pairit 0.1.8 → 0.2.0

package/README.md

@@ -12,6 +12,7 @@ A lightweight command line utility for working with Pairit experiment configurat
 - `media list` — list media objects in Cloud Storage
 - `media delete` — delete a media object from Cloud Storage
 - `data export` — export sessions, events, and chat messages for a config as CSV/JSON/JSONL
+- `admin add-user` / `admin remove-user` / `admin list-users` — manage the manager allowlist (admin role required)
 
 ## Install
    
@@ -62,7 +63,7 @@ Add `--private` if you need to keep an object private. Use `--bucket <name>` onl
 ### Example
 
 ```bash
-# Point to local manager server (default is http://localhost:3002)
+# Point at local manager (published CLI defaults to production)
 export PAIRIT_API_URL=http://localhost:3002
 
 bun run apps/manager/cli/src/index.ts config upload configs/simple-survey-basic.yaml --config-id simple-survey-basic
@@ -77,6 +78,24 @@ bun run apps/manager/cli/src/index.ts media delete onboarding/logo.png --force
 
 `config compile` writes `configs/simple-survey-basic.json` next to the source YAML. `config upload` defaults the config id to a 16-character base64url string derived from the SHA-256 hash of the compiled JSON (unless `--config-id` overrides it).
 
+## Manager allowlist (admin)
+
+Manager sign-ins are gated on a Mongo allowlist. Anyone who isn't on it lands on `/access-denied` after Google sign-in. Use these commands to manage who can sign in. The calling CLI user must be an admin.
+
+```bash
+pairit admin list-users                            # Show everyone on the allowlist
+pairit admin add-user alice@example.com            # Add as researcher
+pairit admin add-user bob@example.com --admin      # Add as admin (can manage the allowlist)
+pairit admin remove-user alice@example.com         # Remove and revoke their sessions
+pairit admin remove-user alice@example.com --force # Skip confirmation prompt
+```
+
+Notes:
+- Bootstrap: `MANAGER_BOOTSTRAP_ADMIN_EMAIL` is seeded as admin on every manager boot. Set it before the first deploy or you'll have no admins.
+- Day-1 migration: on first boot, existing config owners are backfilled as researchers (not the entire user collection, which is shared with lab participants).
+- Self-removal is blocked.
+- The rejection page contact is set by `MANAGER_ADMIN_CONTACT_EMAIL` (defaults to `harang@pairium.ai`).
+
 ## Per-experiment LLM credentials
 
 If your config uses AI agents, attach provider credentials when uploading:
@@ -99,9 +118,16 @@ Notes:
 - `{configId}-events.{format}` — session ID, event type, component info, payload, timestamps
 - `{configId}-chat-messages.{format}` — group ID, session ID, sender, content, timestamps
 
-All hosted commands require the manager service to be reachable (Cloud Run deployment or local server). By default the CLI talks to the deployed manager. Override via shell environment variables when needed:
+All hosted commands require the manager service to be reachable. By default the CLI talks to production (`https://pairit-api.pairium.ai`). Add `--env staging` to use staging; each environment keeps its own saved login.
+
+```bash
+pairit --env staging login
+```
+
+Override via shell environment variables when needed:
 
-- `PAIRIT_API_URL` — manager base URL (e.g. `http://localhost:3002` for local dev)
+- `PAIRIT_ENV` — `production` (default) or `staging`, same as `--env`
+- `PAIRIT_API_URL` — manager base URL. Use `http://localhost:3002` for local dev.
 - `PAIRIT_LAB_URL` — lab base URL used to print the survey link after `config upload`
 - `PAIRIT_CREDENTIALS_BACKEND` — `keychain` (default when available) or `file`
 - `PAIRIT_MAX_INLINE_MEDIA_BYTES` — switch to signed-URL upload above this size (default 5 MiB)

package/dist/index.js

@@ -8866,11 +8866,11 @@ var init_is_inside_container = __esm(() => {
 });
 
 // ../../../node_modules/.bun/is-wsl@3.1.0/node_modules/is-wsl/index.js
-import process2 from "node:process";
+import process3 from "node:process";
 import os from "node:os";
 import fs3 from "node:fs";
 var isWsl = () => {
-  if (process2.platform !== "linux") {
+  if (process3.platform !== "linux") {
     return false;
   }
   if (os.release().toLowerCase().includes("microsoft")) {
@@ -8887,15 +8887,15 @@ var isWsl = () => {
 }, is_wsl_default;
 var init_is_wsl = __esm(() => {
   init_is_inside_container();
-  is_wsl_default = process2.env.__IS_WSL_TEST__ ? isWsl : isWsl();
+  is_wsl_default = process3.env.__IS_WSL_TEST__ ? isWsl : isWsl();
 });
 
 // ../../../node_modules/.bun/powershell-utils@0.1.0/node_modules/powershell-utils/index.js
-import process3 from "node:process";
+import process4 from "node:process";
 import { Buffer as Buffer2 } from "node:buffer";
 import { promisify } from "node:util";
 import childProcess from "node:child_process";
-var execFile, powerShellPath = () => `${process3.env.SYSTEMROOT || process3.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, executePowerShell = async (command, options = {}) => {
+var execFile, powerShellPath = () => `${process4.env.SYSTEMROOT || process4.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, executePowerShell = async (command, options = {}) => {
   const {
     powerShellPath: psPath,
     ...execFileOptions
@@ -9010,10 +9010,10 @@ function defineLazyProperty(object, propertyName, valueGetter) {
 
 // ../../../node_modules/.bun/default-browser-id@5.0.1/node_modules/default-browser-id/index.js
 import { promisify as promisify3 } from "node:util";
-import process4 from "node:process";
+import process5 from "node:process";
 import { execFile as execFile3 } from "node:child_process";
 async function defaultBrowserId() {
-  if (process4.platform !== "darwin") {
+  if (process5.platform !== "darwin") {
     throw new Error("macOS only");
   }
   const { stdout } = await execFileAsync("defaults", ["read", "com.apple.LaunchServices/com.apple.launchservices.secure", "LSHandlers"]);
@@ -9030,11 +9030,11 @@ var init_default_browser_id = __esm(() => {
 });
 
 // ../../../node_modules/.bun/run-applescript@7.1.0/node_modules/run-applescript/index.js
-import process5 from "node:process";
+import process6 from "node:process";
 import { promisify as promisify4 } from "node:util";
 import { execFile as execFile4, execFileSync } from "node:child_process";
 async function runAppleScript(script, { humanReadableOutput = true, signal } = {}) {
-  if (process5.platform !== "darwin") {
+  if (process6.platform !== "darwin") {
     throw new Error("macOS only");
   }
   const outputArguments = humanReadableOutput ? [] : ["-ss"];
@@ -9108,21 +9108,21 @@ var init_windows = __esm(() => {
 
 // ../../../node_modules/.bun/default-browser@5.4.0/node_modules/default-browser/index.js
 import { promisify as promisify6 } from "node:util";
-import process6 from "node:process";
+import process7 from "node:process";
 import { execFile as execFile6 } from "node:child_process";
 async function defaultBrowser2() {
-  if (process6.platform === "darwin") {
+  if (process7.platform === "darwin") {
     const id = await defaultBrowserId();
     const name = await bundleName(id);
     return { name, id };
   }
-  if (process6.platform === "linux") {
+  if (process7.platform === "linux") {
     const { stdout } = await execFileAsync4("xdg-mime", ["query", "default", "x-scheme-handler/http"]);
     const id = stdout.trim();
     const name = titleize(id.replace(/.desktop$/, "").replace("-", " "));
     return { name, id };
   }
-  if (process6.platform === "win32") {
+  if (process7.platform === "win32") {
     return defaultBrowser();
   }
   throw new Error("Only macOS, Linux, and Windows are supported");
@@ -9137,10 +9137,10 @@ var init_default_browser = __esm(() => {
 });
 
 // ../../../node_modules/.bun/is-in-ssh@1.0.0/node_modules/is-in-ssh/index.js
-import process7 from "node:process";
+import process8 from "node:process";
 var isInSsh, is_in_ssh_default;
 var init_is_in_ssh = __esm(() => {
-  isInSsh = Boolean(process7.env.SSH_CONNECTION || process7.env.SSH_CLIENT || process7.env.SSH_TTY);
+  isInSsh = Boolean(process8.env.SSH_CONNECTION || process8.env.SSH_CLIENT || process8.env.SSH_TTY);
   is_in_ssh_default = isInSsh;
 });
 
@@ -9151,7 +9151,7 @@ __export(exports_open, {
   default: () => open_default,
   apps: () => apps
 });
-import process8 from "node:process";
+import process9 from "node:process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import childProcess3 from "node:child_process";
@@ -9322,7 +9322,7 @@ var fallbackAttemptSymbol, __dirname2, localXdgOpenPath, platform, arch, tryEach
         await fs5.access(localXdgOpenPath, fsConstants2.X_OK);
         exeLocalXdgOpen = true;
       } catch {}
-      const useSystemXdgOpen = process8.versions.electron ?? (platform === "android" || isBundled || !exeLocalXdgOpen);
+      const useSystemXdgOpen = process9.versions.electron ?? (platform === "android" || isBundled || !exeLocalXdgOpen);
       command = useSystemXdgOpen ? "xdg-open" : localXdgOpenPath;
     }
     if (appArguments.length > 0) {
@@ -9409,7 +9409,7 @@ var init_open = __esm(() => {
   fallbackAttemptSymbol = Symbol("fallbackAttempt");
   __dirname2 = import.meta.url ? path.dirname(fileURLToPath(import.meta.url)) : "";
   localXdgOpenPath = path.join(__dirname2, "xdg-open");
-  ({ platform, arch } = process8);
+  ({ platform, arch } = process9);
   apps = {
     browser: "browser",
     browserPrivate: "browserPrivate"
@@ -9456,9 +9456,9 @@ var init_open = __esm(() => {
 
 // src/index.ts
 import { createHash } from "node:crypto";
-import { mkdir as mkdir2, readFile as readFile2, stat, writeFile as writeFile2 } from "node:fs/promises";
-import path2 from "node:path";
-import process9 from "node:process";
+import { mkdir as mkdir2, readFile as readFile3, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
+import path3 from "node:path";
+import process11 from "node:process";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // ../../../node_modules/.bun/commander@12.1.0/node_modules/commander/esm.mjs
@@ -9484,15 +9484,58 @@ var import_yaml = __toESM(require_dist(), 1);
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
+
+// src/env.ts
+import process2 from "node:process";
+var ENVIRONMENTS = {
+  production: {
+    api: "https://pairit-api.pairium.ai",
+    lab: "https://pairit.pairium.ai"
+  },
+  staging: {
+    api: "https://pairit-api-staging.pairium.ai",
+    lab: "https://pairit-staging.pairium.ai"
+  }
+};
+var selected;
+function parseEnvName(value) {
+  if (value === "production" || value === "staging")
+    return value;
+  throw new Error(`Unknown environment "${value}". Use staging or production.`);
+}
+function setEnv(name) {
+  selected = name;
+}
+function getEnvName() {
+  if (selected)
+    return selected;
+  const fromEnv = process2.env.PAIRIT_ENV;
+  return fromEnv ? parseEnvName(fromEnv) : "production";
+}
+function getApiUrl() {
+  return process2.env.PAIRIT_API_URL || ENVIRONMENTS[getEnvName()].api;
+}
+function getLabUrl() {
+  return process2.env.PAIRIT_LAB_URL || ENVIRONMENTS[getEnvName()].lab;
+}
+function getCredentialKey() {
+  const api = getApiUrl();
+  if (api === ENVIRONMENTS.production.api)
+    return "default";
+  return new URL(api).host;
+}
+
+// src/auth.ts
 var CONFIG_DIR = join(homedir(), ".pairit");
-var CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json");
+function getCredentialsFile() {
+  const key = getCredentialKey();
+  return join(CONFIG_DIR, key === "default" ? "credentials.json" : `credentials-${key.replace(/[^a-zA-Z0-9.-]/g, "_")}.json`);
+}
 var CREDENTIALS_BACKEND = process.env.PAIRIT_CREDENTIALS_BACKEND || "keychain";
 var KEYCHAIN_SERVICE = "pairit-cli";
-var KEYCHAIN_ACCOUNT = "default";
 var KEYTAR_MODULE_SPECIFIER = "keytar";
-var BASE_URL = process.env.PAIRIT_API_URL || "https://manager-432501290611.us-central1.run.app";
 async function exchangeCodeForToken(code) {
-  const response = await fetch(`${BASE_URL}/api/cli/exchange`, {
+  const response = await fetch(`${getApiUrl()}/api/cli/exchange`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ code })
@@ -9508,8 +9551,8 @@ async function exchangeCodeForToken(code) {
   return data.token;
 }
 async function login() {
-  console.log("Initiating login...");
-  const loginUrl = `${BASE_URL}/login`;
+  console.log(`Initiating login to ${getApiUrl()}...`);
+  const loginUrl = `${getApiUrl()}/login`;
   const manualLoginUrl = `${loginUrl}?manual=1`;
   if (canAttemptBrowserLogin()) {
     try {
@@ -9599,12 +9642,12 @@ async function saveCredentials(creds) {
   if (CREDENTIALS_BACKEND !== "file") {
     const keytar = await loadKeytar();
     if (keytar) {
-      await keytar.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, JSON.stringify(creds));
+      await keytar.setPassword(KEYCHAIN_SERVICE, getCredentialKey(), JSON.stringify(creds));
       return;
     }
   }
   await mkdir(CONFIG_DIR, { recursive: true });
-  await writeFile(CREDENTIALS_FILE, JSON.stringify(creds, null, 2), {
+  await writeFile(getCredentialsFile(), JSON.stringify(creds, null, 2), {
     mode: 384
   });
 }
@@ -9612,7 +9655,7 @@ async function getCredentials() {
   if (CREDENTIALS_BACKEND !== "file") {
     const keytar = await loadKeytar();
     if (keytar) {
-      const stored = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+      const stored = await keytar.getPassword(KEYCHAIN_SERVICE, getCredentialKey());
       if (stored) {
         try {
           return JSON.parse(stored);
@@ -9623,7 +9666,7 @@ async function getCredentials() {
     }
   }
   try {
-    const data = await readFile(CREDENTIALS_FILE, "utf8");
+    const data = await readFile(getCredentialsFile(), "utf8");
     return JSON.parse(data);
   } catch {
     return null;
@@ -9664,9 +9707,115 @@ async function loadKeytar() {
   }
 }
 
+// src/html-assets.ts
+import { readFile as readFile2, stat } from "node:fs/promises";
+import path2 from "node:path";
+import process10 from "node:process";
+var HTML_MAX_BYTES = 1024 * 1024;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function formatBytes(bytes) {
+  if (bytes < 1024)
+    return `${bytes} B`;
+  if (bytes < 1024 * 1024)
+    return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+function listHtmlComponents(config) {
+  const pages = config.pages;
+  const pageList = Array.isArray(pages) ? pages.filter(isRecord) : isRecord(pages) ? Object.values(pages).filter(isRecord) : [];
+  const result = [];
+  for (const page of pageList) {
+    const components = page.components;
+    if (!Array.isArray(components))
+      continue;
+    for (const comp of components) {
+      if (!isRecord(comp) || comp.type !== "html")
+        continue;
+      const props = isRecord(comp.props) ? comp.props : {};
+      const id = typeof comp.id === "string" ? comp.id : "html";
+      result.push({ id, props });
+    }
+  }
+  return result;
+}
+async function resolveHtmlSource(src, componentId, configDir) {
+  if (typeof src !== "string" || src.trim() === "") {
+    throw new Error(`html ${componentId}: missing src`);
+  }
+  const trimmed = src.trim();
+  if (/^https?:\/\//i.test(trimmed)) {
+    throw new Error(`html ${componentId}: remote URLs are not allowed`);
+  }
+  if (path2.extname(trimmed).toLowerCase() !== ".html") {
+    throw new Error(`html ${componentId}: src must be a .html file`);
+  }
+  const absolutePath = path2.resolve(configDir, trimmed);
+  const rel = path2.relative(configDir, absolutePath);
+  if (rel.startsWith("..") || path2.isAbsolute(rel)) {
+    throw new Error(`html ${componentId}: src must stay inside the config directory`);
+  }
+  let info;
+  try {
+    info = await stat(absolutePath);
+  } catch {
+    throw new Error(`html ${componentId}: file not found: ${trimmed}`);
+  }
+  if (!info.isFile()) {
+    throw new Error(`html ${componentId}: file not found: ${trimmed}`);
+  }
+  if (info.size > HTML_MAX_BYTES) {
+    throw new Error(`html ${componentId}: file too large (${formatBytes(info.size)}); max is 1 MB`);
+  }
+  return { src: trimmed, absolutePath, bytes: info.size };
+}
+async function resolveConfigDir(configPath) {
+  const absolute = path2.isAbsolute(configPath) ? configPath : path2.resolve(process10.cwd(), configPath);
+  return path2.dirname(absolute);
+}
+async function inspectHtmlSources(configPath, config) {
+  const configDir = await resolveConfigDir(configPath);
+  const errors = [];
+  const results = [];
+  for (const comp of listHtmlComponents(config)) {
+    try {
+      const resolved = await resolveHtmlSource(comp.props.src, comp.id, configDir);
+      results.push({ componentId: comp.id, ...resolved });
+    } catch (error) {
+      errors.push(error instanceof Error ? error.message : String(error));
+    }
+  }
+  if (errors.length) {
+    throw new Error(errors.join(`
+`));
+  }
+  return results;
+}
+async function attachHtmlToCompiledConfig(configPath, compiled) {
+  const configDir = await resolveConfigDir(configPath);
+  const sources = [];
+  for (const comp of listHtmlComponents(compiled)) {
+    const resolved = await resolveHtmlSource(comp.props.src, comp.id, configDir);
+    comp.props.html = await readFile2(resolved.absolutePath, "utf8");
+    sources.push({ componentId: comp.id, ...resolved });
+  }
+  return sources;
+}
+
 // src/index.ts
 var program2 = new Command;
-program2.name("pairit").description("CLI for Pairit experiment configs").version("0.1.8");
+program2.name("pairit").description("CLI for Pairit experiment configs").version("0.2.0").option("--env <name>", "Target environment: staging or production", (value) => {
+  try {
+    return parseEnvName(value);
+  } catch (error) {
+    throw new InvalidArgumentError(error.message);
+  }
+}).hook("preAction", (command) => {
+  const name = command.optsWithGlobals().env;
+  if (name)
+    setEnv(name);
+});
 program2.command("login").description("Login to Pairit Manager").action(async () => {
   try {
     await login();
@@ -9677,15 +9826,18 @@ program2.command("login").description("Login to Pairit Manager").action(async ()
 var configCommand = program2.command("config").description("Manage experiment configs");
 configCommand.command("lint").argument("<config>", "Path to YAML config").description("Run minimal validation on a config file").action(async (configPath) => {
   try {
-    await lintConfig(configPath);
+    const htmlFiles = await lintConfig(configPath);
     console.log(`✓ ${configPath} passed lint checks`);
+    for (const file of htmlFiles) {
+      console.log(`  html ${file.componentId} ← ${file.src} (${formatBytes(file.bytes)})`);
+    }
   } catch (error) {
     if (error instanceof Error) {
       console.error(`Lint failed: ${error.message}`);
     } else {
       console.error("Lint failed with unknown error");
     }
-    process9.exitCode = 1;
+    process11.exitCode = 1;
   }
 });
 configCommand.command("compile").argument("<config>", "Path to YAML config").description("Compile YAML config to canonical JSON next to source").action(async (configPath) => {
@@ -9698,17 +9850,20 @@ configCommand.command("compile").argument("<config>", "Path to YAML config").des
     } else {
       console.error("Compile failed with unknown error");
     }
-    process9.exitCode = 1;
+    process11.exitCode = 1;
   }
 });
 configCommand.command("upload").argument("<config>", "Path to YAML config").option("--config-id <configId>", "Config id (defaults to hash)").option("--metadata <json>", "Optional metadata JSON string").option("--openai-api-key <key>", "OpenAI API key for this experiment").option("--anthropic-api-key <key>", "Anthropic API key for this experiment").description("Compile and upload config via Pairit Functions").action(async (configPath, options) => {
   try {
-    const { payload, checksum } = await buildUploadPayload(configPath, options);
+    const { payload, checksum, attachments } = await buildUploadPayload(configPath, options);
     const response = await callFunctions("/configs/upload", {
       method: "POST",
       body: JSON.stringify(payload),
       headers: { "Content-Type": "application/json" }
     });
+    for (const file of attachments) {
+      console.log(`✓ Attached ${path3.basename(file.src)} (${formatBytes(file.bytes)})`);
+    }
     console.log(`✓ Uploaded ${payload.configId} (${checksum})`);
     const labUrl = getLabUrl();
     console.log(`Survey Link: ${labUrl}/${payload.configId}`);
@@ -9817,9 +9972,60 @@ dataCommand.command("export").argument("<configId>", "Config ID to export data f
     reportCliError("Export failed", error);
   }
 });
-program2.parseAsync(process9.argv).catch((err) => {
+var adminCommand = program2.command("admin").description("Manage manager allowlist (admin only)");
+adminCommand.command("add-user").argument("<email>", "Email to allow").option("--admin", "Grant admin privileges").description("Add a user to the manager allowlist").action(async (email, options) => {
+  try {
+    const response = await callFunctions("/admin/users", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email, isAdmin: Boolean(options.admin) })
+    });
+    const entry = response?.user;
+    if (!entry)
+      throw new Error("No user returned");
+    console.log(`✓ Added ${entry.email} (${entry.isAdmin ? "admin" : "researcher"})`);
+  } catch (error) {
+    reportCliError("Add user failed", error);
+  }
+});
+adminCommand.command("remove-user").argument("<email>", "Email to remove").option("--force", "Skip confirmation").description("Remove a user from the manager allowlist and revoke sessions").action(async (email, options) => {
+  try {
+    if (!options.force) {
+      const confirmed = await promptConfirm(`Remove ${email} from allowlist? (y/N)`);
+      if (!confirmed) {
+        console.log("Removal aborted");
+        return;
+      }
+    }
+    await callFunctions(`/admin/users/${encodeURIComponent(email)}`, {
+      method: "DELETE"
+    });
+    console.log(`✓ Removed ${email}`);
+  } catch (error) {
+    reportCliError("Remove user failed", error);
+  }
+});
+adminCommand.command("list-users").description("List users on the manager allowlist").action(async () => {
+  try {
+    const response = await callFunctions("/admin/users", {
+      method: "GET"
+    });
+    const users = response?.users ?? [];
+    if (!users.length) {
+      console.log("No users on the allowlist");
+      return;
+    }
+    users.forEach((u) => {
+      const role = u.isAdmin ? "admin" : "researcher";
+      console.log(`${u.email} | ${role} | addedBy=${u.addedBy} | addedAt=${u.addedAt}`);
+    });
+  } catch (error) {
+    reportCliError("List users failed", error);
+  }
+});
+program2.parseAsync(process11.argv).catch((err) => {
   console.error(err);
-  process9.exit(1);
+  process11.exit(1);
 });
 async function lintConfig(configPath) {
   const config = await loadConfig(configPath);
@@ -9843,6 +10049,7 @@ async function lintConfig(configPath) {
   if (errors.length) {
     throw new Error(errors.join(", "));
   }
+  return inspectHtmlSources(configPath, config);
 }
 async function compileConfig(configPath) {
   const config = await loadConfig(configPath);
@@ -9894,7 +10101,7 @@ async function compileConfig(configPath) {
     output.matchmaking = config.matchmaking;
   }
   const resolvedPath = await resolvePath(configPath);
-  const outPath = path2.join(path2.dirname(resolvedPath), `${path2.basename(resolvedPath, path2.extname(resolvedPath))}.json`);
+  const outPath = path3.join(path3.dirname(resolvedPath), `${path3.basename(resolvedPath, path3.extname(resolvedPath))}.json`);
   await writeFile2(outPath, JSON.stringify(output, null, 2), "utf8");
   return outPath;
 }
@@ -9903,14 +10110,15 @@ async function buildUploadPayload(configPath, options) {
   const allowRetake = sourceConfig.allowRetake === true;
   const requireAuth = sourceConfig.requireAuth;
   const compiledPath = await compileConfig(configPath);
-  const compiledContent = await readFile2(compiledPath, "utf8");
-  const hashBuffer = createHash("sha256").update(compiledContent).digest();
-  const checksum = hashBuffer.toString("hex");
+  const compiledContent = await readFile3(compiledPath, "utf8");
   const parsed = JSON.parse(compiledContent);
+  const attachments = await attachHtmlToCompiledConfig(configPath, parsed);
+  const hashBuffer = createHash("sha256").update(JSON.stringify(parsed)).digest();
+  const checksum = hashBuffer.toString("hex");
   const configId = options.configId ?? toBase64Url(hashBuffer.subarray(0, 12));
   const metadata = options.metadata ? JSON.parse(options.metadata) : {};
   if (!metadata.originalFilename) {
-    metadata.originalFilename = path2.basename(configPath);
+    metadata.originalFilename = path3.basename(configPath);
   }
   const llmCredentials = {
     ...options.openaiApiKey && { openaiApiKey: options.openaiApiKey },
@@ -9928,15 +10136,16 @@ async function buildUploadPayload(configPath, options) {
       allowRetake,
       ...requireAuth !== undefined && { requireAuth }
     },
-    checksum
+    checksum,
+    attachments
   };
 }
 async function uploadMedia(filePath, options) {
   const resolved = await resolvePath(filePath);
-  const fileBuffer = await readFile2(resolved);
+  const fileBuffer = await readFile3(resolved);
   const hashBuffer = createHash("sha256").update(fileBuffer).digest();
   const checksum = hashBuffer.toString("hex");
-  const defaultObject = `${toBase64Url(hashBuffer.subarray(0, 12))}${path2.extname(resolved)}`;
+  const defaultObject = `${toBase64Url(hashBuffer.subarray(0, 12))}${path3.extname(resolved)}`;
   const object = options.object ?? defaultObject;
   const shouldBePublic = typeof options.public === "boolean" ? options.public : true;
   const maxInlineBytes = getInlineMediaLimit();
@@ -10005,7 +10214,7 @@ function toBase64Url(buffer) {
 }
 async function loadConfig(configPath) {
   const resolvedPath = await resolvePath(configPath);
-  const content = await readFile2(resolvedPath, "utf8");
+  const content = await readFile3(resolvedPath, "utf8");
   const parsed = import_yaml.default.parse(content);
   if (!parsed || typeof parsed !== "object") {
     throw new Error("config must be an object");
@@ -10013,9 +10222,9 @@ async function loadConfig(configPath) {
   return parsed;
 }
 async function resolvePath(configPath) {
-  const cwd = process9.cwd();
-  const absolute = path2.isAbsolute(configPath) ? configPath : path2.resolve(cwd, configPath);
-  await stat(absolute);
+  const cwd = process11.cwd();
+  const absolute = path3.isAbsolute(configPath) ? configPath : path3.resolve(cwd, configPath);
+  await stat2(absolute);
   return absolute;
 }
 async function fetchAllPages(pathname, extract) {
@@ -10032,7 +10241,7 @@ async function fetchAllPages(pathname, extract) {
   return all;
 }
 async function callFunctions(pathname, init = {}) {
-  const baseUrl = getFunctionsBaseUrl();
+  const baseUrl = getApiUrl();
   const url = new URL(pathname, baseUrl).toString();
   const authHeaders = await getAuthHeaders();
   const headers = {
@@ -10053,33 +10262,21 @@ async function callFunctions(pathname, init = {}) {
     throw new Error(`Invalid JSON response: ${text}`);
   }
 }
-function getFunctionsBaseUrl() {
-  if (process9.env.PAIRIT_API_URL) {
-    return process9.env.PAIRIT_API_URL;
-  }
-  return "https://manager-432501290611.us-central1.run.app";
-}
-function getLabUrl() {
-  if (process9.env.PAIRIT_LAB_URL) {
-    return process9.env.PAIRIT_LAB_URL;
-  }
-  return "https://lab-432501290611.us-central1.run.app";
-}
 function getInlineMediaLimit() {
-  const fromEnv = Number(process9.env.PAIRIT_MAX_INLINE_MEDIA_BYTES);
+  const fromEnv = Number(process11.env.PAIRIT_MAX_INLINE_MEDIA_BYTES);
   if (Number.isFinite(fromEnv) && fromEnv > 0)
     return fromEnv;
   return 5 * 1024 * 1024;
 }
 async function promptConfirm(prompt2) {
-  process9.stdout.write(`${prompt2} `);
+  process11.stdout.write(`${prompt2} `);
   return new Promise((resolve) => {
-    process9.stdin.setEncoding("utf8");
-    process9.stdin.resume();
-    process9.stdin.once("data", (data) => {
+    process11.stdin.setEncoding("utf8");
+    process11.stdin.resume();
+    process11.stdin.once("data", (data) => {
       const input = data.toString().trim().toLowerCase();
       resolve(input === "y" || input === "yes");
-      process9.stdin.pause();
+      process11.stdin.pause();
     });
   });
 }
@@ -10089,20 +10286,20 @@ function reportCliError(prefix, error) {
   } else {
     console.error(`${prefix}: unknown error`);
   }
-  process9.exitCode = 1;
+  process11.exitCode = 1;
 }
 async function exportData(configId, options) {
   const format = options.format;
-  const outDir = path2.resolve(process9.cwd(), options.out);
+  const outDir = path3.resolve(process11.cwd(), options.out);
   await mkdir2(outDir, { recursive: true });
   console.log(`Exporting data for ${configId} in ${format} format...`);
   const cfg = encodeURIComponent(configId);
-  await fetchAndWriteExport(`/data/${cfg}/sessions`, path2.join(outDir, `${configId}-sessions`), (r) => r.sessions ?? [], format, flattenSession, "sessions");
-  await fetchAndWriteExport(`/data/${cfg}/events`, path2.join(outDir, `${configId}-events`), (r) => r.events ?? [], format, flattenEvent, "events");
-  await fetchAndWriteExport(`/data/${cfg}/chat-messages`, path2.join(outDir, `${configId}-chat-messages`), (r) => r.messages ?? [], format, (msg) => msg, "chat messages");
-  await fetchAndWriteExport(`/data/${cfg}/groups`, path2.join(outDir, `${configId}-groups`), (r) => r.groups ?? [], format, (group) => group, "groups");
-  await fetchAndWriteExport(`/data/${cfg}/survey-responses`, path2.join(outDir, `${configId}-survey-responses`), (r) => r.surveyResponses ?? [], format, flattenSurveyResponse, "survey responses");
-  await fetchAndWriteExport(`/data/${cfg}/workspace-documents`, path2.join(outDir, `${configId}-workspace-documents`), (r) => r.workspaceDocuments ?? [], format, flattenWorkspaceDocument, "workspace documents");
+  await fetchAndWriteExport(`/data/${cfg}/sessions`, path3.join(outDir, `${configId}-sessions`), (r) => r.sessions ?? [], format, flattenSession, "sessions");
+  await fetchAndWriteExport(`/data/${cfg}/events`, path3.join(outDir, `${configId}-events`), (r) => r.events ?? [], format, flattenEvent, "events");
+  await fetchAndWriteExport(`/data/${cfg}/chat-messages`, path3.join(outDir, `${configId}-chat-messages`), (r) => r.messages ?? [], format, (msg) => msg, "chat messages");
+  await fetchAndWriteExport(`/data/${cfg}/groups`, path3.join(outDir, `${configId}-groups`), (r) => r.groups ?? [], format, (group) => group, "groups");
+  await fetchAndWriteExport(`/data/${cfg}/survey-responses`, path3.join(outDir, `${configId}-survey-responses`), (r) => r.surveyResponses ?? [], format, flattenSurveyResponse, "survey responses");
+  await fetchAndWriteExport(`/data/${cfg}/workspace-documents`, path3.join(outDir, `${configId}-workspace-documents`), (r) => r.workspaceDocuments ?? [], format, flattenWorkspaceDocument, "workspace documents");
   console.log(`
 Files written to: ${outDir}`);
 }
@@ -10224,7 +10421,7 @@ function escapeCsvValue(value) {
   return str;
 }
 var __filename2 = fileURLToPath2(import.meta.url);
-var __dirname3 = path2.dirname(__filename2);
+var __dirname3 = path3.dirname(__filename2);
 export {
   __filename2 as __filename,
   __dirname3 as __dirname

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pairit",
-  "version": "0.1.8",
+  "version": "0.2.0",
   "description": "CLI for the Pairit behavioral science experiment platform",
   "type": "module",
   "bin": {
@@ -25,7 +25,7 @@
     "url": "https://github.com/pairium/pairit.git",
     "directory": "apps/manager/cli"
   },
-  "homepage": "https://pairium.github.io/pairit/",
+  "homepage": "https://docs.pairium.ai/pairit/",
   "license": "MIT",
   "optionalDependencies": {
     "keytar": "^7.9.0"