whoburnedmore 0.9.10 → 0.9.12

package/dist/index.js

@@ -96,15 +96,15 @@ async function readJson(res) {
     };
   }
 }
-async function post(path, body, token) {
+async function send(method, path, body, token) {
   const headers = { "Content-Type": "application/json" };
   if (token) headers.Authorization = `Bearer ${token}`;
   let res;
   try {
     res = await fetch(`${apiBase()}${path}`, {
-      method: "POST",
+      method,
       headers,
-      body: JSON.stringify(body),
+      ...body === void 0 ? {} : { body: JSON.stringify(body) },
       // Bound the request so a slow/black-holing/hostile server can't hang the CLI
       // — or the unattended 15-minute background sync — indefinitely.
       signal: AbortSignal.timeout(3e4)
@@ -116,6 +116,9 @@ async function post(path, body, token) {
   }
   return { status: res.status, body: await readJson(res) };
 }
+async function post(path, body, token) {
+  return send("POST", path, body, token);
+}
 async function verifyUsage(token, payload) {
   const { status, body } = await post("/v1/verify", payload, token);
   if (status === 401) throw new UnauthorizedError();
@@ -127,18 +130,6 @@ async function verifyUsage(token, payload) {
   }
   return body;
 }
-var ANON_RETIRED_MESSAGE = "Anonymous mode has been retired. Run `npx whoburnedmore` and sign in, or `npx whoburnedmore link --token=\u2026` for a server/CI, to put your usage on the leaderboard.";
-async function anonSubmit(anonKey, payload) {
-  const { status, body } = await post("/v1/anon/submit", { ...payload, anonKey });
-  if (status === 410) throw new Error(ANON_RETIRED_MESSAGE);
-  if (status !== 200) {
-    const err = body;
-    const details = err.details?.length ? `
-  - ${err.details.join("\n  - ")}` : "";
-    throw new Error(`${err.error ?? `submit failed (HTTP ${status})`}${details}`);
-  }
-  return body;
-}
 var UnauthorizedError = class extends Error {
   constructor(message = "your sign-in has expired") {
     super(message);
@@ -207,31 +198,21 @@ async function submit(token, payload) {
   }
   return body;
 }
-function claimUrl(dashboardUrl, anonKey) {
-  return `${dashboardUrl}#k=${encodeURIComponent(anonKey)}`;
-}
-async function anonVisibility(anonKey, listed) {
-  const { status, body } = await post(
-    "/v1/anon/visibility",
-    { anonKey, listed }
-  );
-  if (status === 410) throw new Error(ANON_RETIRED_MESSAGE);
+async function setVisibility(token, listed) {
+  const { status, body } = await post("/v1/cli/visibility", { listed }, token);
+  if (status === 401) throw new UnauthorizedError();
   if (status !== 200) {
     throw new Error(body.error ?? `failed (HTTP ${status})`);
   }
+  return { listed: body.listed === true, eligible: body.eligible === true };
 }
-async function anonRemove(anonKey) {
-  const res = await fetch(`${apiBase()}/v1/anon`, {
-    method: "DELETE",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ anonKey }),
-    signal: AbortSignal.timeout(3e4)
-  });
-  if (res.status === 410) throw new Error(ANON_RETIRED_MESSAGE);
-  if (res.status !== 200) {
-    const b = await res.json().catch(() => ({}));
-    throw new Error(b.error ?? `failed (HTTP ${res.status})`);
+async function removeUsage(token) {
+  const { status, body } = await send("DELETE", "/v1/cli/usage", void 0, token);
+  if (status === 401) throw new UnauthorizedError();
+  if (status !== 200) {
+    throw new Error(body.error ?? `failed (HTTP ${status})`);
   }
+  return { deletedDays: body.deletedDays ?? 0 };
 }
 async function redeemServerInstall(token, anonKey) {
   const { status, body } = await post("/v1/server-install/redeem", { token, anonKey });
@@ -8004,17 +7985,16 @@ function renderDashboardHtml(entries, generatedAt = /* @__PURE__ */ new Date(),
     (p) => `<div class="tbcell"><div class="tblabel"><span class="dot" style="background:${p.color}"></span>${p.label}</div><div class="tbval">${esc(formatTokens(p.value))}</div><div class="tbpct">${Math.round(p.value / tbSum * 100)}%</div></div>`
   ).join("");
   const connectCta = connect ? `
-    <form class="connect" method="POST" action="${esc(connect.webBaseUrl)}/connect">
-      <input type="hidden" name="payload" value="${Buffer.from(JSON.stringify(connect.payload)).toString("base64")}">
+    <div class="connect">
       <div class="connect-row">
         <div>
-          <div class="connect-title">Connect your account</div>
-          <div class="connect-sub">Save this dashboard to your account and claim your spot on the public leaderboard. The local numbers above become your starting point \u2014 nothing has left your machine yet.</div>
+          <div class="connect-title">Claim your spot on the public leaderboard</div>
+          <div class="connect-sub">Run the command below in your terminal \u2014 it signs you in and puts these numbers on <a href="${esc(connect.webBaseUrl)}">whoburnedmore.com</a> under your handle. Nothing has left your machine yet.</div>
         </div>
-        <button type="submit">Connect your account \u2192</button>
+        <code class="connect-cmd">npx whoburnedmore</code>
       </div>
-      <div class="connect-note">After connecting, run <code>npx whoburnedmore</code> (no flag) once so it keeps syncing automatically in the background.</div>
-    </form>` : "";
+      <div class="connect-note">Only daily totals are submitted \u2014 never your prompts or code. Background sync keeps your page fresh afterwards.</div>
+    </div>` : "";
   return `<!doctype html>
 <html lang="en">
 <head>
@@ -8074,8 +8054,8 @@ function renderDashboardHtml(entries, generatedAt = /* @__PURE__ */ new Date(),
   @media (min-width: 640px) { .connect-row { flex-direction: row; align-items: center; justify-content: space-between; } }
   .connect-title { font-size: 16px; font-weight: 700; }
   .connect-sub { color: #d6d3d1; font-size: 13px; margin-top: 4px; max-width: 60ch; }
-  .connect button { flex-shrink: 0; cursor: pointer; border: 0; border-radius: 10px; background: #ea580c; color: #fff; font-size: 14px; font-weight: 600; padding: 11px 18px; font-family: inherit; transition: background .15s; }
-  .connect button:hover { background: #f97316; }
+  .connect-cmd { flex-shrink: 0; display: inline-block; border-radius: 10px; background: rgba(0,0,0,.35); border: 1px solid rgba(234,88,12,.5); color: #fed7aa; font-size: 14px; font-weight: 600; padding: 11px 18px; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; user-select: all; }
+  .connect-sub a { color: #fed7aa; }
   .connect-note { color: #a8a29e; font-size: 12px; margin-top: 14px; padding-top: 12px; border-top: 1px solid rgba(234,88,12,.25); }
   .connect-note code { color: #fed7aa; background: rgba(0,0,0,.25); padding: 1px 6px; border-radius: 5px; }
 </style>
@@ -8145,20 +8125,24 @@ ${connectCta}
 
 // src/publish.ts
 async function publishLocal(payload, deps) {
-  if (!await deps.confirm("  Publish this to the public leaderboard?")) {
+  if (!await deps.confirm("  Publish this to the public leaderboard? (You'll sign in first.)")) {
     deps.log("  Kept local. Nothing left your machine.");
     return false;
   }
-  const key = deps.ensureAnonKey();
-  const res = await deps.anonSubmit(key, payload);
-  deps.log(`  Published \u2014 you're on the board: ${sanitizeServerText(res.dashboardUrl)}`);
-  if (isTrustedWebUrl(res.dashboardUrl)) {
-    deps.openBrowser(claimUrl(res.dashboardUrl, key));
+  const auth = await deps.signIn();
+  if (!auth) {
+    deps.log("  Sign-in didn't complete \u2014 kept local. Nothing left your machine.");
+    return false;
+  }
+  const res = await deps.submit(auth.token, payload);
+  deps.log(`  Published \u2014 you're on the board: ${sanitizeServerText(res.profileUrl)}`);
+  if (isTrustedWebUrl(res.profileUrl)) {
+    deps.openBrowser(res.profileUrl);
   } else {
     deps.log("  (The server returned an unexpected address, so it was not auto-opened.)");
   }
   deps.log(
-    "  Sign in there to claim it, or `npx whoburnedmore private` to hide it again."
+    "  Manage anytime: `npx whoburnedmore private` hides you, `remove` deletes your data."
   );
   return true;
 }
@@ -8241,10 +8225,7 @@ function showLocalDashboard(payload) {
   const file = join10(dir, "dashboard.html");
   writeFileSync3(
     file,
-    renderDashboardHtml(payload.entries, /* @__PURE__ */ new Date(), {
-      payload,
-      webBaseUrl: webBase()
-    })
+    renderDashboardHtml(payload.entries, /* @__PURE__ */ new Date(), { webBaseUrl: webBase() })
   );
   console.log();
   console.log(`  Local dashboard: ${pc2.cyan(`file://${file}`)}`);
@@ -8300,8 +8281,23 @@ async function run(flags) {
     if (!flags.quiet && process.stdin.isTTY) {
       await publishLocal(payload, {
         confirm,
-        ensureAnonKey,
-        anonSubmit,
+        signIn: ensureSignedIn,
+        submit: async (token, p) => {
+          const result = await submit(token, p);
+          try {
+            recordSync();
+          } catch {
+          }
+          try {
+            const cfgNow = loadConfig();
+            if (!cfgNow?.deviceBoundAt) {
+              const key = ensureAnonKey();
+              if (await bindDeviceKey(token, key)) recordDeviceBound();
+            }
+          } catch {
+          }
+          return result;
+        },
         openBrowser,
         log: (line) => console.log(pc2.dim(line))
       });
@@ -8667,6 +8663,102 @@ async function runVerify() {
     );
   }
 }
+async function requireSignedIn(commandName) {
+  const cfg = loadConfig();
+  if (cfg?.cliToken) return { token: cfg.cliToken, handle: cfg.handle ?? "" };
+  const healed = await refreshCliTokenFromConfig();
+  if (healed) {
+    saveAuth(void 0, { cliToken: healed.token, handle: healed.handle });
+    return healed;
+  }
+  if (process.stdout.isTTY) return ensureSignedIn();
+  console.log(
+    pc2.yellow(
+      `  Sign in first \u2014 run \`npx whoburnedmore ${commandName}\` in an interactive terminal.`
+    )
+  );
+  return null;
+}
+async function runVisibility(listed) {
+  const auth = await requireSignedIn(listed ? "public" : "private");
+  if (!auth) return;
+  let res;
+  try {
+    res = await setVisibility(auth.token, listed);
+  } catch (err) {
+    if (err instanceof UnauthorizedError) {
+      clearAuth();
+      console.log(
+        pc2.yellow(
+          `  Your sign-in expired \u2014 run \`npx whoburnedmore ${listed ? "public" : "private"}\` again to retry.`
+        )
+      );
+      return;
+    }
+    throw err;
+  }
+  if (!listed) {
+    console.log("  \u2713 You're off the public leaderboard. `npx whoburnedmore public` puts you back.");
+    return;
+  }
+  if (res.listed) {
+    console.log("  \u2713 You're back on the public leaderboard.");
+  } else if (!res.eligible) {
+    console.log(
+      pc2.yellow("  You're signed in, but not on the leaderboard yet \u2014 it lists accounts with a social handle.")
+    );
+    console.log(
+      pc2.dim("  Add your X, GitHub or Instagram on your profile at whoburnedmore.com, then you're on.")
+    );
+  } else {
+    console.log("  \u2713 Leaderboard listing is on.");
+  }
+}
+async function runRemove() {
+  if (!process.stdin.isTTY) {
+    console.log(
+      pc2.yellow("  `remove` deletes data, so it needs an interactive terminal to confirm.")
+    );
+    console.log(pc2.dim("  Run `npx whoburnedmore remove` in a real terminal."));
+    process.exitCode = 1;
+    return;
+  }
+  const auth = await requireSignedIn("remove");
+  if (!auth) return;
+  const who = auth.handle ? `@${sanitizeServerText(auth.handle)}` : "your account";
+  console.log(
+    `  This deletes ALL usage data stored for ${who} on whoburnedmore.com and turns off this machine's background sync.`
+  );
+  console.log(
+    pc2.dim("  Your local logs are untouched, and the account itself survives (delete it from your dashboard settings on the web).")
+  );
+  if (!await confirm("  Delete your usage data?")) {
+    console.log(pc2.dim("  Cancelled \u2014 nothing was deleted."));
+    return;
+  }
+  let res;
+  try {
+    res = await removeUsage(auth.token);
+  } catch (err) {
+    if (err instanceof UnauthorizedError) {
+      clearAuth();
+      console.log(
+        pc2.yellow("  Your sign-in expired \u2014 run `npx whoburnedmore remove` again to retry.")
+      );
+      return;
+    }
+    throw err;
+  }
+  try {
+    uninstallAutoSync();
+  } catch {
+  }
+  clearAuth();
+  console.log(
+    pc2.green(`  \u2713 Deleted your usage data (${res.deletedDays} day${res.deletedDays === 1 ? "" : "s"}) and turned off background sync.`)
+  );
+  console.log(pc2.dim("  Run `npx whoburnedmore` anytime to start fresh."));
+}
 async function main() {
   const major = Number(process.versions.node.split(".")[0]);
   if (major < 20) {
@@ -8711,28 +8803,12 @@ async function main() {
       break;
     }
     case "private":
-    case "public": {
-      const cfg = loadConfig();
-      if (!cfg?.anonKey) {
-        console.log("  No anonymous dashboard on this machine \u2014 run `npx whoburnedmore` first.");
-        break;
-      }
-      await anonVisibility(cfg.anonKey, command === "public");
-      console.log(
-        command === "public" ? "  Your dashboard is public on the leaderboard again." : "  Your dashboard is now private \u2014 off the public leaderboard."
-      );
+    case "public":
+      await runVisibility(command === "public");
       break;
-    }
-    case "remove": {
-      const cfg = loadConfig();
-      if (!cfg?.anonKey) {
-        console.log("  No anonymous dashboard on this machine \u2014 nothing to remove.");
-        break;
-      }
-      await anonRemove(cfg.anonKey);
-      console.log("  Removed your anonymous dashboard and all its data.");
+    case "remove":
+      await runRemove();
       break;
-    }
     case "install-sync":
       console.log(`  ${installAutoSync()}`);
       break;
@@ -8764,9 +8840,9 @@ function printHelp() {
     npx whoburnedmore --no-submit  collect locally, send nothing (no dashboard)
     npx whoburnedmore link --token=TOKEN  link this server/VM to your signed-in account
     npx whoburnedmore daemon       keep syncing in the foreground (VMs/containers with no cron)
-    npx whoburnedmore private      hide your dashboard from the leaderboard
-    npx whoburnedmore public       put it back on the leaderboard
-    npx whoburnedmore remove       delete your dashboard and its data
+    npx whoburnedmore private      take yourself off the public leaderboard
+    npx whoburnedmore public       put yourself back on it
+    npx whoburnedmore remove       delete your usage data and stop background sync
     npx whoburnedmore verify       delisted? re-verify your usage to get back on (sends a detailed breakdown)
     npx whoburnedmore status       check background-sync health (last sync, staleness)
     npx whoburnedmore uninstall-sync   turn off the background sync

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whoburnedmore",
-  "version": "0.9.10",
+  "version": "0.9.12",
   "description": "Find out who burned more — submit your AI coding-agent token usage to the public leaderboard at whoburnedmore.com",
   "type": "module",
   "bin": {