@siteoshq/cli 1.8.1 → 1.10.0

package/README.md

@@ -1,7 +1,7 @@
 # SiteOS CLI
 
 `@siteoshq/cli` exposes one `siteos` binary for Auth, common Projects, Pulse, Cookie, Forms,
-Search, Trace, SEO and Integrations. This source prepares version 1.8.1; publishing is a separate release.
+Search, Trace, SEO and Integrations. This source prepares version 1.10.0; publishing is a separate release.
 Node.js 22 or newer is required.
 
 ## Install and authenticate
@@ -96,6 +96,15 @@ the bound Pulse resource and current URL; local tests use this URL unless explic
 `siteos.config.json` remains the tracked Playwright check configuration. Deployment and enabling
 monitoring are explicit operations. `deploy --dry-run` builds locally without uploading.
 
+CLI 1.10.0 adds an optional `environmentVariables` array to each Check, for
+example `"environmentVariables": ["TEST_EMAIL", "TEST_INBOX_TOKEN"]`. Declare names only, and set
+values in Pulse Settings for the selected Environment. The runner exposes declared values through
+`process.env.NAME`; `pulse sync --check --json` suggests names found in imported source, while
+computed names need explicit declarations. `PLAYWRIGHT_BASE_URL` remains a system value.
+Use the CLI build containing this support together with the matching application/runner release;
+earlier published versions do not preserve these declarations. See
+[Pulse variables operations](../../docs/operations/pulse-variables.md) for storage and diagnostics.
+
 ### Forms and Search
 
 ```sh
@@ -231,6 +240,12 @@ pnpm --dir packages/cli pack:check
 
 ## Cookie verification
 
+Before a new Cookie connection, `cookie terms show --json` returns the current service terms and
+the selected Organization's acceptance. After the owner or admin explicitly agrees to that
+document, use `cookie terms accept --version <reviewed-version> --confirm --json`, then read the
+status again. Setup and publication requests alone do not constitute agreement. These commands
+are available in CLI 1.9.0 and require the matching application release.
+
 CLI 1.2.0 adds `cookie schema`, `cookie validate --input draft.json`,
 `cookie regions resolve --country GB --source published` and `cookie restore --input restore.json`.
 Restore changes the draft only. Validation makes no write and reports a stale draft version.
@@ -298,7 +313,6 @@ A changed field requires a normal build/release, not a second hand-edited valida
 `forms deployment-key list|revoke` manages release keys; submission keys cannot publish.
 See the SiteOS Forms skill for the portable generator and version serialization contract.
 
-
 ## Website Analytics
 
 The source CLI includes `siteos analytics` for an explicitly connected Project environment. Check

package/dist/cli.js

@@ -1918,6 +1918,26 @@ var ScheduledConfigSchema = z6.object({
 });
 var ManualConfigSchema = z6.object({ mode: z6.literal("manual") });
 var CheckConfigSchema = z6.object({
+  environmentVariables: z6.array(
+    z6.string().regex(/^[A-Z][A-Z0-9_]{0,63}$/).refine(
+      (name) => !/^(?:SITEOS_|PLAYWRIGHT_|DOCKER_|NODE_|NPM_|PNPM_|LD_|DYLD_)/.test(
+        name
+      ) && ![
+        "PATH",
+        "HOME",
+        "TMPDIR",
+        "TMP",
+        "TEMP",
+        "CI",
+        "DATABASE_URL",
+        "RUNNER_SHARED_SECRET"
+      ].includes(name) && !name.endsWith("_DATABASE_URL") && !name.endsWith("_R2_ACCESS_KEY_ID") && !name.endsWith("_R2_SECRET_ACCESS_KEY"),
+      "This name is reserved by Pulse."
+    )
+  ).max(50).refine(
+    (names) => new Set(names).size === names.length,
+    "Variable names must be unique."
+  ).optional(),
   slug,
   name: displayName,
   include: z6.array(safeRelativePath).min(1).max(100),
@@ -6146,7 +6166,7 @@ var BUILTINS = /* @__PURE__ */ new Set([
   ...builtinModules,
   ...builtinModules.map((name) => `node:${name}`)
 ]);
-var ENVIRONMENT_PATTERN = /\bprocess\.env\.([A-Z][A-Z0-9_]*)\b/g;
+var ENVIRONMENT_PATTERN = /\bprocess\.env(?:\.([A-Z][A-Z0-9_]*)\b|\[\s*["']([A-Z][A-Z0-9_]*)["']\s*\])/g;
 function packageName(importPath) {
   if (importPath.startsWith("@"))
     return importPath.split("/").slice(0, 2).join("/");
@@ -6227,8 +6247,9 @@ async function analyzeTestImports(input) {
         () => ""
       );
       for (const match of source.matchAll(ENVIRONMENT_PATTERN)) {
-        if (match[1] && match[1] !== "PLAYWRIGHT_BASE_URL") {
-          environmentVariables.add(match[1]);
+        const name = match[1] ?? match[2];
+        if (name && name !== "PLAYWRIGHT_BASE_URL") {
+          environmentVariables.add(name);
         }
       }
       if (/playwright\.config\.[^.]+$/.test(file) && /\bwebServer\s*:/.test(source)) {
@@ -9588,6 +9609,8 @@ var SERVICE_HELP = {
   cookie: `Manage Cookie for the selected SiteOS Project.
 
 Usage:
+  siteos cookie terms show [--json]
+  siteos cookie terms accept --version <reviewed-version> --confirm [--json]
   siteos cookie status [--json]
   siteos cookie installation [--json]
   siteos cookie schema [--json]
@@ -9600,7 +9623,8 @@ Usage:
   siteos cookie publish --input <publication.json> [--json]
   siteos cookie analytics [--range-days <7|30|90>] [--json]
 
-Start with siteos project use, then siteos project connect cookie.
+Start with siteos project use, then read and explicitly accept Cookie service terms before siteos project connect cookie.
+Accept only after an organization owner or admin has reviewed and authorized that exact version.
 Draft get returns the complete save payload including expectedDraftVersion.
 Publish input: {"expectedDraftVersion":1,"idempotencyKey":"a-unique-request-key"}.
 Saving a draft has no public effect. Publish activates the reviewed banner at Cookie Edge.`,
@@ -9653,6 +9677,8 @@ async function runServiceCommand(service, options) {
       strict: true,
       options: {
         json: { type: "boolean" },
+        confirm: { type: "boolean" },
+        version: { type: "string" },
         input: { type: "string" },
         environment: { type: "string" },
         "range-days": { type: "string" },
@@ -9683,6 +9709,8 @@ async function runServiceCommand(service, options) {
     const route = positionals.join(" ");
     const allowed = {
       cookie: {
+        "terms show": [],
+        "terms accept": ["version", "confirm"],
         status: [],
         installation: [],
         schema: [],
@@ -9736,8 +9764,15 @@ async function runServiceCommand(service, options) {
     const expectedDraftVersion = tracePublicationVersion(
       values["expected-draft-version"]
     );
+    const isCookieTerms = service === "cookie" && action === "terms";
+    if (isCookieTerms && subaction === "accept" && (!values.version || !values.confirm))
+      throw new Error(
+        "Read siteos cookie terms show, then explicitly pass --version <reviewed-version> --confirm."
+      );
     const runtime = commonProjectRuntime(options);
-    const common = service === "integrations" ? null : await commonServiceContext(
+    const common = service === "integrations" ? null : isCookieTerms ? await readCommonProject(options).then(
+      (context) => context ? { ...context, resourceId: "" } : null
+    ) : await commonServiceContext(
       options,
       service,
       values.environment
@@ -9798,7 +9833,12 @@ async function runServiceCommand(service, options) {
     const site = common ? `/sites/${encodeURIComponent(common.resourceId)}` : "";
     let result;
     if (service === "cookie") {
-      if (action === "status" && positionals.length === 1)
+      if (isCookieTerms)
+        result = subaction === "show" ? await request("/terms") : await request("/terms", "POST", {
+          version: values.version,
+          accepted: true
+        });
+      else if (action === "status" && positionals.length === 1)
         result = await request(site);
       else if (action === "schema") result = await request(`${site}/schema`);
       else if (action === "validate") {