campus-stats 0.4.3 → 0.6.0

package/dist/cli.js

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 import { cachePath, emptyCache, mergeSyncResult } from "./cache.js";
-import { dataBundleUrl, GITLAB_PROJECT_ID, } from "./data-bundle.js";
+import { describeCredentials, resolveCredentials, } from "./credentials.js";
+import { dataBundleUrl } from "./data-bundle.js";
 import { readStore, resolveDbPath, resolveStoreMode, runMigrate, writeCacheToStore, writeSyncToStore, } from "./db/store-api.js";
 import { FANTASY_PLAYER_STATS_LIMIT, listWomenCompetitions, syncFantasyBundle, updateCachedCompetitions, } from "./fantasy.js";
 import { CampusClient } from "./client.js";
-import { INJURIES_STATUS_MESSAGE } from "./injuries.js";
 import { proposeIdentitiesForCompetition } from "./identity/propose.js";
 import { setIdentityStatus } from "./identity/store.js";
-import { FbrefSource } from "./sources/fbref.js";
+import { createFootballSource, KNOWN_SOURCE_IDS } from "./sources/create.js";
+import { listStatsBombEndpoints, } from "./sources/statsbomb-endpoints.js";
 import { StatsBombSource } from "./sources/statsbomb.js";
 let storeMode = "json";
 let dbPath = ".campus/campus.sqlite";
@@ -20,6 +21,8 @@ Usage:
   campus update [--with-players] [--player-stats-limit <n>]
   campus pull [--url <cache.json url>]
   campus available
+  campus credentials
+  campus endpoints
   campus competitions
   campus seasons --competition <name>
   campus teams --competition <name>
@@ -29,7 +32,6 @@ Usage:
   campus lineups [--match <id>] [--team <name>]
   campus squad --competition <name> --team <name> [--season <name>]
   campus fantasy-points [--competition <name>] [--player <name>] [--match <id>]
-  campus injuries
   campus identities [--status resolved|pending|rejected]
   campus identities propose --competition <name>
   campus identities confirm --id <identityId>
@@ -39,8 +41,15 @@ Usage:
 Options:
   --fantasy / --all          Sync all StatsBomb women's comps (clubs + national teams)
   --competition <name>       Competition display name (e.g. "Liga F")
-  --source <id>              Data source for sync (default: statsbomb)
-  --with-players             StatsBomb only: also sync v1 player match stats
+  --source <id>              Data source (default: statsbomb). Free or paid if login set.
+  --sb-user <email>          StatsBomb paid API username (or SB_USERNAME)
+  --sb-password <pass>       StatsBomb paid API password (or SB_PASSWORD)
+  --with-players             StatsBomb: also sync lineups/events → v1 player stats
+  --with-paid-player-match-stats   Paid API probe: official player-match aggregates
+  --with-paid-team-match-stats     Paid API probe: team-match aggregates
+  --with-paid-player-season-stats  Paid API probe: player season aggregates
+  --with-paid-team-season-stats    Paid API probe: team season aggregates
+  --with-paid-360                  Paid API probe: 360 frames (needs 360 licence)
   --player-stats-limit <n>   Max matches to enrich (default 5; fantasy default 25)
   --url <url>                Override data-bundle URL for pull
   --season <name>            Season label (e.g. "2023/2024")
@@ -55,7 +64,9 @@ Options:
   --json                     Force JSON cache (default)
   --help                     Show this help
 
-Periodic refresh: see docs/cron.md (GitLab CI schedule + campus pull).
+Sources: ${KNOWN_SOURCE_IDS.join(", ")}. Free by default; StatsBomb paid login → paid API.
+See: campus endpoints · campus credentials
+Periodic refresh: see docs/cron.md (GitHub Actions schedule + campus pull).
 `);
     process.exit(1);
 }
@@ -84,56 +95,144 @@ function requireCompetition(cache, name) {
     }
     return chosen;
 }
+async function resolveCliCredentials(args) {
+    return resolveCredentials({
+        statsbomb: {
+            username: getFlag(args, "--sb-user"),
+            password: getFlag(args, "--sb-password"),
+        },
+    });
+}
+function resolvePaidExtras(args) {
+    return {
+        playerMatchStats: hasFlag(args, "--with-paid-player-match-stats"),
+        teamMatchStats: hasFlag(args, "--with-paid-team-match-stats"),
+        playerSeasonStats: hasFlag(args, "--with-paid-player-season-stats"),
+        teamSeasonStats: hasFlag(args, "--with-paid-team-season-stats"),
+        frames360: hasFlag(args, "--with-paid-360"),
+    };
+}
+function paidExtrasRequested(extras) {
+    return Boolean(extras.playerMatchStats ||
+        extras.teamMatchStats ||
+        extras.playerSeasonStats ||
+        extras.teamSeasonStats ||
+        extras.frames360);
+}
 async function cmdSync(args) {
     const fantasy = hasFlag(args, "--fantasy") || hasFlag(args, "--all");
     const competition = getFlag(args, "--competition");
     const withPlayers = hasFlag(args, "--with-players");
+    const paidExtras = resolvePaidExtras(args);
     const limitRaw = getFlag(args, "--player-stats-limit");
     const playerStatsLimit = limitRaw
         ? Number(limitRaw)
         : fantasy
             ? FANTASY_PLAYER_STATS_LIMIT
             : 5;
+    const creds = await resolveCliCredentials(args);
+    const sbCredentials = creds.statsbombPaidReady
+        ? {
+            username: creds.statsbomb.username,
+            password: creds.statsbomb.password,
+            apiBaseUrl: creds.statsbomb.apiBaseUrl,
+        }
+        : undefined;
+    if (paidExtrasRequested(paidExtras) && !sbCredentials) {
+        throw new Error("Paid extras flags need SB_USERNAME / SB_PASSWORD (or --sb-user / --sb-password). " +
+            "See docs/statsbomb-endpoints.md.");
+    }
     if (fantasy) {
         if (competition) {
             throw new Error("Use either --fantasy/--all or --competition, not both.");
         }
-        console.error("Syncing fantasy bundle (all StatsBomb women's competitions)…");
+        const mode = sbCredentials ? "paid API" : "Open Data";
+        console.error(`Syncing fantasy bundle (all StatsBomb women's competitions, ${mode})…`);
         const result = await syncFantasyBundle({
             includePlayerStats: withPlayers,
             playerStatsLimit,
             latestSeasonPlayersOnly: true,
+            credentials: sbCredentials,
+            paidExtras,
             onProgress: (msg) => console.error(msg),
         });
         const cache = await writeSyncToStore(storeMode, dbPath, result);
-        printSyncSummary("statsbomb", result, cache);
+        printSyncSummary(`statsbomb:${sbCredentials ? "paid" : "open-data"}`, result, cache);
         return;
     }
     if (!competition)
         usage();
     const sourceId = (getFlag(args, "--source") ?? "statsbomb").toLowerCase();
-    let source;
-    if (sourceId === "statsbomb") {
-        source = new StatsBombSource({
-            includePlayerStats: withPlayers,
-            playerStatsLimit,
-        });
-    }
-    else if (sourceId === "fbref") {
-        if (withPlayers) {
-            throw new Error("FBref player stats are not available yet (see docs/fbref-player-stats-deferred.md).");
-        }
-        source = new FbrefSource();
+    if (sourceId === "fbref" && withPlayers) {
+        throw new Error("FBref player stats are not available yet (see docs/fbref-player-stats-deferred.md).");
     }
-    else {
-        throw new Error(`Unknown source: "${sourceId}". Use statsbomb or fbref.`);
+    if (sourceId === "fbref" && paidExtrasRequested(paidExtras)) {
+        throw new Error("Paid extras apply only to --source statsbomb.");
     }
-    console.error(`Syncing "${competition}" from ${source.id}…`);
+    const source = createFootballSource(sourceId, {
+        statsbomb: {
+            includePlayerStats: withPlayers,
+            playerStatsLimit,
+            credentials: sbCredentials,
+            paidExtras,
+        },
+        credentials: sbCredentials,
+    });
+    const modeLabel = sourceId === "statsbomb"
+        ? sbCredentials
+            ? "statsbomb:paid"
+            : "statsbomb:open-data"
+        : source.id;
+    console.error(`Syncing "${competition}" from ${modeLabel}…`);
     const result = await source.syncCompetition(competition);
     const cache = await writeSyncToStore(storeMode, dbPath, result);
-    printSyncSummary(source.id, result, cache);
+    let paidExtraProbes;
+    if (paidExtrasRequested(paidExtras) &&
+        source instanceof StatsBombSource &&
+        result.competitions[0] &&
+        result.seasons[0]) {
+        const compNative = Number(result.competitions[0].sources.find((s) => s.source === "statsbomb")?.id);
+        const seasonNative = Number(result.seasons[0].sources
+            .find((s) => s.source === "statsbomb")
+            ?.id.split(":")
+            .at(-1));
+        const matchNative = result.matches[0]?.sources.find((s) => s.source === "statsbomb")?.id;
+        if (Number.isFinite(compNative) && Number.isFinite(seasonNative)) {
+            console.error("Probing optional paid endpoints (not yet mapped to schema)…");
+            paidExtraProbes = await source.probePaidExtras({
+                competitionId: compNative,
+                seasonId: seasonNative,
+                matchId: matchNative,
+            });
+        }
+    }
+    printSyncSummary(modeLabel, result, cache, paidExtraProbes);
+}
+async function cmdCredentials(args) {
+    const creds = await resolveCliCredentials(args);
+    const described = describeCredentials(creds);
+    console.log(JSON.stringify({
+        ...described,
+        hint: creds.statsbombPaidReady
+            ? "StatsBomb paid login detected — sync uses data.statsbombservices.com"
+            : "No StatsBomb login — sync uses free Open Data. FBref stays free HTML only.",
+    }, null, 2));
+}
+async function cmdEndpoints() {
+    console.log(JSON.stringify({
+        endpoints: listStatsBombEndpoints().map((e) => ({
+            id: e.id,
+            name: e.name,
+            wiredInCampus: e.wiredInCampus,
+            requiresPaidLicense: e.requiresPaidLicense,
+            availability: e.availability,
+            paidPath: e.paidPath ?? null,
+            openDataPath: e.openDataPath ?? null,
+            notes: e.notes,
+        })),
+    }, null, 2));
 }
-function printSyncSummary(sourceId, result, cache) {
+function printSyncSummary(sourceId, result, cache, paidExtraProbes) {
     console.log(JSON.stringify({
         source: sourceId,
         cache: storeMode === "json" ? cachePath() : dbPath,
@@ -143,6 +242,7 @@ function printSyncSummary(sourceId, result, cache) {
         matches: result.matches.length,
         players: result.players?.length ?? 0,
         playerMatchStats: result.playerMatchStats?.length ?? 0,
+        paidExtraProbes,
         totals: {
             competitions: cache.competitions.length,
             seasons: cache.seasons.length,
@@ -159,6 +259,14 @@ async function cmdUpdate(args) {
     const playerStatsLimit = limitRaw
         ? Number(limitRaw)
         : FANTASY_PLAYER_STATS_LIMIT;
+    const creds = await resolveCliCredentials(args);
+    const sbCredentials = creds.statsbombPaidReady
+        ? {
+            username: creds.statsbomb.username,
+            password: creds.statsbomb.password,
+            apiBaseUrl: creds.statsbomb.apiBaseUrl,
+        }
+        : undefined;
     const before = await readStore(storeMode, dbPath);
     console.error(before.competitions.length === 0
         ? "Cache empty — running full fantasy sync…"
@@ -167,18 +275,19 @@ async function cmdUpdate(args) {
         includePlayerStats: withPlayers,
         playerStatsLimit,
         latestSeasonPlayersOnly: true,
+        credentials: sbCredentials,
         onProgress: (msg) => console.error(msg),
     });
     const cache = await writeSyncToStore(storeMode, dbPath, result);
-    printSyncSummary("statsbomb", result, cache);
+    printSyncSummary(`statsbomb:${sbCredentials ? "paid" : "open-data"}`, result, cache);
 }
 async function cmdPull(args) {
-    const url = getFlag(args, "--url") ?? dataBundleUrl(GITLAB_PROJECT_ID);
+    const url = getFlag(args, "--url") ?? dataBundleUrl();
     console.error(`Pulling data bundle from ${url}…`);
     const res = await fetch(url);
     if (!res.ok) {
         throw new Error(`Failed to pull data bundle (${res.status}). ` +
-            `Ensure the GitLab CI cron has published campus-data/latest (see docs/cron.md).`);
+            `Ensure the GitHub Actions cron has published the data-latest release (see docs/cron.md).`);
     }
     const remote = (await res.json());
     const incoming = {
@@ -191,7 +300,6 @@ async function cmdPull(args) {
         players: remote.players ?? [],
         playerMatchStats: remote.playerMatchStats ?? [],
         lineups: remote.lineups ?? [],
-        injuries: remote.injuries ?? [],
     };
     const local = await readStore(storeMode, dbPath);
     const merged = mergeSyncResult(local, {
@@ -202,7 +310,6 @@ async function cmdPull(args) {
         players: incoming.players,
         playerMatchStats: incoming.playerMatchStats,
         lineups: incoming.lineups,
-        injuries: incoming.injuries,
     });
     // Preserve local identities; prefer remote entity payloads via mergeById.
     merged.identities = local.identities.length
@@ -463,14 +570,6 @@ async function cmdFantasyPoints(args) {
         breakdown: r.breakdown,
     })), null, 2));
 }
-async function cmdInjuries() {
-    const client = CampusClient.fromCache(await readStore(storeMode, dbPath));
-    console.log(JSON.stringify({
-        available: client.injuries().available,
-        message: INJURIES_STATUS_MESSAGE,
-        records: client.injuries().records,
-    }, null, 2));
-}
 async function main() {
     const [, , command, ...args] = process.argv;
     if (!command || command === "--help" || args.includes("--help"))
@@ -491,6 +590,13 @@ async function main() {
         case "available":
             await cmdAvailable();
             break;
+        case "credentials":
+        case "auth":
+            await cmdCredentials(args);
+            break;
+        case "endpoints":
+            await cmdEndpoints();
+            break;
         case "competitions":
             await cmdCompetitions();
             break;
@@ -518,9 +624,6 @@ async function main() {
         case "fantasy-points":
             await cmdFantasyPoints(args);
             break;
-        case "injuries":
-            await cmdInjuries();
-            break;
         case "identities":
             await cmdIdentities(args);
             break;

package/dist/client.d.ts

@@ -5,7 +5,7 @@
  */
 import { type FantasySyncOptions } from "./fantasy.js";
 import { type FantasyPointRow, type FantasyScoringRules } from "./scoring.js";
-import type { CampusCache, Competition, InjuryRecord, LineupEntry, Match, Player, PlayerMatchStats, Season, Team } from "./types.js";
+import type { CampusCache, Competition, LineupEntry, Match, Player, PlayerMatchStats, Season, Team } from "./types.js";
 export interface SquadMember {
     playerId: string;
     playerName: string;
@@ -80,9 +80,4 @@ export declare class CampusClient {
         team?: string;
         rules?: FantasyScoringRules;
     }): FantasyPointRow[];
-    injuries(): {
-        available: boolean;
-        message: string;
-        records: InjuryRecord[];
-    };
 }

package/dist/client.js

@@ -4,9 +4,8 @@
  * helpers against an in-memory cache loaded via `fromBundle` / `fromCache`.
  */
 import { emptyCache, loadCache, mergeSyncResult, saveCache, cachePath, } from "./cache.js";
-import { dataBundleUrl, GITLAB_PROJECT_ID } from "./data-bundle.js";
+import { dataBundleUrl } from "./data-bundle.js";
 import { syncFantasyBundle, updateCachedCompetitions, } from "./fantasy.js";
-import { listInjuries, INJURIES_AVAILABLE, INJURIES_STATUS_MESSAGE } from "./injuries.js";
 import { DEFAULT_FANTASY_RULES, scoreFantasyPoints, } from "./scoring.js";
 function includesCI(haystack, needle) {
     return haystack.toLowerCase().includes(needle.toLowerCase());
@@ -28,11 +27,11 @@ export class CampusClient {
     }
     /** Download the cron-published bundle and optionally merge with local cache. */
     static async fromBundle(options = {}) {
-        const url = options.url ?? dataBundleUrl(GITLAB_PROJECT_ID);
+        const url = options.url ?? dataBundleUrl();
         const res = await fetch(url);
         if (!res.ok) {
             throw new Error(`Failed to load data bundle (${res.status}) from ${url}. ` +
-                "Publish via GitLab CI schedule (docs/cron.md) or call syncFantasy() once.");
+                "Publish via GitHub Actions schedule (docs/cron.md) or call syncFantasy() once.");
         }
         const remote = (await res.json());
         const incoming = {
@@ -45,7 +44,6 @@ export class CampusClient {
             players: remote.players ?? [],
             playerMatchStats: remote.playerMatchStats ?? [],
             lineups: remote.lineups ?? [],
-            injuries: remote.injuries ?? [],
         };
         const base = options.mergeWith ?? emptyCache();
         const merged = mergeSyncResult(base, {
@@ -56,7 +54,6 @@ export class CampusClient {
             players: incoming.players,
             playerMatchStats: incoming.playerMatchStats,
             lineups: incoming.lineups,
-            injuries: incoming.injuries,
         });
         merged.identities =
             base.identities.length > 0 ? base.identities : incoming.identities;
@@ -263,11 +260,4 @@ export class CampusClient {
             rules: filter?.rules ?? DEFAULT_FANTASY_RULES,
         });
     }
-    injuries() {
-        return {
-            available: INJURIES_AVAILABLE,
-            message: INJURIES_STATUS_MESSAGE,
-            records: listInjuries(this.cache),
-        };
-    }
 }

package/dist/credentials.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Optional credentials so Campus can use free open feeds by default, or a
+ * customer's own StatsBomb login for the paid API.
+ *
+ * Resolution order (highest wins):
+ * 1. Explicit overrides (CLI flags / library options)
+ * 2. Environment variables
+ * 3. Local config file `.campus/config.json` (gitignored under `.campus/`)
+ *
+ * StatsBomb paid API uses HTTP Basic Auth (same as statsbombpy):
+ *   SB_USERNAME / SB_PASSWORD
+ *
+ * FBref / Sports Reference does **not** sell a public API key — free mode is
+ * polite HTML only. See docs/byok.md.
+ *
+ * Never log raw secrets; use `maskSecret` / `describeCredentials`.
+ */
+/** StatsBomb customer login (paid API). Matches statsbombpy env names. */
+export declare const SB_USERNAME_ENV = "SB_USERNAME";
+export declare const SB_PASSWORD_ENV = "SB_PASSWORD";
+export declare const CAMPUS_STATSBOMB_USERNAME_ENV = "CAMPUS_STATSBOMB_USERNAME";
+export declare const CAMPUS_STATSBOMB_PASSWORD_ENV = "CAMPUS_STATSBOMB_PASSWORD";
+/** Optional override for the paid StatsBomb API host. */
+export declare const CAMPUS_STATSBOMB_API_BASE_URL_ENV = "CAMPUS_STATSBOMB_API_BASE_URL";
+export declare const DEFAULT_STATSBOMB_API_BASE = "https://data.statsbombservices.com";
+export type CredentialSource = "override" | "env" | "config" | "none";
+export interface StatsBombCredentials {
+    username?: string;
+    password?: string;
+    /** Paid API host (default data.statsbombservices.com). */
+    apiBaseUrl?: string;
+}
+export interface CampusConfigFile {
+    statsbomb?: {
+        username?: string;
+        password?: string;
+        apiBaseUrl?: string;
+    };
+    /** @deprecated Prefer statsbomb.username / statsbomb.password. */
+    apiKey?: string;
+    apiBaseUrl?: string;
+}
+export interface ResolvedCredentials {
+    statsbomb: StatsBombCredentials & {
+        usernameSource: CredentialSource;
+        passwordSource: CredentialSource;
+        apiBaseUrlSource: CredentialSource;
+    };
+    /** True when both username and password are present. */
+    statsbombPaidReady: boolean;
+    fbref: {
+        /** Always false — FBref has no official API-key product. */
+        paidApiAvailable: false;
+        note: string;
+    };
+}
+export interface ResolveCredentialsOptions {
+    statsbomb?: StatsBombCredentials;
+    configPath?: string;
+    configFile?: CampusConfigFile | null;
+    env?: NodeJS.ProcessEnv;
+}
+export declare function defaultConfigPath(cwd?: string): string;
+export declare function loadConfigFile(filePath?: string): Promise<CampusConfigFile | null>;
+/**
+ * Resolve optional paid credentials. Missing StatsBomb login is fine — free
+ * open-data / FBref HTML still work.
+ */
+export declare function resolveCredentials(options?: ResolveCredentialsOptions): Promise<ResolvedCredentials>;
+export declare function requireStatsBombPaidLogin(creds: StatsBombCredentials): {
+    username: string;
+    password: string;
+};
+/** Mask a secret for CLI / logs. */
+export declare function maskSecret(secret: string, visibleTail?: number): string;
+export declare function describeCredentials(creds: ResolvedCredentials): {
+    statsbomb: {
+        mode: "paid" | "open-data";
+        username: string | null;
+        usernameSource: CredentialSource;
+        passwordConfigured: boolean;
+        passwordSource: CredentialSource;
+        apiBaseUrl: string;
+        apiBaseUrlSource: CredentialSource;
+    };
+    fbref: ResolvedCredentials["fbref"];
+};
+/** @deprecated Use requireStatsBombPaidLogin / free open-data instead. */
+export declare function requireApiKey(_creds: {
+    apiKey?: string;
+}, _purpose?: string): string;

package/dist/credentials.js

@@ -0,0 +1,145 @@
+/**
+ * Optional credentials so Campus can use free open feeds by default, or a
+ * customer's own StatsBomb login for the paid API.
+ *
+ * Resolution order (highest wins):
+ * 1. Explicit overrides (CLI flags / library options)
+ * 2. Environment variables
+ * 3. Local config file `.campus/config.json` (gitignored under `.campus/`)
+ *
+ * StatsBomb paid API uses HTTP Basic Auth (same as statsbombpy):
+ *   SB_USERNAME / SB_PASSWORD
+ *
+ * FBref / Sports Reference does **not** sell a public API key — free mode is
+ * polite HTML only. See docs/byok.md.
+ *
+ * Never log raw secrets; use `maskSecret` / `describeCredentials`.
+ */
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { DEFAULT_CACHE_DIR } from "./cache.js";
+/** StatsBomb customer login (paid API). Matches statsbombpy env names. */
+export const SB_USERNAME_ENV = "SB_USERNAME";
+export const SB_PASSWORD_ENV = "SB_PASSWORD";
+export const CAMPUS_STATSBOMB_USERNAME_ENV = "CAMPUS_STATSBOMB_USERNAME";
+export const CAMPUS_STATSBOMB_PASSWORD_ENV = "CAMPUS_STATSBOMB_PASSWORD";
+/** Optional override for the paid StatsBomb API host. */
+export const CAMPUS_STATSBOMB_API_BASE_URL_ENV = "CAMPUS_STATSBOMB_API_BASE_URL";
+export const DEFAULT_STATSBOMB_API_BASE = "https://data.statsbombservices.com";
+function firstEnv(env, names) {
+    for (const name of names) {
+        const value = env[name]?.trim();
+        if (value)
+            return value;
+    }
+    return undefined;
+}
+function pickField(override, envValue, configValue) {
+    if (override?.trim())
+        return { value: override.trim(), source: "override" };
+    if (envValue)
+        return { value: envValue, source: "env" };
+    if (configValue?.trim()) {
+        return { value: configValue.trim(), source: "config" };
+    }
+    return { value: undefined, source: "none" };
+}
+export function defaultConfigPath(cwd = process.cwd()) {
+    return path.join(cwd, DEFAULT_CACHE_DIR, "config.json");
+}
+export async function loadConfigFile(filePath = defaultConfigPath()) {
+    try {
+        const raw = await readFile(filePath, "utf8");
+        const parsed = JSON.parse(raw);
+        if (parsed == null || typeof parsed !== "object")
+            return null;
+        return parsed;
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT")
+            return null;
+        throw err;
+    }
+}
+/**
+ * Resolve optional paid credentials. Missing StatsBomb login is fine — free
+ * open-data / FBref HTML still work.
+ */
+export async function resolveCredentials(options = {}) {
+    const env = options.env ?? process.env;
+    const config = options.configFile !== undefined
+        ? options.configFile
+        : await loadConfigFile(options.configPath ?? defaultConfigPath());
+    const sb = config?.statsbomb;
+    const username = pickField(options.statsbomb?.username, firstEnv(env, [SB_USERNAME_ENV, CAMPUS_STATSBOMB_USERNAME_ENV]), sb?.username);
+    const password = pickField(options.statsbomb?.password, firstEnv(env, [SB_PASSWORD_ENV, CAMPUS_STATSBOMB_PASSWORD_ENV]), sb?.password);
+    const apiBaseUrl = pickField(options.statsbomb?.apiBaseUrl, firstEnv(env, [CAMPUS_STATSBOMB_API_BASE_URL_ENV]), sb?.apiBaseUrl ?? config?.apiBaseUrl);
+    const statsbomb = {
+        username: username.value,
+        password: password.value,
+        apiBaseUrl: apiBaseUrl.value ?? DEFAULT_STATSBOMB_API_BASE,
+        usernameSource: username.source,
+        passwordSource: password.source,
+        apiBaseUrlSource: apiBaseUrl.source === "none" && apiBaseUrl.value === undefined
+            ? "none"
+            : apiBaseUrl.value
+                ? apiBaseUrl.source === "none"
+                    ? "none"
+                    : apiBaseUrl.source
+                : "none",
+    };
+    // Default host counts as configured only when user overrode it.
+    if (!apiBaseUrl.value) {
+        statsbomb.apiBaseUrl = DEFAULT_STATSBOMB_API_BASE;
+        statsbomb.apiBaseUrlSource = "none";
+    }
+    return {
+        statsbomb,
+        statsbombPaidReady: Boolean(username.value && password.value),
+        fbref: {
+            paidApiAvailable: false,
+            note: "FBref/Sports Reference does not sell a public API key. Campus uses free HTML (rate-limited). For bulk licensing contact Sports Reference directly.",
+        },
+    };
+}
+export function requireStatsBombPaidLogin(creds) {
+    const username = creds.username?.trim();
+    const password = creds.password?.trim();
+    if (username && password)
+        return { username, password };
+    throw new Error("StatsBomb paid API needs SB_USERNAME and SB_PASSWORD " +
+        "(or CAMPUS_STATSBOMB_USERNAME / CAMPUS_STATSBOMB_PASSWORD, " +
+        "or .campus/config.json statsbomb.username/password). " +
+        "Without them Campus uses free Open Data.");
+}
+/** Mask a secret for CLI / logs. */
+export function maskSecret(secret, visibleTail = 4) {
+    const trimmed = secret.trim();
+    if (trimmed.length <= visibleTail)
+        return "•".repeat(trimmed.length);
+    const head = trimmed.slice(0, Math.min(8, trimmed.length - visibleTail));
+    const tail = trimmed.slice(-visibleTail);
+    return `${head}${"•".repeat(Math.max(4, trimmed.length - head.length - visibleTail))}${tail}`;
+}
+export function describeCredentials(creds) {
+    return {
+        statsbomb: {
+            mode: creds.statsbombPaidReady ? "paid" : "open-data",
+            username: creds.statsbomb.username
+                ? maskSecret(creds.statsbomb.username)
+                : null,
+            usernameSource: creds.statsbomb.usernameSource,
+            passwordConfigured: Boolean(creds.statsbomb.password),
+            passwordSource: creds.statsbomb.passwordSource,
+            apiBaseUrl: creds.statsbomb.apiBaseUrl ?? DEFAULT_STATSBOMB_API_BASE,
+            apiBaseUrlSource: creds.statsbomb.apiBaseUrlSource,
+        },
+        fbref: creds.fbref,
+    };
+}
+/** @deprecated Use requireStatsBombPaidLogin / free open-data instead. */
+export function requireApiKey(_creds, _purpose = "paid sources") {
+    throw new Error("Generic API keys were replaced by StatsBomb login (SB_USERNAME / SB_PASSWORD). " +
+        "See docs/byok.md.");
+}

package/dist/data-bundle.d.ts

@@ -1,11 +1,12 @@
 /**
- * Published women's fantasy data bundle (refreshed by GitLab CI cron).
- * Generic Package Registry paths under project 86296665.
+ * Published women's fantasy data bundle (refreshed by GitHub Actions cron).
+ * Served as assets on the rolling Release tag `data-latest`.
  */
-export declare const GITLAB_PROJECT_ID = "86296665";
-export declare const DATA_BUNDLE_PACKAGE = "campus-data";
-export declare const DATA_BUNDLE_VERSION = "latest";
+export declare const DATA_BUNDLE_OWNER = "Minacava";
+export declare const DATA_BUNDLE_REPO = "campus-stats";
+export declare const DATA_BUNDLE_RELEASE_TAG = "data-latest";
 export declare const DATA_BUNDLE_FILE = "cache.json";
+export declare const DATA_BUNDLE_META_FILE = "meta.json";
 /** Absolute URL of the periodically refreshed cache snapshot. */
-export declare function dataBundleUrl(projectId?: string, version?: string): string;
-export declare function dataBundleMetaUrl(projectId?: string, version?: string): string;
+export declare function dataBundleUrl(tag?: string): string;
+export declare function dataBundleMetaUrl(tag?: string): string;