@overscore/cli 0.13.3 → 0.13.5

package/dist/index.js

@@ -8,6 +8,7 @@ import { execSync } from "child_process";
 import { createInterface } from "readline";
 import { createHash, randomBytes } from "crypto";
 import yauzl from "yauzl";
+import { templatePush } from "./template-push.js";
 // ── Shared helpers ──────────────────────────────────────────────────
 // Name CLI-minted API keys after the machine + date so stale keys are
 // recognizable and revocable in the Hub UI (mitigates key sprawl). Keys are
@@ -261,6 +262,12 @@ const SOURCE_EXCLUDE = new Set([
     ".docker",
     ".gnupg",
     ".overscore",
+    // Raw exploratory query results (`query run` writes warehouse rows here).
+    // NEVER ship these in the deployed source bundle — they're real warehouse
+    // data. The analysis publish path already excludes data/ via .overscoreignore;
+    // this baseline exclusion protects the dashboard deploy path too, regardless of
+    // whether a project has a .overscoreignore.
+    "data",
 ]);
 const SECRET_FILE_EXTENSIONS = new Set([
     ".pem",
@@ -2704,12 +2711,16 @@ else if (command === "template") {
     if (subcommand === "pull") {
         templatePull(process.argv[4]);
     }
+    else if (subcommand === "push") {
+        templatePush(process.argv[4]);
+    }
     else {
         console.log(`
   overscore template — Manage marketplace templates
 
   Commands:
     pull <slug> [dir]        Download and extract a template
+    push [slug]              Build the current directory and push it back to your template
 
   Examples:
     npx @overscore/cli template pull mrr-tracker

package/dist/template-push.js

@@ -0,0 +1,306 @@
+/**
+ * `overscore template push [slug]` — build the current directory and push it
+ * back to YOUR marketplace template (push update channel). The Hub replaces
+ * the template's frozen built files + pinned source.zip in place; no project,
+ * no dashboard, and no API key are involved — auth is the device token and
+ * ownership is checked server-side.
+ *
+ * Self-contained on purpose: index.ts is a single hand-rolled router and this
+ * module duplicates the few helpers it needs (parseEnv, file collectors)
+ * rather than entangling the deploy path.
+ *
+ * ── DEFERRED HOOK (staged — do NOT wire until the push backend ships) ──────
+ * packages/cli/src/index.ts needs exactly these 4 lines:
+ *
+ * 1. Import, with the other imports at the top of the file (after the
+ *    `import yauzl from "yauzl";` line, index.ts ~11). The `.js` extension is
+ *    required — tsc emits ESM (module: ESNext) and Node only resolves
+ *    relative ESM imports with an extension:
+ *
+ *      import { templatePush } from "./template-push.js";
+ *
+ * 2-3. Router case inside the `command === "template"` block, directly after
+ *    the `if (subcommand === "pull") { templatePull(process.argv[4]); }`
+ *    branch (index.ts ~3338-3339), before the help `else`:
+ *
+ *      } else if (subcommand === "push") {
+ *        templatePush(process.argv[4]);
+ *
+ * 4. Help line in the `overscore template` help text (index.ts ~3345, under
+ *    the `pull <slug> [dir]` line):
+ *
+ *      push [slug]              Build the current directory and push it back to your template
+ */
+import fs from "fs";
+import path from "path";
+import { execSync } from "child_process";
+const HUB_URL = "https://overscore.dev";
+// Mirrors the templates_slug_format CHECK in the marketplace migration.
+const TEMPLATE_SLUG_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+function isValidTemplateSlug(slug) {
+    return (slug.length >= 1 &&
+        slug.length <= 100 &&
+        !slug.includes("--") &&
+        TEMPLATE_SLUG_RE.test(slug));
+}
+// Duplicated from index.ts — parses the KEY=VALUE lines of ~/.overscore/config.
+function parseEnv(content) {
+    const env = {};
+    for (const line of content.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        const eqIndex = trimmed.indexOf("=");
+        if (eqIndex === -1)
+            continue;
+        env[trimmed.slice(0, eqIndex)] = trimmed.slice(eqIndex + 1);
+    }
+    return env;
+}
+function readDeviceToken() {
+    const configPath = path.join(process.env.HOME || "", ".overscore", "config");
+    if (!fs.existsSync(configPath))
+        return null;
+    const cfg = parseEnv(fs.readFileSync(configPath, "utf-8"));
+    return cfg.OVERSCORE_DEVICE_TOKEN || null;
+}
+/** Slug fallback: `template pull` records it in .overscore/template.json. */
+function readPulledTemplateSlug() {
+    const metaPath = path.resolve(process.cwd(), ".overscore", "template.json");
+    if (!fs.existsSync(metaPath))
+        return null;
+    try {
+        const meta = JSON.parse(fs.readFileSync(metaPath, "utf-8"));
+        return typeof meta.template_slug === "string" ? meta.template_slug : null;
+    }
+    catch {
+        return null;
+    }
+}
+// Duplicated from index.ts — plain recursive walk of dist/ (built output is
+// machine-generated; no secret filtering needed there).
+function collectFiles(dir, prefix) {
+    const files = [];
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) {
+            files.push(...collectFiles(path.join(dir, entry.name), relativePath));
+        }
+        else {
+            files.push(relativePath);
+        }
+    }
+    return files;
+}
+// ── Safe source collector (duplicated guards from the deploy path) ──────────
+// Excludes machine state, build output, and anything secret-shaped, and NEVER
+// follows symlinks (a symlink could point at ~/.ssh/id_rsa or outside the
+// project). v1 limitation, on purpose: `.overscoreignore` is NOT honored here
+// — templates ship mock data only, so there should be nothing project-
+// specific to hide beyond these baseline exclusions.
+const SOURCE_EXCLUDE = new Set([
+    "node_modules",
+    "dist",
+    ".git",
+    ".DS_Store",
+    ".aws",
+    ".ssh",
+    ".kube",
+    ".docker",
+    ".gnupg",
+    ".overscore",
+    // Raw exploratory query results — never ship real warehouse rows.
+    "data",
+]);
+const SECRET_FILE_EXTENSIONS = new Set([
+    ".pem",
+    ".key",
+    ".p12",
+    ".pfx",
+    ".jks",
+    ".keystore",
+    ".p8",
+    ".ppk",
+    ".gpg",
+    ".asc",
+    ".tfstate",
+    ".tfvars",
+]);
+const SECRET_FILE_NAMES = new Set([
+    "service-account.json",
+    "service_account.json",
+    "serviceaccount.json",
+    "gcp-credentials.json",
+    "credentials.json",
+    "id_rsa",
+    "id_dsa",
+    "id_ecdsa",
+    "id_ed25519",
+    ".netrc",
+    ".pgpass",
+    ".htpasswd",
+    "secrets.json",
+    "secrets.yaml",
+    "secrets.yml",
+]);
+function isSecretFileName(name) {
+    const lower = name.toLowerCase();
+    if (SECRET_FILE_NAMES.has(lower))
+        return true;
+    const ext = lower.substring(lower.lastIndexOf("."));
+    if (SECRET_FILE_EXTENSIONS.has(ext))
+        return true;
+    if (lower.includes(".tfstate"))
+        return true;
+    return false;
+}
+function collectTemplateSourceFiles(dir, prefix, skipped) {
+    const s = skipped ?? [];
+    const files = [];
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        if (entry.isSymbolicLink()) {
+            s.push((prefix ? `${prefix}/` : "") + entry.name + " (symlink)");
+            continue;
+        }
+        if (SOURCE_EXCLUDE.has(entry.name))
+            continue;
+        if (entry.name.startsWith(".env"))
+            continue; // .env, .env.local, …
+        if (entry.name.endsWith(".log"))
+            continue;
+        if (isSecretFileName(entry.name)) {
+            s.push((prefix ? `${prefix}/` : "") + entry.name + " (secret)");
+            continue;
+        }
+        const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) {
+            files.push(...collectTemplateSourceFiles(path.join(dir, entry.name), relativePath, s)
+                .files);
+        }
+        else {
+            files.push(relativePath);
+        }
+    }
+    return { files, skipped: s };
+}
+// ── Command ──────────────────────────────────────────────────────────────────
+export async function templatePush(slugArg) {
+    const slug = slugArg || readPulledTemplateSlug();
+    if (!slug) {
+        console.error(`
+  Usage: npx @overscore/cli template push [template-slug]
+
+  Run it from a pulled template directory (.overscore/template.json supplies
+  the slug automatically) or pass the slug explicitly.
+
+  Example:
+    npx @overscore/cli template push mrr-tracker
+`);
+        process.exit(1);
+    }
+    if (!isValidTemplateSlug(slug)) {
+        console.error(`\n  Error: "${slug}" is not a valid template slug.\n`);
+        process.exit(1);
+    }
+    const deviceToken = readDeviceToken();
+    if (!deviceToken) {
+        console.error(`
+  No Overscore credentials found. Sign in first:
+
+    npx @overscore/cli auth login
+`);
+        process.exit(1);
+    }
+    console.log(`\n  Pushing template: ${slug}\n`);
+    // Build — same guard as deploy: blank the API key env so a local dev key
+    // can never end up baked into the published bundle.
+    console.log("  Building...");
+    try {
+        execSync("npm run build", {
+            stdio: "inherit",
+            env: { ...process.env, VITE_OVERSCORE_API_KEY: "" },
+        });
+    }
+    catch {
+        console.error("\n  Build failed. Fix errors and try again.");
+        process.exit(1);
+    }
+    const distDir = path.resolve(process.cwd(), "dist");
+    if (!fs.existsSync(distDir)) {
+        console.error("  Error: No dist/ directory found after build.");
+        process.exit(1);
+    }
+    const builtFiles = collectFiles(distDir, "");
+    console.log(`  Found ${builtFiles.length} built files.`);
+    const { files: sourceFiles, skipped } = collectTemplateSourceFiles(process.cwd(), "");
+    console.log(`  Found ${sourceFiles.length} source files.`);
+    if (skipped.length > 0) {
+        // Never silently lossy on secrets — same rule as deploy.
+        console.log(`  Skipped ${skipped.length} sensitive/symlinked file(s): ${skipped
+            .slice(0, 10)
+            .join(", ")}${skipped.length > 10 ? ", …" : ""}`);
+    }
+    console.log("  Uploading...");
+    const formData = new FormData();
+    for (const file of builtFiles) {
+        const content = fs.readFileSync(path.join(distDir, file));
+        formData.append(`file:${file}`, new Blob([content]), file);
+    }
+    for (const file of sourceFiles) {
+        const content = fs.readFileSync(path.join(process.cwd(), file));
+        formData.append(`source:${file}`, new Blob([content]), file);
+    }
+    let res;
+    try {
+        res = await fetch(`${HUB_URL}/api/templates/${slug}/push`, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${deviceToken}` },
+            body: formData,
+        });
+    }
+    catch {
+        console.error(`\n  Error: Could not reach overscore.dev\n`);
+        process.exit(1);
+    }
+    const data = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        const serverMsg = data.error || data.message;
+        if (res.status === 401) {
+            console.error(`
+  Authentication failed${serverMsg ? `: ${serverMsg}` : ""}.
+
+  Your device token may have expired — sign in again:
+    npx @overscore/cli auth login
+`);
+        }
+        else if (res.status === 403) {
+            console.error(`
+  You don't own the template "${slug}"${serverMsg ? ` — ${serverMsg}` : "."}
+
+  Push only works on templates you published. To build on someone else's
+  template, pull it and publish your own listing.
+`);
+        }
+        else if (res.status === 422) {
+            // Channel/validation errors (e.g. a dashboard-channel template that
+            // updates via "Refresh to the latest deploy") — the server explains
+            // itself; pass it through verbatim.
+            console.error(`\n  Error: ${serverMsg || "This template can't be pushed."}\n`);
+        }
+        else {
+            console.error(`\n  Push failed: ${serverMsg || `HTTP ${res.status}`}\n`);
+        }
+        process.exit(1);
+    }
+    const builtCount = data.built_file_count ?? builtFiles.length;
+    const sourceCount = sourceFiles.length;
+    const listingUrl = data.detail_url
+        ? `${HUB_URL}${data.detail_url}`
+        : `${HUB_URL}/explore/${slug}`;
+    console.log(`
+  Pushed successfully!
+
+  ${builtCount} built files + ${sourceCount} source files uploaded
+  Listing: ${listingUrl}${data.preview_url ? `\n  Preview: ${data.preview_url}` : ""}
+`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overscore/cli",
-  "version": "0.13.3",
+  "version": "0.13.5",
   "description": "CLI for deploying Overscore dashboards and publishing analyses",
   "bin": {
     "overscore": "dist/index.js"