typefully-cli 0.2.1__tar.gz → 0.4.0__tar.gz

{typefully_cli-0.2.1 → typefully_cli-0.4.0}/.github/workflows/ci.yml

@@ -8,13 +8,13 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Python 3.9 remains supported; avoid ubuntu-latest image drift.
     strategy:
       matrix:
         python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
@@ -25,7 +25,14 @@ jobs:
         run: pip install -e ".[dev]"
 
       - name: Lint
-        run: ruff check src/ tests/
+        run: ruff check --isolated --select E4,E7,E9,F --target-version py39 --line-length 100 src/ tests/ scripts/
 
       - name: Test
         run: python -m pytest tests/ -v
+
+  collector:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - name: Test collector (mocked storage, no network)
+        run: node --test collector/worker.test.mjs

typefully_cli-0.4.0/.github/workflows/monitor.yml

@@ -0,0 +1,72 @@
+name: Monitor Typefully API & Competitors
+
+on:
+  schedule:
+    - cron: "0 8 * * 1,4"  # Mon & Thu 8am UTC (1:30pm IST)
+  workflow_dispatch: {}
+
+concurrency:
+  group: typefully-upstream-monitor
+  cancel-in-progress: false
+
+permissions:
+  issues: write
+  contents: read
+
+jobs:
+  monitor:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+
+      - name: Restore cache
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        with:
+          path: .monitor-cache
+          key: monitor-cache-${{ github.run_id }}
+          restore-keys: monitor-cache-
+
+      - name: Fetch and validate public upstream sources
+        run: python3 scripts/monitor.py
+
+      - name: Report changes or degraded monitoring
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          python3 - <<'PYTHON'
+          import json
+          import subprocess
+          from pathlib import Path
+
+          cache = Path(".monitor-cache")
+          result = json.loads((cache / "result.json").read_text())
+          if result["report_needed"]:
+              # A stable title deduplicates the same unresolved change/failure.
+              issues = json.loads(subprocess.check_output([
+                  "gh", "issue", "list", "--state", "open", "--search",
+                  result["fingerprint"] + " in:title",
+                  "--json", "title", "--limit", "100",
+              ], text=True))
+              if not any(issue["title"] == result["title"] for issue in issues):
+                  subprocess.run([
+                      "gh", "issue", "create", "--title", result["title"],
+                      "--body-file", str(cache / "report.md"),
+                  ], check=True)
+          subprocess.run(["python3", "scripts/monitor.py", "--commit"], check=True)
+          PYTHON
+
+      - name: Save cache
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        with:
+          path: .monitor-cache
+          key: monitor-cache-${{ github.run_id }}
+
+      - name: Fail visibly on degraded monitoring
+        run: |
+          python3 - <<'PYTHON'
+          import json
+          from pathlib import Path
+          result = json.loads(Path(".monitor-cache/result.json").read_text())
+          if result["failed"]:
+              raise SystemExit("Upstream fetch failed; see monitoring issue and result.json")
+          PYTHON

{typefully_cli-0.2.1 → typefully_cli-0.4.0}/.github/workflows/publish.yml

@@ -11,7 +11,7 @@ jobs:
       id-token: write  # trusted publishing
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0

{typefully_cli-0.2.1 → typefully_cli-0.4.0}/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.4.0 (unreleased)
+
+- Add minimal default-on usage telemetry for interactive text commands only, after a visible disclosure. The first notice invocation sends nothing.
+- Disable with `TYPEFULLY_TELEMETRY=0` or `typefully config set telemetry_enabled false`. CI, noninteractive, JSON and quiet runs are excluded.
+- Send only CLI version and command category to a maintainer-owned collector; store daily aggregate counts, not unique-user IDs or content. Network infrastructure still sees source IP.
+- Add strict collector validation, privacy documentation and mocked telemetry tests. See `docs/telemetry.md` for retention and limits.
+
+## 0.3.0 (2026-10-29)
+
+- Add schema-backed `draft-payload` request-file input with offline validation, per-post fields and null/false clearing; keep `--json` as output-only.
+- Add X reply/subscriber/community flags, LinkedIn first-comment/reshare fields, upload alt text and media metadata updates.
+- Follow social-set pagination, accept repeated tag filters and reject negative offsets; document every public API operation and unverified MCP/product-only boundaries.
+
+
+- Repair upstream monitoring: validate official public sources, expose fetch failures, deduplicate reports, and advance baselines only after successful reporting.
+- Pin CI to Ubuntu 22.04 to retain Python 3.9 compatibility; isolate Fish completion tests from the real home directory.
+- Extend `--quote-post-url` / `--qrt` to the documented Threads, Bluesky, Mastodon and Substack quote targets.
+
 ## 0.2.1 (2026-08-21)
 
 - Fix trusted PyPI publishing workflow action pin.

{typefully_cli-0.2.1 → typefully_cli-0.4.0}/CLAUDE.md

@@ -2,13 +2,15 @@
 
 ## Overview
 
-Python CLI wrapping the Typefully API v2. Agent-first design: JSON output by default, structured errors on stderr, deterministic behavior. 24 Click commands for drafts, threads, batch, media, analytics, queue, LinkedIn, tags, accounts, config, completions.
+Python CLI wrapping the Typefully API v2. Agent-friendly structured JSON output with `--json`, structured errors on stderr, and configurable text output. See `skills/typefully-cli/SKILL.md` for current agent usage and `docs/upstream-parity.md` for evidence and limitations.
 
 ## Architecture
 
 ```
 src/typefully_cli/
-  cli.py        -- 24 Click commands, shared options, error handler, payload builder
+  cli.py        -- Click commands, shared options, error handler, payload builder
+  payloads.py   -- Explicit JSON request input, local schema validation, media metadata
+  request-schemas.json -- Reviewed public create/update schema snapshot
   client.py     -- httpx wrapper over Typefully API v2 (rate-limited, account resolution)
   completions.py -- Shell completions install/show (bash/zsh/fish)
   auth.py       -- API key resolution chain: flag > env > config > 1Password
@@ -29,7 +31,7 @@ src/typefully_cli/
 - **Timezone conversion:** Config `timezone` (IANA name) converts naive schedule datetimes to UTC before API call. Already-tz-aware values pass through unchanged.
 - **Partial failure:** Delete and batch loops catch per-item errors. `_handle_multi_result()` handles the 3-branch contract (all succeed / partial / all fail).
 - **Error sanitization:** `APIError.user_message` property strips raw upstream bodies from stdout payloads. Full details stay on stderr.
-- **API parity:** Tracks all Typefully API v2 endpoints including analytics, queue management, and LinkedIn org resolution.
+- **API parity:** Map each public operation in docs/upstream-parity.md. Do not claim exhaustive MCP parity; analytics and legacy convenience fields are not verified by the current public schema.
 
 ## Dev setup
 
@@ -41,19 +43,15 @@ pip install -e ".[dev]"
 
 ```bash
 python3 -m pytest tests/ -v
-ruff check src/ tests/
+ruff check --isolated --select E4,E7,E9,F --target-version py39 --line-length 100 src/ tests/ scripts/
 ```
 
 ## Auth for live testing
 
-Config at `~/.config/typefully/config.toml`. Test account: BungeeCEO.
-
-```bash
-typefully config set api_key tf_...
-typefully config set default_account BungeeCEO
-typefully config set default_platforms x,linkedin
-typefully config set timezone Asia/Kolkata
-```
+Use existing authorized access from environment/config; never assume an account
+named in documentation is a sandbox. No cloud credential is bundled with this repo.
+Use local `--validate-only` and mocked tests first. Live test writes need explicit
+scope and a verified social set; never publish as part of maintenance tests.
 
 ## Conventions
 

{typefully_cli-0.2.1 → typefully_cli-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: typefully-cli
-Version: 0.2.1
+Version: 0.4.0
 Summary: CLI for the Typefully API -- manage drafts, threads, and publishing from the terminal
 Project-URL: Homepage, https://github.com/dheeraj-shah/typefully-cli
 Project-URL: Repository, https://github.com/dheeraj-shah/typefully-cli
@@ -37,8 +37,8 @@ Description-Content-Type: text/markdown
 
 Publish to X, LinkedIn, Bluesky, Threads, Mastodon, Substack Notes, and X Articles from your terminal. Goes from idea to post without opening a browser.
 
-[![PyPI](https://img.shields.io/pypi/v/typefully-cli?v=1)](https://pypi.org/project/typefully-cli/)
-[![Python 3.9+](https://img.shields.io/pypi/pyversions/typefully-cli?v=1)](https://pypi.org/project/typefully-cli/)
+[![PyPI](https://img.shields.io/pypi/v/typefully-cli.svg)](https://pypi.org/project/typefully-cli/)
+[![Python 3.9+](https://img.shields.io/pypi/pyversions/typefully-cli.svg)](https://pypi.org/project/typefully-cli/)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
 ## Why
@@ -331,6 +331,14 @@ account = "MyBrand"
 output_format = "text"   # or "json" for agent/script use
 ```
 
+## Usage telemetry
+
+This unreleased branch counts CLI version and command category only through a
+maintainer-owned collector, after a visible notice. The first notice invocation
+sends nothing. Published 0.3.0 installations are unchanged until a new release.
+Disable with `TYPEFULLY_TELEMETRY=0` or
+`typefully config set telemetry_enabled false`. See [privacy and activation details](docs/telemetry.md).
+
 ## Contributing
 
 See [CONTRIBUTING.md](CONTRIBUTING.md).
@@ -338,3 +346,41 @@ See [CONTRIBUTING.md](CONTRIBUTING.md).
 ## License
 
 MIT
+
+## Upstream compatibility maintenance
+
+The public-source monitor opens issues for upstream changes or failed checks; it does not
+implement or merge updates. See the [source and capability baseline](docs/upstream-parity.md)
+for monitored sources, known limits, and how maintenance coordinates with Dependabot.
+
+Native quotes route to the matching selected platform (the existing `--qrt` alias still works):
+
+```sh
+typefully draft "My take" --platform bluesky --quote-post-url https://bsky.app/profile/example.com/post/abc
+```
+
+Threads, Bluesky, Mastodon and Substack quotes apply to the first new post. Existing X
+thread behavior is retained. See [quote compatibility notes](docs/quote-parity.md).
+
+### Complete request input and media alt text
+
+`draft-payload create --file draft.json --validate-only` validates the reviewed public
+API schema offline. Remove `--validate-only` and select `--account` to submit.
+Use `draft-payload update --draft-id ID --file update.json` for per-post settings,
+explicit null/false clearing, or advanced fields. This is **request input**;
+`--json` on existing commands only controls output. The new advanced commands
+always emit JSON. Platform arrays replace content: retain posts/comment markers
+and settings you want to keep. `publish_at: "now"` really requests publication.
+
+`upload image.png --alt-text "Description"` sets alt text before attachment.
+`media-update MEDIA_ID --alt-text "New description"` or `--clear-alt-text` changes
+stored media; previously attached drafts keep their existing metadata snapshot.
+See [the full public capability matrix and remaining MCP boundaries](docs/upstream-parity.md).
+
+### Agent skill
+
+The repository's [Typefully CLI skill](skills/typefully-cli/SKILL.md) describes these
+Python CLI commands, local validation and authorization boundaries. It is distinct
+from Typefully's official JavaScript agent skill. Check the installed CLI's help:
+maintenance-branch features are not available in an older published package until
+an approved release is made.

{typefully_cli-0.2.1 → typefully_cli-0.4.0}/README.md

@@ -2,8 +2,8 @@
 
 Publish to X, LinkedIn, Bluesky, Threads, Mastodon, Substack Notes, and X Articles from your terminal. Goes from idea to post without opening a browser.
 
-[![PyPI](https://img.shields.io/pypi/v/typefully-cli?v=1)](https://pypi.org/project/typefully-cli/)
-[![Python 3.9+](https://img.shields.io/pypi/pyversions/typefully-cli?v=1)](https://pypi.org/project/typefully-cli/)
+[![PyPI](https://img.shields.io/pypi/v/typefully-cli.svg)](https://pypi.org/project/typefully-cli/)
+[![Python 3.9+](https://img.shields.io/pypi/pyversions/typefully-cli.svg)](https://pypi.org/project/typefully-cli/)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
 ## Why
@@ -296,6 +296,14 @@ account = "MyBrand"
 output_format = "text"   # or "json" for agent/script use
 ```
 
+## Usage telemetry
+
+This unreleased branch counts CLI version and command category only through a
+maintainer-owned collector, after a visible notice. The first notice invocation
+sends nothing. Published 0.3.0 installations are unchanged until a new release.
+Disable with `TYPEFULLY_TELEMETRY=0` or
+`typefully config set telemetry_enabled false`. See [privacy and activation details](docs/telemetry.md).
+
 ## Contributing
 
 See [CONTRIBUTING.md](CONTRIBUTING.md).
@@ -303,3 +311,41 @@ See [CONTRIBUTING.md](CONTRIBUTING.md).
 ## License
 
 MIT
+
+## Upstream compatibility maintenance
+
+The public-source monitor opens issues for upstream changes or failed checks; it does not
+implement or merge updates. See the [source and capability baseline](docs/upstream-parity.md)
+for monitored sources, known limits, and how maintenance coordinates with Dependabot.
+
+Native quotes route to the matching selected platform (the existing `--qrt` alias still works):
+
+```sh
+typefully draft "My take" --platform bluesky --quote-post-url https://bsky.app/profile/example.com/post/abc
+```
+
+Threads, Bluesky, Mastodon and Substack quotes apply to the first new post. Existing X
+thread behavior is retained. See [quote compatibility notes](docs/quote-parity.md).
+
+### Complete request input and media alt text
+
+`draft-payload create --file draft.json --validate-only` validates the reviewed public
+API schema offline. Remove `--validate-only` and select `--account` to submit.
+Use `draft-payload update --draft-id ID --file update.json` for per-post settings,
+explicit null/false clearing, or advanced fields. This is **request input**;
+`--json` on existing commands only controls output. The new advanced commands
+always emit JSON. Platform arrays replace content: retain posts/comment markers
+and settings you want to keep. `publish_at: "now"` really requests publication.
+
+`upload image.png --alt-text "Description"` sets alt text before attachment.
+`media-update MEDIA_ID --alt-text "New description"` or `--clear-alt-text` changes
+stored media; previously attached drafts keep their existing metadata snapshot.
+See [the full public capability matrix and remaining MCP boundaries](docs/upstream-parity.md).
+
+### Agent skill
+
+The repository's [Typefully CLI skill](skills/typefully-cli/SKILL.md) describes these
+Python CLI commands, local validation and authorization boundaries. It is distinct
+from Typefully's official JavaScript agent skill. Check the installed CLI's help:
+maintenance-branch features are not available in an older published package until
+an approved release is made.

typefully_cli-0.4.0/collector/DEPLOYMENT.md

@@ -0,0 +1,54 @@
+# Deployment verification — 2026-10-29
+
+Owner approved dedicated personal Cloudflare Worker + D1 creation on the confirmed
+Workers/D1 Free plan; no plan change, credentials, or security grants were made.
+
+- Endpoint: `https://typefully-cli-telemetry.dheeraj-personal-site.workers.dev/v1/count`
+- Worker: `typefully-cli-telemetry`
+- Account: `22980d1f74f2694e0642ea3cf9f384d9` (Dheeraj Shah)
+- D1: `typefully-cli-telemetry`, ID `1c795c09-fb39-41bf-bf9d-a4f7deae6c9c`
+- Worker version: `e251b178-c17f-44d1-99e5-ca1006ad1067`
+- D1 read replication: disabled
+
+Uploaded `worker.mjs` with only its default fetch export. The API upload response
+confirmed `observability.enabled=false`, log/invocation-log/trace enabled flags
+false, both log/trace persistence flags false, `logpush=false`, and empty tail
+consumers. Subsequent settings readback confirmed the dedicated D1 binding,
+`logpush=false` and empty tail consumers; disabled observability was omitted from
+that read response. Account Logpush jobs list was empty. The workers.dev route was
+read back enabled with preview URLs disabled.
+
+Checks against the deployed endpoint used no real usage:
+
+- GET `/v1/count` returned 405 with an empty body.
+- POST of the rejected synthetic dimensions `synthetic-test` / `synthetic-test`
+  returned 400 with an empty body.
+- D1 schema readback showed only `day`, `version`, `category`, `count`.
+- D1 count after both checks: zero rows. No production-dimension count was sent.
+- Local Node tests: 7 passed. SQLite schema/upsert checked locally.
+
+This verifies the rejection path and deployed configuration, not a production
+accepted-event end-to-end write. Accepted payload/database behavior is tested
+locally with a mock D1 binding. Cloudflare infrastructure still receives IP and
+transport metadata; application configuration and account Logpush checks do not
+verify all provider-internal security retention. No claim of full anonymity.
+
+The example Wrangler configuration remains intentionally inactive. An operator
+must copy it and explicitly supply the above binding/approved route before future
+deployment. Do not upgrade the Free plan automatically; quota exhaustion should
+leave telemetry best-effort, not change CLI behavior or authorize charges.
+
+## Prepared 0.4.0 candidate update — 12:20 UTC
+
+The existing collector was redeployed with only the reviewed version allowlist
+expanded from `0.3.0` to `0.3.0` and `0.4.0`; the CLI candidate is not published.
+Downloaded deployed source confirmed both exact versions. Local mock tests accept
+both and reject `0.4.0-rc.1`, `0.4.1`, and `0.5.0`.
+
+Upload again confirmed all observability/logging/tracing and persistence flags
+false, Logpush false, and no tail consumers. Settings readback confirmed the same
+D1 binding and no Logpush/tails; account Logpush jobs remain empty. Route remains
+enabled and previews disabled. A rejected synthetic POST returned 400 with zero
+response bytes; a subsequent D1 count confirmed zero rows. No accepted production
+payload was sent. No resources, paid plan
+changes, credentials, or grants were added by this update.

typefully_cli-0.4.0/collector/README.md

@@ -0,0 +1,70 @@
+# Minimal usage collector
+
+Owned Cloudflare Worker + dedicated D1 database. The owner approved the dedicated
+Free-plan deployment on 2026-10-29. See [deployment verification](DEPLOYMENT.md) for
+the exact recipient and checks. No credentials or deployment automation are bundled.
+CLI publication/release remains a separate approval.
+
+## Data contract
+
+`POST /v1/count`, `Content-Type: application/json`, at most 256 UTF-8 bytes:
+
+```json
+{"version":"0.3.0","category":"drafts"}
+```
+
+Only reviewed release versions are accepted (`VERSIONS`: `0.3.0` and the prepared
+`0.4.0` candidate); add a version explicitly
+when releasing. Categories: `account`, `drafts`, `publishing`, `media`, `tags`,
+`analytics`, `comments`, `queue`. Other keys/values and URLs with query strings are
+rejected. The application ignores all request headers except content type.
+
+The only database columns are UTC day (generated by the server), release version,
+category, and aggregate invocation count. An atomic upsert increments that day's
+count; there are no per-invocation rows, identifiers, fingerprints, IP addresses,
+user agents, content, tokens, arguments, or errors stored by the application.
+Counts measure activity, **not unique people**, and can be inflated by anyone
+sending valid requests: this is deliberately an unauthenticated, non-identifying
+counter, not trustworthy billing or security data.
+
+On each accepted request the same D1 transaction removes aggregate rows older
+than 90 days. If traffic stops, old aggregate rows remain until another accepted
+request or an operator deletes them. D1 backups may temporarily retain deleted
+aggregate rows. No application request logs, traces, or Logpush are enabled in the
+template; do not enable tail consumers or add request logging.
+
+Cloudflare necessarily receives source IP and other transport metadata. This code
+cannot promise that Cloudflare's independent infrastructure/security processing
+retains none of it. Review the service's current policies and account settings
+before enabling collection; do not describe it as fully anonymous.
+
+## Local verification (no HTTP traffic)
+
+```sh
+node --test collector/worker.test.mjs
+```
+
+Tests use in-memory Requests and a fake D1 binding; they never call a live endpoint.
+
+## Deployment approval checklist
+
+1. Approve the exact owner/account, endpoint and disclosed recipient. Verify the
+   account's current Workers/D1 billing plan, quotas and limits; do not assume zero
+   cost from the word "free". Do not upgrade a plan or grant new credentials.
+2. Approve creation of a dedicated Worker and dedicated D1 database. Do not reuse a
+   newsletter/customer database or Worker with request logging enabled.
+3. Copy `wrangler.example.jsonc` to a private deployment configuration, add the
+   approved D1 binding named `COUNTS`, and apply `schema.sql` to that database.
+4. Verify observability logs/traces, invocation logs, Logpush and tail consumers are
+   disabled in effective deployed settings, including any account-level exports.
+   Review platform retention separately. Enable only the approved HTTPS route.
+5. Update the CLI compiled endpoint and its disclosure together after approval.
+   Run mocked tests and review the diff. Publishing/releasing remains a separate
+   approval; deployment is not permission to release the CLI.
+6. Do not perform a real telemetry smoke test without approval for that payload and
+   recipient. A health check must not record an event.
+
+Current API references used when preparing this proposal:
+[Workers best practices](https://developers.cloudflare.com/workers/best-practices/workers-best-practices/),
+[D1 prepared statements](https://developers.cloudflare.com/d1/worker-api/prepared-statements/),
+[Wrangler configuration](https://developers.cloudflare.com/workers/wrangler/configuration/).

typefully_cli-0.4.0/collector/schema.sql

@@ -0,0 +1,7 @@
+CREATE TABLE IF NOT EXISTS daily_counts (
+    day TEXT NOT NULL,
+    version TEXT NOT NULL,
+    category TEXT NOT NULL,
+    count INTEGER NOT NULL CHECK (count > 0),
+    PRIMARY KEY (day, version, category)
+) WITHOUT ROWID;

typefully_cli-0.4.0/collector/worker.mjs

@@ -0,0 +1,72 @@
+// This collector deliberately never records request headers, IPs, or event-level data.
+const VERSIONS = new Set(['0.3.0', '0.4.0']);
+const CATEGORIES = new Set(['account', 'drafts', 'publishing', 'media', 'tags', 'analytics', 'comments', 'queue']);
+const MAX_BYTES = 256;
+
+async function readPayload(request) {
+  if (!request.body) throw new Error('invalid');
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > MAX_BYTES) {
+        await reader.cancel();
+        throw new Error('invalid');
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  const data = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+  if (!data || Array.isArray(data) || typeof data !== 'object'
+      || Object.keys(data).sort().join(',') !== 'category,version'
+      || !VERSIONS.has(data.version) || !CATEGORIES.has(data.category)) {
+    throw new Error('invalid');
+  }
+  return data;
+}
+
+const response = (status) => new Response(null, {
+  status, headers: { 'Cache-Control': 'no-store' },
+});
+
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    if (url.pathname !== '/v1/count' || url.search) return response(404);
+    if (request.method !== 'POST') return response(405);
+    if (request.headers.get('content-type') !== 'application/json') return response(415);
+    let data;
+    try {
+      data = await readPayload(request);
+    } catch {
+      return response(400);
+    }
+    try {
+      // Only UTC day, approved release version/category, and an aggregate count reach D1.
+      const day = new Date().toISOString().slice(0, 10);
+      const cutoff = new Date(Date.now() - 90 * 86400000).toISOString().slice(0, 10);
+      await env.COUNTS.batch([
+        env.COUNTS.prepare('DELETE FROM daily_counts WHERE day < ?').bind(cutoff),
+        env.COUNTS.prepare(`INSERT INTO daily_counts (day, version, category, count)
+          VALUES (?, ?, ?, 1)
+          ON CONFLICT(day, version, category) DO UPDATE SET count = count + 1`)
+          .bind(day, data.version, data.category),
+      ]);
+      return response(204);
+    } catch {
+      return response(503);
+    }
+  },
+};

typefully_cli-0.4.0/collector/worker.test.mjs

@@ -0,0 +1,123 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import worker from './worker.mjs';
+const CATEGORIES = ['account', 'drafts', 'publishing', 'media', 'tags', 'analytics', 'comments', 'queue'];
+
+function database(fail = false) {
+  const batches = [];
+  return {
+    batches,
+    prepare(sql) { return { bind: (...values) => ({ sql, values }) }; },
+    async batch(statements) {
+      if (fail) throw new Error('private backend details');
+      batches.push(statements);
+    },
+  };
+}
+function request(body = { version: '0.3.0', category: 'drafts' }, options = {}) {
+  return new Request('https://collector.invalid/v1/count', {
+    method: 'POST', headers: { 'Content-Type': 'application/json' },
+    body: typeof body === 'string' ? body : JSON.stringify(body), ...options,
+  });
+}
+
+test('every category stores only daily aggregate dimensions; never headers', async () => {
+  for (const category of CATEGORIES) {
+    const db = database();
+    const req = request({ version: '0.3.0', category });
+    req.headers.set('CF-Connecting-IP', '192.0.2.1');
+    req.headers.set('User-Agent', 'private-machine-name');
+    req.headers.set('Authorization', 'Bearer secret');
+    const res = await worker.fetch(req, { COUNTS: db });
+    assert.equal(res.status, 204);
+    assert.equal(res.headers.get('Cache-Control'), 'no-store');
+    assert.equal(db.batches.length, 1);
+    const [cleanup, increment] = db.batches[0];
+    assert.match(cleanup.sql, /DELETE FROM daily_counts/);
+    assert.match(cleanup.values[0], /^\d{4}-\d{2}-\d{2}$/);
+    assert.match(increment.sql, /ON CONFLICT.*DO UPDATE SET count = count \+ 1/);
+    assert.deepEqual(increment.values, [new Date().toISOString().slice(0, 10), '0.3.0', category]);
+    assert.doesNotMatch(JSON.stringify(db.batches), /secret|private-machine-name|192\.0/);
+  }
+});
+
+test('accepts both reviewed release versions without broadening the allowlist', async () => {
+  for (const version of ['0.3.0', '0.4.0']) {
+    const db = database();
+    assert.equal((await worker.fetch(request({ version, category: 'drafts' }), { COUNTS: db })).status, 204);
+    assert.equal(db.batches[0][1].values[1], version);
+  }
+  for (const version of ['0.4.0-rc.1', '0.4.1', '0.5.0']) {
+    const db = database();
+    assert.equal((await worker.fetch(request({ version, category: 'drafts' }), { COUNTS: db })).status, 400);
+    assert.deepEqual(db.batches, []);
+  }
+});
+
+test('rejects malformed, unapproved, and extra fields before storage', async () => {
+  for (const body of [
+    'not json', 'null', '[]', '"text"', '{}',
+    { version: '0.3.0', category: 'drafts', content: 'secret' },
+    { version: '0.3.0', category: 'unknown' },
+    { version: 'my-private-build', category: 'drafts' },
+    { version: '99.99.99', category: 'drafts' },
+    { version: 3, category: 'drafts' },
+    { version: '0.3.0', category: ['drafts'] },
+    ' '.repeat(257),
+  ]) {
+    const db = database();
+    const res = await worker.fetch(request(body), { COUNTS: db });
+    assert.equal(res.status, 400, JSON.stringify(body));
+    assert.deepEqual(db.batches, []);
+  }
+});
+
+test('bounded streamed body ignores forged Content-Length', async () => {
+  const stream = new ReadableStream({
+    start(controller) {
+      controller.enqueue(new TextEncoder().encode(' '.repeat(200)));
+      controller.enqueue(new TextEncoder().encode(' '.repeat(200)));
+      controller.close();
+    },
+  });
+  const db = database();
+  const req = request('', { body: stream, duplex: 'half', headers: {
+    'Content-Type': 'application/json', 'Content-Length': '1',
+  } });
+  assert.equal((await worker.fetch(req, { COUNTS: db })).status, 400);
+  assert.deepEqual(db.batches, []);
+});
+
+test('rejects invalid UTF-8, route, query, method and content type', async () => {
+  const db = database();
+  for (const [req, status] of [
+    [request('', { body: new Uint8Array([0xff]) }), 400],
+    [new Request('https://collector.invalid/'), 404],
+    [new Request('https://collector.invalid/v1/count?secret=1'), 404],
+    [new Request('https://collector.invalid/v1/count'), 405],
+    [request('{}', { headers: { 'Content-Type': 'text/plain' } }), 415],
+  ]) assert.equal((await worker.fetch(req, { COUNTS: db })).status, status);
+  assert.deepEqual(db.batches, []);
+});
+
+test('storage errors do not expose backend details or fail open', async () => {
+  const res = await worker.fetch(request(), { COUNTS: database(true) });
+  assert.equal(res.status, 503);
+  assert.equal(await res.text(), '');
+});
+
+test('deployment template keeps public routes and application logging disabled', async () => {
+  const { readFile } = await import('node:fs/promises');
+  const template = await readFile(new URL('./wrangler.example.jsonc', import.meta.url), 'utf8');
+  const cfg = JSON.parse(template.replace(/\/\/.*$/gm, ''));
+  assert.equal(cfg.workers_dev, false);
+  assert.equal(cfg.preview_urls, false);
+  assert.equal(cfg.logpush, false);
+  assert.equal(cfg.observability.enabled, false);
+  assert.equal(cfg.observability.logs.enabled, false);
+  assert.equal(cfg.observability.logs.invocation_logs, false);
+  assert.equal(cfg.observability.traces.enabled, false);
+  assert.equal(cfg.routes, undefined);
+  assert.equal(cfg.account_id, undefined);
+  assert.equal(cfg.d1_databases, undefined);
+});