@cimplify/cli 0.15.2 → 0.16.0

package/dist/chunk-EGQIPYUN.mjs

@@ -0,0 +1,696 @@
+#!/usr/bin/env node
+import { RemoteError } from './chunk-SCKQ4XSD.mjs';
+import { VERIFIED_SOURCE_STORAGE_QUOTA_BYTES, SOURCE_STORAGE_QUOTA_BYTES, UPLOAD_PART_BYTES, VERIFIED_UPLOAD_BYTES_PER_HOUR, UPLOAD_BYTES_PER_HOUR, MAX_CAPTURE_FILE_BYTES, MAX_SOURCE_FILE_BYTES, VERIFIED_MAX_SOURCE_SET_BYTES, MAX_SOURCE_SET_BYTES, sourceSetFromFiles, buildInteractive } from './chunk-CPBESPWK.mjs';
+import { digestHex, sha256 } from './chunk-25ZPFHLF.mjs';
+import { formatDiagnostic } from './chunk-SGT5IJVW.mjs';
+import { ApiClient } from './chunk-CLQYPTJ2.mjs';
+import { authConfigDir, readAuthOrNull } from './chunk-TT4YI33G.mjs';
+import { CliError, CLI_ERROR_CODE } from './chunk-KOD4GBQ5.mjs';
+import { generateKeyPairSync, createPrivateKey, sign, randomBytes, createPublicKey, verify } from 'crypto';
+import { promises } from 'fs';
+import path2 from 'path';
+
+var SIGNING_KEY_FILE = "interactive-signing-key.json";
+var SOURCE_SIGNATURE_CONTEXT = "cimplify.interactives.source.v1\n";
+var KEY_FILE_MODE = 384;
+var SIGNATURE_ALGORITHM = "ed25519";
+var RAW_PUBLIC_KEY_BYTES = 32;
+var ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+function keyPath(dir) {
+  return path2.join(dir, SIGNING_KEY_FILE);
+}
+function rawPublicKeyOf(spkiBase64) {
+  const der = Buffer.from(spkiBase64, "base64");
+  if (der.length !== ED25519_SPKI_PREFIX.length + RAW_PUBLIC_KEY_BYTES || !der.subarray(0, ED25519_SPKI_PREFIX.length).equals(ED25519_SPKI_PREFIX)) {
+    throw new Error("the stored signing key is not an Ed25519 public key");
+  }
+  return der.subarray(ED25519_SPKI_PREFIX.length).toString("base64");
+}
+function withKeys(publicKey, privateKey, registrations) {
+  return { publicKey, privateKey, rawPublicKey: rawPublicKeyOf(publicKey), registrations };
+}
+function generateSigningKey() {
+  const pair = generateKeyPairSync(SIGNATURE_ALGORITHM);
+  return withKeys(
+    pair.publicKey.export({ type: "spki", format: "der" }).toString("base64"),
+    pair.privateKey.export({ type: "pkcs8", format: "der" }).toString("base64"),
+    []
+  );
+}
+async function writeSigningKey(dir, key) {
+  const stored = {
+    algorithm: SIGNATURE_ALGORITHM,
+    public_key: key.publicKey,
+    private_key: key.privateKey,
+    registered: key.registrations.map((r) => ({ origin: r.origin, key_id: r.keyId }))
+  };
+  await promises.mkdir(dir, { recursive: true });
+  await promises.writeFile(keyPath(dir), `${JSON.stringify(stored, null, 2)}
+`, { mode: KEY_FILE_MODE });
+}
+async function loadSigningKey(dir) {
+  try {
+    const stored = JSON.parse(await promises.readFile(keyPath(dir), "utf8"));
+    if (stored.algorithm !== SIGNATURE_ALGORITHM) return null;
+    const registrations = (stored.registered ?? []).map((r) => ({ origin: r.origin, keyId: r.key_id }));
+    return withKeys(stored.public_key, stored.private_key, registrations);
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+async function loadOrCreateSigningKey(dir) {
+  const existing = await loadSigningKey(dir);
+  if (existing !== null) return existing;
+  const key = generateSigningKey();
+  await writeSigningKey(dir, key);
+  return key;
+}
+async function removeSigningKey(dir) {
+  await promises.rm(keyPath(dir), { force: true });
+}
+function registrationFor(key, origin) {
+  return key.registrations.find((r) => r.origin === origin) ?? null;
+}
+function withRegistration(key, registration) {
+  return { ...key, registrations: [...key.registrations.filter((r) => r.origin !== registration.origin), registration] };
+}
+function sourceSignatureMessage(sourceDigest) {
+  return Buffer.concat([Buffer.from(SOURCE_SIGNATURE_CONTEXT, "ascii"), Buffer.from(sourceDigest, "hex")]);
+}
+function signSource(key, sourceDigest) {
+  const privateKey = createPrivateKey({ key: Buffer.from(key.privateKey, "base64"), format: "der", type: "pkcs8" });
+  return sign(null, sourceSignatureMessage(sourceDigest), privateKey).toString("base64");
+}
+function verifySource(rawPublicKey, sourceDigest, signature) {
+  try {
+    const der = Buffer.concat([ED25519_SPKI_PREFIX, Buffer.from(rawPublicKey, "base64")]);
+    const key = createPublicKey({ key: der, format: "der", type: "spki" });
+    return verify(null, sourceSignatureMessage(sourceDigest), key, Buffer.from(signature, "base64"));
+  } catch {
+    return false;
+  }
+}
+var ID_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+var ID_LENGTH = 16;
+var INTERACTIVE_PREFIX = "ixr_";
+var REVISION_PREFIX = "rev_";
+var KEY_PREFIX = "ixkey_";
+var FAKE_ORIGIN = "fake:";
+var FAKE_ACCOUNT = "acct_fake";
+var KEYS_FILE = "signing-keys.json";
+function randomId() {
+  const bytes = randomBytes(ID_LENGTH);
+  let out = "";
+  for (let i = 0; i < ID_LENGTH; i++) out += ID_ALPHABET[bytes[i] % ID_ALPHABET.length];
+  return out;
+}
+var FakeInteractivesRemote = class {
+  origin;
+  root;
+  now;
+  newId;
+  account;
+  verified;
+  storageQuotaBytes;
+  uploadsBeforeFailure;
+  partsReceived = 0;
+  publishesBegun = 0;
+  constructor(options) {
+    this.root = options.root;
+    this.origin = `${FAKE_ORIGIN}${options.root}`;
+    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+    this.newId = options.newId ?? randomId;
+    this.account = options.account ?? FAKE_ACCOUNT;
+    this.verified = options.verified ?? false;
+    this.storageQuotaBytes = options.storageQuotaBytes ?? (this.verified ? VERIFIED_SOURCE_STORAGE_QUOTA_BYTES : SOURCE_STORAGE_QUOTA_BYTES);
+    this.uploadsBeforeFailure = options.uploadsBeforeFailure ?? null;
+  }
+  sessionPath(id) {
+    return path2.join(this.root, "sessions", `${id}.json`);
+  }
+  async session(id) {
+    try {
+      return JSON.parse(await promises.readFile(this.sessionPath(id), "utf8"));
+    } catch (err) {
+      if (err.code === "ENOENT") return null;
+      throw err;
+    }
+  }
+  async sessions() {
+    let names;
+    try {
+      names = await promises.readdir(path2.join(this.root, "sessions"));
+    } catch (err) {
+      if (err.code === "ENOENT") return [];
+      throw err;
+    }
+    const out = [];
+    for (const name of names) {
+      const found = await this.session(path2.basename(name, ".json"));
+      if (found !== null) out.push(found);
+    }
+    return out;
+  }
+  uploadPath(digest) {
+    return path2.join(this.root, "uploads", `${digestHex(digest)}.json`);
+  }
+  partPath(digest, part) {
+    return path2.join(this.root, "uploads", digestHex(digest), String(part));
+  }
+  async upload(digest) {
+    try {
+      return JSON.parse(await promises.readFile(this.uploadPath(digest), "utf8"));
+    } catch (err) {
+      if (err.code === "ENOENT") return null;
+      throw err;
+    }
+  }
+  async saveUpload(digest, upload) {
+    await promises.mkdir(path2.dirname(this.uploadPath(digest)), { recursive: true });
+    await promises.writeFile(this.uploadPath(digest), JSON.stringify(upload));
+  }
+  async usedBytes() {
+    let used = 0;
+    for (const dir of ["blobs", "uploads"]) {
+      let names;
+      try {
+        names = await promises.readdir(path2.join(this.root, dir));
+      } catch (err) {
+        if (err.code === "ENOENT") continue;
+        throw err;
+      }
+      for (const name of names) {
+        if (dir === "blobs") used += (await promises.stat(path2.join(this.root, dir, name))).size;
+        else if (name.endsWith(".json")) used += JSON.parse(await promises.readFile(path2.join(this.root, dir, name), "utf8")).size;
+      }
+    }
+    return used;
+  }
+  async reserve(bytes) {
+    const used = await this.usedBytes();
+    if (used + bytes > this.storageQuotaBytes) {
+      throw new RemoteError("quota", `the creator's source storage quota is ${this.storageQuotaBytes} bytes; ${used} are in use and this upload needs ${bytes} more`);
+    }
+  }
+  async awaitedSize(digest) {
+    for (const session of await this.sessions()) {
+      const file = session.files.find((f) => f.digest === digest);
+      if (file !== void 0) return file.size;
+    }
+    return null;
+  }
+  async sourceLimits() {
+    return {
+      verified: this.verified,
+      sourceSetBytes: this.verified ? VERIFIED_MAX_SOURCE_SET_BYTES : MAX_SOURCE_SET_BYTES,
+      sourceFileBytes: MAX_SOURCE_FILE_BYTES,
+      captureFileBytes: MAX_CAPTURE_FILE_BYTES,
+      storageQuotaBytes: this.storageQuotaBytes,
+      storageUsedBytes: await this.usedBytes(),
+      uploadBytesPerHour: this.verified ? VERIFIED_UPLOAD_BYTES_PER_HOUR : UPLOAD_BYTES_PER_HOUR,
+      partBytes: UPLOAD_PART_BYTES
+    };
+  }
+  async pendingPublish(sessionId) {
+    const session = await this.session(sessionId);
+    if (session === null) return null;
+    const missing = [];
+    for (const file of session.files) if (!missing.includes(file.digest) && !await this.hasBlob(file.digest)) missing.push(file.digest);
+    return { receiving: true, missing };
+  }
+  async openUpload(digest, size, parts) {
+    const count = Math.ceil(size / UPLOAD_PART_BYTES);
+    if (await this.hasBlob(digest)) return { partBytes: UPLOAD_PART_BYTES, parts: count, received: [], stored: true };
+    if (await this.awaitedSize(digest) !== size) throw new RemoteError("not_found", `no revision awaits ${digest} at ${size} bytes`);
+    if (parts.length !== count) throw new RemoteError("invalid", `name the SHA-256 of all ${count} parts`);
+    const open = await this.upload(digest);
+    if (open !== null) {
+      if (open.size !== size || open.parts.some((p, i) => p !== parts[i])) throw new RemoteError("invalid", "the parts differ from the upload already open for this file");
+      return { partBytes: UPLOAD_PART_BYTES, parts: count, received: open.received, stored: false };
+    }
+    await this.reserve(size);
+    await this.saveUpload(digest, { size, parts: [...parts], received: [] });
+    return { partBytes: UPLOAD_PART_BYTES, parts: count, received: [], stored: false };
+  }
+  async uploadPart(digest, part, bytes) {
+    const open = await this.upload(digest);
+    if (open === null) throw new RemoteError("not_found", `no open upload for ${digest}`);
+    if (open.received.includes(part)) return;
+    if (part < 1 || part > open.parts.length || sha256(bytes) !== open.parts[part - 1]) throw new RemoteError("invalid", `part ${part} does not hash to its declared digest`);
+    this.spendUpload();
+    await promises.mkdir(path2.dirname(this.partPath(digest, part)), { recursive: true });
+    await promises.writeFile(this.partPath(digest, part), bytes);
+    await this.serialised(digest, async () => {
+      const latest = await this.upload(digest);
+      if (!latest.received.includes(part)) latest.received.push(part);
+      latest.received.sort((a, b) => a - b);
+      await this.saveUpload(digest, latest);
+    });
+    this.partsReceived++;
+  }
+  spendUpload() {
+    if (this.uploadsBeforeFailure === null) return;
+    if (this.uploadsBeforeFailure === 0) throw new Error("the connection dropped");
+    this.uploadsBeforeFailure--;
+  }
+  locks = /* @__PURE__ */ new Map();
+  serialised(key, work) {
+    const next = (this.locks.get(key) ?? Promise.resolve()).then(work);
+    this.locks.set(
+      key,
+      next.catch(() => void 0)
+    );
+    return next;
+  }
+  async completeUpload(digest) {
+    const open = await this.upload(digest);
+    if (open === null) throw new RemoteError("not_found", `no open upload for ${digest}`);
+    if (open.received.length !== open.parts.length) throw new RemoteError("invalid", "parts have not all arrived");
+    const pieces = [];
+    for (let part = 1; part <= open.parts.length; part++) pieces.push(await promises.readFile(this.partPath(digest, part)));
+    const whole = Buffer.concat(pieces);
+    await promises.rm(path2.join(this.root, "uploads", digestHex(digest)), { recursive: true, force: true });
+    await promises.rm(this.uploadPath(digest), { force: true });
+    if (sha256(whole) !== digest || whole.length !== open.size) throw new RemoteError("invalid", "the assembled file does not hash to its digest");
+    await promises.mkdir(path2.join(this.root, "blobs"), { recursive: true });
+    await promises.writeFile(this.blobPath(digest), whole);
+  }
+  statePath(id) {
+    return path2.join(this.root, "interactives", `${id}.json`);
+  }
+  blobPath(digest) {
+    return path2.join(this.root, "blobs", digestHex(digest));
+  }
+  async load(id) {
+    try {
+      return JSON.parse(await promises.readFile(this.statePath(id), "utf8"));
+    } catch (err) {
+      if (err.code === "ENOENT") throw new RemoteError("not_found", `no Interactive ${id}`);
+      throw err;
+    }
+  }
+  async save(state) {
+    await promises.mkdir(path2.dirname(this.statePath(state.interactive_id)), { recursive: true });
+    await promises.writeFile(this.statePath(state.interactive_id), `${JSON.stringify(state, null, 2)}
+`);
+  }
+  async loadKeys() {
+    try {
+      return JSON.parse(await promises.readFile(path2.join(this.root, KEYS_FILE), "utf8"));
+    } catch (err) {
+      if (err.code === "ENOENT") return [];
+      throw err;
+    }
+  }
+  async saveKeys(keys) {
+    await promises.mkdir(this.root, { recursive: true });
+    await promises.writeFile(path2.join(this.root, KEYS_FILE), `${JSON.stringify(keys, null, 2)}
+`);
+  }
+  async hasBlob(digest) {
+    try {
+      await promises.access(this.blobPath(digest));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  toStatus(state) {
+    return {
+      interactiveId: state.interactive_id,
+      name: state.name,
+      live: state.live,
+      test: state.test,
+      revisions: state.revisions.slice().reverse()
+    };
+  }
+  async createInteractive(request) {
+    const id = INTERACTIVE_PREFIX + this.newId();
+    await this.save({ interactive_id: id, name: request.name, next_number: 1, live: null, test: null, revisions: [], logs: [], testers: [] });
+    return id;
+  }
+  async registerSigningKey(publicKey, label) {
+    const keys = await this.loadKeys();
+    const active = keys.find((k) => k.publicKey === publicKey && k.revokedAt === null);
+    if (active) return active;
+    const record2 = { keyId: KEY_PREFIX + this.newId(), publicKey, label, createdAt: this.now().toISOString(), revokedAt: null };
+    await this.saveKeys([...keys, record2]);
+    return record2;
+  }
+  async listSigningKeys() {
+    return (await this.loadKeys()).filter((k) => k.revokedAt === null);
+  }
+  async rotateSigningKey(keyId, publicKey, label) {
+    await this.revokeSigningKey(keyId);
+    return this.registerSigningKey(publicKey, label);
+  }
+  async revokeSigningKey(keyId) {
+    const keys = await this.loadKeys();
+    if (!keys.some((k) => k.keyId === keyId && k.revokedAt === null)) throw new RemoteError("not_found", `no signing key ${keyId}`);
+    const at = this.now().toISOString();
+    await this.saveKeys(keys.map((k) => k.keyId === keyId ? { ...k, revokedAt: at } : k));
+  }
+  async beginPublish(request) {
+    await this.load(request.interactiveId);
+    const keys = await this.listSigningKeys();
+    if (!keys.some((k) => verifySource(k.publicKey, request.sourceDigest, request.signature))) {
+      throw new RemoteError("invalid", "the source set signature does not verify against a registered signing key");
+    }
+    const missing = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const file of request.files) {
+      if (seen.has(file.digest)) continue;
+      seen.add(file.digest);
+      if (!await this.hasBlob(file.digest)) missing.push(file.digest);
+    }
+    const unique = new Map(request.files.map((f) => [f.digest, f.size]));
+    let missingBytes = 0;
+    for (const digest of missing) missingBytes += unique.get(digest) ?? 0;
+    const limit = this.verified ? VERIFIED_MAX_SOURCE_SET_BYTES : MAX_SOURCE_SET_BYTES;
+    if (request.files.reduce((n, f) => n + f.size, 0) > limit) {
+      throw new RemoteError("invalid", this.verified ? "files.size exceed the 2 GiB source set limit together" : "files.size exceed 1 GiB together; verify your creator account to publish source sets up to 2 GiB");
+    }
+    await this.reserve(missingBytes);
+    const sessionId = this.newId();
+    await promises.mkdir(path2.dirname(this.sessionPath(sessionId)), { recursive: true });
+    await promises.writeFile(this.sessionPath(sessionId), JSON.stringify(request));
+    this.publishesBegun++;
+    return { sessionId, missing };
+  }
+  async uploadFile(sessionId, digest, bytes) {
+    if (await this.session(sessionId) === null) throw new RemoteError("not_found", `no upload session ${sessionId}`);
+    if (sha256(bytes) !== digest) throw new RemoteError("invalid", `uploaded bytes do not match ${digest}`);
+    if (await this.hasBlob(digest)) return;
+    this.spendUpload();
+    await this.reserve(bytes.length);
+    await promises.mkdir(path2.join(this.root, "blobs"), { recursive: true });
+    await promises.writeFile(this.blobPath(digest), bytes);
+  }
+  async commitPublish(sessionId) {
+    const session = await this.session(sessionId);
+    if (!session) throw new RemoteError("not_found", `no upload session ${sessionId}`);
+    await promises.rm(this.sessionPath(sessionId), { force: true });
+    const state = await this.load(session.interactiveId);
+    const files = [];
+    for (const file of session.files) {
+      if (!await this.hasBlob(file.digest)) throw new RemoteError("invalid", `${file.path} was never uploaded`);
+      files.push({ path: file.path, bytes: await promises.readFile(this.blobPath(file.digest)) });
+    }
+    const set = sourceSetFromFiles(files);
+    if (set.digest !== session.sourceDigest) {
+      throw new RemoteError("invalid", "the uploaded files do not reproduce the signed source digest");
+    }
+    const built = buildInteractive(set);
+    const at = this.now().toISOString();
+    const number = state.next_number;
+    const revision = {
+      revision: `${REVISION_PREFIX}${number}`,
+      number,
+      channel: session.channel,
+      state: built.ok ? "admitted" : "refused",
+      sourceDigest: set.digest,
+      packageDigest: built.packageDigest,
+      createdAt: at
+    };
+    const logs = [{ at, revision: revision.revision, level: "info", message: `build started for ${set.files.length} files` }];
+    for (const d of built.diagnostics) {
+      logs.push({ at, revision: revision.revision, level: d.severity === "error" ? "error" : "warning", message: formatDiagnostic(d) });
+    }
+    logs.push({
+      at,
+      revision: revision.revision,
+      level: built.ok ? "info" : "error",
+      message: built.ok ? `admitted package ${built.packageDigest} to the ${revision.channel} channel` : "admission refused the revision"
+    });
+    state.next_number = number + 1;
+    state.revisions.push(revision);
+    for (const l of logs) state.logs.push(l);
+    if (built.ok) state[revision.channel] = revision.revision;
+    await this.save(state);
+    return { revision, logs };
+  }
+  async status(interactiveId) {
+    return this.toStatus(await this.load(interactiveId));
+  }
+  async logs(interactiveId, query) {
+    const state = await this.load(interactiveId);
+    const filtered = query.revision === null ? state.logs : state.logs.filter((l) => l.revision === query.revision);
+    return filtered.slice(Math.max(0, filtered.length - query.limit));
+  }
+  async rollback(interactiveId, revision, channel) {
+    const state = await this.load(interactiveId);
+    const target = state.revisions.find((r) => r.revision === revision);
+    if (!target) throw new RemoteError("not_found", `no revision ${revision}`);
+    if (target.state !== "admitted") throw new RemoteError("conflict", `revision ${revision} was not admitted and cannot be released`);
+    state[channel] = revision;
+    state.logs.push({ at: this.now().toISOString(), revision, level: "info", message: `${channel} channel now points at ${revision}` });
+    await this.save(state);
+    return this.toStatus(state);
+  }
+  async testers(interactiveId) {
+    return (await this.load(interactiveId)).testers;
+  }
+  async addTester(interactiveId, accountId) {
+    const state = await this.load(interactiveId);
+    const existing = state.testers.find((t) => t.accountId === accountId);
+    if (existing) return existing;
+    const tester2 = { accountId, addedBy: this.account, addedAt: this.now().toISOString() };
+    state.testers.push(tester2);
+    await this.save(state);
+    return tester2;
+  }
+  async removeTester(interactiveId, accountId) {
+    const state = await this.load(interactiveId);
+    state.testers = state.testers.filter((t) => t.accountId !== accountId);
+    await this.save(state);
+  }
+};
+
+// src/interactives/remote/http.ts
+var POLL_INTERVAL_MS = 1e3;
+var PUBLISH_DEADLINE_MS = 15 * 60 * 1e3;
+var STATUS_REVISIONS = 20;
+var BASE = "/v1/interactives";
+var RECEIVING = "receiving";
+var AWAITING_REVIEW = "awaiting_review";
+var ADMITTED = "admitted";
+var REFUSED = "refused";
+var TERMINAL_STAGES = /* @__PURE__ */ new Set([ADMITTED, REFUSED, AWAITING_REVIEW]);
+function pause(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function stateOf(stage) {
+  if (stage === ADMITTED) return "admitted";
+  if (stage === REFUSED) return "refused";
+  if (stage === AWAITING_REVIEW) return "in_review";
+  return "pending";
+}
+function record(body) {
+  return {
+    revision: body.id,
+    number: body.number,
+    channel: body.target_channel,
+    state: stateOf(body.stage),
+    sourceDigest: body.source_digest,
+    packageDigest: body.package_digest,
+    createdAt: body.created_at
+  };
+}
+function refusalText(refusal) {
+  return refusal.detail === null ? `refused: ${refusal.reason}` : `refused: ${refusal.reason}: ${refusal.detail}`;
+}
+function entry(at, revision, level, message) {
+  return { at, revision, level, message };
+}
+function revisionLogs(body) {
+  const out = [entry(body.created_at, body.id, "info", `revision ${body.number} received for the ${body.target_channel} channel`)];
+  if (body.admitted_at !== null) out.push(entry(body.admitted_at, body.id, "info", `admitted package ${body.package_digest ?? ""}`));
+  if (body.refusal !== null) out.push(entry(body.created_at, body.id, "error", refusalText(body.refusal)));
+  if (body.stage === AWAITING_REVIEW) out.push(entry(body.created_at, body.id, "warning", "waiting for review by Cimplify"));
+  return out;
+}
+function signingKey(body) {
+  return { keyId: body.key_id, publicKey: body.public_key, label: body.label, createdAt: body.created_at, revokedAt: body.revoked_at };
+}
+function tester(body) {
+  return { accountId: body.account_id, addedBy: body.added_by, addedAt: body.added_at };
+}
+function segment(value) {
+  return encodeURIComponent(value);
+}
+var HttpInteractivesRemote = class {
+  constructor(client, origin, options = {}) {
+    this.client = client;
+    this.origin = origin;
+    this.pollIntervalMs = options.pollIntervalMs ?? POLL_INTERVAL_MS;
+    this.deadlineMs = options.deadlineMs ?? PUBLISH_DEADLINE_MS;
+    this.sleep = options.sleep ?? pause;
+    this.now = options.now ?? Date.now;
+  }
+  client;
+  origin;
+  pollIntervalMs;
+  deadlineMs;
+  sleep;
+  now;
+  async createInteractive(request) {
+    const created = await this.client.post(BASE, {
+      name: request.name,
+      description: request.description,
+      category: request.category,
+      remix_allowed: null
+    });
+    return created.id;
+  }
+  async registerSigningKey(publicKey, label) {
+    return signingKey(await this.client.post(`${BASE}/signing-keys`, { public_key: publicKey, label }));
+  }
+  async listSigningKeys() {
+    return (await this.client.get(`${BASE}/signing-keys`)).map(signingKey);
+  }
+  async rotateSigningKey(keyId, publicKey, label) {
+    return signingKey(await this.client.post(`${BASE}/signing-keys/${segment(keyId)}/rotate`, { public_key: publicKey, label }));
+  }
+  async revokeSigningKey(keyId) {
+    await this.client.delete(`${BASE}/signing-keys/${segment(keyId)}`);
+  }
+  async beginPublish(request) {
+    const receipt = await this.client.post(`${BASE}/publish`, {
+      interactive_id: request.interactiveId,
+      channel: request.channel,
+      files: request.files.map((f) => ({ path: f.path, digest: f.digest, size: f.size })),
+      signature: request.signature
+    });
+    return { sessionId: receipt.revision_id, missing: receipt.missing };
+  }
+  async uploadFile(_sessionId, digest, bytes) {
+    await this.client.putBytes(`${BASE}/sources/${segment(digest)}`, bytes);
+  }
+  async pendingPublish(sessionId) {
+    try {
+      const receipt = await this.client.post(`${BASE}/revisions/${segment(sessionId)}/complete`);
+      return { receiving: receipt.stage === RECEIVING, missing: receipt.missing };
+    } catch (err) {
+      if (err instanceof CliError && err.code === CLI_ERROR_CODE.NOT_FOUND) return null;
+      throw err;
+    }
+  }
+  async sourceLimits() {
+    try {
+      const body = await this.client.get(`${BASE}/creator/source-limits`);
+      return {
+        verified: body.verified,
+        sourceSetBytes: body.source_set_bytes,
+        sourceFileBytes: body.source_file_bytes,
+        captureFileBytes: body.capture_file_bytes,
+        storageQuotaBytes: body.storage_quota_bytes,
+        storageUsedBytes: body.storage_used_bytes,
+        uploadBytesPerHour: body.upload_bytes_per_hour,
+        partBytes: body.part_bytes
+      };
+    } catch (err) {
+      if (err instanceof CliError && err.code === CLI_ERROR_CODE.NOT_FOUND) return null;
+      throw err;
+    }
+  }
+  async openUpload(digest, size, parts) {
+    const body = await this.client.post(`${BASE}/sources/${segment(digest)}/upload`, { size, parts });
+    return { partBytes: body.part_bytes, parts: body.parts, received: body.received, stored: body.stored };
+  }
+  async uploadPart(digest, part, bytes) {
+    await this.client.putBytes(`${BASE}/sources/${segment(digest)}/upload/parts/${part}`, bytes);
+  }
+  async completeUpload(digest) {
+    await this.client.post(`${BASE}/sources/${segment(digest)}/upload/complete`);
+  }
+  async commitPublish(sessionId) {
+    const receipt = await this.client.post(`${BASE}/revisions/${segment(sessionId)}/complete`);
+    if (receipt.stage === RECEIVING) {
+      throw new RemoteError("invalid", `${receipt.missing.length} files never arrived: ${receipt.missing.join(", ")}`);
+    }
+    const deadline = this.now() + this.deadlineMs;
+    const logs = [];
+    let seen = null;
+    for (; ; ) {
+      const body = await this.client.get(`${BASE}/revisions/${segment(sessionId)}`);
+      if (body.stage !== seen) {
+        seen = body.stage;
+        logs.push(entry(new Date(this.now()).toISOString(), body.id, "info", `stage ${body.stage}`));
+      }
+      if (TERMINAL_STAGES.has(body.stage)) {
+        for (const line of revisionLogs(body)) if (line.level !== "info") logs.push(line);
+        return { revision: record(body), logs };
+      }
+      if (this.now() >= deadline) {
+        throw new CliError(CLI_ERROR_CODE.TIMEOUT, `revision ${body.id} is still at ${body.stage}; follow it with \`cimplify status\``);
+      }
+      await this.sleep(this.pollIntervalMs);
+    }
+  }
+  async revisionBodies(interactiveId, limit) {
+    return this.client.get(`${BASE}/${segment(interactiveId)}/revisions`, { query: { limit } });
+  }
+  async status(interactiveId) {
+    const [interactive, revisions] = await Promise.all([
+      this.client.get(`${BASE}/${segment(interactiveId)}`),
+      this.revisionBodies(interactiveId, STATUS_REVISIONS)
+    ]);
+    return {
+      interactiveId: interactive.id,
+      name: interactive.name,
+      live: interactive.releases.live,
+      test: interactive.releases.test,
+      revisions: revisions.map(record)
+    };
+  }
+  async logs(interactiveId, query) {
+    const revisions = await this.revisionBodies(interactiveId, STATUS_REVISIONS);
+    const lines = [];
+    for (let i = revisions.length - 1; i >= 0; i--) {
+      if (query.revision === null || revisions[i].id === query.revision) for (const line of revisionLogs(revisions[i])) lines.push(line);
+    }
+    return lines.slice(Math.max(0, lines.length - query.limit));
+  }
+  async rollback(interactiveId, revision, channel) {
+    await this.client.put(`${BASE}/${segment(interactiveId)}/channels/${channel}`, { revision_id: revision });
+    return this.status(interactiveId);
+  }
+  async testers(interactiveId) {
+    return (await this.client.get(`${BASE}/${segment(interactiveId)}/testers`)).map(tester);
+  }
+  async addTester(interactiveId, accountId) {
+    return tester(await this.client.put(`${BASE}/${segment(interactiveId)}/testers/${segment(accountId)}`));
+  }
+  async removeTester(interactiveId, accountId) {
+    await this.client.delete(`${BASE}/${segment(interactiveId)}/testers/${segment(accountId)}`);
+  }
+};
+
+// src/interactives/remote/select.ts
+var REMOTE_ENV = "CIMPLIFY_INTERACTIVES_REMOTE";
+var FAKE_ROOT_ENV = "CIMPLIFY_INTERACTIVES_FAKE_ROOT";
+var FAKE_REMOTE = "fake";
+var HTTP_REMOTE = "http";
+var FAKE_DIR = "interactives-fake";
+function signingKeyDir() {
+  return authConfigDir();
+}
+async function remoteFromEnv() {
+  const kind = process.env[REMOTE_ENV] ?? HTTP_REMOTE;
+  if (kind === FAKE_REMOTE) {
+    return new FakeInteractivesRemote({ root: process.env[FAKE_ROOT_ENV] ?? path2.join(authConfigDir(), FAKE_DIR) });
+  }
+  if (kind !== HTTP_REMOTE) {
+    throw new CliError(CLI_ERROR_CODE.INVALID_INPUT, `${REMOTE_ENV}=${kind} is not a known remote; expected ${HTTP_REMOTE} or ${FAKE_REMOTE}`);
+  }
+  const auth = await readAuthOrNull();
+  if (auth === null) {
+    throw new CliError(CLI_ERROR_CODE.NOT_LOGGED_IN, "publishing Interactives needs a signed-in account", {
+      remediation: `Run \`cimplify login\`, or set ${REMOTE_ENV}=${FAKE_REMOTE} to use the local fake publishing service.`
+    });
+  }
+  return new HttpInteractivesRemote(ApiClient.fromAuth(auth), auth.apiBaseUrl);
+}
+
+export { generateSigningKey, loadOrCreateSigningKey, loadSigningKey, registrationFor, remoteFromEnv, removeSigningKey, signSource, signingKeyDir, withRegistration, writeSigningKey };