@trypattern/sdk 0.1.4 → 0.1.6

package/dist/cli/app.js

@@ -13,6 +13,7 @@ import { homedir } from 'node:os';
 import { delimiter, dirname, extname, join, relative, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { createHash } from 'node:crypto';
+import { z } from 'zod';
 import { resetLocalDatabase } from "../vite/localWorker.js";
 import { login, publish, pull, restore, versions as listVersions } from "./publishing.js";
 import { toolBin } from "./tools.js";
@@ -73,7 +74,13 @@ const CONTACT_SHEET = join(SCREENSHOTS_DIR, 'contact-sheet.png');
 const SCREENSHOT_WORKER = join(SDK_SOURCE, 'cli', `screenshot${SDK_EXTENSION}`);
 const VISUAL_URL_ENV = 'PATTERN_VISUAL_URL';
 const GLOBAL_FLAGS = ['--json', '--help', '-h'];
-const VALUE_FLAGS = new Set(['--commands', '--name', '--as']);
+const VALUE_FLAGS = new Set([
+    '--commands',
+    '--name',
+    '--as',
+    '--code',
+    '--message'
+]);
 const SHIM_SOURCE = `#!/bin/sh
 ${SHIM_MARKER_LINE}
 dir=$PWD
@@ -266,8 +273,13 @@ and restore sign in the same way when they need to, so this is rarely run on its
         details: `app pull sundayparty
 Downloads the source of the site's latest live version into this folder when it is empty, or into
 ./<name> otherwise, writes pattern.json, installs, and runs app setup. Never needs git; when the
-Command Line Tools are installed it also makes a first commit. Signs in first if needed (see app login).`,
-        run: (argument) => pull(publishingIo(), argument, process.cwd()),
+Command Line Tools are installed it also makes a first commit. Signs in first if needed (see app login).
+--code <setup code> signs in with the one-time setup code from onpattern.app instead of the browser.`,
+        run: (argument, options) => {
+            const code = options.get('--code');
+            return pull(publishingIo(), argument, process.cwd(), typeof code === 'string' ? code : undefined);
+        },
+        flags: ['--code'],
         takesArgument: true,
         runsAnywhere: true
     },
@@ -278,9 +290,14 @@ git would keep, never .dev.vars, .env, node_modules, dist or .dev) to onpattern.
 until the new version answers at https://<name>.onpattern.app, printing each step. The database
 moves forward with any new migrations; nothing is ever deleted from it. If a step fails, the site
 keeps running the previous version and the error says why. Run app check first.
+--message '…' says what changed in a few plain words for the owner ("Pink brand colour and a welcome
+line"); onpattern.app and app versions show it beside the version.
 --starter (Pattern's admins only) publishes this project as the starter every new site begins from.`,
-        run: (_argument, options) => publish(publishingIo(), ROOT, options.has('--starter')),
-        flags: ['--starter']
+        run: (_argument, options) => {
+            const message = options.get('--message');
+            return publish(publishingIo(), ROOT, options.has('--starter'), typeof message === 'string' ? message : undefined);
+        },
+        flags: ['--starter', '--message']
     },
     versions: {
         summary: 'List the versions that went live, newest first',
@@ -297,7 +314,7 @@ every row and column added since, which version 3's code ignores.`,
     },
     setup: {
         summary: 'Verify Node/pnpm major versions, pnpm install, install the global `app` shim',
-        details: `Idempotent. Fails unless Node and pnpm have the major versions in .nvmrc and package.json "packageManager".
+        details: `Idempotent. Fails unless Node and pnpm have the major versions in .nvmrc and package.json devEngines.
 Then runs \`pnpm install\` and installs ${SHIM_PATH}, a tiny shim that walks up from the
 current directory to the nearest project launcher (an executable ./app containing the line
 ${LAUNCHER_MARKER_LINE}) and runs it, so each project's CLI lives in its repo and the shim
@@ -1217,13 +1234,16 @@ async function build() {
 function majorOf(version) {
     return version.split('.')[0] ?? '';
 }
+const packagePins = z.object({
+    devEngines: z.object({
+        packageManager: z.object({ version: z.string() })
+    })
+});
 function readPins() {
     const node = readText(join(ROOT, '.nvmrc')).trim().replace(/^v/, '');
-    const pkg = JSON.parse(readText(join(ROOT, 'package.json')));
-    const pm = typeof pkg === 'object' && pkg !== null && 'packageManager' in pkg
-        ? String(pkg.packageManager)
-        : '';
-    return { node, pnpm: pm.replace(/^pnpm@/, '').split('+')[0] ?? '' };
+    const pkg = packagePins.safeParse(JSON.parse(readText(join(ROOT, 'package.json'))));
+    const pnpm = pkg.success ? pkg.data.devEngines.packageManager.version : '';
+    return { node, pnpm: pnpm.replace(/^>=/, '') };
 }
 function isPatternShim(source) {
     const lines = source.split('\n');
@@ -1260,7 +1280,7 @@ async function setup() {
         problems.push(`Node ${haveNode} is not Node ${majorOf(pins.node)} (.nvmrc says ${pins.node})\n  fix  pnpm env use --global ${majorOf(pins.node)}`);
     }
     if (majorOf(havePnpm) !== majorOf(pins.pnpm)) {
-        problems.push(`pnpm ${havePnpm || '(not found)'} is not pnpm ${majorOf(pins.pnpm)} (package.json packageManager says ${pins.pnpm})\n  fix  curl -fsSL https://get.pnpm.io/install.sh | sh -`);
+        problems.push(`pnpm ${havePnpm || '(not found)'} is not pnpm ${majorOf(pins.pnpm)} (package.json devEngines says ${pins.pnpm} or newer)\n  fix  curl -fsSL https://get.pnpm.io/install.sh | sh -`);
     }
     const versions = { node: haveNode, pnpm: havePnpm, expected: pins };
     if (problems.length > 0) {
@@ -1302,7 +1322,7 @@ async function setup() {
 function help() {
     const width = Math.max(...Object.keys(COMMANDS).map((n) => n.length));
     const lines = Object.entries(COMMANDS).map(([name, cmd]) => `app ${name.padEnd(width)}  ${cmd.summary}`);
-    lines.push('Flags: --json (machine-readable stdout), <command> --help (details and its own flags: start --no-open, test --visual, screenshot --commands --name --as --signed-out)');
+    lines.push('Flags: --json (machine-readable stdout), <command> --help (details and its own flags: start --no-open, test --visual, screenshot --commands --name --as --signed-out, pull --code, publish --message)');
     return {
         code: 0,
         data: {

package/dist/cli/publishing.d.ts

@@ -14,8 +14,8 @@ export type PublishingIo = {
     sdkVersion: string;
 };
 export declare function login(io: PublishingIo): Promise<Outcome>;
-export declare function pull(io: PublishingIo, name: string | undefined, cwd: string): Promise<Outcome>;
-export declare function publish(io: PublishingIo, root: string, isStarter: boolean): Promise<Outcome>;
+export declare function pull(io: PublishingIo, name: string | undefined, cwd: string, setupCode: string | undefined): Promise<Outcome>;
+export declare function publish(io: PublishingIo, root: string, isStarter: boolean, message: string | undefined): Promise<Outcome>;
 export declare function versions(io: PublishingIo, root: string): Promise<Outcome>;
 export declare function restore(io: PublishingIo, root: string, number: string | undefined): Promise<Outcome>;
 export {};

package/dist/cli/publishing.js

@@ -3,7 +3,7 @@ import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, st
 import { homedir, hostname, userInfo } from 'node:os';
 import { basename, dirname, extname, join, matchesGlob, relative } from 'node:path';
 import { z } from 'zod';
-import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, nameProblem, publishSummary, sourcePathProblem } from "../publishWire.js";
+import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, nameProblem, publishMessage, publishSummary, setupCodeExchanged, sourcePathProblem } from "../publishWire.js";
 import { appInfo } from "../appTitle.js";
 import { PROJECT_FILE, readProjectFile } from "../vite/projectFile.js";
 const CONFIG_DIR = join(homedir(), '.config', 'pattern');
@@ -175,6 +175,20 @@ async function signIn(io, again) {
         text: `Opened ${started.url} in the browser.\n  code  ${started.code}\n  next  tell them: "Check the code on the page is ${started.code}, then click Allow." Then, without waiting for them to reply, run ${again} again: it waits for Allow.`
     };
 }
+async function useSetupCode(io, code) {
+    const response = await fetch(`${dashboard()}/api/auth/cli/setup-codes/exchange`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ code, label: labelOfThisMachine() })
+    }).catch(() => undefined);
+    const exchanged = setupCodeExchanged.safeParse(await response?.json().catch(() => null));
+    if (response?.ok === true && exchanged.success) {
+        saveCookie(exchanged.data.cookie);
+        io.say('✓ Connected with the setup code');
+        return;
+    }
+    io.say('✗ That setup code has expired or was already used');
+}
 async function signedIn(io, again, work) {
     if (savedCookie() === undefined) {
         const outcome = await signIn(io, again);
@@ -237,7 +251,7 @@ function folderFor(name, cwd) {
 function commandLineToolsReady() {
     return spawnSync('xcode-select', ['-p'], { stdio: 'ignore' }).status === 0;
 }
-export async function pull(io, name, cwd) {
+export async function pull(io, name, cwd, setupCode) {
     if (name === undefined || nameProblem(name) !== undefined) {
         return {
             code: 2,
@@ -254,6 +268,8 @@ export async function pull(io, name, cwd) {
         };
     }
     try {
+        if (setupCode !== undefined)
+            await useSetupCode(io, setupCode);
         const result = await signedIn(io, `app pull ${name}`, async () => {
             const app = await callJson(`/api/apps/${name}`, appSummary);
             const response = await call(`/api/apps/${name}/source`);
@@ -408,11 +424,13 @@ async function followPublish(io, name, started) {
     }
     const data = { name, version: publish.number, status: publish.status };
     if (publish.status === 'live') {
-        return {
-            code: 0,
-            data,
-            text: `✓ Version ${publish.number} is live at https://${name}.onpattern.app`
-        };
+        const lines = [
+            `✓ Version ${publish.number} is live at https://${name}.onpattern.app${publish.message === null ? '' : ` · ${publish.message}`}`
+        ];
+        if (publish.message === null && publish.restoredFrom === null) {
+            lines.push("  tip  add --message '…' so the owner sees what changed, in plain words");
+        }
+        return { code: 0, data, text: lines.join('\n') };
     }
     if (publish.status === 'failed') {
         return {
@@ -427,7 +445,7 @@ async function followPublish(io, name, started) {
         text: `✗ Version ${publish.number} is still publishing after ${PUBLISH_WAIT_MS / 60_000} minutes\n  next  app versions shows how it ends`
     };
 }
-export async function publish(io, root, isStarter) {
+export async function publish(io, root, isStarter, message) {
     try {
         const { name } = readProjectFile(root);
         const built = await io.build();
@@ -435,6 +453,9 @@ export async function publish(io, root, isStarter) {
             return built;
         io.say('✓ Built');
         const { form, sources } = uploadForm(root, io, isStarter);
+        const said = publishMessage(message ?? '');
+        if (said !== null)
+            form.append(UPLOAD.message, said);
         io.say(`✓ Packed the build and ${sources} source files`);
         const again = isStarter ? 'app publish --starter' : 'app publish';
         const result = await signedIn(io, again, async () => {
@@ -476,7 +497,7 @@ export async function versions(io, root) {
                 ? `restored version ${item.restoredFrom}`
                 : item.isStarter
                     ? 'starter site'
-                    : `published by ${item.byEmail}`;
+                    : (item.message ?? `published by ${item.byEmail}`);
             return `  ${String(item.number).padStart(3)}  ${item.status.padEnd(7)}  ${item.startedAt.slice(0, 16).replace('T', ' ')}  ${what}`;
         });
         return {

package/dist/publishWire.d.ts

@@ -17,7 +17,10 @@ export declare const UPLOAD: {
     readonly source: "source/";
     readonly compatibilityDate: "compatibilityDate";
     readonly sdkVersion: "sdkVersion";
+    readonly message: "message";
 };
+export declare const PUBLISH_MESSAGE_LIMIT = 100;
+export declare function publishMessage(text: string): string | null;
 export declare const publishStep: z.ZodEnum<{
     publish: "publish";
     reserve: "reserve";
@@ -47,6 +50,7 @@ export declare const publishSummary: z.ZodObject<{
     byEmail: z.ZodString;
     restoredFrom: z.ZodNullable<z.ZodNumber>;
     isStarter: z.ZodBoolean;
+    message: z.ZodNullable<z.ZodString>;
     startedAt: z.ZodString;
     finishedAt: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
@@ -73,6 +77,7 @@ export declare const appSummary: z.ZodObject<{
         byEmail: z.ZodString;
         restoredFrom: z.ZodNullable<z.ZodNumber>;
         isStarter: z.ZodBoolean;
+        message: z.ZodNullable<z.ZodString>;
         startedAt: z.ZodString;
         finishedAt: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>>;
@@ -99,6 +104,18 @@ export declare const loginToApprove: z.ZodObject<{
     code: z.ZodString;
     label: z.ZodString;
 }, z.core.$strip>;
+export declare const setupCode: z.ZodObject<{
+    code: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+export declare const setupCodeExchanged: z.ZodObject<{
+    cookie: z.ZodString;
+}, z.core.$strip>;
+export declare const connection: z.ZodObject<{
+    label: z.ZodString;
+    connectedAt: z.ZodString;
+}, z.core.$strip>;
+export type Connection = z.output<typeof connection>;
 export declare const publishServices: {
     readonly apps: {
         readonly list: NoInfer<import("./services.ts").ServiceCall<"/apps", {}, z.ZodArray<z.ZodObject<{
@@ -123,6 +140,7 @@ export declare const publishServices: {
                 byEmail: z.ZodString;
                 restoredFrom: z.ZodNullable<z.ZodNumber>;
                 isStarter: z.ZodBoolean;
+                message: z.ZodNullable<z.ZodString>;
                 startedAt: z.ZodString;
                 finishedAt: z.ZodNullable<z.ZodString>;
             }, z.core.$strip>>;
@@ -149,6 +167,7 @@ export declare const publishServices: {
                 byEmail: z.ZodString;
                 restoredFrom: z.ZodNullable<z.ZodNumber>;
                 isStarter: z.ZodBoolean;
+                message: z.ZodNullable<z.ZodString>;
                 startedAt: z.ZodString;
                 finishedAt: z.ZodNullable<z.ZodString>;
             }, z.core.$strip>>;
@@ -178,6 +197,7 @@ export declare const publishServices: {
                 byEmail: z.ZodString;
                 restoredFrom: z.ZodNullable<z.ZodNumber>;
                 isStarter: z.ZodBoolean;
+                message: z.ZodNullable<z.ZodString>;
                 startedAt: z.ZodString;
                 finishedAt: z.ZodNullable<z.ZodString>;
             }, z.core.$strip>>;
@@ -215,6 +235,7 @@ export declare const publishServices: {
             byEmail: z.ZodString;
             restoredFrom: z.ZodNullable<z.ZodNumber>;
             isStarter: z.ZodBoolean;
+            message: z.ZodNullable<z.ZodString>;
             startedAt: z.ZodString;
             finishedAt: z.ZodNullable<z.ZodString>;
         }, z.core.$strip>>>>;
@@ -235,6 +256,7 @@ export declare const publishServices: {
             byEmail: z.ZodString;
             restoredFrom: z.ZodNullable<z.ZodNumber>;
             isStarter: z.ZodBoolean;
+            message: z.ZodNullable<z.ZodString>;
             startedAt: z.ZodString;
             finishedAt: z.ZodNullable<z.ZodString>;
         }, z.core.$strip>>>;
@@ -255,10 +277,24 @@ export declare const publishServices: {
             byEmail: z.ZodString;
             restoredFrom: z.ZodNullable<z.ZodNumber>;
             isStarter: z.ZodBoolean;
+            message: z.ZodNullable<z.ZodString>;
             startedAt: z.ZodString;
             finishedAt: z.ZodNullable<z.ZodString>;
         }, z.core.$strip>>>;
     };
+    readonly setup: {
+        readonly newCode: NoInfer<import("./services.ts").ServiceCall<"/apps/:name/setup-code", {}, z.ZodObject<{
+            code: z.ZodString;
+            expiresAt: z.ZodString;
+        }, z.core.$strip>>>;
+        readonly connection: NoInfer<import("./services.ts").ServiceCall<"/apps/:name/connection", {}, z.ZodNullable<z.ZodObject<{
+            label: z.ZodString;
+            connectedAt: z.ZodString;
+        }, z.core.$strip>>>>;
+        readonly disconnect: NoInfer<import("./services.ts").ServiceCall<"/apps/:name/connection/disconnect", {}, z.ZodObject<{
+            ok: z.ZodBoolean;
+        }, z.core.$strip>>>;
+    };
     readonly logins: {
         readonly read: NoInfer<import("./services.ts").ServiceCall<"/cli/logins/:approval", {}, z.ZodObject<{
             code: z.ZodString;

package/dist/publishWire.js

@@ -89,8 +89,14 @@ export const UPLOAD = {
     migrations: 'migrations/',
     source: 'source/',
     compatibilityDate: 'compatibilityDate',
-    sdkVersion: 'sdkVersion'
+    sdkVersion: 'sdkVersion',
+    message: 'message'
 };
+export const PUBLISH_MESSAGE_LIMIT = 100;
+export function publishMessage(text) {
+    const firstLine = (text.split('\n')[0] ?? '').replaceAll(/\s+/g, ' ').trim();
+    return firstLine === '' ? null : firstLine.slice(0, PUBLISH_MESSAGE_LIMIT);
+}
 export const publishStep = z.enum(['reserve', 'database', 'sign-in', 'publish']);
 export const publishStatus = z.enum(['running', 'live', 'failed']);
 export const publishSummary = z.object({
@@ -101,6 +107,7 @@ export const publishSummary = z.object({
     byEmail: z.string(),
     restoredFrom: z.number().nullable(),
     isStarter: z.boolean(),
+    message: z.string().nullable(),
     startedAt: z.string(),
     finishedAt: z.string().nullable()
 });
@@ -126,6 +133,12 @@ export const loginPoll = z.union([
     z.object({ status: z.literal('approved'), cookie: z.string() })
 ]);
 export const loginToApprove = z.object({ code: z.string(), label: z.string() });
+export const setupCode = z.object({ code: z.string(), expiresAt: z.string() });
+export const setupCodeExchanged = z.object({ cookie: z.string() });
+export const connection = z.object({
+    label: z.string(),
+    connectedAt: z.string()
+});
 export const publishServices = defineServices({
     apps: {
         list: call({ get: '/apps', reply: z.array(appSummary) }),
@@ -158,6 +171,17 @@ export const publishServices = defineServices({
             reply: publishSummary
         })
     },
+    setup: {
+        newCode: call({ post: '/apps/:name/setup-code', reply: setupCode }),
+        connection: call({
+            get: '/apps/:name/connection',
+            reply: connection.nullable()
+        }),
+        disconnect: call({
+            post: '/apps/:name/connection/disconnect',
+            reply: z.object({ ok: z.boolean() })
+        })
+    },
     logins: {
         read: call({ get: '/cli/logins/:approval', reply: loginToApprove }),
         approve: call({

package/dist/server/index.d.ts

@@ -5,7 +5,7 @@ export { refused } from '../services.ts';
 export { serveServices } from './services.ts';
 export type { ServiceHandlers } from './services.ts';
 export { sessionCookieFor } from './session.ts';
-export { sessions } from './sessions.ts';
+export { deleteSession, sessions } from './sessions.ts';
 export { readTitle, seedTitleSql, settings, writeTitle } from './settings.ts';
 export { exchangeReply, exchangeRequest, sendCodeReply, sendCodeRequest, verifiedIdentity, verifyCodeReply, verifyCodeRequest } from './signInWire.ts';
 export type { VerifiedIdentity } from './signInWire.ts';

package/dist/server/index.js

@@ -3,7 +3,7 @@ export { seedSql, serveTables, sqlTable, sqlTables } from "./tables.js";
 export { refused } from "../services.js";
 export { serveServices } from "./services.js";
 export { sessionCookieFor } from "./session.js";
-export { sessions } from "./sessions.js";
+export { deleteSession, sessions } from "./sessions.js";
 export { readTitle, seedTitleSql, settings, writeTitle } from "./settings.js";
 export { exchangeReply, exchangeRequest, sendCodeReply, sendCodeRequest, verifiedIdentity, verifyCodeReply, verifyCodeRequest } from "./signInWire.js";
 export { findUser, users } from "./users.js";

package/dist/server/session.d.ts

@@ -17,7 +17,10 @@ export declare function issuePass(c: Context<ServerEnv>, user: StoredUser, sessi
     recheckAt: number;
 }>;
 export declare function startSession(c: Context<ServerEnv>, user: StoredUser): Promise<void>;
-export declare function sessionCookieFor(env: ServerEnv['Bindings'], user: StoredUser): Promise<string>;
+export declare function sessionCookieFor(env: ServerEnv['Bindings'], user: StoredUser): Promise<{
+    cookie: string;
+    sessionId: `${string}-${string}-${string}-${string}-${string}`;
+}>;
 export declare function readPass(c: Context<ServerEnv>): Promise<{
     sessionId: string;
     userId: string;

package/dist/server/session.js

@@ -37,14 +37,15 @@ export async function startSession(c, user) {
     await issuePass(c, user, await createSession(c.env.DB, user.id));
 }
 export async function sessionCookieFor(env, user) {
+    const sessionId = await createSession(env.DB, user.id);
     const pass = {
-        sessionId: await createSession(env.DB, user.id),
+        sessionId,
         userId: user.id,
         email: user.email,
         recheckAt: nowInSeconds() + RECHECK_SECONDS
     };
     const cookie = await serializeSigned(SESSION_COOKIE, JSON.stringify(pass), env.SESSION_SECRET);
-    return cookie.split(';')[0] ?? cookie;
+    return { cookie: cookie.split(';')[0] ?? cookie, sessionId };
 }
 export async function readPass(c) {
     const value = await getSignedCookie(c, c.env.SESSION_SECRET, SESSION_COOKIE);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trypattern/sdk",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "type": "module",
   "files": [
     "dist",