@dropthis/cli 0.3.5 → 0.4.1

package/README.md

@@ -14,7 +14,7 @@ Requires Node.js >= 20.
 
 ```bash
 dropthis login
-dropthis publish index.html
+dropthis ./index.html         # publish is the default command
 ```
 
 ## Authentication
@@ -47,6 +47,8 @@ Credentials resolve in this order:
 2. `DROPTHIS_API_KEY` environment variable
 3. Stored credential from `dropthis login`
 
+If you run `dropthis publish` without credentials in an interactive terminal, the CLI prompts you to log in inline — no separate `dropthis login` step needed. Disable with `--no-interactive`.
+
 ```bash
 dropthis whoami        # Check current auth status
 dropthis logout        # Remove stored credentials
@@ -55,21 +57,29 @@ dropthis logout --revoke  # Remove and revoke the key on the server
 
 ## Publish
 
+`publish` is the default command — you can omit it and pass files directly:
+
+```bash
+# These are equivalent:
+dropthis ./report.html
+dropthis publish ./report.html
+```
+
 ```bash
 # HTML file
-dropthis publish report.html
+dropthis ./report.html
 
 # Directory (static site)
-dropthis publish ./dist
+dropthis ./dist
 
 # Stdin
 echo "<h1>Hello</h1>" | dropthis publish - --content-type text/html --path index.html
 
 # Multiple files bundled into one drop
-dropthis publish index.html styles.css app.js
+dropthis index.html styles.css app.js
 
 # Print only the URL (recommended for agents)
-dropthis publish ./dist --url
+dropthis ./dist --url
 ```
 
 ### Publish options
@@ -90,9 +100,7 @@ All publish flags:
 | `--title <title>` | Drop title |
 | `--visibility <public\|unlisted>` | Drop visibility |
 | `--password <password>` | Set password protection |
-| `--no-password` | Clear password |
 | `--noindex` | Prevent search indexing |
-| `--index` | Allow indexing |
 | `--entry <path>` | Entry file for directories |
 | `--content-type <mime>` | MIME type (required for stdin) |
 | `--path <path>` | Filename (required for stdin) |
@@ -113,35 +121,39 @@ These flags are inherited by all commands:
 |------|-------------|
 | `--api-key <key>` | Override API key for this invocation |
 | `--api-url <url>` | Override API base URL |
+| `--json` | Force JSON output |
 | `-q, --quiet` | Suppress status output and imply JSON |
+| `--no-interactive` | Disable interactive prompts (inline auth, confirmations) |
 
 ## Update
 
+Update an existing drop's content, metadata, or both via `drops update`:
+
 ```bash
 # Replace content
-dropthis update drop_abc123 ./dist-v2
+dropthis drops update drop_abc123 ./dist-v2
 
 # Update metadata only
-dropthis update drop_abc123 --title "New title"
+dropthis drops update drop_abc123 --title "New title"
 
 # Optimistic concurrency
-dropthis update drop_abc123 ./dist-v2 --if-revision 1
+dropthis drops update drop_abc123 ./dist-v2 --if-revision 1
 
 # Change vanity slug
-dropthis update drop_abc123 --slug new-slug
+dropthis drops update drop_abc123 --slug new-slug
 ```
 
-The `update` command supports all publish flags plus `--slug` and `--if-revision`.
+`drops update` supports all publish flags plus `--slug` and `--if-revision`.
 
 ## Commands
 
 ```bash
-dropthis publish [input...]            # Publish content, get a URL
-dropthis update <drop-id> [input]      # Update an existing drop
+dropthis [input...]                    # Publish content (default command)
+dropthis publish [input...]            # Same as above, explicit form
 
 dropthis drops list                    # List your drops
 dropthis drops get <drop-id>           # Get drop details
-dropthis drops update <drop-id>        # Update drop metadata
+dropthis drops update <drop-id> [input] # Update content or metadata
 dropthis drops delete <drop-id>        # Delete a drop
 
 dropthis login                         # Authenticate with email OTP
@@ -166,10 +178,15 @@ dropthis commands                      # Machine-readable command metadata
 
 The CLI is designed for non-interactive use. In non-TTY environments (pipes, CI, agents), output defaults to JSON automatically.
 
-**Environment variable auth (recommended for CI):**
+**Environment variables:**
+
+```bash
+export DROPTHIS_API_KEY=sk_live_...    # API key (same as --api-key)
+export DROPTHIS_API_URL=https://...    # Override API base URL (same as --api-url)
+export DROPTHIS_NON_INTERACTIVE=1      # Disable interactive prompts (same as --no-interactive)
+```
 
 ```bash
-export DROPTHIS_API_KEY=sk_live_...
 dropthis publish ./dist --url
 ```
 
@@ -178,6 +195,7 @@ dropthis publish ./dist --url
 - Use `--url` to get only the published URL (cleanest for agents)
 - Use `--json` for the full structured response
 - Use `--yes` for destructive commands (`drops delete`, `api-keys delete`)
+- Use `--no-interactive` to disable inline auth prompts
 - All errors write to stderr as JSON with a `next_action` field
 
 **Exit codes:**
@@ -211,18 +229,18 @@ Run diagnostics to verify CLI health:
 dropthis doctor
 ```
 
-Reports CLI version, auth source (`env`, `flag`, `stored`, or `missing`), and credential storage backend (`keyring`, `file`, or `none`).
+Reports CLI version, auth source (`env`, `flag`, `storage`, or `missing`), and credential storage backend (`secure`, `insecure`, or `none`).
 
 ```json
-{"ok":true,"version":"0.2.4","auth":{"source":"env"},"storage":{"backend":"keyring"}}
+{"ok":true,"version":"0.4.1","auth":{"source":"env"},"storage":{"backend":"secure"}}
 ```
 
 ## Agent skills
 
-This CLI ships with an [agent skill](https://skills.sh) that teaches AI coding agents (Cursor, Claude Code, Windsurf, etc.) how to use the dropthis CLI effectively, including non-interactive flags, output formats, and common pitfalls.
+For AI coding agents (Cursor, Claude Code, Windsurf, etc.), install the [dropthis-skills](https://github.com/dropthis-dev/dropthis-skills) package:
 
 ```bash
-npx skills add dropthis-dev/dropthis-cli
+npx skills add dropthis-dev/dropthis-skills
 ```
 
 ## Links

package/dist/cli.cjs

@@ -6,6 +6,13 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
@@ -23,6 +30,126 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// src/inline-auth.ts
+var inline_auth_exports = {};
+__export(inline_auth_exports, {
+  runInlineAuth: () => runInlineAuth
+});
+async function runInlineAuth(deps) {
+  try {
+    const prompt = deps.prompt ?? defaultPrompts();
+    deps.stderr("\nNot logged in. Let's fix that:\n");
+    const emailResult = await prompt.email();
+    if (typeof emailResult === "symbol") {
+      return null;
+    }
+    const email = emailResult;
+    const otpRequest = await deps.client.auth.requestEmailOtp({ email });
+    if (otpRequest.error) {
+      deps.stderr(`${otpRequest.error.message}
+`);
+      return null;
+    }
+    deps.stderr("Code sent! Check your inbox.\n");
+    const maxAttempts = 3;
+    let session = null;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+      const codeResult = await prompt.code(attempt, maxAttempts);
+      if (typeof codeResult === "symbol") {
+        return null;
+      }
+      const code = codeResult;
+      const verifyResult = await deps.client.auth.verifyEmailOtp({
+        email,
+        code
+      });
+      if (!verifyResult.error) {
+        session = verifyResult.data;
+        break;
+      }
+      if (attempt < maxAttempts) {
+        deps.stderr(`${verifyResult.error.message}
+`);
+      } else {
+        deps.stderr(
+          "Too many attempts. Run `dropthis login` to request a new code.\n"
+        );
+        return null;
+      }
+    }
+    if (!session) {
+      return null;
+    }
+    const authedClient = deps.createClient(session.token);
+    const apiKeyResult = await authedClient.apiKeys.create({
+      label: `CLI on ${deps.hostname ?? (0, import_node_os2.hostname)()}`
+    });
+    if (apiKeyResult.error) {
+      deps.stderr(`${apiKeyResult.error.message}
+`);
+      return null;
+    }
+    const { id: keyId, key: apiKey, keyLast4, accountId } = apiKeyResult.data;
+    try {
+      await deps.store.save({
+        apiKey,
+        keyId,
+        keyLast4,
+        accountId: accountId ?? session.accountId,
+        email,
+        storage: "secure"
+      });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      deps.stderr(`Failed to save credentials: ${message}
+`);
+      return null;
+    }
+    deps.stderr("\u2713 Logged in\n\n");
+    return {
+      apiKey,
+      source: "storage",
+      keyId,
+      keyLast4,
+      accountId: accountId ?? session.accountId,
+      email
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    deps.stderr(`Login failed: ${message}
+`);
+    return null;
+  }
+}
+function defaultPrompts() {
+  return {
+    email: () => readlineQuestion("Email: "),
+    code: (attempt) => readlineQuestion(
+      attempt === 1 ? "Code: " : "Try again \u2014 enter the code: "
+    )
+  };
+}
+function readlineQuestion(question) {
+  const rl = (0, import_node_readline.createInterface)({
+    input: process.stdin,
+    output: process.stderr
+  });
+  return new Promise((resolve) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer);
+    });
+  });
+}
+var import_node_os2, import_node_readline;
+var init_inline_auth = __esm({
+  "src/inline-auth.ts"() {
+    "use strict";
+    import_node_os2 = require("os");
+    import_node_readline = require("readline");
+  }
+});
+
 // src/program.ts
 var import_commander = require("commander");
 var import_picocolors4 = __toESM(require("picocolors"), 1);
@@ -93,11 +220,14 @@ function apiErrorEnvelope(error2) {
       ...error2.param ? { param: error2.param } : {},
       ...error2.currentRevision !== void 0 ? { current_revision: error2.currentRevision } : {},
       ...error2.requestId ? { request_id: error2.requestId } : {},
+      ...error2.suggestion ? { suggestion: error2.suggestion } : {},
+      ...error2.retryable !== void 0 && error2.retryable !== null ? { retryable: error2.retryable } : {},
       next_action: nextActionForApiError(error2)
     }
   };
 }
 function nextActionForApiError(error2) {
+  if (error2.suggestion) return error2.suggestion;
   const uploadNextAction = error2.code ? UPLOAD_NEXT_ACTIONS[error2.code] : void 0;
   if (uploadNextAction) return uploadNextAction;
   if (error2.code === "revision_conflict") {
@@ -221,8 +351,11 @@ function writeApiError(deps, details) {
   if (deps.outputMode === "human") {
     deps.stderr(`${error(details.message)}
 `);
-    const nextAction = details.requestId ? `Request ID: ${details.requestId}` : void 0;
+    const nextAction = nextActionForApiError(details);
     if (nextAction) deps.stderr(`${hint(nextAction)}
+`);
+    if (details.requestId)
+      deps.stderr(`${import_picocolors2.default.dim(`Request ID: ${details.requestId}`)}
 `);
   } else {
     deps.stderr(`${JSON.stringify(apiErrorEnvelope(details))}
@@ -394,6 +527,7 @@ var COMMAND_CATALOG = [
     arguments: ["input"],
     options: ["--json", "--url", "--dry-run", "--title", "--metadata"],
     examples: [
+      "dropthis ./file.html",
       "dropthis publish ./site --json",
       "dropthis publish ./site --url",
       "dropthis publish ./dist --dry-run"
@@ -555,13 +689,13 @@ async function runDoctor(_input, deps) {
   const authSource = credential?.source ?? "missing";
   const storageBackend = stored?.storage ?? "none";
   const pairs = [
-    ["Version", "0.3.5"],
+    ["Version", "0.4.1"],
     ["Auth", authSource],
     ["Storage", storageBackend]
   ];
   writeKv(deps, pairs, {
     ok: true,
-    version: "0.3.5",
+    version: "0.4.1",
     auth: { source: authSource },
     storage: { backend: storageBackend }
   });
@@ -991,8 +1125,9 @@ async function readJsonObjectFile(path) {
 
 // src/commands/publish.ts
 async function runPublish(input, raw, deps) {
+  let credential;
   try {
-    await requireCredential({
+    credential = await resolveCredential({
       ...raw.apiKey ?? deps.apiKey ? { apiKey: raw.apiKey ?? deps.apiKey } : {},
       env: deps.env,
       store: deps.store
@@ -1000,8 +1135,26 @@ async function runPublish(input, raw, deps) {
   } catch {
     return writeAuthError(deps);
   }
+  let didInlineAuth = false;
+  if (!credential) {
+    if (deps.interactive && deps.inlineAuth) {
+      try {
+        credential = await deps.inlineAuth();
+      } catch {
+        return writeAuthError(deps);
+      }
+      if (!credential) return writeAuthError(deps);
+      didInlineAuth = true;
+    } else {
+      return writeAuthError(deps);
+    }
+  }
+  let client = deps.client;
+  if (didInlineAuth && deps.createClient) {
+    client = deps.createClient(credential.apiKey);
+  }
   if (raw.dryRun) {
-    return handlePublishDryRun(input, raw, deps);
+    return handlePublishDryRun(input, raw, deps, client);
   }
   const singleInput = Array.isArray(input) ? input[0] : input;
   const spin = shouldSpin(deps.outputMode) ? createSpinner("Publishing\u2026", deps.stderr) : void 0;
@@ -1010,13 +1163,44 @@ async function runPublish(input, raw, deps) {
       throw new Error("Use either <input> or --from-json, not both.");
     }
     const options = withIdempotencyKey(await parseDropOptions(raw), "pub");
-    const result = raw.fromJson ? await deps.client.drops.createRaw(
-      await (deps.readJsonObject ?? readJsonObjectFile)(raw.fromJson),
-      options.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : {}
-    ) : singleInput ? await deps.client.publish(singleInput, options) : (() => {
+    const jsonBody = raw.fromJson ? await (deps.readJsonObject ?? readJsonObjectFile)(raw.fromJson) : void 0;
+    const idempotencyOpt = options.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : {};
+    const doPublish = (c) => jsonBody ? c.drops.createRaw(jsonBody, idempotencyOpt) : singleInput ? c.publish(singleInput, options) : (() => {
       throw new Error("Publish requires <input> or --from-json.");
     })();
+    const result = await doPublish(client);
     if (result.error) {
+      if (result.error.statusCode === 401 && deps.interactive && deps.inlineAuth && !didInlineAuth) {
+        spin?.stop();
+        const newCredential = await deps.inlineAuth();
+        if (newCredential && deps.createClient) {
+          client = deps.createClient(newCredential.apiKey);
+          const retrySpin = shouldSpin(deps.outputMode) ? createSpinner("Publishing\u2026", deps.stderr) : void 0;
+          try {
+            const retryResult = await doPublish(client);
+            if (retryResult.error) {
+              retrySpin?.fail();
+              return writeApiError(deps, retryResult.error);
+            }
+            retrySpin?.stop();
+            if (raw.url) deps.stdout(`${retryResult.data.url}
+`);
+            else
+              writeResult(
+                deps,
+                retryResult.data.url,
+                "Published",
+                retryResult.data
+              );
+            return { exitCode: 0 };
+          } catch (retryError) {
+            retrySpin?.fail();
+            const message = retryError instanceof Error ? retryError.message : "Publish failed.";
+            const code = isFileSystemError(retryError) ? "local_input_error" : "invalid_usage";
+            return writeError(deps, code, message);
+          }
+        }
+      }
       spin?.fail();
       return writeApiError(deps, result.error);
     }
@@ -1032,7 +1216,7 @@ async function runPublish(input, raw, deps) {
     return writeError(deps, code, message);
   }
 }
-async function handlePublishDryRun(input, raw, deps) {
+async function handlePublishDryRun(input, raw, deps, client) {
   if (raw.url) {
     return writeError(
       deps,
@@ -1061,10 +1245,10 @@ async function handlePublishDryRun(input, raw, deps) {
     if (Array.isArray(input)) {
       return dryRunMultiFile(input, options, deps);
     }
-    if (!deps.client.prepare) {
+    if (!client.prepare) {
       throw new Error("Client does not support dry-run.");
     }
-    const prepared = await deps.client.prepare(input, options);
+    const prepared = await client.prepare(input, options);
     const output = formatDryRunManifest(prepared);
     validateManifestFileCount(
       output.manifest.files.length
@@ -1396,11 +1580,13 @@ async function readJsonFile(path) {
 }
 async function writeCredentialFile(path, credential) {
   await (0, import_promises4.mkdir)((0, import_node_path3.dirname)(path), { recursive: true });
-  await (0, import_promises4.writeFile)(path, `${JSON.stringify(credential, null, 2)}
+  const tmpPath = `${path}.${process.pid}.tmp`;
+  await (0, import_promises4.writeFile)(tmpPath, `${JSON.stringify(credential, null, 2)}
 `, {
     mode: 384
   });
-  await (0, import_promises4.chmod)(path, 384);
+  await (0, import_promises4.chmod)(tmpPath, 384);
+  await (0, import_promises4.rename)(tmpPath, path);
 }
 
 // src/program.ts
@@ -1415,7 +1601,7 @@ function buildProgram(options = {}) {
       `  ${import_picocolors4.default.cyan("dropthis login")}`,
       `  ${import_picocolors4.default.cyan("dropthis publish ./dist")}`
     ].join("\n")
-  ).version("0.3.5").configureHelp({
+  ).version("0.4.1").configureHelp({
     subcommandTerm(cmd) {
       const args = cmd.registeredArguments.map((a) => {
         const name = a.name();
@@ -1433,7 +1619,8 @@ function buildProgram(options = {}) {
   program.option("--api-url <url>", "Override API base URL");
   program.option("--json", "Force JSON output");
   program.option("-q, --quiet", "Suppress status output and imply JSON");
-  program.command("publish [input...]").description(
+  program.option("--no-interactive", "Disable interactive prompts");
+  program.command("publish [input...]", { isDefault: true }).description(
     "Publish files, folders, URLs, strings, or stdin.\nMultiple files are bundled into one drop.\nUse - to read stdin explicitly, or pipe without args."
   ).option("--title <title>", "Drop title").option("--visibility <v>", "public or unlisted (default: public)").option("--password <password>", "Require password to view").option("--noindex", "Prevent search-engine indexing").option("--expires-at <datetime>", "Auto-delete after this ISO 8601 date").option(
     "--content-type <mime>",
@@ -1448,8 +1635,18 @@ function buildProgram(options = {}) {
     "--idempotency-key <key>",
     "Prevent duplicate publishes on retry (auto-generated)"
   ).action(async (inputs, commandOptions) => {
-    const deps = await commandDeps(program, options, store, commandOptions);
     const stdinIsTTY = options.stdinIsTTY ?? process.stdin.isTTY ?? false;
+    if (inputs.length === 0 && stdinIsTTY && !commandOptions.fromJson) {
+      program.outputHelp();
+      return;
+    }
+    const { deps } = await buildPublishDeps(
+      program,
+      options,
+      store,
+      commandOptions,
+      stdinIsTTY
+    );
     let publishInput;
     try {
       if (commandOptions.dryRun && inputs.length > 1) {
@@ -1538,10 +1735,15 @@ function buildProgram(options = {}) {
   );
   drops.command("delete <dropId>").description("Delete a drop").option("--yes", "Confirm deletion").option("--json", "Force JSON output").action(
     async (dropId, commandOptions) => {
+      const stdinIsTTY = options.stdinIsTTY ?? process.stdin.isTTY ?? false;
+      const global = globalOptions(program, commandOptions);
       const deps = await commandDeps(program, options, store, commandOptions);
       const result = await runDropsDelete(
         dropId,
-        { ...commandOptions, interactive: deps.outputMode === "human" },
+        {
+          ...commandOptions,
+          interactive: isInteractive(stdinIsTTY, deps.env, global)
+        },
         deps
       );
       process.exitCode = result.exitCode;
@@ -1560,10 +1762,15 @@ function buildProgram(options = {}) {
   });
   apiKeys.command("delete <keyId>").description("Delete an API key").option("--yes", "Confirm deletion").option("--json", "Force JSON output").action(
     async (keyId, commandOptions) => {
+      const stdinIsTTY = options.stdinIsTTY ?? process.stdin.isTTY ?? false;
+      const global = globalOptions(program, commandOptions);
       const deps = await commandDeps(program, options, store, commandOptions);
       const result = await runApiKeysDelete(
         keyId,
-        { ...commandOptions, interactive: deps.outputMode === "human" },
+        {
+          ...commandOptions,
+          interactive: isInteractive(stdinIsTTY, deps.env, global)
+        },
         deps
       );
       process.exitCode = result.exitCode;
@@ -1708,13 +1915,56 @@ async function commandDeps(program, options, store, commandOptions) {
     outputMode: context.output.mode
   };
 }
+async function buildPublishDeps(program, options, store, commandOptions, stdinIsTTY) {
+  const global = globalOptions(program, commandOptions);
+  const context = createContext({
+    global,
+    ...options.env !== void 0 ? { env: options.env } : {},
+    ...options.stdout !== void 0 ? { stdout: options.stdout } : {},
+    ...options.stderr !== void 0 ? { stderr: options.stderr } : {},
+    ...options.stdoutIsTTY !== void 0 ? { stdoutIsTTY: options.stdoutIsTTY } : {}
+  });
+  const credential = await resolveCredential({
+    ...global.apiKey ? { apiKey: global.apiKey } : {},
+    env: context.env,
+    store
+  });
+  const interactive = isInteractive(stdinIsTTY, context.env, global);
+  const inlineAuth = async () => {
+    const { runInlineAuth: runInlineAuth2 } = await Promise.resolve().then(() => (init_inline_auth(), inline_auth_exports));
+    return runInlineAuth2({
+      client: context.createClient(),
+      createClient: (apiKey) => context.createClient(apiKey),
+      store,
+      stderr: context.stderr
+    });
+  };
+  return {
+    deps: {
+      store,
+      client: options.client ?? context.createClient(credential?.apiKey),
+      ...global.apiKey ? { apiKey: global.apiKey } : {},
+      env: context.env,
+      stdout: context.stdout,
+      stderr: context.stderr,
+      outputMode: context.output.mode,
+      interactive,
+      inlineAuth,
+      createClient: (apiKey) => context.createClient(apiKey)
+    }
+  };
+}
+function isInteractive(stdinIsTTY, env, global) {
+  return stdinIsTTY && !env.CI && !env.DROPTHIS_NON_INTERACTIVE && global.interactive !== false;
+}
 function globalOptions(program, commandOptions) {
   const opts = program.opts();
   return {
     ...opts.apiKey ? { apiKey: opts.apiKey } : {},
     ...opts.apiUrl ? { apiUrl: opts.apiUrl } : {},
     ...commandOptions.json !== void 0 ? { json: commandOptions.json } : opts.json !== void 0 ? { json: opts.json } : {},
-    ...commandOptions.quiet !== void 0 ? { quiet: commandOptions.quiet } : opts.quiet !== void 0 ? { quiet: opts.quiet } : {}
+    ...commandOptions.quiet !== void 0 ? { quiet: commandOptions.quiet } : opts.quiet !== void 0 ? { quiet: opts.quiet } : {},
+    ...opts.interactive !== void 0 ? { interactive: opts.interactive } : {}
   };
 }
 function toDropOptions(options) {