whoburnedmore 0.9.7 → 0.9.9

package/dist/index.js

@@ -167,11 +167,40 @@ async function devicePoll(deviceCode) {
   }
   return body;
 }
+async function refreshCliToken(anonKey) {
+  try {
+    const { status, body } = await post("/v1/auth/cli/refresh", { anonKey });
+    if (status === 200 && typeof body.token === "string" && body.token) {
+      return { token: body.token, handle: body.handle ?? "" };
+    }
+  } catch {
+  }
+  return null;
+}
+async function bindDeviceKey(token, anonKey) {
+  try {
+    const { status } = await post(
+      "/v1/me/devices/bind",
+      { anonKey },
+      token
+    );
+    return status === 200 || status === 409;
+  } catch {
+    return false;
+  }
+}
 async function submit(token, payload) {
   const { status, body } = await post("/v1/submit", payload, token);
   if (status === 401) throw new UnauthorizedError();
   if (status !== 200) {
     const err = body;
+    if (status === 403 && err.error === "account blocked") {
+      const reason = err.reason ? `
+  Reason: ${err.reason}` : "";
+      const appeal = err.appealUrl ? `
+  If you think this is a mistake, appeal at: ${err.appealUrl}` : "";
+      throw new Error(`Your account is blocked.${reason}${appeal}`);
+    }
     const details = err.details?.length ? `
   - ${err.details.join("\n  - ")}` : "";
     throw new Error(`${err.error ?? `submit failed (HTTP ${status})`}${details}`);
@@ -260,6 +289,9 @@ function loadConfig(dir = defaultConfigDir()) {
     if (typeof parsed.launchNotificationDeliveredAt === "number" && Number.isFinite(parsed.launchNotificationDeliveredAt)) {
       config.launchNotificationDeliveredAt = parsed.launchNotificationDeliveredAt;
     }
+    if (typeof parsed.deviceBoundAt === "number" && Number.isFinite(parsed.deviceBoundAt)) {
+      config.deviceBoundAt = parsed.deviceBoundAt;
+    }
     return Object.keys(config).length > 0 ? config : null;
   } catch {
     return null;
@@ -295,6 +327,10 @@ function recordSync(dir = defaultConfigDir(), when = Date.now()) {
   const config = loadConfig(dir) ?? {};
   saveConfig(dir, { ...config, lastSyncAt: when });
 }
+function recordDeviceBound(dir = defaultConfigDir(), when = Date.now()) {
+  const config = loadConfig(dir) ?? {};
+  saveConfig(dir, { ...config, deviceBoundAt: when });
+}
 function saveAuth(dir = defaultConfigDir(), auth = { cliToken: "" }) {
   const config = loadConfig(dir) ?? {};
   saveConfig(dir, { ...config, cliToken: auth.cliToken, handle: auth.handle });
@@ -6944,13 +6980,40 @@ var RESERVED_SLUGS = /* @__PURE__ */ new Set([
   "robots",
   "sitemap"
 ]);
+var ORG_TEXT_BLOCKLIST = /* @__PURE__ */ new Set([
+  "nigger",
+  "nigga",
+  "faggot",
+  "retard",
+  "rape",
+  "rapist",
+  "kike",
+  "spic",
+  "chink",
+  "cunt"
+]);
+var ORG_TEXT_LEET = {
+  "0": "o",
+  "1": "i",
+  "3": "e",
+  "4": "a",
+  "5": "s",
+  "7": "t",
+  "8": "b",
+  "@": "a",
+  "$": "s"
+};
+function isCleanOrgText(input) {
+  const runs = String(input).toLowerCase().split(/[^a-z0-9@$]+/).map((run2) => run2.replace(/[0-9@$]/g, (c) => ORG_TEXT_LEET[c] ?? c).replace(/[^a-z]/g, ""));
+  return !runs.some((run2) => run2.length > 0 && ORG_TEXT_BLOCKLIST.has(run2));
+}
 var SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?$/;
 function isValidSlug(slug) {
   return typeof slug === "string" && slug.length >= 2 && slug.length <= 32 && SLUG_RE.test(slug) && // Reject consecutive hyphens — the regex above permits "a--b", which makes
   // for confusing subdomains and is never a deliberate slug.
   !slug.includes("--") && !RESERVED_SLUGS.has(slug);
 }
-var OrgSlug = external_exports.string().min(2).max(32).refine(isValidSlug, "invalid or reserved slug");
+var OrgSlug = external_exports.string().min(2).max(32).refine(isValidSlug, "invalid or reserved slug").refine(isCleanOrgText, "invalid or reserved slug");
 var OrgWindow = external_exports.object({
   startDate: DateString.nullable().optional(),
   endDate: DateString.nullable().optional()
@@ -6994,11 +7057,21 @@ var OrgProvisionInput = external_exports.object({
    */
   issueClaimLink: external_exports.boolean().optional()
 });
+var OrgSelfServeInput = external_exports.object({
+  slug: OrgSlug,
+  name: external_exports.string().min(1).max(120).refine(isCleanOrgText, "name not allowed"),
+  type: OrgType,
+  description: external_exports.string().max(2e3).optional(),
+  accentColor: HexColor.optional(),
+  /** Who can view the board — defaults to the type's default when omitted. */
+  boardVisibility: OrgBoardVisibility.optional(),
+  /** Optional event window (mainly for hackathons). */
+  window: OrgWindow.optional()
+});
 var OrgSettingsInput = external_exports.object({
   name: external_exports.string().min(1).max(120).optional(),
   description: external_exports.string().max(2e3).nullable().optional(),
   accentColor: HexColor.optional(),
-  logoUrl: external_exports.string().url().max(500).nullable().optional(),
   boardVisibility: OrgBoardVisibility.optional(),
   window: OrgWindow.optional(),
   joinPolicy: OrgJoinPolicy.partial().optional()
@@ -8243,6 +8316,12 @@ async function run(flags) {
   const canSignIn = !flags.quiet && Boolean(process.stdout.isTTY);
   if (cfg?.cliToken) {
     await submitSignedIn(cfg.cliToken, payload, flags, canSignIn);
+    return;
+  }
+  const healed = cfg?.anonKey ? await refreshCliToken(cfg.anonKey) : null;
+  if (healed) {
+    saveAuth(void 0, { cliToken: healed.token, handle: healed.handle });
+    await submitSignedIn(healed.token, payload, flags, canSignIn);
   } else if (canSignIn) {
     const auth = await ensureSignedIn();
     if (!auth) return;
@@ -8261,6 +8340,11 @@ async function run(flags) {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+async function refreshCliTokenFromConfig() {
+  const cfg = loadConfig();
+  if (!cfg?.anonKey) return null;
+  return refreshCliToken(cfg.anonKey);
+}
 async function ensureSignedIn() {
   const cfg = loadConfig();
   if (cfg?.cliToken) return { token: cfg.cliToken, handle: cfg.handle ?? "" };
@@ -8300,16 +8384,25 @@ async function ensureSignedIn() {
   return null;
 }
 async function submitSignedIn(token, payload, flags, interactive) {
+  let activeToken = token;
   let result;
   try {
     result = await submit(token, payload);
   } catch (err) {
     if (err instanceof UnauthorizedError) {
-      clearAuth();
-      if (!interactive) return;
-      const auth = await ensureSignedIn();
-      if (!auth) return;
-      result = await submit(auth.token, payload);
+      const healed = await refreshCliTokenFromConfig();
+      if (healed) {
+        saveAuth(void 0, { cliToken: healed.token, handle: healed.handle });
+        activeToken = healed.token;
+        result = await submit(healed.token, payload);
+      } else {
+        clearAuth();
+        if (!interactive) return;
+        const auth = await ensureSignedIn();
+        if (!auth) return;
+        activeToken = auth.token;
+        result = await submit(auth.token, payload);
+      }
     } else {
       throw err;
     }
@@ -8318,6 +8411,14 @@ async function submitSignedIn(token, payload, flags, interactive) {
     recordSync();
   } catch {
   }
+  try {
+    const cfgNow = loadConfig();
+    if (!cfgNow?.deviceBoundAt) {
+      const key = ensureAnonKey();
+      if (await bindDeviceKey(activeToken, key)) recordDeviceBound();
+    }
+  } catch {
+  }
   const baseUrl = result.orgBoardUrl ?? result.boardUrl ?? result.profileUrl;
   if (!flags.quiet) {
     console.log(
@@ -8346,6 +8447,20 @@ async function submitSignedIn(token, payload, flags, interactive) {
         )
       );
     }
+    if (result.quarantinedDates && result.quarantinedDates.length > 0) {
+      const days = result.quarantinedDates.map((d) => sanitizeServerText(d)).join(", ");
+      console.log();
+      console.log(
+        pc2.yellow(
+          `  \u26A0 These day(s) were held off the leaderboard as an anomaly: ${days}`
+        )
+      );
+      console.log(
+        pc2.dim(
+          "  Your data is kept, not deleted. Run `npx whoburnedmore verify` to get back on the board, or appeal at whoburnedmore.com/appeal to have these days reviewed and restored."
+        )
+      );
+    }
     if (isTrustedWebUrl(baseUrl)) {
       console.log(pc2.dim("  Opening your dashboard in your browser\u2026"));
       openBrowser(baseUrl);
@@ -8643,7 +8758,7 @@ function printHelp() {
   ${pc2.bold("usage")}
     npx whoburnedmore              sign in, burn + land on the public leaderboard, open your dashboard
     npx whoburnedmore --board=CODE compare with friends \u2014 sign in and join their board
-    npx whoburnedmore --org=SLUG   submit to your organization's board (companies/hackathons)
+    npx whoburnedmore --org=SLUG --pass=CODE  join your organization's board (companies/hackathons)
     npx whoburnedmore --local      build the dashboard on your machine and open it (offline)
     npx whoburnedmore --dry-run    print exactly what would be sent, send nothing
     npx whoburnedmore --no-submit  collect locally, send nothing (no dashboard)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whoburnedmore",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "description": "Find out who burned more — submit your AI coding-agent token usage to the public leaderboard at whoburnedmore.com",
   "type": "module",
   "bin": {