlanRequiredMessage(err));
+    process.exit(1);
+  }
 }
 
 // ---------------------------------------------------------------------------
@@ -363,6 +384,20 @@ async function getMaxDeployEventIdForBuild(buildId, accessToken = null) {
   return Number.isFinite(n) ? n : 0;
 }
 
+/**
+ * Highest build_deploy_events.id across the project, 0 when none. A cursor
+ * taken before a post change, when the build the server will rebuild is not
+ * known yet: event ids are global and the stream filters by build.
+ */
+async function getMaxDeployEventIdForProject(projectId) {
+  const url = `${SUPABASE_URL}/rest/v1/build_deploy_events?select=id&project_id=eq.${encodeURIComponent(String(projectId))}&order=id.desc&limit=1`;
+  const data = await request('GET', url, null);
+  const row = Array.isArray(data) ? data[0] : null;
+  if (!row || row.id == null) return 0;
+  const n = Number(row.id);
+  return Number.isFinite(n) ? n : 0;
+}
+
 /**
  * Stream build/deploy/archive events until a terminal event or the connection closes.
  * @param {string} bearerToken
@@ -654,6 +689,7 @@ async function exchangeDeployTokenForAccessToken(deployTokenPlaintext, projectUu
     );
     err.status = res.status;
     err.data = data;
+    attachPlanRequired(err, data);
     throw err;
   }
   if (!data?.access_token) {
@@ -693,6 +729,7 @@ async function invokePublishBuild(accessToken, projectId, buildId) {
     );
     err.status = res.status;
     err.data = data;
+    attachPlanRequired(err, data);
     throw err;
   }
   return data;
@@ -703,8 +740,10 @@ module.exports = {
   fn,
   getUserInfo,
   handleAuthError,
+  attachPlanRequired,
   getValidAccessToken,
   getMaxDeployEventIdForBuild,
+  getMaxDeployEventIdForProject,
   streamDeployEventsUntilDone,
   exchangeDeployTokenForAccessToken,
   pushWithToken,