@opul/cli 0.1.2 → 0.1.4

package/dist/index.js

@@ -243,6 +243,10 @@ function overlayInitSource() {
     const POS_KEY = "__opul_cursor_pos";
     const INK2 = "#0E0E0E";
     const PAPER = "#F4F4F2";
+    const DEFAULT_COLOR = "#C8F24E";
+    if (typeof config.color !== "string" || !/^#[0-9a-fA-F]{3,8}$|^(?:rgb|rgba|hsl|hsla)\([0-9.,%\s]+\)$|^[a-zA-Z]{1,20}$/.test(config.color.trim())) {
+      config = { color: DEFAULT_COLOR };
+    }
     function ensureFont() {
       if (document.getElementById("__opul_font"))
         return;
@@ -977,6 +981,18 @@ var ACTIONS = [
 ];
 var StepsValidationError = class extends Error {
 };
+var SAFE_COLOR = /^#[0-9a-fA-F]{3,8}$|^(?:rgb|rgba|hsl|hsla)\(\s*[0-9.,%\s]+\)$|^[a-zA-Z]{1,20}$/;
+function isSafeColor(c2) {
+  return SAFE_COLOR.test(c2.trim());
+}
+function isSafeUrl(u) {
+  try {
+    const p = new URL(u);
+    return p.protocol === "http:" || p.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
 function parseSteps(raw) {
   if (typeof raw !== "object" || raw === null) {
     throw new StepsValidationError("steps file must be a JSON object");
@@ -989,6 +1005,16 @@ function parseSteps(raw) {
     throw new StepsValidationError('"steps" must be a non-empty array');
   }
   const steps = obj.steps.map((s, i) => validateStep(s, i));
+  for (const key of ["url", "startUrl"]) {
+    const v = obj[key];
+    if (typeof v === "string" && v !== "" && !isSafeUrl(v)) {
+      throw new StepsValidationError(`"${key}" must be an http(s) URL`);
+    }
+  }
+  const cursorColor = obj.cursor?.color;
+  if (typeof cursorColor === "string" && !isSafeColor(cursorColor)) {
+    throw new StepsValidationError(`cursor.color "${cursorColor}" is not a valid CSS color`);
+  }
   const vp = obj.viewport;
   const viewport = vp && typeof vp.width === "number" && typeof vp.height === "number" ? { width: vp.width, height: vp.height } : { width: 1440, height: 900 };
   return {
@@ -1016,8 +1042,12 @@ function validateStep(s, i) {
       throw new StepsValidationError(`step ${i} (${a}): "${field}" is required`);
     }
   };
-  if (a === "goto")
+  if (a === "goto") {
     need("url");
+    if (typeof step.url === "string" && !isSafeUrl(step.url)) {
+      throw new StepsValidationError(`step ${i} (goto): "url" must be http(s)`);
+    }
+  }
   if (a === "click" || a === "hover" || a === "wait")
     need("selector");
   if (a === "type") {
@@ -1219,6 +1249,9 @@ async function demoCommand(opts) {
     console.log(`  ${rel(result.posterPath)}`);
     console.log(`
   next:  ${ink.bold(`opul publish ${rel(result.videoPath)}`)}`);
+    console.log(
+      `  ${ink.dim("\u21B3 turns it into a shareable link. needs a free account \u2014 run")} ${ink.bold("opul login")} ${ink.dim("first.")}`
+    );
   } catch (e) {
     progress.stop();
     if (e instanceof ChromeNotFoundError) fail(e.message);
@@ -1242,7 +1275,7 @@ import { createInterface as createInterface2 } from "readline/promises";
 import { stdin, stdout } from "process";
 
 // src/config.ts
-import { readFile as readFile2, writeFile as writeFile7, mkdir as mkdir3 } from "fs/promises";
+import { readFile as readFile2, writeFile as writeFile7, mkdir as mkdir3, chmod } from "fs/promises";
 import { homedir } from "os";
 import { join as join6 } from "path";
 var dir = join6(homedir(), ".opul");
@@ -1256,8 +1289,12 @@ async function loadConfig() {
   }
 }
 async function saveConfig(cfg) {
-  await mkdir3(dir, { recursive: true });
+  await mkdir3(dir, { recursive: true, mode: 448 });
+  await chmod(dir, 448).catch(() => {
+  });
   await writeFile7(file, JSON.stringify(cfg, null, 2) + "\n", { mode: 384 });
+  await chmod(file, 384).catch(() => {
+  });
 }
 async function requireToken() {
   const { token } = await loadConfig();
@@ -1321,15 +1358,15 @@ async function publishCommand(file2, opts) {
   }
   const videoPath = resolve3(process.cwd(), file2);
   const posterPath = opts.poster ? resolve3(process.cwd(), opts.poster) : join7(dirname(videoPath), "poster.jpg");
-  let video;
+  let size;
   try {
-    video = await readFile3(videoPath);
+    size = (await stat2(videoPath)).size;
   } catch {
     return fail3(`file not found: ${file2}`);
   }
-  const poster = await readFile3(posterPath).catch(() => null);
-  const size = (await stat2(videoPath)).size;
   if (size > 200 * 1024 * 1024) return fail3("file exceeds 200 MB upload cap.");
+  const video = await readFile3(videoPath);
+  const poster = await readFile3(posterPath).catch(() => null);
   const meta = await readFile3(join7(dirname(videoPath), "demo.json"), "utf8").then((s) => JSON.parse(s)).catch(() => ({}));
   const title = opts.title ?? meta.title ?? basename(videoPath).replace(/\.[^.]+$/, "");
   const auth = { authorization: `Bearer ${token}` };
@@ -1340,9 +1377,11 @@ async function publishCommand(file2, opts) {
     body: JSON.stringify({ title, hasPoster: !!poster, byteSize: size })
   }).catch(() => null);
   if (!presign || !presign.ok) {
-    return fail3(
-      presign ? `publish failed (${presign.status}): ${await presign.text()}` : "could not reach opul.dev \u2014 check your connection."
-    );
+    if (!presign) return fail3("could not reach opul.dev \u2014 check your connection.");
+    const body = await parseError(presign);
+    const hint = presign.status === 403 ? `
+  ${ink.dim("\u21B3 upgrade or manage your plan:")} ${ink.bold(`${base}/account/billing`)}` : "";
+    return fail3(`publish failed (${presign.status}): ${body}${hint}`);
   }
   const { id, slug, uploadUrl, posterUploadUrl } = await presign.json();
   process.stderr.write(ink.dim(`uploading ${fmtSize(size)}\u2026`));
@@ -1373,6 +1412,15 @@ async function publishCommand(file2, opts) {
   console.log(`${ink.green("\u2713")} published`);
   console.log(`  ${ink.bold(`${base}/d/${slug}`)}`);
 }
+async function parseError(res) {
+  const text = await res.text().catch(() => "");
+  try {
+    const j = JSON.parse(text);
+    if (j && typeof j.error === "string") return j.error;
+  } catch {
+  }
+  return text || res.statusText;
+}
 function fail3(msg) {
   console.error(`${ink.red("\u2717")} ${msg}`);
   process.exit(1);
@@ -1433,7 +1481,7 @@ function fail4(msg) {
 
 // src/index.ts
 var program = new Command();
-program.name("opul").description("Record a product demo from your running web app.").version("0.1.2");
+program.name("opul").description("Record a product demo from your running web app.").version("0.1.4");
 program.command("init").description("Create an opul.steps.json stub").option("--out <file>", "output path", "opul.steps.json").action(initCommand);
 program.command("doctor").description("Check that Chrome and ffmpeg are installed").action(doctorCommand);
 program.command("record").description("Click through your app to generate a steps file").option("--url <url>", "app URL to open").option("--out <file>", "steps file to write", "opul.steps.json").option("--name <name>", "product/demo name").option("--chrome <path>", "path to Chrome executable").action(recordCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opul/cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Record a polished product-demo video from your running web app — from the terminal.",
   "type": "module",
   "bin": {