@hacloud/cli 0.1.0

package/README.md

@@ -0,0 +1,44 @@
+# hacli — CLI da Hospede Aqui
+
+Deploy, logs em tempo real, variáveis, rollback e previews dos seus apps na [Hospede Aqui](https://hospedeaqui.cloud) pelo terminal ou no CI. Disponível em todos os planos.
+
+Requer Node.js 20 ou mais novo.
+
+```bash
+npm install -g @hacloud/cli
+hacli login            # autoriza no navegador (OAuth)
+hacli link minha-api   # vincula a pasta a um app
+hacli deploy --wait    # faz o deploy e acompanha o build
+hacli logs -f          # logs em tempo real, com segredos redigidos
+```
+
+Sem instalar: `npx @hacloud/cli login`.
+
+## Comandos
+
+| Comando | O que faz |
+|---|---|
+| `hacli login` / `logout` / `whoami` | Conta e sessão |
+| `hacli apps` | Lista os apps da organização |
+| `hacli link <app>` | Vincula a pasta atual a um app (`.hospedeaqui.json`) |
+| `hacli status` | Status do app e do último deploy |
+| `hacli deploy [--wait] [--no-cache]` | Agenda um deploy; `--wait` acompanha e falha se o deploy falhar |
+| `hacli logs [-f] [-n 200] [--deployment <id>]` | Logs de runtime ou de um deploy |
+| `hacli env ls` / `set K=v` / `unset K` | Variáveis do app (valores sempre mascarados) |
+| `hacli rollback [deploymentId]` | Volta para o deploy anterior que funcionou |
+| `hacli restart` · `hacli open` · `hacli previews` | Reinicia, abre no navegador, lista previews de PR |
+
+Use `--app <nome>` para escolher o app sem vincular a pasta.
+
+## CI
+
+Crie um token de acesso em **Integrações › MCP** (escopos `platform:read`, `apps:read`, `apps:write`, `deployments:write`) e salve como segredo `HOSPEDEAQUI_TOKEN`:
+
+```yaml
+- name: Deploy na Hospede Aqui
+  run: npx -y @hacloud/cli deploy --app minha-api --wait
+  env:
+    HOSPEDEAQUI_TOKEN: ${{ secrets.HOSPEDEAQUI_TOKEN }}
+```
+
+Documentação: https://hospedeaqui.cloud/cli

package/dist/hacli.mjs

@@ -0,0 +1,706 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { parseArgs } from "node:util";
+
+// src/api.ts
+import { randomUUID } from "node:crypto";
+
+// src/auth.ts
+import { spawn } from "node:child_process";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+
+// src/config.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+var DEFAULT_API_URL = "https://api.hospedeaqui.cloud";
+var LINK_FILE = ".hospedeaqui.json";
+function apiUrl(env = process.env) {
+  return (env.HOSPEDEAQUI_API_URL?.trim() || DEFAULT_API_URL).replace(/\/+$/, "");
+}
+function configDir(env = process.env, platform = process.platform) {
+  if (platform === "win32") return join(env.APPDATA || join(homedir(), "AppData", "Roaming"), "hospedeaqui");
+  return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "hospedeaqui");
+}
+var credentialsPath = () => join(configDir(), "credentials.json");
+function readCredentials() {
+  try {
+    return JSON.parse(readFileSync(credentialsPath(), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeCredentials(credentials) {
+  const path = credentialsPath();
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(credentials, null, 2), { mode: 384 });
+  try {
+    chmodSync(tmp, 384);
+  } catch {
+  }
+  renameSync(tmp, path);
+}
+function clearCredentials() {
+  rmSync(credentialsPath(), { force: true });
+}
+function findLink(start = process.cwd()) {
+  let dir = resolve(start);
+  for (; ; ) {
+    const path = join(dir, LINK_FILE);
+    if (existsSync(path)) {
+      try {
+        return { path, link: JSON.parse(readFileSync(path, "utf8")) };
+      } catch {
+        return null;
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function writeLink(link, dir = process.cwd()) {
+  const path = join(dir, LINK_FILE);
+  writeFileSync(path, JSON.stringify(link, null, 2) + "\n");
+  return path;
+}
+
+// src/output.ts
+var CliError = class extends Error {
+  constructor(message, exitCode = 1) {
+    super(message);
+    this.exitCode = exitCode;
+  }
+};
+var useColor = process.stdout.isTTY && !process.env.NO_COLOR;
+var paint = (code) => (text) => useColor ? `\x1B[${code}m${text}\x1B[0m` : text;
+var color = { dim: paint(2), bold: paint(1), red: paint(31), green: paint(32), yellow: paint(33), cyan: paint(36) };
+function statusColor(status) {
+  if (["success", "running", "active", "succeeded", "ready"].includes(status)) return color.green(status);
+  if (["failed", "error", "cancelled", "rejected", "crashed"].includes(status)) return color.red(status);
+  return color.yellow(status);
+}
+function table(headers, rows) {
+  const visible = (s) => s.replace(/\u001b\[\d+m/g, "").length;
+  const widths = headers.map((h, i) => Math.max(visible(h), ...rows.map((r) => visible(r[i] ?? ""))));
+  const line = (cells) => cells.map((c, i) => c + " ".repeat(widths[i] - visible(c))).join("  ").trimEnd();
+  return [color.bold(line(headers)), ...rows.map(line)].join("\n");
+}
+
+// src/auth.ts
+var CLI_SCOPES = "platform:read apps:read apps:write deployments:write";
+var LOGIN_TIMEOUT_MS = 5 * 6e4;
+function pkcePair() {
+  const verifier = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+function authorizeUrl(base, input) {
+  const url = new URL(`${base}/oauth/authorize`);
+  url.search = new URLSearchParams({
+    response_type: "code",
+    client_id: input.clientId,
+    redirect_uri: input.redirectUri,
+    code_challenge: input.challenge,
+    code_challenge_method: "S256",
+    state: input.state,
+    resource: `${base}/mcp`,
+    scope: CLI_SCOPES
+  }).toString();
+  return url.toString();
+}
+var AUTH_TIMEOUT_MS = 15e3;
+async function postForm(url, body) {
+  const response = await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+    body: new URLSearchParams(body).toString(),
+    signal: AbortSignal.timeout(AUTH_TIMEOUT_MS)
+  });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok) throw new CliError(`Falha na autentica\xE7\xE3o: ${String(data.error_description ?? data.error ?? response.status)}`);
+  return data;
+}
+function browserCommand(url, platform = process.platform) {
+  if (platform === "win32") return ["rundll32", ["url.dll,FileProtocolHandler", url]];
+  if (platform === "darwin") return ["open", [url]];
+  return ["xdg-open", [url]];
+}
+function openBrowser(url) {
+  const [command, args] = browserCommand(url);
+  try {
+    const child = spawn(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function login(log) {
+  const base = apiUrl();
+  const state = randomBytes(16).toString("base64url");
+  const { verifier, challenge } = pkcePair();
+  let resolveCode, rejectCode;
+  const codePromise = new Promise((ok, fail) => {
+    resolveCode = ok;
+    rejectCode = fail;
+  });
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (url.pathname !== "/callback") {
+      res.writeHead(404).end();
+      return;
+    }
+    const error = url.searchParams.get("error");
+    const ok = !error && url.searchParams.get("state") === state && url.searchParams.get("code");
+    res.writeHead(ok ? 200 : 400, { "content-type": "text/html; charset=utf-8" });
+    res.end(`<!doctype html><meta charset="utf-8"><title>Hospede Aqui CLI</title><body style="font-family:system-ui;padding:40px">
+      <h2>${ok ? "Pronto! Pode fechar esta aba e voltar ao terminal." : "N\xE3o foi poss\xEDvel autorizar a CLI."}</h2></body>`);
+    if (ok) resolveCode(url.searchParams.get("code"));
+    else rejectCode(new CliError(error === "access_denied" ? "Autoriza\xE7\xE3o recusada no navegador." : "Resposta inv\xE1lida do login (state n\xE3o confere)."));
+  });
+  await new Promise((ok) => server.listen(0, "127.0.0.1", ok));
+  const redirectUri = `http://127.0.0.1:${server.address().port}/callback`;
+  const timer = setTimeout(() => rejectCode(new CliError("Tempo de login esgotado (5 min).")), LOGIN_TIMEOUT_MS);
+  try {
+    const client = await postJson(`${base}/oauth/register`, {
+      client_name: "Hospede Aqui CLI",
+      redirect_uris: [redirectUri],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none"
+    });
+    const url = authorizeUrl(base, { clientId: client.client_id, redirectUri, challenge, state });
+    log("Abrindo o navegador para autorizar a CLI. Se n\xE3o abrir, acesse:");
+    log(url);
+    openBrowser(url);
+    const code = await codePromise;
+    const token = await postForm(`${base}/oauth/token`, {
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: redirectUri,
+      code_verifier: verifier,
+      client_id: client.client_id,
+      resource: `${base}/mcp`
+    });
+    writeCredentials({
+      apiUrl: base,
+      clientId: client.client_id,
+      accessToken: token.access_token,
+      refreshToken: token.refresh_token,
+      expiresAt: Date.now() + token.expires_in * 1e3,
+      scope: token.scope
+    });
+  } finally {
+    clearTimeout(timer);
+    server.close();
+  }
+}
+async function postJson(url, body) {
+  const response = await fetch(url, { method: "POST", headers: { "content-type": "application/json", accept: "application/json" }, body: JSON.stringify(body) });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok) throw new CliError(`Falha ao registrar a CLI: ${String(data.error_description ?? data.error ?? response.status)}`);
+  return data;
+}
+async function accessToken(options = {}) {
+  const pat = process.env.HOSPEDEAQUI_TOKEN?.trim();
+  if (pat) return pat;
+  const stored = readCredentials();
+  if (!stored) throw new CliError("Voc\xEA n\xE3o est\xE1 logado. Rode `hacli login` (ou defina HOSPEDEAQUI_TOKEN com um token de acesso).");
+  if (stored.apiUrl !== apiUrl()) throw new CliError(`O login salvo \xE9 de ${stored.apiUrl}. Rode \`hacli login\` de novo.`);
+  if (!options.forceRefresh && stored.expiresAt - 6e4 > Date.now()) return stored.accessToken;
+  refreshing ??= refreshOnce(stored.accessToken).finally(() => {
+    refreshing = null;
+  });
+  return refreshing;
+}
+var refreshing = null;
+var LOCK_STALE_MS = 6e4;
+async function withRefreshLock(fn) {
+  const lock = join2(configDir(), "refresh.lock");
+  const ownerFile = join2(lock, "owner");
+  const token = `${process.pid}-${randomBytes(8).toString("hex")}`;
+  mkdirSync2(configDir(), { recursive: true, mode: 448 });
+  const deadline = Date.now() + 3e4;
+  for (; ; ) {
+    try {
+      mkdirSync2(lock);
+      writeFileSync2(ownerFile, token);
+      break;
+    } catch {
+      try {
+        if (Date.now() - statSync(lock).mtimeMs > LOCK_STALE_MS) rmSync2(lock, { recursive: true, force: true });
+      } catch {
+      }
+      if (Date.now() > deadline) throw new CliError("Outra execu\xE7\xE3o da CLI est\xE1 renovando o login. Tente de novo.");
+      await new Promise((r) => setTimeout(r, 200));
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    try {
+      if (readFileSync2(ownerFile, "utf8") === token) rmSync2(lock, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+async function refreshOnce(staleAccessToken) {
+  return withRefreshLock(async () => {
+    const stored = readCredentials();
+    if (!stored) throw new CliError("Voc\xEA n\xE3o est\xE1 logado. Rode `hacli login`.");
+    if (stored.accessToken !== staleAccessToken && stored.expiresAt - 6e4 > Date.now()) return stored.accessToken;
+    let token;
+    try {
+      token = await postForm(`${stored.apiUrl}/oauth/token`, {
+        grant_type: "refresh_token",
+        refresh_token: stored.refreshToken,
+        client_id: stored.clientId,
+        resource: `${stored.apiUrl}/mcp`
+      });
+    } catch {
+      clearCredentials();
+      throw new CliError("Sua sess\xE3o expirou ou foi revogada. Rode `hacli login` de novo.");
+    }
+    const next = {
+      ...stored,
+      accessToken: token.access_token,
+      refreshToken: token.refresh_token,
+      expiresAt: Date.now() + token.expires_in * 1e3,
+      scope: token.scope
+    };
+    writeCredentials(next);
+    return next.accessToken;
+  });
+}
+async function logout() {
+  const stored = readCredentials();
+  if (!stored) return "none";
+  const revoke = (token) => fetch(`${stored.apiUrl}/oauth/revoke`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ token, client_id: stored.clientId }).toString()
+  }).then((r) => r.ok).catch(() => false);
+  const results = await Promise.all([revoke(stored.refreshToken), revoke(stored.accessToken)]);
+  clearCredentials();
+  return results.every(Boolean) ? "revoked" : "local_only";
+}
+
+// src/api.ts
+var nextId = 1;
+function toolPayload(result) {
+  const text = result.content?.find((c) => c.type === "text")?.text;
+  if (result.isError) throw new CliError(text || "A opera\xE7\xE3o falhou.");
+  if (result.structuredContent !== void 0) return result.structuredContent;
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+async function callTool(name, args = {}) {
+  const token = await accessToken();
+  const response = await fetch(`${apiUrl()}/mcp`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json", accept: "application/json, text/event-stream" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: nextId++, method: "tools/call", params: { name, arguments: args } })
+  });
+  if (response.status === 401) throw new CliError("Token inv\xE1lido, expirado ou revogado. Rode `hacli login` (ou confira HOSPEDEAQUI_TOKEN).");
+  if (response.status === 429) throw new CliError("Muitas requisi\xE7\xF5es. Aguarde um minuto e tente de novo.");
+  const data = await response.json().catch(() => null);
+  if (!response.ok || !data) throw new CliError(`A API respondeu ${response.status}.`);
+  if (data.error) throw new CliError(data.error.message || "Erro na API.");
+  return toolPayload(data.result ?? {});
+}
+async function runMutation(name, args, timeoutMs = 6e4) {
+  const queued = await callTool(name, { idempotencyKey: `cli-${randomUUID()}`, ...args });
+  if (!queued?.operationId) return queued;
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    const operation = await callTool("operation_get", { operationId: queued.operationId });
+    if (operation.status === "succeeded") return operation.result;
+    if (operation.status === "failed" || operation.status === "cancelled") throw new CliError(operation.error?.message || `Opera\xE7\xE3o ${operation.status}.`);
+    if (Date.now() > deadline) throw new CliError(`A opera\xE7\xE3o ainda est\xE1 em andamento (${queued.operationId}).`);
+    await new Promise((r) => setTimeout(r, 1500));
+  }
+}
+var StreamTokenExpired = class extends Error {
+};
+async function streamEvents(path, onEvent, signal, options = {}) {
+  const token = await accessToken(options);
+  const response = await fetch(`${apiUrl()}${path}`, { headers: { authorization: `Bearer ${token}`, accept: "text/event-stream" }, signal });
+  if (response.status === 401) throw new CliError("Token inv\xE1lido, expirado ou revogado. Rode `hacli login`.");
+  if (!response.ok || !response.body) {
+    const body = await response.json().catch(() => ({}));
+    throw new CliError(body.message || `A API respondeu ${response.status}.`);
+  }
+  const decoder = new TextDecoder();
+  let buffer = "";
+  for await (const chunk of response.body) {
+    buffer += decoder.decode(chunk, { stream: true });
+    const { events, rest } = parseSse(buffer);
+    buffer = rest;
+    for (const event of events) {
+      if (event.type === "error" && event.code === "token_expired") throw new StreamTokenExpired();
+      if (onEvent(event) === false) return;
+    }
+  }
+}
+function parseSse(buffer) {
+  const parts = buffer.replace(/\r\n/g, "\n").split("\n\n");
+  const rest = parts.pop() ?? "";
+  const events = [];
+  for (const part of parts) {
+    const data = part.split("\n").filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join("\n");
+    if (!data) continue;
+    try {
+      events.push(JSON.parse(data));
+    } catch {
+    }
+  }
+  return { events, rest };
+}
+
+// src/commands/apps.ts
+var appUrl = (app) => app.customDomain || app.subdomain ? `https://${app.customDomain || app.subdomain}` : null;
+async function listApps() {
+  const data = await callTool("app_list");
+  return (data.apps ?? []).filter((app) => !app.previewOfAppId);
+}
+async function resolveApp(flag) {
+  if (flag) {
+    const apps = await listApps();
+    const found = apps.find((app) => app.id === flag || app.name === flag);
+    if (!found) throw new CliError(`App "${flag}" n\xE3o encontrado. Veja a lista com \`hacli apps\`.`);
+    return found;
+  }
+  const linked = findLink();
+  if (!linked) throw new CliError("Nenhum app vinculado a esta pasta. Rode `hacli link` ou passe --app <nome>.");
+  if (linked.link.apiUrl !== apiUrl()) throw new CliError(`Esta pasta est\xE1 vinculada a ${linked.link.apiUrl}.`);
+  return { id: linked.link.appId, name: linked.link.appName };
+}
+async function appsCommand(print) {
+  const apps = await listApps();
+  if (!apps.length) return print("Nenhum app nesta organiza\xE7\xE3o.");
+  print(table(["NOME", "STATUS", "URL", "ID"], apps.map((app) => [app.name, statusColor(app.status ?? "\u2014"), appUrl(app) ?? "\u2014", color.dim(app.id)])));
+}
+async function linkCommand(print, target) {
+  if (!target) {
+    const apps = await listApps();
+    throw new CliError(`Informe o app: \`hacli link <nome>\`.
+Apps: ${apps.map((a) => a.name).join(", ") || "nenhum"}`);
+  }
+  const app = await resolveApp(target);
+  const path = writeLink({ appId: app.id, appName: app.name, apiUrl: apiUrl() });
+  print(`${color.green("\u2713")} Pasta vinculada a ${color.bold(app.name)} (${path}).`);
+}
+async function statusCommand(print, appFlag) {
+  const target = await resolveApp(appFlag);
+  const [{ app }, { deployments }] = await Promise.all([
+    callTool("app_get", { appId: target.id }),
+    callTool("app_deployment_list", { appId: target.id })
+  ]);
+  print(`${color.bold(app.name)}  ${statusColor(app.status ?? "\u2014")}`);
+  if (appUrl(app)) print(`URL:    ${appUrl(app)}`);
+  if (app.branch) print(`Branch: ${app.branch}`);
+  const last = deployments?.[0];
+  if (last) print(`\xDAltimo deploy: ${statusColor(last.status)}${last.phase ? ` (${last.phase})` : ""} \xB7 ${last.commitSha?.slice(0, 7) ?? "\u2014"} \xB7 ${last.createdAt ?? ""}`);
+}
+async function restartCommand(print, appFlag) {
+  const app = await resolveApp(appFlag);
+  await runMutation("app_restart", { appId: app.id });
+  print(`${color.green("\u2713")} ${app.name} reiniciando.`);
+}
+async function rollbackCommand(print, appFlag, deploymentId) {
+  const app = await resolveApp(appFlag);
+  let target = deploymentId;
+  if (!target) {
+    const { deployments } = await callTool("app_deployment_list", { appId: app.id });
+    const successes = (deployments ?? []).filter((d) => d.status === "success");
+    target = successes[1]?.id;
+    if (!target) throw new CliError("N\xE3o h\xE1 deploy anterior bem-sucedido para voltar. Informe o ID: `hacli rollback <deploymentId>`.");
+  }
+  await runMutation("app_rollback", { appId: app.id, deploymentId: target });
+  print(`${color.green("\u2713")} Rollback de ${app.name} para ${target} agendado.`);
+}
+async function openCommand(print, appFlag) {
+  const target = await resolveApp(appFlag);
+  const { app } = await callTool("app_get", { appId: target.id });
+  const url = appUrl(app);
+  if (!url) throw new CliError("O app ainda n\xE3o tem endere\xE7o p\xFAblico.");
+  print(url);
+  openBrowser(url);
+}
+async function previewsCommand(print, appFlag) {
+  const app = await resolveApp(appFlag);
+  const { previews } = await callTool("app_preview_list", { appId: app.id });
+  if (!previews?.length) return print("Nenhum preview aberto. Previews nascem de pull requests (plano Hobby em diante).");
+  print(table(["PR", "BRANCH", "ESTADO", "DEPLOY", "URL"], previews.map((p) => [
+    `#${p.prNumber}`,
+    p.headRef,
+    statusColor(p.state),
+    p.latestDeployment ? statusColor(p.latestDeployment.status) : "\u2014",
+    p.url ?? "\u2014"
+  ])));
+}
+
+// src/commands/deploy.ts
+var TERMINAL = /* @__PURE__ */ new Set(["success", "failed", "cancelled"]);
+var WAIT_TIMEOUT_MS = 60 * 6e4;
+async function deployCommand(print, write, opts) {
+  const app = await resolveApp(opts.app);
+  const created = await runMutation("app_deploy", { appId: app.id, ...opts.noCache ? { options: { noCache: true } } : {} });
+  let deploymentId = created?.id;
+  if (!deploymentId) {
+    const { deployments } = await callTool("app_deployment_list", { appId: app.id });
+    deploymentId = deployments?.[0]?.id;
+  }
+  print(`${color.green("\u2713")} Deploy de ${color.bold(app.name)} agendado${deploymentId ? ` (${deploymentId})` : ""}.`);
+  if (created?.queuePosition) print(color.dim(`Posi\xE7\xE3o na fila: ${created.queuePosition}`));
+  if (!opts.wait) return;
+  if (!deploymentId) throw new CliError("N\xE3o foi poss\xEDvel identificar o deploy para acompanhar.");
+  const status = await followDeployment(app.id, deploymentId, write);
+  print("");
+  print(`Deploy ${statusColor(status)}.`);
+  if (status !== "success") throw new CliError(`O deploy terminou como ${status}.`, 1);
+}
+async function followDeployment(appId, deploymentId, write) {
+  const deadline = Date.now() + WAIT_TIMEOUT_MS;
+  let finalStatus = null;
+  let forceRefresh = false;
+  while (!finalStatus && Date.now() < deadline) {
+    try {
+      await streamEvents(`/cli/apps/${encodeURIComponent(appId)}/deployments/${encodeURIComponent(deploymentId)}/logs/stream`, (event) => {
+        if (event.type === "update" || event.type === "reset") write(String(event.text ?? ""));
+        if (event.type === "done") {
+          finalStatus = String(event.status);
+          return false;
+        }
+        if (event.type === "error") throw new CliError(String(event.message ?? "Erro no stream de logs."));
+      }, void 0, { forceRefresh });
+      forceRefresh = false;
+    } catch (error) {
+      if (error instanceof StreamTokenExpired) {
+        forceRefresh = true;
+        continue;
+      }
+      if (error instanceof CliError) throw error;
+    }
+    if (finalStatus) break;
+    const { deployments } = await callTool("app_deployment_list", { appId });
+    const current = deployments?.find((d) => d.id === deploymentId);
+    if (current && TERMINAL.has(current.status)) finalStatus = current.status;
+    else await new Promise((r) => setTimeout(r, 3e3));
+  }
+  if (!finalStatus) throw new CliError("Tempo de espera esgotado (60 min).");
+  return finalStatus;
+}
+function newLines(previous, current) {
+  for (let overlap = Math.min(previous.length, current.length); overlap > 0; overlap--) {
+    let same = true;
+    for (let i = 0; i < overlap; i++) if (previous[previous.length - overlap + i] !== current[i]) {
+      same = false;
+      break;
+    }
+    if (same) return current.slice(overlap);
+  }
+  return current;
+}
+async function logsCommand(print, opts) {
+  const app = await resolveApp(opts.app);
+  if (opts.deployment) {
+    if (opts.follow) {
+      await followDeployment(app.id, opts.deployment, (text) => process.stdout.write(text));
+      return;
+    }
+    const { logs } = await callTool("app_deployment_logs", { appId: app.id, deploymentId: opts.deployment });
+    return print(logs);
+  }
+  if (!opts.follow) {
+    const { logs } = await callTool("app_logs", { appId: app.id, lines: opts.lines ?? 200 });
+    return print((logs ?? []).join("\n"));
+  }
+  let forceRefresh = false, seenInitial = false;
+  const recent = [];
+  const show = (lines) => {
+    for (const line of lines) {
+      print(line);
+      recent.push(line);
+    }
+    if (recent.length > 500) recent.splice(0, recent.length - 500);
+  };
+  for (; ; ) {
+    try {
+      await streamEvents(`/cli/apps/${encodeURIComponent(app.id)}/logs/stream`, (event) => {
+        const lines = event.lines ?? [];
+        if (event.type === "initial") {
+          show(seenInitial ? newLines(recent, lines) : lines);
+          seenInitial = true;
+        }
+        if (event.type === "update") show(lines);
+        if (event.type === "timeout") print(color.dim("\u2014 stream encerrado ap\xF3s 30 min; rode de novo para continuar \u2014"));
+        if (event.type === "error") throw new CliError(String(event.message ?? "Erro no stream de logs."));
+      }, void 0, { forceRefresh });
+      return;
+    } catch (error) {
+      if (error instanceof StreamTokenExpired) {
+        forceRefresh = true;
+        continue;
+      }
+      throw error;
+    }
+  }
+}
+
+// src/commands/env.ts
+async function envCommand(print, sub, args, appFlag) {
+  const app = await resolveApp(appFlag);
+  if (!sub || sub === "ls" || sub === "list") {
+    const { envs } = await callTool("app_env_list", { appId: app.id });
+    if (!envs?.length) return print("Nenhuma vari\xE1vel definida.");
+    return print(table(["CHAVE", "VALOR", "ESCOPO"], envs.map((env) => [env.key, color.dim(env.value), env.scope ?? "both"])));
+  }
+  if (sub === "set") {
+    if (!args.length) throw new CliError("Uso: hacli env set CHAVE=valor [OUTRA=valor ...]");
+    const { envs } = await callTool("app_env_list", { appId: app.id });
+    for (const pair of args) {
+      const eq = pair.indexOf("=");
+      if (eq <= 0) throw new CliError(`Formato inv\xE1lido: "${pair}". Use CHAVE=valor.`);
+      const key = pair.slice(0, eq), value = pair.slice(eq + 1);
+      const existing = envs?.find((env) => env.key === key);
+      await runMutation("app_env_set", existing ? { appId: app.id, envId: existing.id, value } : { appId: app.id, key, value });
+      print(`${color.green("\u2713")} ${key} ${existing ? "atualizada" : "criada"}.`);
+    }
+    return print(color.dim("As vari\xE1veis valem a partir do pr\xF3ximo deploy (`hacli deploy`)."));
+  }
+  if (sub === "unset" || sub === "rm") {
+    if (!args.length) throw new CliError("Uso: hacli env unset CHAVE [OUTRA ...]");
+    const { envs } = await callTool("app_env_list", { appId: app.id });
+    for (const key of args) {
+      const existing = envs?.find((env) => env.key === key);
+      if (!existing) {
+        print(color.yellow(`\u2022 ${key} n\xE3o existe; nada a remover.`));
+        continue;
+      }
+      await runMutation("app_env_delete", { appId: app.id, envId: existing.id });
+      print(`${color.green("\u2713")} ${key} removida.`);
+    }
+    return print(color.dim("A remo\xE7\xE3o vale a partir do pr\xF3ximo deploy."));
+  }
+  throw new CliError(`Subcomando desconhecido: env ${sub}. Use ls, set ou unset.`);
+}
+
+// src/index.ts
+var VERSION = "0.1.0";
+var HELP = `${color.bold("hacli")} \u2014 CLI da Hospede Aqui
+
+Uso: hacli <comando> [op\xE7\xF5es]
+
+Conta
+  login                      Autoriza a CLI no navegador
+  logout                     Revoga e apaga o login salvo
+  whoami                     Mostra usu\xE1rio, organiza\xE7\xE3o e plano
+
+Apps
+  apps                       Lista os apps da organiza\xE7\xE3o
+  link <app>                 Vincula a pasta atual a um app (.hospedeaqui.json)
+  status                     Status do app e do \xFAltimo deploy
+  deploy [--wait] [--no-cache]  Agenda um deploy (--wait acompanha e falha se o deploy falhar)
+  logs [-f] [-n 200] [--deployment <id>]  Logs de runtime (ou de um deploy)
+  env ls | set K=v ... | unset K ...      Vari\xE1veis do app (valores mascarados)
+  rollback [deploymentId]    Volta para um deploy anterior
+  restart                    Reinicia o app
+  open                       Abre o app no navegador
+  previews                   Previews por pull request
+
+Op\xE7\xF5es gerais
+  --app <nome|id>            App alvo (sem link na pasta)
+  -h, --help | -v, --version
+
+Em CI, defina HOSPEDEAQUI_TOKEN com um token de acesso (Integra\xE7\xF5es \u203A MCP \u203A Tokens).
+Documenta\xE7\xE3o: https://hospedeaqui.cloud/cli`;
+async function main(argv) {
+  const { values, positionals } = parseArgs({
+    args: argv,
+    allowPositionals: true,
+    strict: true,
+    options: {
+      app: { type: "string" },
+      wait: { type: "boolean" },
+      "no-cache": { type: "boolean" },
+      follow: { type: "boolean", short: "f" },
+      lines: { type: "string", short: "n" },
+      deployment: { type: "string" },
+      help: { type: "boolean", short: "h" },
+      version: { type: "boolean", short: "v" }
+    }
+  });
+  const [command, ...rest] = positionals;
+  const print = (line) => process.stdout.write(line + "\n");
+  if (values.version) return print(VERSION);
+  if (values.help || !command || command === "help") return print(HELP);
+  switch (command) {
+    case "login":
+      await login(print);
+      return print(`${color.green("\u2713")} Login feito em ${apiUrl()}.`);
+    case "logout": {
+      const result = await logout();
+      if (result === "none") return print("Nenhum login salvo.");
+      return print(result === "revoked" ? `${color.green("\u2713")} Login removido e sess\xE3o revogada.` : `${color.yellow("!")} Login removido deste computador, mas o servidor n\xE3o confirmou a revoga\xE7\xE3o. Revogue em Integra\xE7\xF5es \u203A MCP.`);
+    }
+    case "whoami": {
+      const ctx = await callTool("platform_get_context");
+      return print(`${ctx.user?.name ?? "\u2014"} <${ctx.user?.email ?? "\u2014"}>
+Organiza\xE7\xE3o: ${ctx.organization?.name ?? "\u2014"}
+Plano: ${ctx.plan?.name ?? "sem plano"}`);
+    }
+    case "apps":
+      return appsCommand(print);
+    case "link":
+      return linkCommand(print, rest[0]);
+    case "status":
+      return statusCommand(print, values.app);
+    case "deploy":
+      return deployCommand(print, (text) => process.stdout.write(text), { app: values.app, wait: values.wait, noCache: values["no-cache"] });
+    case "logs":
+      return logsCommand(print, {
+        app: values.app,
+        follow: values.follow,
+        deployment: values.deployment,
+        lines: values.lines ? Math.min(1e3, Math.max(1, Number(values.lines) || 200)) : void 0
+      });
+    case "env":
+      return envCommand(print, rest[0], rest.slice(1), values.app);
+    case "rollback":
+      return rollbackCommand(print, values.app, rest[0]);
+    case "restart":
+      return restartCommand(print, values.app);
+    case "open":
+      return openCommand(print, values.app);
+    case "previews":
+      return previewsCommand(print, values.app);
+    default:
+      throw new CliError(`Comando desconhecido: ${command}. Veja \`hacli --help\`.`);
+  }
+}
+
+// src/bin.ts
+main(process.argv.slice(2)).catch((error) => {
+  if (error instanceof CliError) {
+    process.stderr.write(color.red(`\u2717 ${error.message}`) + "\n");
+    process.exit(error.exitCode);
+  }
+  const code = error.code;
+  if (code?.startsWith("ERR_PARSE_ARGS")) {
+    process.stderr.write(color.red(`\u2717 ${error.message}`) + "\n");
+    process.exit(2);
+  }
+  process.stderr.write(color.red(`\u2717 Erro inesperado: ${error instanceof Error ? error.message : String(error)}`) + "\n");
+  process.exit(1);
+});

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@hacloud/cli",
+  "version": "0.1.0",
+  "description": "hacli, a CLI da Hospede Aqui: deploy, logs, variáveis e previews dos seus apps pelo terminal.",
+  "private": false,
+  "type": "module",
+  "bin": {
+    "hacli": "dist/hacli.mjs"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "esbuild src/bin.ts --bundle --platform=node --format=esm --target=node20 --outfile=dist/hacli.mjs --banner:js=\"#!/usr/bin/env node\"",
+    "typecheck": "tsc --noEmit",
+    "test": "tsx --test \"test/**/*.test.ts\"",
+    "dev": "tsx src/bin.ts"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "esbuild": "^0.25.12",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0"
+  },
+  "license": "UNLICENSED",
+  "publishConfig": {
+    "access": "public"
+  },
+  "homepage": "https://hospedeaqui.cloud/cli",
+  "keywords": [
+    "hospede aqui",
+    "hacli",
+    "deploy",
+    "cli",
+    "paas"
+  ]
+}