@vincentt-xr/cli 0.17.0 → 0.18.0

package/dist/dx/consent.js

@@ -23,6 +23,7 @@ import { stateMatches } from "../login/pkce.js";
 import { getFreePort } from "../preview/net.js";
 import { authFailureMessage } from "../shared/authError.js";
 import { clientHeaders } from "../shared/clientHeader.js";
+import { apiFetch } from "../shared/http.js";
 import { readAccountConsent } from "./enablement.js";
 async function safeText(res) {
     try {
@@ -50,7 +51,7 @@ export function httpConsentBackend() {
     const strip = (u) => u.replace(/\/$/, "");
     return {
         async read(apiUrl, pat, now) {
-            const res = await fetch(`${strip(apiUrl)}/me`, {
+            const res = await apiFetch(`${strip(apiUrl)}/me`, {
                 headers: { ...clientHeaders(), authorization: `Bearer ${pat}` },
             });
             if (!res.ok) {
@@ -59,7 +60,7 @@ export function httpConsentBackend() {
             return readAccountConsent(unwrapMe(await res.json()), now);
         },
         async grant(apiUrl, pat, now) {
-            const res = await fetch(`${strip(apiUrl)}/me/dx-consent`, {
+            const res = await apiFetch(`${strip(apiUrl)}/me/dx-consent`, {
                 method: "POST",
                 headers: { ...clientHeaders(), authorization: `Bearer ${pat}` },
             });
@@ -69,7 +70,7 @@ export function httpConsentBackend() {
             return readAccountConsent(unwrapMe(await res.json()), now);
         },
         async revoke(apiUrl, pat) {
-            const res = await fetch(`${strip(apiUrl)}/me/dx-consent`, {
+            const res = await apiFetch(`${strip(apiUrl)}/me/dx-consent`, {
                 method: "DELETE",
                 headers: { ...clientHeaders(), authorization: `Bearer ${pat}` },
             });
@@ -114,7 +115,7 @@ export function parseConsentCallback(params, expectedState, stateMatches) {
         return {
             ok: false,
             reason: "state_mismatch",
-            message: "State mismatch — ignoring an unexpected callback.",
+            message: "State mismatch. Ignoring an unexpected callback.",
         };
     }
     const result = params.get("result");
@@ -165,7 +166,7 @@ export async function runConsentInBrowser(opts) {
                     value: result.decision,
                     page: {
                         status: 200,
-                        html: browserPage(granted, granted ? "Reports allowed" : "Not enabled", "Return to your terminal — you can close this tab."),
+                        html: browserPage(granted, granted ? "Reports allowed" : "Not enabled", "Return to your terminal. You can close this tab."),
                     },
                 };
             }

package/dist/dx/journal.d.ts

@@ -47,5 +47,20 @@ export declare function buildEntry(input: RecordInput): JournalEntry;
  * turned into a failed command.
  */
 export declare function record(input: RecordInput): void;
-/** Read the journal oldest-first. Malformed lines are skipped, not fatal. */
-export declare function readJournal(): JournalEntry[];
+export interface JournalWindow {
+    /** Epoch ms. Entries stamped before this are dropped. */
+    sinceMs: number;
+}
+/**
+ * Keep only entries stamped at or after the cutoff. An entry whose timestamp
+ * does not parse is dropped: it cannot be placed inside any window.
+ */
+export declare function withinWindow(entries: JournalEntry[], window: JournalWindow): JournalEntry[];
+/**
+ * Read the journal oldest-first. Malformed lines are skipped, not fatal.
+ *
+ * With a window, only entries inside it are returned. Without one, the whole
+ * file is: the size trim is the only other bound, so how far back an unwindowed
+ * read reaches depends on how much the CLI was used, not on when.
+ */
+export declare function readJournal(window?: JournalWindow): JournalEntry[];

package/dist/dx/journal.js

@@ -105,8 +105,24 @@ export function record(input) {
         // Instrumentation must not break the tool it measures.
     }
 }
-/** Read the journal oldest-first. Malformed lines are skipped, not fatal. */
-export function readJournal() {
+/**
+ * Keep only entries stamped at or after the cutoff. An entry whose timestamp
+ * does not parse is dropped: it cannot be placed inside any window.
+ */
+export function withinWindow(entries, window) {
+    return entries.filter((e) => {
+        const t = Date.parse(e.ts);
+        return Number.isFinite(t) && t >= window.sinceMs;
+    });
+}
+/**
+ * Read the journal oldest-first. Malformed lines are skipped, not fatal.
+ *
+ * With a window, only entries inside it are returned. Without one, the whole
+ * file is: the size trim is the only other bound, so how far back an unwindowed
+ * read reaches depends on how much the CLI was used, not on when.
+ */
+export function readJournal(window) {
     let raw;
     try {
         raw = fs.readFileSync(journalPath(), "utf8");
@@ -125,5 +141,5 @@ export function readJournal() {
             // A torn line from a killed process is not a reason to lose the rest.
         }
     }
-    return out;
+    return window === undefined ? out : withinWindow(out, window);
 }

package/dist/dx/report.js

@@ -1,6 +1,7 @@
 import { enablementLine } from "./enablement.js";
 import { DXSendError, platformTag } from "./send.js";
 import { resolveBuiltWith } from "../platform/resolve.js";
+import { EXIT } from "../lib/exitCodes.js";
 import { renderPayloadWithVersionSummary, summarizeBuiltWith, versionDisclosureLines, } from "../platform/versionSummary.js";
 /** Matches the server's MaxDXNote. Checked here so a refusal costs no round trip. */
 export const MAX_NOTE = 2000;
@@ -93,7 +94,7 @@ export function renderObservation(report) {
         "",
         ...renderPayloadWithVersionSummary(report, report.builtWith).map((l) => `  ${l}`),
         "",
-        "  YOUR NOTE IS SENT EXACTLY AS WRITTEN — check it for paths, URLs,",
+        "  YOUR NOTE IS SENT EXACTLY AS WRITTEN. Check it for paths, URLs,",
         "  tokens, or customer names before sending.",
         // Entry 2: it explains the one anomalous line above, so it sits directly
         // under the warning where the reader's eye lands next — above the context
@@ -153,7 +154,7 @@ export async function reportCommand(deps, options) {
     }
     if (auth === undefined) {
         deps.print("Not signed in. Run `vincentt login` to send a report.");
-        return 1;
+        return EXIT.NOT_AUTHENTICATED;
     }
     const context = options.noContext ? undefined : lastContext(deps.entries());
     // RESOLVED AFTER THE GATE AND IMMEDIATELY BEFORE THE BUILD.
@@ -199,7 +200,7 @@ export async function reportCommand(deps, options) {
     try {
         const res = await deps.post(auth.apiUrl, auth.pat, report);
         deps.print(`Sent. Reference ${res.ref}.`);
-        deps.print("Thank you — this is the kind of thing we cannot detect on our own.");
+        deps.print("Thank you. This is the kind of thing we cannot detect on our own.");
         return 0;
     }
     catch (err) {

package/dist/dx/reportIo.js

@@ -1,5 +1,7 @@
 import { DXSendError } from "./send.js";
-export async function postObservationReport(apiUrl, pat, report, fetchImpl = fetch) {
+import { AUTH_EXPIRED_MESSAGE } from "../shared/authError.js";
+import { apiFetch } from "../shared/http.js";
+export async function postObservationReport(apiUrl, pat, report, fetchImpl = apiFetch) {
     const res = await fetchImpl(`${apiUrl}/dx-reports`, {
         method: "POST",
         headers: { "content-type": "application/json", authorization: `Bearer ${pat}` },
@@ -14,14 +16,13 @@ export async function postObservationReport(apiUrl, pat, report, fetchImpl = fet
         catch {
             // A non-JSON body is not more informative than the status.
         }
-        if (res.status === 401) {
-            throw new DXSendError("Your access token is no longer valid — run `vincentt login`.", 401);
-        }
+        if (res.status === 401)
+            throw new DXSendError(AUTH_EXPIRED_MESSAGE, 401);
         if (res.status === 429) {
             // Distinguished from the generic path because it is the one refusal the
             // creator can act on by simply waiting, and a bare "not accepted" would
             // read as their report being rejected on its merits.
-            throw new DXSendError("Too many reports from this account just now — try again shortly.", 429);
+            throw new DXSendError("Too many reports from this account just now. Try again shortly.", 429);
         }
         throw new DXSendError(detail !== "" ? detail : `The report was not accepted (${res.status}).`, res.status);
     }

package/dist/dx/send.js

@@ -1,3 +1,5 @@
+import { AUTH_EXPIRED_MESSAGE } from "../shared/authError.js";
+import { apiFetch } from "../shared/http.js";
 import { renderPayloadWithVersionSummary, summarizeBuiltWith, versionDisclosureLines, } from "../platform/versionSummary.js";
 /**
  * The server bounds a report at 50 findings and refuses the whole thing past
@@ -79,7 +81,7 @@ export function renderPayload(report) {
     // creator to consent on a false claim — the one thing this screen exists to
     // prevent. So the sentence changes when a note is present.
     if (hasNote) {
-        lines.push("  The generated fields carry no paths, flag values, or error messages.", "  YOUR NOTE IS SENT EXACTLY AS WRITTEN — check it for paths, URLs,", "  tokens, or customer names before sending.");
+        lines.push("  The generated fields carry no paths, flag values, or error messages.", "  YOUR NOTE IS SENT EXACTLY AS WRITTEN. Check it for paths, URLs,", "  tokens, or customer names before sending.");
     }
     else {
         lines.push("  No paths, no flag values, no error messages, and nothing about which", "  project this was.");
@@ -102,7 +104,7 @@ export class DXSendError extends Error {
 /**
  * POST the report. The caller has already shown the payload and had it accepted.
  */
-export async function postReport(apiUrl, pat, report, fetchImpl = fetch) {
+export async function postReport(apiUrl, pat, report, fetchImpl = apiFetch) {
     const res = await fetchImpl(`${apiUrl}/dx-reports`, {
         method: "POST",
         headers: { "content-type": "application/json", authorization: `Bearer ${pat}` },
@@ -117,9 +119,8 @@ export async function postReport(apiUrl, pat, report, fetchImpl = fetch) {
         catch {
             // A non-JSON body is not more informative than the status.
         }
-        if (res.status === 401) {
-            throw new DXSendError("Your access token is no longer valid — run `vincentt login`.", 401);
-        }
+        if (res.status === 401)
+            throw new DXSendError(AUTH_EXPIRED_MESSAGE, 401);
         // A 400 here means the payload this CLI built failed the server's own
         // grammar. Surfaced verbatim rather than softened: it is a bug in this CLI,
         // and the creator is the one who can report it.

package/dist/lib/backend.d.ts

@@ -56,22 +56,6 @@ export declare function createProject(cfg: ResolvedConfig, orgSlug: string, name
 export declare function listProjects(cfg: ResolvedConfig, orgSlug: string): Promise<ProjectView[]>;
 /** Read a project by id. Backs `link`; the org is derived server-side from the row. */
 export declare function getProject(cfg: ResolvedConfig, projectId: string): Promise<ProjectView>;
-export interface MintedTunnel {
-    tunnelId: string;
-    /** The public host the phone opens: <slug>-<token>.<previewApex>. */
-    hostname: string;
-    /** cloudflared run token — `cloudflared tunnel run --token <this>`. */
-    runToken: string;
-    /** DNS record id, passed back on reap. */
-    dnsRecordId: string;
-}
-/** Mint a per-session dev tunnel for `localPort` (the backend holds CF creds). */
-export declare function mintTunnel(cfg: ResolvedConfig, projectId: string, localPort: number): Promise<MintedTunnel>;
-/** Tear down a session tunnel (DNS route + tunnel). Best-effort; never throws. */
-export declare function reapTunnel(cfg: ResolvedConfig, projectId: string, ref: {
-    tunnelId: string;
-    dnsRecordId?: string;
-}): Promise<void>;
 /** Recursively list files under `dir`, returning dir-relative POSIX paths. */
 export declare function walkDir(dir: string, base?: string): Promise<string[]>;
 export interface MeMembership {

package/dist/lib/backend.js

@@ -8,6 +8,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { clientHeaders } from "../shared/clientHeader.js";
 import { authFailureMessage } from "../shared/authError.js";
+import { apiFetch } from "../shared/http.js";
 const execFileAsync = promisify(execFile);
 export class BackendError extends Error {
     status;
@@ -18,7 +19,7 @@ export class BackendError extends Error {
     }
 }
 async function authFetch(cfg, pathname, init = {}) {
-    return fetch(`${cfg.apiUrl}${pathname}`, {
+    return apiFetch(`${cfg.apiUrl}${pathname}`, {
         ...init,
         headers: {
             ...(init.headers ?? {}),
@@ -159,31 +160,6 @@ function parseProjectView(raw, what) {
         publishState: str("publishState") ?? "never",
     };
 }
-/** Mint a per-session dev tunnel for `localPort` (the backend holds CF creds). */
-export async function mintTunnel(cfg, projectId, localPort) {
-    const res = await authFetch(cfg, `/projects/${projectId}/tunnel`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ port: localPort }),
-    });
-    if (!res.ok) {
-        throw new BackendError(authFailureMessage("tunnel mint failed", res.status, await safeText(res)), res.status);
-    }
-    return (await res.json());
-}
-/** Tear down a session tunnel (DNS route + tunnel). Best-effort; never throws. */
-export async function reapTunnel(cfg, projectId, ref) {
-    try {
-        await authFetch(cfg, `/projects/${projectId}/tunnel/reap`, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify(ref),
-        });
-    }
-    catch {
-        // Reap is a cleanup courtesy — a failure must never crash the preview teardown.
-    }
-}
 /** Recursively list files under `dir`, returning dir-relative POSIX paths. */
 export async function walkDir(dir, base = dir) {
     const out = [];

package/dist/lib/detect.d.ts

@@ -0,0 +1,87 @@
+import type { SettingsField } from "./settings.js";
+export declare const DETECT_MAX_BYTES: number;
+/** `notFile`: it exists but is not a regular file (a FIFO would block the read). */
+export type ReadResult = {
+    text: string;
+} | {
+    missing: true;
+} | {
+    tooLarge: true;
+} | {
+    notFile: true;
+};
+export interface DetectProbes {
+    /** Read a repo-relative file, at most DETECT_MAX_BYTES. */
+    readText: (rel: string) => Promise<ReadResult>;
+    exists: (rel: string) => Promise<boolean>;
+}
+export interface DetectedField {
+    value: string | number;
+    evidence: string;
+}
+export interface DetectResult {
+    /** Exactly the files that were read or looked for by name, in report order. */
+    read: string[];
+    fields: Partial<Record<SettingsField, DetectedField>>;
+    missing: {
+        field: SettingsField;
+        reason: string;
+    }[];
+    pm: PackageManager;
+}
+export type PackageManager = "npm" | "pnpm" | "yarn" | "bun";
+/** One simple command of a script body: its words, wrappers and env assignments removed. */
+interface Command {
+    words: string[];
+    /** The command as written, for evidence. */
+    text: string;
+}
+/** Split a script body on `&&`, `||`, `;`, `|` and `&`, honouring quotes. Linear. */
+export declare function splitScript(body: string): Command[];
+type Tok = {
+    t: "ident";
+    v: string;
+} | {
+    t: "str";
+    v: string;
+} | {
+    t: "num";
+    v: string;
+} | {
+    t: "tpl";
+    v: string;
+    interpolated: boolean;
+} | {
+    t: "p";
+    v: string;
+} | {
+    t: "re";
+};
+/** A JS/TS tokenizer just good enough to find object keys. One pass, no backtracking. */
+export declare function tokenize(src: string): Tok[];
+export type ConfigValue = {
+    kind: "object";
+    spread: boolean;
+} | {
+    kind: "number";
+    value: number;
+} | {
+    kind: "string";
+    value: string;
+} | {
+    kind: "dirname";
+    fn: "resolve" | "join";
+    args: string[];
+} | {
+    kind: "expr";
+};
+/**
+ * Every object key whose objects nest DIRECTLY from an anonymous root, keyed by
+ * its dotted path (`devServer.port`, `build.outDir`). A key inside a function
+ * body, an array, a call argument that is not the config itself, or any value
+ * expression is not recorded: its value is judged as "an expression", which
+ * detection reports as not found.
+ */
+export declare function scanConfigKeys(src: string): Map<string, ConfigValue[]>;
+export declare function detect(probes: DetectProbes): Promise<DetectResult>;
+export {};