@phnx-labs/agents-cli 1.22.114 → 1.22.115

package/dist/lib/share/config.js

@@ -1,211 +0,0 @@
-// Config + credential glue for `agents artifacts share`.
-//
-// - The endpoint config (base URL, account, worker/bucket names) lives in
-//   `agents.yaml` under `share:` (Meta.share) so it syncs fleet-wide via
-//   `agents repo push/pull`.
-// - The raw write token lives in the `share` secrets bundle (keychain-backed,
-//   fleet-injectable) — never on disk in plaintext.
-// - The Cloudflare API token (for provisioning) is read from the user's existing
-//   `cloudflare` bundle.
-import { randomBytes } from 'node:crypto';
-import { readMeta, updateMeta } from '../state.js';
-import { bundleExistsSync as bundleExists, keychainRef, readAndResolveBundleEnvSync as readAndResolveBundleEnv, readBundleSync as readBundle, secretsKeychainItem, writeBundleWithItemsSync as writeBundleWithItems, } from '../secrets-client.js';
-export const SHARE_BUNDLE = 'share';
-export const SHARE_TOKEN_KEY = 'WRITE_TOKEN';
-export const SHARE_TOKEN_ENV_KEY = 'SHARE_WRITE_TOKEN';
-export const DEFAULT_CF_BUNDLE = 'cloudflare';
-export const DEFAULT_WORKER_NAME = 'agents-share';
-export const DEFAULT_BUCKET_NAME = 'agents-share';
-// The Rush product share endpoint (PHNX-3960): share.getrush.ai on the product
-// domain. Publishing prints this host; bound to the `agents-share` Worker in the
-// Phoenix CF account. share.agents-cli.sh + artifacts.prix.dev stay bound as legacy aliases.
-export const DEFAULT_SHARE_DOMAIN = 'share.getrush.ai';
-// Managed hosts still recognized as "the platform endpoint" for backward
-// compatibility. `share.agents-cli.sh` is the pre-PHNX-3960 default: it stays
-// attached to the same Worker, so every link already shared on it keeps
-// resolving, and a persisted config pointing at it is still treated as managed
-// (e.g. for deploy-time PHOENIX_ID_BASE binding). Compared lowercased.
-export const LEGACY_MANAGED_SHARE_DOMAINS = ['share.agents-cli.sh', 'artifacts.prix.dev'];
-/** The write token may be injected ephemerally into fleet/cloud agents. */
-export function readWriteTokenEnv(env = process.env) {
-    const token = env[SHARE_TOKEN_ENV_KEY]?.trim();
-    return token ? token : null;
-}
-/** Trim; empty / whitespace-only strings are absent. */
-function nonempty(v) {
-    const t = v?.trim();
-    return t ? t : undefined;
-}
-/**
- * Read the persisted endpoint config, or null if there is no `share.baseUrl`.
- *
- * Publish talks only to `baseUrl` with `WRITE_TOKEN`. `accountId` / worker /
- * bucket are provisioning metadata for `setup`/`update`. Requiring all four
- * (and treating `accountId: ""` as missing) made `status` and publish both
- * report "not set up" on an endpoint that still worked — RUSH-2837.
- */
-export function readShareConfig() {
-    const s = readMeta().share;
-    const baseUrl = nonempty(s?.baseUrl)?.replace(/\/+$/, '');
-    if (!baseUrl)
-        return null;
-    return {
-        baseUrl,
-        accountId: nonempty(s?.accountId) ?? '',
-        workerName: nonempty(s?.workerName) ?? DEFAULT_WORKER_NAME,
-        bucketName: nonempty(s?.bucketName) ?? DEFAULT_BUCKET_NAME,
-        domain: nonempty(s?.domain),
-        analyticsToken: nonempty(s?.analyticsToken),
-        templateHash: nonempty(s?.templateHash),
-    };
-}
-/** Persist the endpoint config to `agents.yaml` (syncs across the fleet).
- * Empty strings never overwrite a previously stored value and are not written
- * back as `accountId: ""` (that form made {@link readShareConfig} return null
- * under the old all-fields-required check, and it is still useless). */
-export function writeShareConfig(cfg) {
-    updateMeta((meta) => {
-        const prev = meta.share ?? {};
-        const next = { ...prev };
-        const assign = (key, incoming) => {
-            const v = nonempty(incoming);
-            if (v)
-                next[key] = v;
-        };
-        assign('baseUrl', cfg.baseUrl);
-        assign('accountId', cfg.accountId);
-        assign('workerName', cfg.workerName);
-        assign('bucketName', cfg.bucketName);
-        assign('domain', cfg.domain);
-        assign('analyticsToken', cfg.analyticsToken);
-        assign('templateHash', cfg.templateHash);
-        for (const key of Object.keys(next)) {
-            if (typeof next[key] === 'string' && !nonempty(next[key]))
-                delete next[key];
-        }
-        return { ...meta, share: next };
-    });
-}
-/** A fresh 32-byte hex write token. */
-export function generateWriteToken() {
-    return randomBytes(32).toString('hex');
-}
-/** Persist the raw write token into the `share` secrets bundle (keychain-backed,
- * fleet-injectable). Mirrors the add-key sequence in `commands/secrets.ts`. */
-export function storeWriteToken(token) {
-    let bundle;
-    try {
-        bundle = readBundle(SHARE_BUNDLE);
-    }
-    catch {
-        bundle = {
-            name: SHARE_BUNDLE,
-            description: 'agents artifacts share — write token for the R2 share endpoint',
-            // A NEW share bundle defaults to the `never` tier (no biometry ACL). The R2
-            // write token is low-sensitivity automation infra that is auto-read on EVERY
-            // `agents run` (shareRuntimeEnv) — a biometry ACL there is what produced the
-            // per-run Touch ID storm. `never` stores it no-ACL so auto-share is silent
-            // and needs no unlock. An EXISTING bundle keeps its tier (we never silently
-            // downgrade one the user already made); change it explicitly with
-            // `agents secrets policy share <tier>`.
-            policy: 'never',
-            vars: {},
-        };
-    }
-    // writeBundleWithItems decides the ACL (keychain backend) purely from
-    // `bundle.policy === 'never'` — the fresh-bundle case above sets it
-    // explicitly, and an existing bundle already carries its own explicit tier.
-    bundle.vars[SHARE_TOKEN_KEY] = keychainRef(SHARE_TOKEN_KEY);
-    const item = secretsKeychainItem(bundle.name, SHARE_TOKEN_KEY);
-    writeBundleWithItems(bundle, new Map([[item, token]]));
-}
-/** Read the raw write token from the `share` secrets bundle. */
-export function readWriteTokenFromBundle() {
-    const { env } = readAndResolveBundleEnv(SHARE_BUNDLE, {
-        caller: 'share',
-        // Explicit share commands are reads, not authorization to authenticate.
-        agentOnly: true,
-    });
-    const token = env[SHARE_TOKEN_KEY];
-    if (!token) {
-        throw new Error(`No ${SHARE_TOKEN_KEY} in the '${SHARE_BUNDLE}' secrets bundle. ` +
-            `Run 'agents artifacts setup' (to provision your own endpoint) or 'agents artifacts share join' (to use an existing one).`);
-    }
-    return token;
-}
-/** Read the raw write token from injected env first, then the local bundle.
- * Throws with an actionable message if absent (run setup/join first). */
-export function readWriteToken() {
-    return readWriteTokenEnv() ?? readWriteTokenFromBundle();
-}
-/** Best-effort runtime env for spawned agents. Never throws AND never prompts.
- *
- * Auto-injecting the share write token on every `agents run` is a background
- * convenience, NOT a user-initiated secret access — so it MUST NOT raise a Touch
- * ID sheet (SEC-13: an agent launch never pops biometry on its own). This was the
- * per-run prompt storm: `share` is a keychain bundle that is rarely broker-held,
- * so an interactive read here spawned the helper and popped Touch ID on EVERY
- * launch. The read is now always `agentOnly` — it resolves the token only from the
- * injected env or an already-held / no-ACL bundle, and silently returns undefined
- * otherwise (the caller runs without auto-share; the agent can still publish via
- * its own `agents artifacts share`). To get zero-friction auto-share with no prompt: unlock
- * once (`agents secrets unlock share`) or make it no-ACL (`agents secrets policy
- * share never`). */
-export function shareRuntimeEnv() {
-    if (!readShareConfig())
-        return undefined;
-    const fromEnv = readWriteTokenEnv();
-    if (fromEnv)
-        return { [SHARE_TOKEN_ENV_KEY]: fromEnv };
-    try {
-        if (!bundleExists(SHARE_BUNDLE))
-            return undefined;
-        const { env } = readAndResolveBundleEnv(SHARE_BUNDLE, {
-            caller: 'share',
-            keys: [SHARE_TOKEN_KEY],
-            agentOnly: true, // never raise a Touch ID sheet on an agent launch (SEC-13)
-        });
-        const token = env[SHARE_TOKEN_KEY];
-        return token ? { [SHARE_TOKEN_ENV_KEY]: token } : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/** Cloudflare API credentials for provisioning, read from `cloudflare` (or a
- * user-named bundle). Fuzzy-matches key names so it works across bundle layouts. */
-export function readCloudflareCreds(bundle = DEFAULT_CF_BUNDLE, override) {
-    // Explicit --token/--account bypass the bundle entirely (robust escape hatch).
-    if (override?.apiToken) {
-        return { apiToken: override.apiToken, accountId: override.accountId ?? '' };
-    }
-    // Check existence first (same guard as readShareToken above): resolving a
-    // missing bundle through the process client surfaces an opaque transport code
-    // (e.g. LOCKED), never naming the bundle the user typed — so name it here.
-    if (!bundleExists(bundle)) {
-        throw new Error(`The '${bundle}' bundle does not exist. ` +
-            `Pass credentials directly with --token <t> [--account <id>], or create it: ` +
-            `agents secrets add ${bundle} CLOUDFLARE_API_TOKEN`);
-    }
-    const { env } = readAndResolveBundleEnv(bundle, {
-        caller: 'share',
-        // Setup is still a read; only `agents secrets unlock` may authenticate.
-        agentOnly: true,
-    });
-    const find = (re) => {
-        for (const [k, v] of Object.entries(env))
-            if (re.test(k) && v)
-                return v;
-        return '';
-    };
-    const apiToken = env.CLOUDFLARE_API_TOKEN || env.CF_API_TOKEN || find(/API[_-]?TOKEN|(?:^|_)TOKEN$/i);
-    const accountId = override?.accountId || env.CLOUDFLARE_ACCOUNT_ID || env.CF_ACCOUNT_ID || find(/ACCOUNT[_-]?ID/i);
-    if (!apiToken) {
-        const keys = Object.keys(env);
-        throw new Error(`No Cloudflare API token in the '${bundle}' bundle ` +
-            `(keys present: ${keys.length ? keys.join(', ') : 'none'}). ` +
-            `Pass it directly with --token <t> [--account <id>], or add it: ` +
-            `agents secrets add ${bundle} CLOUDFLARE_API_TOKEN`);
-    }
-    return { apiToken, accountId };
-}

package/dist/lib/share/delete.d.ts

@@ -1,123 +0,0 @@
-import { type ShareConfig } from './config.js';
-/** DI seam for tests — override the real HTTP DELETE. `body`/`retryAfter` carry
- * the Worker's error response (read only on `!ok`) so a failed delete surfaces
- * WHY, via the bounded {@link extractShareHttpError}. */
-export type DeleteFn = (url: string, headers: Record<string, string>) => Promise<{
-    ok: boolean;
-    status: number;
-    body?: string;
-    retryAfter?: string;
-}>;
-/** DI seam for tests — override the real HTTP existence check (HEAD). */
-export type CheckFn = (url: string) => Promise<{
-    status: number;
-}>;
-/** DI seam for tests — override the real HTTP GET of the revisions listing route. */
-export type RevisionsFetchFn = (url: string) => Promise<{
-    status: number;
-    contentType: string;
-    body: string;
-}>;
-interface DeleteEndpoint {
-    baseUrl: string;
-    token: string;
-}
-interface ResolvedShareTarget {
-    /** R2 object key for the page, `<user>/<slug>`. */
-    key: string;
-    /** R2 object key for the sibling OG cover, `<user>/<slug>.png`. */
-    coverKey: string;
-}
-/**
- * Normalize any of the three accepted target forms to the R2 key that publish
- * would have written:
- *   - a full share URL: `https://share.getrush.ai/<user>/<slug>`
- *   - `<user>/<slug>`
- *   - a bare `<slug>` — resolved against the caller's own namespace exactly as
- *     `publishToEndpoint` resolves it at publish time (resolveShareUsername +
- *     buildShareKey), so a bare slug always targets *your* published page.
- *
- * The URL and `<user>/<slug>` forms are taken as already the exact key a prior
- * publish produced (no re-sanitizing) — only the bare-slug form runs through
- * `buildShareKey`, because that's the one case where the slug hasn't already
- * been normalized by a publish.
- */
-export declare function resolveDeleteTarget(target: string, opts?: {
-    githubUser?: string;
-}): Promise<ResolvedShareTarget>;
-interface DeleteObjectResult {
-    key: string;
-    url: string;
-    /** Whether the object resolved (non-404) before the DELETE was issued. */
-    existedBefore: boolean;
-    /** Whether the Worker's DELETE call itself reported ok. */
-    deleted: boolean;
-    /** The postcondition: a follow-up check resolved 404 after the DELETE. */
-    verified404: boolean;
-}
-/**
- * Delete one R2 object behind the share Worker and assert the postcondition.
- * `{"ok":true}` from the Worker is not evidence a page came down — R2 delete is
- * idempotent, so a DELETE on a key that was never there also returns `ok:true`.
- * This checks existence before (so callers can tell "deleted" from "was never
- * there") and re-checks after (so callers can tell "deleted" from "still public").
- */
-export declare function deleteObject(endpoint: DeleteEndpoint, key: string, opts?: {
-    deleter?: DeleteFn;
-    checker?: CheckFn;
-}): Promise<DeleteObjectResult>;
-interface DeleteShareOptions {
-    /** Skip deleting the sibling `<slug>.png` OG cover (default: delete it too). */
-    keepCover?: boolean;
-    /** Skip deleting the target's retained revisions (`<key>/rev-*`, RUSH-2683
-     * revision retention) — default: delete them too. A republished-then-deleted
-     * share would otherwise leave its prior world-readable versions live for up
-     * to the bucket's lifecycle max-age (see docs/distribution.md). */
-    keepRevisions?: boolean;
-    /** Treat an already-missing target as a no-op success instead of an error
-     * (mirrors SQL's `DROP ... IF EXISTS`). Default: missing target is an error. */
-    ifExists?: boolean;
-    /** Override the GitHub username used to resolve a bare-slug target. */
-    githubUser?: string;
-    /** DI seam for tests — override the persisted share endpoint config. */
-    config?: ShareConfig;
-    /** DI seam for tests — override the keychain-backed write token. Selects BYO. */
-    writeToken?: string;
-    /** DI seam for tests — override `readSession()`. `null` means signed out. */
-    session?: import('../identity/client.js').PhoenixSession | null;
-    /** Force the BYO Cloudflare path even when signed in. */
-    byo?: boolean;
-    /** DI seam for tests — override the real HTTP DELETE. */
-    deleter?: DeleteFn;
-    /** DI seam for tests — override the real HTTP existence check. */
-    checker?: CheckFn;
-    /** DI seam for tests — override the real HTTP GET of the revisions listing route. */
-    fetchRevisions?: RevisionsFetchFn;
-}
-export interface DeleteShareResult {
-    key: string;
-    url: string;
-    existedBefore: boolean;
-    verified404: boolean;
-    /** True when `ifExists` was set and the target was already gone — nothing ran. */
-    skipped?: boolean;
-    cover?: {
-        key: string;
-        url: string;
-        existedBefore: boolean;
-        verified404: boolean;
-    };
-    /** Retained revisions of this target that were also deleted (omitted when
-     * there were none, or `keepRevisions` was passed). */
-    revisions?: Array<{
-        key: string;
-        url: string;
-        existedBefore: boolean;
-        verified404: boolean;
-    }>;
-}
-/** Delete one share target (page + by default its OG cover) and verify both
- * are gone. Throws on an unverified takedown — never reports success for an
- * object that still resolves. */
-export declare function deleteShare(target: string, opts?: DeleteShareOptions): Promise<DeleteShareResult>;
-export {};

package/dist/lib/share/delete.js

@@ -1,173 +0,0 @@
-// The delete path for `agents artifacts share delete` / `agents artifacts unshare` — an authed DELETE
-// to the Worker, which already implements it (worker-template.ts). Mirrors
-// publish.ts: pure target-resolution logic is exported for tests, the network
-// calls (a status check + a delete) sit behind an injectable DI seam.
-//
-// The Worker's R2 delete is idempotent — DELETE on a key that never existed still
-// returns `{"ok":true}` — so `{"ok":true}` alone is never proof of a takedown.
-// Every delete here is followed by a status check that must observe 404 before
-// the operation is reported as successful.
-import { resolveShareBackend } from './backend.js';
-import { buildShareKey, resolveShareUsername } from './publish.js';
-import { extractShareHttpError, formatShareHttpErrorDetail } from './http-error.js';
-/**
- * Normalize any of the three accepted target forms to the R2 key that publish
- * would have written:
- *   - a full share URL: `https://share.getrush.ai/<user>/<slug>`
- *   - `<user>/<slug>`
- *   - a bare `<slug>` — resolved against the caller's own namespace exactly as
- *     `publishToEndpoint` resolves it at publish time (resolveShareUsername +
- *     buildShareKey), so a bare slug always targets *your* published page.
- *
- * The URL and `<user>/<slug>` forms are taken as already the exact key a prior
- * publish produced (no re-sanitizing) — only the bare-slug form runs through
- * `buildShareKey`, because that's the one case where the slug hasn't already
- * been normalized by a publish.
- */
-export async function resolveDeleteTarget(target, opts = {}) {
-    const trimmed = target.trim();
-    if (!trimmed)
-        throw new Error('Share target is empty.');
-    let key;
-    if (/^https?:\/\//i.test(trimmed)) {
-        const url = new URL(trimmed);
-        const segments = url.pathname
-            .replace(/^\/+|\/+$/g, '')
-            .split('/')
-            .filter(Boolean)
-            .map(decodeURIComponent);
-        if (segments.length < 2) {
-            throw new Error(`Not a share page URL (expected .../<user>/<slug>): ${trimmed}`);
-        }
-        key = segments.slice(0, 2).join('/');
-    }
-    else if (trimmed.includes('/')) {
-        const segments = trimmed.replace(/^\/+|\/+$/g, '').split('/').filter(Boolean);
-        if (segments.length !== 2) {
-            throw new Error(`Expected <user>/<slug>, got: ${trimmed}`);
-        }
-        key = segments.join('/');
-    }
-    else {
-        const username = await resolveShareUsername(opts);
-        key = buildShareKey(username, trimmed);
-    }
-    return { key, coverKey: `${key}.png` };
-}
-async function defaultCheck(url) {
-    const res = await fetch(url, { method: 'HEAD' });
-    return { status: res.status };
-}
-async function defaultDelete(url, headers) {
-    const res = await fetch(url, { method: 'DELETE', headers });
-    if (res.ok)
-        return { ok: true, status: res.status };
-    const body = await res.text().catch(() => undefined);
-    return { ok: false, status: res.status, body, retryAfter: res.headers.get('retry-after') ?? undefined };
-}
-async function defaultRevisionsFetch(url) {
-    const res = await fetch(url, { headers: { accept: 'application/json' } });
-    return { status: res.status, contentType: res.headers.get('content-type') ?? '', body: await res.text() };
-}
-/**
- * List the R2 keys of a slug's retained revisions via the Worker's
- * `?revisions=json` route (worker-template.ts `renderRevisions`). Best-effort:
- * any failure to reach or parse the route (an endpoint provisioned before
- * revisions existed, a network blip) yields an empty list rather than
- * throwing — purging revisions is a safety improvement on top of the primary
- * delete contract (take the canonical page down), never a reason to fail it.
- */
-async function listRevisionKeys(endpoint, key, fetchRevisions) {
-    try {
-        const url = `${endpoint.baseUrl.replace(/\/+$/, '')}/${key}?revisions=json`;
-        const res = await fetchRevisions(url);
-        if (res.status !== 200 || !/application\/json/i.test(res.contentType))
-            return [];
-        const data = JSON.parse(res.body);
-        if (!Array.isArray(data.revisions))
-            return [];
-        return data.revisions.map((r) => String(r.key ?? '')).filter(Boolean);
-    }
-    catch {
-        return [];
-    }
-}
-/**
- * Delete one R2 object behind the share Worker and assert the postcondition.
- * `{"ok":true}` from the Worker is not evidence a page came down — R2 delete is
- * idempotent, so a DELETE on a key that was never there also returns `ok:true`.
- * This checks existence before (so callers can tell "deleted" from "was never
- * there") and re-checks after (so callers can tell "deleted" from "still public").
- */
-export async function deleteObject(endpoint, key, opts = {}) {
-    const url = `${endpoint.baseUrl.replace(/\/+$/, '')}/${key}`;
-    const check = opts.checker ?? defaultCheck;
-    const del = opts.deleter ?? defaultDelete;
-    const before = await check(url);
-    const existedBefore = before.status !== 404;
-    const r = await del(url, { authorization: `Bearer ${endpoint.token}` });
-    if (!r.ok) {
-        const detail = formatShareHttpErrorDetail(extractShareHttpError({ status: r.status, body: r.body, retryAfter: r.retryAfter }));
-        throw new Error(`Delete failed (${r.status}) for ${url}${detail}. Check the bearer (Phoenix session or WRITE_TOKEN), or that 'agents artifacts setup' completed.`);
-    }
-    const after = await check(url);
-    const verified404 = after.status === 404;
-    return { key, url, existedBefore, deleted: r.ok, verified404 };
-}
-/** Delete one share target (page + by default its OG cover) and verify both
- * are gone. Throws on an unverified takedown — never reports success for an
- * object that still resolves. */
-export async function deleteShare(target, opts = {}) {
-    const backend = resolveShareBackend(opts);
-    const githubUser = backend.kind === 'managed'
-        ? backend.namespace
-        : opts.githubUser || backend.namespace || undefined;
-    const resolved = await resolveDeleteTarget(target, { githubUser });
-    const endpoint = { baseUrl: backend.baseUrl, token: backend.token };
-    const page = await deleteObject(endpoint, resolved.key, { deleter: opts.deleter, checker: opts.checker });
-    if (!page.existedBefore) {
-        if (opts.ifExists) {
-            return { key: page.key, url: page.url, existedBefore: false, verified404: page.verified404, skipped: true };
-        }
-        throw new Error(`Nothing to delete — ${page.url} was already not found. Pass --if-exists to treat this as a no-op instead of an error.`);
-    }
-    if (!page.verified404) {
-        throw new Error(`Delete reported success but ${page.url} still resolves — takedown NOT verified. Retry, or investigate the Worker/R2 directly.`);
-    }
-    const result = {
-        key: page.key,
-        url: page.url,
-        existedBefore: page.existedBefore,
-        verified404: page.verified404,
-    };
-    if (!opts.keepCover) {
-        const cover = await deleteObject(endpoint, resolved.coverKey, { deleter: opts.deleter, checker: opts.checker });
-        result.cover = {
-            key: cover.key,
-            url: cover.url,
-            existedBefore: cover.existedBefore,
-            verified404: cover.verified404,
-        };
-        // A missing cover is normal (non-HTML publishes, or --no-cover at publish
-        // time never made one) — only a cover that existed and is still up is a bug.
-        if (cover.existedBefore && !cover.verified404) {
-            throw new Error(`Cover delete reported success but ${cover.url} still resolves — takedown NOT verified. Retry, or pass --keep-cover and delete it manually.`);
-        }
-    }
-    if (!opts.keepRevisions) {
-        const revisionKeys = await listRevisionKeys(endpoint, resolved.key, opts.fetchRevisions ?? defaultRevisionsFetch);
-        if (revisionKeys.length > 0) {
-            const revisions = [];
-            for (const revisionKey of revisionKeys) {
-                const rev = await deleteObject(endpoint, revisionKey, { deleter: opts.deleter, checker: opts.checker });
-                revisions.push({ key: rev.key, url: rev.url, existedBefore: rev.existedBefore, verified404: rev.verified404 });
-            }
-            result.revisions = revisions;
-            const stillUp = revisions.filter((r) => r.existedBefore && !r.verified404);
-            if (stillUp.length > 0) {
-                throw new Error(`Delete reported success but ${stillUp.length} retained revision(s) still resolve — takedown NOT verified. Retry, or pass --keep-revisions and delete them manually.`);
-            }
-        }
-    }
-    return result;
-}

package/dist/lib/share/html.d.ts

@@ -1,20 +0,0 @@
-/**
- * Make an HTML page self-contained enough to view on share.getrush.ai.
- *
- * Chrome "Save as" (and some renderers) leave `file:///…html#section` TOC
- * links and sibling image paths. Those work on disk and 404 on the share
- * Worker, which only stores the one PUT body. Rewrite same-document file
- * anchors to `#section`, and inline local image files as data URIs.
- *
- * https citations, data: URIs already in the page, and missing files are
- * left alone. This is not a bundler — it only fixes what would otherwise
- * render as a broken page after a single-file publish.
- */
-/**
- * `href="file:///tmp/page.html#purpose"` → `href="#purpose"`.
- * Bare `file:///tmp/page.html` (no hash) becomes `href="#"`.
- */
-export declare function rewriteFileAnchors(html: string): string;
-/** Replace local image src/href with a data URI when the file exists next to the page. */
-export declare function inlineLocalAssets(html: string, htmlPath: string): string;
-export declare function prepareShareHtml(html: string, htmlPath: string): string;

package/dist/lib/share/html.js

@@ -1,88 +0,0 @@
-/**
- * Make an HTML page self-contained enough to view on share.getrush.ai.
- *
- * Chrome "Save as" (and some renderers) leave `file:///…html#section` TOC
- * links and sibling image paths. Those work on disk and 404 on the share
- * Worker, which only stores the one PUT body. Rewrite same-document file
- * anchors to `#section`, and inline local image files as data URIs.
- *
- * https citations, data: URIs already in the page, and missing files are
- * left alone. This is not a bundler — it only fixes what would otherwise
- * render as a broken page after a single-file publish.
- */
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, extname, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-/** Skip inlining a sibling that would bloat the page past a reasonable PUT. */
-const MAX_INLINE_BYTES = 4 * 1024 * 1024;
-const IMAGE_MIME = {
-    '.png': 'image/png',
-    '.jpg': 'image/jpeg',
-    '.jpeg': 'image/jpeg',
-    '.gif': 'image/gif',
-    '.webp': 'image/webp',
-    '.svg': 'image/svg+xml',
-    '.ico': 'image/x-icon',
-    '.avif': 'image/avif',
-};
-/**
- * `href="file:///tmp/page.html#purpose"` → `href="#purpose"`.
- * Bare `file:///tmp/page.html` (no hash) becomes `href="#"`.
- */
-export function rewriteFileAnchors(html) {
-    return html.replace(/\b(href\s*=\s*["'])file:\/\/[^"'#]*(#[^"']*)?(["'])/gi, (_m, attr, hash, quote) => `${attr}${hash ?? '#'}${quote}`);
-}
-/**
- * Only a bare path or a `file:` URL can name a local asset; every other scheme
- * is left alone. A single-letter "scheme" is a Windows drive (`C:\\x.png`), not a URL.
- */
-function isRemoteOrSpecial(url) {
-    if (url.startsWith('//') || url.startsWith('#'))
-        return true;
-    const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(url)?.[1];
-    return scheme !== undefined && scheme.length > 1 && scheme.toLowerCase() !== 'file';
-}
-function localImagePath(url, htmlDir) {
-    if (!url || isRemoteOrSpecial(url))
-        return null;
-    const withoutHash = url.split('#')[0] ?? url;
-    let fsPath;
-    if (withoutHash.startsWith('file:')) {
-        try {
-            fsPath = fileURLToPath(withoutHash);
-        }
-        catch {
-            return null;
-        }
-    }
-    else {
-        fsPath = resolve(htmlDir, withoutHash);
-    }
-    if (!existsSync(fsPath))
-        return null;
-    const mime = IMAGE_MIME[extname(fsPath).toLowerCase()];
-    if (!mime)
-        return null;
-    return { path: fsPath, mime };
-}
-/** Replace local image src/href with a data URI when the file exists next to the page. */
-export function inlineLocalAssets(html, htmlPath) {
-    const dir = dirname(htmlPath);
-    return html.replace(/\b((?:src|href)\s*=\s*["'])([^"']+)(["'])/gi, (full, pre, url, post) => {
-        const local = localImagePath(url, dir);
-        if (!local)
-            return full;
-        try {
-            const buf = readFileSync(local.path);
-            if (buf.length > MAX_INLINE_BYTES)
-                return full;
-            return `${pre}data:${local.mime};base64,${buf.toString('base64')}${post}`;
-        }
-        catch {
-            return full;
-        }
-    });
-}
-export function prepareShareHtml(html, htmlPath) {
-    return inlineLocalAssets(rewriteFileAnchors(html), htmlPath);
-}

package/dist/lib/share/http-error.d.ts

@@ -1,53 +0,0 @@
-/**
- * ONE bounded extractor for the share Worker's error responses.
- *
- * Every share HTTP call (publish PUT, list/revisions GET, delete DELETE)
- * previously threw on `!ok` with only the status code, discarding the JSON error
- * body the Worker actually returns (`{"error":"…"}` for a 400/413/429, plus a
- * `Retry-After` on a 429). The result: a rate-limited or quota-exceeded publish
- * surfaced as a bare "Publish failed (429)" with no reason. This pulls the
- * server's own `error` string and preserves the status + `Retry-After`, so the
- * user sees why.
- *
- * Bounded and safe by construction: it parses at most {@link MAX_ERROR_BODY_BYTES}
- * of the body, only lifts a string `error` field, caps its length, and NEVER
- * surfaces an arbitrary body — a non-JSON or oversized body yields no message,
- * so an HTML error page or a huge payload can't leak into a CLI error string.
- */
-/** The raw pieces a caller's fetch wrapper hands in — status plus the (optional)
- * response body text and `Retry-After` header value. */
-interface ShareHttpResponse {
-    status: number;
-    /** The response body text, when the caller read it (only on `!ok` paths). */
-    body?: string;
-    /** The `Retry-After` header value, when present (a 429 carries it). */
-    retryAfter?: string;
-}
-/** The extracted, bounded error facts. `serverMessage` is present only when the
- * body parsed as JSON carrying a non-empty string `error`. */
-interface ShareHttpError {
-    status: number;
-    serverMessage?: string;
-    retryAfter?: string;
-}
-/** Never parse more than this many chars of a body — a legitimate `{"error":"…"}`
- * is tiny; a larger body is an HTML page or noise we deliberately don't surface. */
-export declare const MAX_ERROR_BODY_BYTES = 4096;
-/** Cap the surfaced message so even a pathological (but valid-JSON) `error`
- * string can't blow up the CLI output. */
-export declare const MAX_ERROR_MESSAGE_CHARS = 300;
-/**
- * Extract the bounded error facts from a share Worker response. Pulls a string
- * `error` field from a small JSON body, preserves status + `Retry-After`, and
- * never surfaces an arbitrary body.
- */
-export declare function extractShareHttpError(res: ShareHttpResponse): ShareHttpError;
-/**
- * A one-line suffix summarizing the server's structured error, or `''` when the
- * response carried nothing extractable. Appended after the status-bearing prefix
- * a caller already builds, e.g.:
- *   `Publish failed (429) for <url>` + `formatShareHttpErrorDetail(err)`
- *   → `Publish failed (429) for <url> — rate limit exceeded; retry after 37s`
- */
-export declare function formatShareHttpErrorDetail(err: ShareHttpError): string;
-export {};