@hiyve/cli 1.0.13 → 1.0.17

package/README.md

@@ -107,6 +107,18 @@ Set `HIYVE_API_KEY` in your CI environment (GitHub Actions secrets, AWS SSM, etc
 - Check your internet connection
 - The registry may be temporarily unavailable
 
+### "401 Unauthorized" when running `npx @hiyve/cli login`
+
+If you've previously logged in and your token has expired, `npx` may fail because npm routes all `@hiyve/*` packages (including the CLI) through the private registry. To fix this, remove the stale registry line from your `~/.npmrc` and re-run login:
+
+```bash
+# Remove the stale @hiyve registry config
+npm config delete @hiyve:registry
+
+# Now login will work again
+npx @hiyve/cli login
+```
+
 ### Packages not installing
 
 After login, verify your configuration:
@@ -129,6 +141,6 @@ cat ~/.npmrc | grep hiyve
 
 ## Support
 
-- Documentation: https://docs.hiyve.io
+- Documentation: https://sdk.hiyve.dev
 - Issues: https://github.com/hiyve/hiyve-sdk/issues
 - Email: support@hiyve.io

package/bin/hiyve.js

@@ -18,7 +18,7 @@ program
   .name('hiyve')
   .description('Hiyve SDK CLI - Configure npm for private @hiyve packages')
   .version('1.0.0')
-  .option('--dev', 'Use dev registry (api.muziemedia.com)')
+  .option('--dev', 'Retained for compatibility — there is no separate dev registry; same host as production')
   .hook('preAction', () => {
     if (program.opts().dev) {
       setDevMode(true);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hiyve/cli",
-  "version": "1.0.13",
+  "version": "1.0.17",
   "description": "Hiyve SDK CLI - Configure npm for private @hiyve packages",
   "type": "module",
   "bin": {
@@ -12,7 +12,7 @@
     "src"
   ],
   "scripts": {
-    "test": "vitest run",
+    "test": "vitest run --pool=forks --poolOptions.forks.singleFork",
     "test:watch": "vitest",
     "deploy": "./deploy.sh"
   },
@@ -44,6 +44,6 @@
     "prompts": "^2.4.2"
   },
   "devDependencies": {
-    "vitest": "^2.1.9"
+    "vitest": "^3.2.6"
   }
 }

package/src/commands/init.js

@@ -217,7 +217,7 @@ export default defineConfig({
 }
 
 function generateEnvExample(template) {
-  let env = `# Hiyve API Key (from api.hiyve.dev)
+  let env = `# Hiyve API Key (from cloud.hiyve.io)
 HIYVE_API_KEY=pk_live_your_api_key_here
 
 # Room configuration
@@ -227,7 +227,7 @@ HIYVE_SIGNALING_URL=https://signal.hiyve.dev
   if (template.features.intelligence) {
     env += `
 # Cloud API (for AI features)
-HIYVE_CLOUD_URL=https://api.hiyve.dev
+HIYVE_CLOUD_URL=https://cloud.hiyve.io
 `;
   }
 
@@ -383,7 +383,7 @@ app.use(express.json());
 
 const API_KEY = process.env.HIYVE_API_KEY;
 const SIGNALING_URL = process.env.HIYVE_SIGNALING_URL || 'https://signal.hiyve.dev';
-${hasCloud ? `const CLOUD_URL = process.env.HIYVE_CLOUD_URL || 'https://api.hiyve.dev';\n` : ''}
+${hasCloud ? `const CLOUD_URL = process.env.HIYVE_CLOUD_URL || 'https://cloud.hiyve.io';\n` : ''}
 /**
  * Generate a room token for the client.
  * In production, add your own authentication before issuing tokens.

package/src/commands/list.js

@@ -6,8 +6,9 @@
 
 import chalk from 'chalk';
 import ora from 'ora';
-import { getApiUrl, isDevMode } from '../config.js';
+import { getApiUrl } from '../config.js';
 import { getCurrentConfig } from '../utils/npmrc.js';
+import { printDevHint, printDevModeBanner, fetchWithTimeout } from '../utils/output.js';
 
 /**
  * List available packages
@@ -16,9 +17,7 @@ export async function list() {
   console.log('');
   console.log(chalk.cyan('Available @hiyve Packages'));
   console.log(chalk.gray('─'.repeat(40)));
-  if (isDevMode()) {
-    console.log(chalk.yellow('  Mode: development (--dev)'));
-  }
+  printDevModeBanner();
   console.log('');
 
   // Get current config for auth token
@@ -33,7 +32,7 @@ export async function list() {
   const spinner = ora('Fetching packages...').start();
 
   try {
-    const response = await fetch(`${getApiUrl()}packages`, {
+    const response = await fetchWithTimeout(`${getApiUrl()}packages`, {
       headers: {
         Authorization: `Bearer ${config.apiKey}`,
       },
@@ -44,14 +43,7 @@ export async function list() {
       const error = await response.json().catch(() => ({ error: 'Unknown error' }));
       console.log('');
       console.log(chalk.red(`  ${error.error || 'Failed to fetch packages'}`));
-      if (isDevMode()) {
-        console.log(chalk.gray('  You are using --dev mode (development registry).'));
-        console.log(chalk.gray('  If you meant to use production, run without --dev:'));
-        console.log(chalk.cyan('    npx @hiyve/cli list'));
-      } else {
-        console.log(chalk.gray('  If you meant to use the development registry, use --dev:'));
-        console.log(chalk.cyan('    npx @hiyve/cli --dev list'));
-      }
+      printDevHint('list');
       process.exit(1);
     }
 
@@ -82,18 +74,17 @@ export async function list() {
     console.log(chalk.gray('  npm install <package-name>'));
     console.log('');
   } catch (err) {
-    spinner.fail('Connection failed');
-    console.log('');
-    console.log(chalk.red(`  ${err.message}`));
-    console.log(chalk.gray('  Please check your internet connection.'));
-    if (isDevMode()) {
-      console.log(chalk.gray('  You are using --dev mode (development registry).'));
-      console.log(chalk.gray('  If you meant to use production, run without --dev:'));
-      console.log(chalk.cyan('    npx @hiyve/cli list'));
+    if (err.name === 'AbortError') {
+      spinner.fail('Request timed out');
+      console.log('');
+      console.log(chalk.gray('  The server did not respond within 15 seconds.'));
     } else {
-      console.log(chalk.gray('  If you meant to use the development registry, use --dev:'));
-      console.log(chalk.cyan('    npx @hiyve/cli --dev list'));
+      spinner.fail('Connection failed');
+      console.log('');
+      console.log(chalk.red(`  ${err.message}`));
     }
+    console.log(chalk.gray('  Please check your internet connection.'));
+    printDevHint('list');
     process.exit(1);
   }
 }

package/src/commands/login.js

@@ -8,7 +8,8 @@ import prompts from 'prompts';
 import chalk from 'chalk';
 import ora from 'ora';
 import { configureNpmrc } from '../utils/npmrc.js';
-import { getApiUrl, getRegistryUrl, isDevMode } from '../config.js';
+import { getApiUrl, getRegistryUrl } from '../config.js';
+import { printDevHint, printDevModeBanner, fetchWithTimeout } from '../utils/output.js';
 
 /**
  * Login to Hiyve and configure npm
@@ -21,9 +22,7 @@ export async function login(options) {
   console.log('');
   console.log(chalk.cyan('Hiyve SDK Authentication'));
   console.log(chalk.gray('─'.repeat(40)));
-  if (isDevMode()) {
-    console.log(chalk.yellow('  Mode: development (--dev)'));
-  }
+  printDevModeBanner();
   console.log('');
 
   // Prompt for API key if not provided
@@ -78,7 +77,7 @@ export async function login(options) {
   const spinner = ora('Verifying API key...').start();
 
   try {
-    const response = await fetch(`${getApiUrl()}verify`, {
+    const response = await fetchWithTimeout(`${getApiUrl()}verify`, {
       headers: {
         Authorization: `Bearer ${apiKey}`,
       },
@@ -89,36 +88,32 @@ export async function login(options) {
       spinner.fail('API key verification failed');
       console.log('');
       console.log(chalk.red(`  ${error.error || 'Invalid API key'}`));
-      if (isDevMode()) {
-        console.log(chalk.gray('  You are using --dev mode (development registry).'));
-        console.log(chalk.gray('  If you meant to use production, run without --dev:'));
-        console.log(chalk.cyan('    npx @hiyve/cli login'));
-      } else {
-        console.log(chalk.gray('  If you are using a test key (pk_test_*), use --dev mode:'));
-        console.log(chalk.cyan('    npx @hiyve/cli --dev login'));
-      }
+      printDevHint('login');
       process.exit(1);
     }
 
     const data = await response.json();
     spinner.succeed('API key verified');
 
+    // Server returns a masked key — always mask client-side as a safety net
     if (data.apiKey) {
-      console.log(chalk.gray(`  Account: ${data.apiKey}`));
+      const display = data.apiKey.length > 12
+        ? `${data.apiKey.slice(0, 8)}...${data.apiKey.slice(-4)}`
+        : data.apiKey;
+      console.log(chalk.gray(`  Account: ${display}`));
     }
   } catch (err) {
-    spinner.fail('Connection failed');
-    console.log('');
-    console.log(chalk.red(`  ${err.message}`));
-    console.log(chalk.gray('  Please check your internet connection.'));
-    if (isDevMode()) {
-      console.log(chalk.gray('  You are using --dev mode (development registry).'));
-      console.log(chalk.gray('  If you meant to use production, run without --dev:'));
-      console.log(chalk.cyan('    npx @hiyve/cli login'));
+    if (err.name === 'AbortError') {
+      spinner.fail('Request timed out');
+      console.log('');
+      console.log(chalk.gray('  The server did not respond within 15 seconds.'));
     } else {
-      console.log(chalk.gray('  If you meant to use the development registry, use --dev:'));
-      console.log(chalk.cyan('    npx @hiyve/cli --dev login'));
+      spinner.fail('Connection failed');
+      console.log('');
+      console.log(chalk.red(`  ${err.message}`));
     }
+    console.log(chalk.gray('  Please check your internet connection.'));
+    printDevHint('login');
     process.exit(1);
   }
 
@@ -142,7 +137,7 @@ export async function login(options) {
 
   // Fetch available packages from registry
   try {
-    const packagesResponse = await fetch(`${getApiUrl()}packages`, {
+    const packagesResponse = await fetchWithTimeout(`${getApiUrl()}packages`, {
       headers: { Authorization: `Bearer ${apiKey}` },
     });
 

package/src/config.js

@@ -6,13 +6,36 @@
  *   - Registry URL: what goes into ~/.npmrc for npm to fetch tarballs. Always prod.
  */
 
-const PROD_API_URL = 'https://api.hiyve.dev/registry/';
-const DEV_API_URL = 'https://api.muziemedia.com/registry/';
+// The CLI's own API — key verification and the package catalogue, served by
+// hiyve-cloud at /registry/{verify,packages}.
+const PROD_API_URL = 'https://cloud.hiyve.io/registry/';
+// No separate development cloud exists — kept so --dev stays a valid flag,
+// but it reaches the SAME live host (2026-08-24).
+const DEV_API_URL = 'https://cloud.hiyve.io/registry/';
+
+/**
+ * Where npm actually fetches tarballs. DELIBERATELY NOT the API URL.
+ *
+ * This used to return getApiUrl(), on the assumption that "tarballs are
+ * served through the same API". They are not: the cloud's /registry proxy
+ * serves a stale catalogue whose `dist.tarball` URLs still name
+ * api.muziemedia.com — a host with no DNS record — so a packument fetch
+ * succeeded and the download that followed failed with ENOTFOUND. npm does
+ * not rewrite tarball hosts for a non-npmjs registry, so the URL in the
+ * metadata is the URL it uses.
+ *
+ * registry.muziemedia.com is the Verdaccio registry `changeset publish`
+ * actually publishes to. Verified 2026-08-24 with a customer pk_ key: it
+ * authenticates API keys natively (the proxy is not needed for auth),
+ * serves current versions, its tarball URLs point at itself, and the
+ * download returns a valid package.
+ */
+const REGISTRY_URL_VALUE = 'https://registry.muziemedia.com/';
 
 let _devMode = false;
 
 /**
- * Enable dev mode (CLI API calls go to api.muziemedia.com)
+ * Enable dev mode (there is no separate dev cloud — same host as prod)
  */
 export function setDevMode(enabled) {
   _devMode = enabled;
@@ -28,10 +51,10 @@ export function getApiUrl() {
 
 /**
  * Get the registry URL for ~/.npmrc (where npm fetches tarballs).
- * Must match the API URL since tarballs are served through the API.
+ * Independent of the API URL, and of --dev: there is one registry.
  */
 export function getRegistryUrl() {
-  return _devMode ? DEV_API_URL : PROD_API_URL;
+  return REGISTRY_URL_VALUE;
 }
 
 /**
@@ -42,7 +65,8 @@ export function isDevMode() {
 }
 
 // Backwards-compatible named export
-export const REGISTRY_URL = PROD_API_URL;
+// The npm registry, NOT the CLI API (they are different hosts — see above).
+export const REGISTRY_URL = REGISTRY_URL_VALUE;
 
 export default {
   REGISTRY_URL,

package/src/config.test.js

@@ -3,30 +3,38 @@ import config, { REGISTRY_URL, getApiUrl, getRegistryUrl, setDevMode } from './c
 
 describe('config', () => {
   it('exports REGISTRY_URL as a named export', () => {
-    expect(REGISTRY_URL).toBe('https://api.hiyve.dev/registry/');
+    expect(REGISTRY_URL).toBe('https://registry.muziemedia.com/');
   });
 
   it('default export contains REGISTRY_URL', () => {
     expect(config).toHaveProperty('REGISTRY_URL');
-    expect(config.REGISTRY_URL).toBe('https://api.hiyve.dev/registry/');
+    expect(config.REGISTRY_URL).toBe('https://registry.muziemedia.com/');
   });
 
   it('getApiUrl returns prod URL by default', () => {
     setDevMode(false);
-    expect(getApiUrl()).toBe('https://api.hiyve.dev/registry/');
+    expect(getApiUrl()).toBe('https://cloud.hiyve.io/registry/');
   });
 
   it('getApiUrl returns dev URL when dev mode is enabled', () => {
     setDevMode(true);
-    expect(getApiUrl()).toBe('https://api.muziemedia.com/registry/');
+    expect(getApiUrl()).toBe('https://cloud.hiyve.io/registry/');
     setDevMode(false);
   });
 
-  it('getRegistryUrl switches with dev mode', () => {
+  it('getRegistryUrl is the npm registry, NOT the API host', () => {
+    // These are different services: the API serves /verify and /packages
+    // from hiyve-cloud; npm fetches tarballs from Verdaccio. Conflating them
+    // shipped a registry whose tarball URLs pointed at a dead host.
+    expect(getRegistryUrl()).toBe('https://registry.muziemedia.com/');
+    expect(getRegistryUrl()).not.toBe(getApiUrl());
+  });
+
+  it('getRegistryUrl does NOT switch with dev mode — there is one registry', () => {
     setDevMode(false);
-    expect(getRegistryUrl()).toBe('https://api.hiyve.dev/registry/');
+    const prod = getRegistryUrl();
     setDevMode(true);
-    expect(getRegistryUrl()).toBe('https://api.muziemedia.com/registry/');
+    expect(getRegistryUrl()).toBe(prod);
     setDevMode(false);
   });
 });

package/src/utils/npmrc.js

@@ -10,9 +10,40 @@ import path from 'path';
 
 const NPMRC_PATH = path.join(os.homedir(), '.npmrc');
 
+// Known Hiyve registry hosts (current and historical)
+const HIYVE_HOSTS = [
+  '//registry.muziemedia.com/',
+  '//cloud.hiyve.io/',
+  // Historical hosts stay listed FOREVER: this array's job is to strip
+  // stale entries from a developer's .npmrc, so dropping a retired host
+  // leaves its dead token line behind.
+  '//console.hiyve.dev/',
+  '//api.hiyve.dev/',
+  '//api.muziemedia.com/',
+];
+
+/**
+ * Check if a line in .npmrc is a Hiyve-related config line.
+ * Only matches lines that reference a known Hiyve host or @hiyve scope.
+ * Will NOT match third-party tokens that happen to start with sk_/pk_ (e.g. Stripe).
+ */
+function isHiyveConfigLine(line) {
+  const trimmed = line.trim();
+  if (trimmed.startsWith('@hiyve:registry')) return true;
+  if (HIYVE_HOSTS.some((host) => trimmed.includes(host))) return true;
+  return false;
+}
+
+/**
+ * Filter out all Hiyve-related lines from .npmrc content.
+ */
+function filterOutHiyveLines(content) {
+  return content.split('\n').filter((line) => !isHiyveConfigLine(line));
+}
+
 /**
  * Configure ~/.npmrc for Hiyve registry
- * @param {string} registryUrl - The registry URL (e.g., https://api.hiyve.dev/registry/)
+ * @param {string} registryUrl - The registry URL (e.g., https://registry.muziemedia.com/)
  * @param {string} apiKey - The API key for authentication
  */
 export async function configureNpmrc(registryUrl, apiKey) {
@@ -23,19 +54,8 @@ export async function configureNpmrc(registryUrl, apiKey) {
     content = fs.readFileSync(NPMRC_PATH, 'utf8');
   }
 
-  // Remove any existing @hiyve config lines (both old and new registry URLs)
-  const lines = content.split('\n').filter((line) => {
-    const trimmed = line.trim();
-    return (
-      !trimmed.startsWith('@hiyve:registry') &&
-      !trimmed.includes('//console.hiyve.dev/') &&
-      !trimmed.includes('//api.hiyve.dev/') &&
-      !trimmed.includes('//api.muziemedia.com/') &&
-      !trimmed.includes(':_authToken=mk_') &&
-      !trimmed.includes(':_authToken=sk_') &&
-      !trimmed.includes(':_authToken=pk_')
-    );
-  });
+  // Remove any existing Hiyve config lines (scoped to known Hiyve hosts)
+  const lines = filterOutHiyveLines(content);
 
   // Parse the registry URL to derive the auth token path
   const url = new URL(registryUrl);
@@ -47,7 +67,7 @@ export async function configureNpmrc(registryUrl, apiKey) {
 
   // Write back, removing empty lines at start/end
   const finalContent = lines.filter((line) => line.trim()).join('\n') + '\n';
-  fs.writeFileSync(NPMRC_PATH, finalContent, 'utf8');
+  fs.writeFileSync(NPMRC_PATH, finalContent, { encoding: 'utf8', mode: 0o600 });
 }
 
 /**
@@ -60,23 +80,12 @@ export async function removeNpmrc() {
 
   const content = fs.readFileSync(NPMRC_PATH, 'utf8');
 
-  // Remove @hiyve config lines (both old and new registry URLs)
-  const lines = content.split('\n').filter((line) => {
-    const trimmed = line.trim();
-    return (
-      !trimmed.startsWith('@hiyve:registry') &&
-      !trimmed.includes('//console.hiyve.dev/') &&
-      !trimmed.includes('//api.hiyve.dev/') &&
-      !trimmed.includes('//api.muziemedia.com/') &&
-      !trimmed.includes(':_authToken=mk_') &&
-      !trimmed.includes(':_authToken=sk_') &&
-      !trimmed.includes(':_authToken=pk_')
-    );
-  });
+  // Remove Hiyve config lines (scoped to known Hiyve hosts)
+  const lines = filterOutHiyveLines(content);
 
   // Write back
   const finalContent = lines.filter((line) => line.trim()).join('\n');
-  fs.writeFileSync(NPMRC_PATH, finalContent ? finalContent + '\n' : '', 'utf8');
+  fs.writeFileSync(NPMRC_PATH, finalContent ? finalContent + '\n' : '', { encoding: 'utf8', mode: 0o600 });
 }
 
 /**
@@ -94,10 +103,11 @@ export function getCurrentConfig() {
   // Find registry line
   const registryLine = lines.find((line) => line.trim().startsWith('@hiyve:registry'));
 
-  // Find token line (pk_*, sk_*, or legacy mk_*)
+  // Find token line on a known Hiyve host
   const tokenLine = lines.find((line) => {
     const trimmed = line.trim();
-    return trimmed.includes(':_authToken=pk_') || trimmed.includes(':_authToken=sk_') || trimmed.includes(':_authToken=mk_');
+    return HIYVE_HOSTS.some((host) => trimmed.includes(host)) &&
+      (trimmed.includes(':_authToken=pk_') || trimmed.includes(':_authToken=sk_') || trimmed.includes(':_authToken=mk_'));
   });
 
   if (!registryLine || !tokenLine) {
@@ -114,7 +124,7 @@ export function getCurrentConfig() {
   return {
     apiKey,
     maskedApiKey,
-    registryUrl: registryLine.split('=')[1]?.trim(),
+    registryUrl: registryLine.substring(registryLine.indexOf('=') + 1).trim(),
   };
 }
 

package/src/utils/npmrc.test.js

@@ -139,6 +139,39 @@ describe('configureNpmrc', () => {
     expect(content).toContain('api.hiyve.dev');
   });
 
+  it('does not delete third-party sk_ tokens (e.g. Stripe)', async () => {
+    const existingContent = [
+      '@hiyve:registry=https://api.hiyve.dev/registry/',
+      '//api.hiyve.dev/registry/:_authToken=pk_live_hiyvekey123',
+      '//npm.stripe.com/:_authToken=sk_live_stripekey456',
+      'other-config=value',
+    ].join('\n');
+
+    fs.existsSync.mockReturnValue(true);
+    fs.readFileSync.mockReturnValue(existingContent);
+    fs.writeFileSync.mockImplementation(() => {});
+
+    await configureNpmrc('https://api.hiyve.dev/registry/', 'pk_live_newkey789');
+
+    const [, content] = fs.writeFileSync.mock.calls[0];
+    // Hiyve lines replaced
+    expect(content).not.toContain('pk_live_hiyvekey123');
+    expect(content).toContain(':_authToken=pk_live_newkey789');
+    // Stripe token preserved
+    expect(content).toContain('//npm.stripe.com/:_authToken=sk_live_stripekey456');
+  });
+
+  it('writes correct auth path for dev registry URL', async () => {
+    fs.existsSync.mockReturnValue(false);
+    fs.writeFileSync.mockImplementation(() => {});
+
+    await configureNpmrc('https://api.muziemedia.com/registry/', 'pk_test_abc123def456');
+
+    const [, content] = fs.writeFileSync.mock.calls[0];
+    expect(content).toContain('@hiyve:registry=https://api.muziemedia.com/registry/');
+    expect(content).toContain('//api.muziemedia.com/registry/:_authToken=pk_test_abc123def456');
+  });
+
   it('preserves non-hiyve lines', async () => {
     const existingContent = [
       'registry=https://registry.npmjs.org/',
@@ -163,8 +196,8 @@ describe('configureNpmrc', () => {
 
     await configureNpmrc('https://api.hiyve.dev/registry/', 'sk_live_1a2b3c4d5e6f');
 
-    const [, content, encoding] = fs.writeFileSync.mock.calls[0];
-    expect(encoding).toBe('utf8');
+    const [, content, options] = fs.writeFileSync.mock.calls[0];
+    expect(options).toEqual({ encoding: 'utf8', mode: 0o600 });
 
     const lines = content.split('\n').filter((l) => l.trim());
     const registryLine = lines.find((l) => l.startsWith('@hiyve:registry='));
@@ -281,6 +314,27 @@ describe('removeNpmrc', () => {
     expect(content).not.toContain('mk_abc123');
   });
 
+  it('does not delete third-party sk_ tokens (e.g. Stripe)', async () => {
+    const existingContent = [
+      'registry=https://registry.npmjs.org/',
+      '@hiyve:registry=https://api.hiyve.dev/registry/',
+      '//api.hiyve.dev/registry/:_authToken=pk_live_hiyvekey123',
+      '//npm.stripe.com/:_authToken=sk_live_stripekey456',
+    ].join('\n');
+
+    fs.existsSync.mockReturnValue(true);
+    fs.readFileSync.mockReturnValue(existingContent);
+    fs.writeFileSync.mockImplementation(() => {});
+
+    await removeNpmrc();
+
+    const [, content] = fs.writeFileSync.mock.calls[0];
+    expect(content).not.toContain('@hiyve:registry');
+    expect(content).not.toContain('pk_live_hiyvekey123');
+    // Third-party token preserved
+    expect(content).toContain('//npm.stripe.com/:_authToken=sk_live_stripekey456');
+  });
+
   it('preserves non-hiyve lines', async () => {
     const existingContent = [
       'registry=https://registry.npmjs.org/',

package/src/utils/output.js

@@ -0,0 +1,50 @@
+/**
+ * Shared CLI output helpers
+ */
+
+import chalk from 'chalk';
+import { isDevMode } from '../config.js';
+
+const FETCH_TIMEOUT_MS = 15_000;
+
+/**
+ * Print a --dev mode hint when a CLI command fails.
+ * Suggests the opposite mode to help the user try the right registry.
+ * @param {string} command - The CLI command name (e.g., 'login', 'list')
+ */
+export function printDevHint(command) {
+  if (isDevMode()) {
+    // No longer suggests the opposite mode: both use the same host since
+    // 2026-08-24, so "try without --dev" sent people hunting a difference
+    // that cannot exist.
+    console.log(chalk.gray('  --dev no longer selects a different registry — same host as the'));
+    console.log(chalk.gray('  default, so re-running without it will not change this result.'));
+    console.log(chalk.cyan(`    npx @hiyve/cli ${command}`));
+  }
+}
+
+/**
+ * Print the dev mode banner if --dev is active.
+ */
+export function printDevModeBanner() {
+  if (isDevMode()) {
+    console.log(chalk.yellow('  Mode: development (--dev)'));
+  }
+}
+
+/**
+ * Create a fetch call with a timeout via AbortController.
+ * @param {string} url
+ * @param {RequestInit} [options]
+ * @returns {Promise<Response>}
+ */
+export async function fetchWithTimeout(url, options = {}) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+
+  try {
+    return await fetch(url, { ...options, signal: controller.signal });
+  } finally {
+    clearTimeout(timeout);
+  }
+}