@uptimerobot/cli 0.3.0 → 1.1.0

package/dist/lib/cli-errors.js

@@ -1,6 +1,7 @@
 import { outputFormatFromEnvironment, requestedFormatFromArgv } from '../output/resolve-format.js';
 import { agentEnvironmentDetected } from './invocation.js';
 import { isRecord } from './objects.js';
+import { redactSecrets } from './redact-secrets.js';
 const handledErrors = new WeakSet();
 export class CliFailure extends Error {
     cliError;
@@ -11,9 +12,26 @@ export class CliFailure extends Error {
         this.oclif = { exit: exitCode };
     }
 }
+/**
+ * Redacts the envelope rather than each error's source, because this is the one
+ * place a failure becomes output: it covers the API's `details` passthrough,
+ * the CLI's own bulk failures, and any error shape added later. The cast holds
+ * because only values are replaced and no CliError key is credential-like, so
+ * every key survives with its type.
+ *
+ * Unlike the success path this ignores --reveal-secrets. errorEnvelope also
+ * serves failures raised before flags are parsed, and failure output is what
+ * gets pasted into bug reports, CI logs, and agent transcripts.
+ *
+ * Redaction is key-based, so a secret interpolated into a free-text `message`
+ * is not covered; only structured content is.
+ */
+function redactError(error) {
+    return redactSecrets(error).value;
+}
 export function errorEnvelope(error) {
     if (error instanceof CliFailure)
-        return { error: error.cliError };
+        return { error: redactError(error.cliError) };
     const metadata = isRecord(error) ? error : {};
     const exitCode = exitCodeForError(error);
     const code = typeof metadata.code === 'string' && metadata.code !== 'EEXIT'
@@ -27,7 +45,7 @@ export function errorEnvelope(error) {
             ? error
             : 'The command failed.';
     return {
-        error: {
+        error: redactError({
             code,
             ...(metadata.details !== undefined ? { details: metadata.details } : {}),
             ...(typeof metadata.expected === 'string' ? { expected: metadata.expected } : {}),
@@ -38,7 +56,7 @@ export function errorEnvelope(error) {
                 metadata.suggestions.every((suggestion) => typeof suggestion === 'string')
                 ? { suggestions: metadata.suggestions }
                 : {}),
-        },
+        }),
     };
 }
 export function exitCodeForError(error) {

package/dist/lib/command-suggestions.js

@@ -12,6 +12,7 @@ export const HANDWRITTEN_COMMANDS = [
     'help',
     'monitors schema',
     'skills install',
+    'version',
 ];
 const commands = [
     ...Object.keys(operations).map((commandId) => commandId.replaceAll(':', ' ')),

package/dist/lib/help-curation.js

@@ -0,0 +1,25 @@
+/**
+ * The three bulk endpoints answer with a per-monitor `success` that reports
+ * acceptance, not application: there is no operation id to poll and nothing
+ * distinguishes queued from applied, so a caller treating exit 0 as "done" may
+ * act on monitors still in their old state. A stale-cache defect that made the
+ * gap tens of seconds wide was fixed in UPT-3557, so no duration is quoted —
+ * the absent completion signal is the part that is structural.
+ */
+const BULK_DELAY_NOTE = 'Reports acceptance, not completion. The API answers "success" for every matched monitor as soon as the write is accepted; it carries no operation id, and nothing in the response distinguishes queued from applied. Confirm with `uptimerobot monitors get <id>` before anything depends on the new state.';
+/**
+ * Editorial notes appended to a command's help description. `src/generated` is
+ * a projection of openapi/openapi.yaml and is rewritten by
+ * `pnpm openapi:generate`, so behaviour the published contract omits belongs
+ * here, alongside the request curation in request-curation.ts.
+ */
+const DESCRIPTION_NOTES = {
+    'monitors:bulk:pause': BULK_DELAY_NOTE,
+    'monitors:bulk:start': BULK_DELAY_NOTE,
+    'monitors:bulk:update': BULK_DELAY_NOTE,
+};
+export function curatedCommandDescription(operation) {
+    const description = operation.description ?? operation.summary;
+    const note = DESCRIPTION_NOTES[operation.commandId];
+    return note === undefined ? description : `${description}\n\n${note}`;
+}

package/dist/lib/operation-command.js

@@ -13,6 +13,8 @@ import { InputValidationError, validateInput } from '../runtime/validate-input.j
 import { AuthenticationError, resolveApiKey } from './auth.js';
 import { BaseCommand } from './base-command.js';
 import { flagName } from './flag-name.js';
+import { curatedCommandDescription } from './help-curation.js';
+import { withDerivedFields } from './response-curation.js';
 import { detectInvocationMode, isCI, requestConfirmation } from './invocation.js';
 import { enrichOperationParserError } from './operation-parser-error.js';
 import { redactSecrets } from './redact-secrets.js';
@@ -57,6 +59,7 @@ export function createOperationCommand(operation, options = {}) {
         }
         : {};
     const defaultColumns = columnsFor(operation.commandId);
+    const description = curatedCommandDescription(operation);
     const bodyFieldFlags = Object.fromEntries((operation.requestBodyFields ?? []).map((field) => [
         field.flag,
         flagForBodyField(curatedRequestBodyField(operation, field)),
@@ -102,10 +105,10 @@ export function createOperationCommand(operation, options = {}) {
     class OperationCommand extends BaseCommand {
         static args = commandArgs;
         static description = options.canonicalCommand
-            ? `${operation.description ?? operation.summary}
+            ? `${description}
 
 Canonical command: ${options.canonicalCommand}`
-            : (operation.description ?? operation.summary);
+            : description;
         static examples = examplesFor(operation);
         static flags = commandFlags;
         static summary = operation.summary;
@@ -254,7 +257,8 @@ Canonical command: ${options.canonicalCommand}`
                 const apiError = normalizeApiError(response.status, payload);
                 return this.fail(apiError, exitCodeFor(response.status));
             }
-            const normalized = flags.raw === true ? payload : normalizeResult(payload);
+            // --raw is the untouched API response, so derived fields stay out of it.
+            const normalized = flags.raw === true ? payload : withDerivedFields(normalizeResult(payload));
             // Redacted before rendering, so column selection, truncation, and JSONL
             // splitting all operate on the redacted values. --raw stays untouched.
             const redaction = flags.raw === true || flags['reveal-secrets'] === true

package/dist/lib/redact-secrets.js

@@ -17,15 +17,30 @@ function redactValue(value, path, redacted) {
     }
     if (!isRecord(value))
         return value;
+    const contextual = contextualSensitiveKeys(value);
     return Object.fromEntries(Object.entries(value).map(([key, child]) => {
         const childPath = [...path, key];
-        if (isSensitiveFieldName(key)) {
+        if (isSensitiveFieldName(key) || contextual.has(key)) {
             redacted.push(formatPath(childPath));
             return [key, REDACTED];
         }
         return [key, redactValue(child, childPath, redacted)];
     }));
 }
+const NO_KEYS = new Set();
+const HEARTBEAT_SECRET_KEYS = new Set(['pingUrl', 'url']);
+/**
+ * Fields that carry a secret because of the record they sit in rather than what
+ * they are called. A heartbeat monitor's `url` is the token its ping endpoint
+ * is built from, and `pingUrl` is that endpoint: anyone holding either can
+ * report the heartbeat, so a leak keeps a dead service looking alive with no
+ * alert and nothing on the monitor to show for it. Every other monitor type
+ * uses `url` for a target address, which is not a secret — hence the type
+ * check rather than a name added to sensitive-fields.ts.
+ */
+function contextualSensitiveKeys(record) {
+    return record.type === 'HEARTBEAT' ? HEARTBEAT_SECRET_KEYS : NO_KEYS;
+}
 function formatPath(segments) {
     return segments.reduce((path, segment) => /^\d+$/.test(segment) ? `${path}[${segment}]` : path ? `${path}.${segment}` : segment, '');
 }

package/dist/lib/request.js

@@ -44,13 +44,17 @@ export async function buildRequestBody(operation, flags, headers) {
         return undefined;
     }
     const objectBody = toObject(bodyValue);
+    const typedAssignments = new Map();
     for (const field of bodyFields) {
         const value = flags[field.flag];
-        if (value !== undefined)
-            assignPath(objectBody, field.path, parseBodyField(field, value));
+        if (value === undefined)
+            continue;
+        const parsed = parseBodyField(field, value);
+        assignPath(objectBody, field.path, parsed);
+        typedAssignments.set(field.path, { flag: field.flag, value: parsed });
     }
     for (const assignment of assignments)
-        assignValue(objectBody, assignment);
+        assignValue(objectBody, assignment, typedAssignments);
     for (const [path, value] of Object.entries(operation.requestBodyDefaults ?? {})) {
         const supplied = valueAtPath(objectBody, path);
         if (supplied !== undefined && supplied !== value) {
@@ -111,9 +115,41 @@ function toObject(value) {
     }
     return structuredClone(value);
 }
-function assignValue(target, assignment) {
+function assignValue(target, assignment, typedAssignments) {
     const [path, rawValue] = splitAssignment(assignment, '--set');
-    assignPath(target, path, parseValue(rawValue));
+    const value = parseValue(rawValue);
+    // --body is a base that both typed flags and --set layer onto, but those two
+    // are peers: when they name the same field nothing says which one was meant,
+    // so the old last-one-wins silently discarded the typed flag.
+    const typed = typedAssignments.get(path);
+    if (typed !== undefined && !sameValue(typed.value, value)) {
+        throw new RequestInputError(path, 'a single value', `${path} received conflicting values: --${typed.flag} ${describeValue(typed.value)} and --set ${path}=${describeValue(value)}. Pass only one.`);
+    }
+    assignPath(target, path, value);
+}
+/**
+ * Structural equality, so the same object written two ways is not a conflict:
+ * a typed flag carrying `{"a":1,"b":2}` and `--set` carrying `{"b":2,"a":1}`
+ * say the same thing, and refusing them would be a false positive on the very
+ * case the conflict check is meant to allow through.
+ */
+function sameValue(left, right) {
+    return canonicalJson(left) === canonicalJson(right);
+}
+function canonicalJson(value) {
+    return JSON.stringify(withSortedKeys(value ?? null));
+}
+function withSortedKeys(value) {
+    if (Array.isArray(value))
+        return value.map(withSortedKeys);
+    if (!isPlainRecord(value))
+        return value;
+    return Object.fromEntries(Object.keys(value)
+        .sort()
+        .map((key) => [key, withSortedKeys(value[key])]));
+}
+function describeValue(value) {
+    return typeof value === 'string' ? value : JSON.stringify(value);
 }
 function splitAssignment(value, flag) {
     const separator = value.indexOf('=');

package/dist/lib/response-curation.js

@@ -0,0 +1,43 @@
+import { isPlainRecord } from './objects.js';
+/**
+ * The heartbeat host the ping URL is built against. Overridable because the
+ * host is environment-specific and is not part of the published API contract.
+ */
+const DEFAULT_HEARTBEAT_HOST = 'https://heartbeat.uptimerobot.com';
+/**
+ * A heartbeat monitor is inert until something pings its URL, and the API
+ * returns the ingredients without ever naming the result: `url` carries the
+ * token and the ping endpoint is `<host>/m<id>-<token>`. That composition is
+ * how the dashboard builds the URL it shows, but it is documented nowhere, so
+ * an API consumer cannot discover it. Deriving it here lets a heartbeat be
+ * created and wired up without a trip to the dashboard.
+ *
+ * Derived rather than authoritative: UPT-3726 asks the API to return the URL
+ * itself, and this should give way to that field once it exists.
+ */
+export function withDerivedFields(payload, env = process.env) {
+    if (Array.isArray(payload))
+        return payload.map((item) => withDerivedFields(item, env));
+    if (!isPlainRecord(payload))
+        return payload;
+    if (Array.isArray(payload.items)) {
+        return { ...payload, items: payload.items.map((item) => withDerivedFields(item, env)) };
+    }
+    // An API-supplied value wins: this composition exists only while the contract
+    // has none, and must not shadow the real field when UPT-3726 lands.
+    if (typeof payload.pingUrl === 'string')
+        return payload;
+    const pingUrl = heartbeatPingUrl(payload, env);
+    return pingUrl === undefined ? payload : { ...payload, pingUrl };
+}
+function heartbeatPingUrl(monitor, env) {
+    if (monitor.type !== 'HEARTBEAT')
+        return undefined;
+    const { id, url } = monitor;
+    if (typeof url !== 'string' || url.length === 0)
+        return undefined;
+    if (typeof id !== 'number' && typeof id !== 'string')
+        return undefined;
+    const host = (env.UPTIMEROBOT_HEARTBEAT_URL ?? DEFAULT_HEARTBEAT_HOST).replace(/\/+$/, '');
+    return `${host}/m${id}-${url}`;
+}

package/dist/output/columns.js

@@ -9,9 +9,12 @@ export const COLLECTION_COMMAND_IDS = [
     'maintenance-windows:list',
     'monitor-groups:list',
     'monitors:list',
+    'monitors:third-party-service:incidents:activity-log',
+    'monitors:third-party-service:incidents:list',
     'status-pages:announcements:list',
     'status-pages:list',
     'tags:list',
+    'third-party-providers:list',
     'user:alert-contacts',
     'user:all-alert-contacts',
 ];
@@ -87,6 +90,20 @@ export const COMMAND_COLUMNS = {
         { format: stateAge, header: 'IN STATE', key: 'currentStateDuration' },
         { format: joinNames, key: 'tags', maxWidth: 32 },
     ],
+    'monitors:third-party-service:incidents:activity-log': [
+        { key: 'timestamp' },
+        { key: 'status' },
+        { header: 'RECIPIENT', key: 'alertContactName', maxWidth: 28 },
+        { header: 'CONTACT', key: 'channelIdentifier', maxWidth: 36 },
+        { key: 'channel' },
+    ],
+    'monitors:third-party-service:incidents:list': [
+        { key: 'id' },
+        { key: 'severity' },
+        { key: 'title', maxWidth: 48 },
+        { header: 'STARTED', key: 'startedAt' },
+        { header: 'RESOLVED', key: 'resolvedAt' },
+    ],
     'status-pages:announcements:list': [
         { key: 'id' },
         { key: 'title', maxWidth: 40 },
@@ -106,6 +123,13 @@ export const COMMAND_COLUMNS = {
         { format: accessLevel, header: 'ACCESS', key: 'isPasswordSet' },
     ],
     'tags:list': [{ key: 'id' }, { key: 'name', maxWidth: 28 }],
+    'third-party-providers:list': [
+        { key: 'id' },
+        { key: 'name', maxWidth: 28 },
+        { key: 'state' },
+        { header: 'TRACKED', key: 'isTracked' },
+        { header: 'STATUS PAGE', key: 'statusPageUrl', maxWidth: 40 },
+    ],
     'user:alert-contacts': ALERT_CONTACT_COLUMNS,
     'user:all-alert-contacts': [
         { header: 'USER ID', key: 'user.id' },