@host0/cli 0.0.0-stage → 0.1.0

package/dist/host0.mjs

@@ -0,0 +1,1751 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { existsSync as existsSync5 } from "node:fs";
+import { parseArgs } from "node:util";
+
+// src/errors.ts
+var CliError = class extends Error {
+  exitCode;
+  constructor(message, exitCode = 1) {
+    super(message);
+    this.exitCode = exitCode;
+  }
+};
+var Exit = class extends Error {
+  exitCode;
+  constructor(exitCode) {
+    super(`exit ${exitCode}`);
+    this.exitCode = exitCode;
+  }
+};
+function die(message) {
+  throw new CliError(message);
+}
+
+// src/interrupt.ts
+var controller = new AbortController();
+var signalExitCode = 0;
+function interrupt(exitCode) {
+  if (signalExitCode) return;
+  signalExitCode = exitCode;
+  controller.abort();
+}
+var interruptSignal = controller.signal;
+function interruptedExitCode() {
+  return signalExitCode;
+}
+var Interrupted = class extends Error {
+  constructor() {
+    super("interrupted");
+  }
+};
+
+// src/io.ts
+function out(line) {
+  if (interruptedExitCode()) return;
+  process.stdout.write(line + "\n");
+}
+function err(line) {
+  process.stderr.write(line + "\n");
+}
+
+// src/net.ts
+var NET_ATTEMPTS = 4;
+var NEVER_REACHED = /* @__PURE__ */ new Set([
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "ECONNREFUSED",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "EADDRNOTAVAIL",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "EPROTO"
+]);
+var MAYBE_REACHED = /* @__PURE__ */ new Set([
+  "ECONNRESET",
+  "EPIPE",
+  "ETIMEDOUT",
+  "ECONNABORTED",
+  "UND_ERR_SOCKET",
+  "UND_ERR_CLOSED",
+  "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_BODY_TIMEOUT"
+]);
+var CERT_ERROR = /^(CERT_|UNABLE_TO_|DEPTH_ZERO_|SELF_SIGNED_|ERR_TLS_CERT_)/;
+function classify(code) {
+  if (CERT_ERROR.test(code)) return "fatal";
+  if (NEVER_REACHED.has(code) || /^ERR_(SSL|TLS)_/.test(code)) return "never";
+  if (MAYBE_REACHED.has(code)) return "maybe";
+  return "fatal";
+}
+function isNetworkCode(code) {
+  return NEVER_REACHED.has(code) || MAYBE_REACHED.has(code) || CERT_ERROR.test(code) || /^ERR_(SSL|TLS)_/.test(code);
+}
+function causeChain(e) {
+  const codes = [];
+  const messages = [];
+  let cur = e;
+  for (let depth = 0; depth < 6 && cur && typeof cur === "object"; depth++) {
+    const o = cur;
+    if (typeof o.code === "string" && o.code) codes.push(o.code);
+    if (typeof o.message === "string") messages.push(o.message);
+    if (Array.isArray(o.errors) && o.errors.length > 0) {
+      const first = o.errors[0];
+      if (typeof first?.code === "string") codes.push(first.code);
+      if (typeof first?.message === "string") messages.push(first.message);
+    }
+    cur = o.cause;
+  }
+  return { codes, messages };
+}
+function redact(text) {
+  return text.replace(/Bearer\s+[^\s"']+/gi, "Bearer [redacted]").replace(/h0_[A-Za-z0-9_-]+/g, "h0_[redacted]");
+}
+function describeFailure(e) {
+  const { codes, messages } = causeChain(e);
+  const code = codes.find(isNetworkCode);
+  if (!code) return { code: codes[0] ?? "", reach: "fatal", network: false };
+  if ((code === "ECONNRESET" || code === "EPIPE") && messages.some((m) => /before secure TLS connection was established/i.test(m))) {
+    return { code, reach: "never", network: true };
+  }
+  return { code, reach: classify(code), network: true };
+}
+function hostOf(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return "host0";
+  }
+}
+var NetError = class extends Error {
+  code;
+  host;
+  constructor(message, code, host) {
+    super(message);
+    this.code = code;
+    this.host = host;
+  }
+};
+function sleep(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+function baseDelayMs() {
+  const raw = Number(process.env.HOST0_RETRY_BASE_MS);
+  return Number.isFinite(raw) && raw >= 0 ? raw : 1e3;
+}
+async function request(url, opts) {
+  const host = hostOf(url);
+  const signal = opts.ignoreInterrupt ? void 0 : interruptSignal;
+  let delay = baseDelayMs();
+  for (let attempt = 1; ; attempt++) {
+    if (signal?.aborted) throw new Interrupted();
+    try {
+      const res = await fetch(url, {
+        method: opts.method,
+        headers: opts.headers,
+        body: opts.body,
+        // curl without -L: a redirect is an answer, never a hop that could
+        // carry the bearer key to another host.
+        redirect: "manual",
+        signal
+      });
+      const body = Buffer.from(await res.arrayBuffer());
+      return { status: res.status, body, text: body.toString("utf8") };
+    } catch (e) {
+      if (signal?.aborted) throw new Interrupted();
+      const failure = describeFailure(e);
+      if (!failure.network) {
+        const reason = redact(e instanceof Error ? e.message : String(e));
+        throw new NetError(`request to ${host} failed: ${reason}`, failure.code, host);
+      }
+      const { code, reach } = failure;
+      const retry = reach === "never" || reach === "maybe" && opts.idempotent;
+      if (retry && attempt < NET_ATTEMPTS) {
+        err(`host0: network hiccup reaching ${host} (${code}) \u2014 retrying ${attempt + 1}/${NET_ATTEMPTS}`);
+        await sleep(delay);
+        delay *= 2;
+        continue;
+      }
+      if (retry) {
+        err(
+          `host0: could not reach ${host} after ${NET_ATTEMPTS} attempts (${code}) \u2014 if this keeps happening, the network may be blocking ${host}: ask the user to allow it.`
+        );
+      }
+      throw new NetError(`could not reach ${host} (${code})`, code, host);
+    }
+  }
+}
+
+// src/paths.ts
+import { homedir } from "node:os";
+import { join } from "node:path";
+function configDir() {
+  return process.env.HOST0_HOME || join(homedir(), ".host0");
+}
+function credentialsFile() {
+  return join(configDir(), "credentials");
+}
+function deviceFile() {
+  return join(configDir(), "device.json");
+}
+
+// src/api.ts
+function alt(a, b) {
+  return a === void 0 || a === null || a === false ? b : a;
+}
+function parseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function jqRaw(value) {
+  if (value === void 0 || value === null) return "null";
+  return typeof value === "string" ? value : JSON.stringify(value);
+}
+function unauthorizedHint(ctx, style) {
+  const fix = `host0 login to sign in again (the new key replaces ${credentialsFile()} once the user approves), then ${style === "contract" ? "publish again" : "try again"}.`;
+  switch (ctx.apiKeySource) {
+    case "env":
+      return `Unset HOST0_API_KEY, then run ${fix}`;
+    case "flag":
+      return `Drop --api-key, then run ${fix}`;
+    default:
+      return `Run ${fix}`;
+  }
+}
+function checkApiError(ctx, text, what, style) {
+  const body = parseJson(text);
+  if (body === void 0 || body === null || body === false) {
+    die(`${what}: unexpected non-JSON response: ${text.slice(0, 300)}`);
+  }
+  if (typeof body !== "object" || Array.isArray(body) || !("error" in body)) return body;
+  const message = jqRaw(alt(body.message, body.error));
+  if (Array.isArray(body.problems)) {
+    for (const p of body.problems) {
+      err(`  - ${typeof p === "string" ? p : jqRaw(alt(p?.message, p))}`);
+    }
+  }
+  if (body.error === "unauthorized") {
+    err(`host0: the API key from ${ctx.apiKeySource} was rejected \u2014 it may have been revoked. ${unauthorizedHint(ctx, style)}`);
+  }
+  const upgrade = typeof body.upgrade_url === "string" ? body.upgrade_url : "";
+  if (style === "contract") {
+    err(`publish_result.error=${jqRaw(body.error)}`);
+    if (upgrade) err(`publish_result.upgrade_url=${upgrade}`);
+  } else if (upgrade && !message.includes(upgrade)) {
+    err(`host0: upgrade to Pro: ${upgrade}`);
+  }
+  die(`${what}: ${message}`);
+}
+function apiHeaders(ctx, withBody) {
+  const headers = {
+    authorization: `Bearer ${ctx.apiKey}`,
+    "x-host0-client": ctx.clientHeader
+  };
+  if (withBody) headers["content-type"] = "application/json";
+  return headers;
+}
+function apiRequest(ctx, method, path, body) {
+  const withBody = body !== void 0;
+  return request(`${ctx.baseUrl}${path}`, {
+    method,
+    headers: apiHeaders(ctx, withBody),
+    body: withBody ? JSON.stringify(body) : void 0,
+    idempotent: method !== "POST"
+  });
+}
+async function apiJson(ctx, method, path, body, what, style) {
+  let res;
+  try {
+    res = await apiRequest(ctx, method, path, body);
+  } catch (e) {
+    if (e instanceof NetError) die(`${what}: ${e.message}`);
+    throw e;
+  }
+  return checkApiError(ctx, res.text, what, style);
+}
+async function apiProbe(ctx, path) {
+  try {
+    const res = await apiRequest(ctx, "GET", path);
+    return { status: res.status, body: parseJson(res.text) };
+  } catch (e) {
+    if (e instanceof NetError) return { status: 0, body: void 0 };
+    throw e;
+  }
+}
+
+// src/agent.ts
+import { statSync } from "node:fs";
+
+// src/version.ts
+var VERSION = "0.1.0";
+
+// src/agent.ts
+function isDir(path) {
+  try {
+    return statSync(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function detectAgent(env = process.env, devinDir = "/opt/.devin") {
+  if (env.AI_AGENT) return env.AI_AGENT;
+  if (env.CLAUDECODE || env.CLAUDE_CODE) return env.CLAUDE_CODE_IS_COWORK ? "claude-cowork" : "claude-code";
+  if (env.CODEX_SANDBOX || env.CODEX_CI || env.CODEX_THREAD_ID) return "codex";
+  if (env.GEMINI_CLI) return "gemini-cli";
+  if (env.CURSOR_AGENT || env.CURSOR_EXTENSION_HOST_ROLE === "agent-exec") return "cursor-cli";
+  if (env.ANTIGRAVITY_AGENT) return "antigravity";
+  if (env.AUGMENT_AGENT) return "augment-cli";
+  if (env.OPENCODE_CLIENT) return "opencode";
+  if (env.COPILOT_MODEL || env.COPILOT_ALLOW_ALL || env.COPILOT_GITHUB_TOKEN) return "github-copilot";
+  if (env.REPL_ID) return "replit";
+  if (isDir(devinDir)) return "devin";
+  if (env.CURSOR_TRACE_ID) return "cursor";
+  return "";
+}
+function sanitizeAgent(raw) {
+  let v = raw.replace(/[A-Z]/g, (c) => c.toLowerCase()).replace(/[^a-z0-9._-]/g, "-").replace(/-+/g, "-");
+  if (v.startsWith("-")) v = v.slice(1);
+  v = v.slice(0, 40);
+  if (v.endsWith("-")) v = v.slice(0, -1);
+  return v;
+}
+function resolveAgent(flag, env = process.env) {
+  for (const candidate of [flag, env.HOST0_CLIENT, detectAgent(env)]) {
+    if (!candidate) continue;
+    const name = sanitizeAgent(candidate);
+    if (name) return name;
+  }
+  return "";
+}
+function clientHeaderValue(agent) {
+  return `${agent || "unknown"}/cli-${VERSION}`;
+}
+
+// src/credentials.ts
+import { randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+function readCredentialsFile() {
+  const file = credentialsFile();
+  if (!existsSync(file)) return "";
+  return readFileSync(file, "utf8").replace(/\s+/g, "");
+}
+function checked(key, source) {
+  if (!/^[\x21-\x7e]+$/.test(key)) {
+    die(`the API key from ${source} contains invalid characters \u2014 copy it again (an API key is h0_ followed by letters, digits, - and _)`);
+  }
+  return { key, source };
+}
+function resolveApiKey(flag) {
+  const fromFlag = flag?.trim();
+  if (fromFlag) return checked(fromFlag, "flag");
+  const fromEnv = process.env.HOST0_API_KEY?.trim();
+  if (fromEnv) return checked(fromEnv, "env");
+  const stored = readCredentialsFile();
+  if (stored) return checked(stored, "credentials");
+  return { key: "", source: "none" };
+}
+function writePrivateFile(file, content) {
+  mkdirSync(dirname(file), { recursive: true, mode: 448 });
+  const tmp = `${file}.${randomBytes(4).toString("hex")}`;
+  writeFileSync(tmp, content, { mode: 384 });
+  chmodSync(tmp, 384);
+  renameSync(tmp, file);
+}
+function saveApiKey(key) {
+  writePrivateFile(credentialsFile(), key);
+}
+function deleteCredentials() {
+  rmSync(credentialsFile(), { force: true });
+}
+
+// src/context.ts
+var DEFAULT_BASE_URL = "https://host0.ai";
+function urlOrigin(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return "null";
+  }
+}
+function buildContext(flags) {
+  const baseUrl = (flags["base-url"] || process.env.HOST0_BASE_URL || DEFAULT_BASE_URL).replace(/\/+$/, "");
+  if (!/^https?:\/\/[^/]+/.test(baseUrl) || urlOrigin(baseUrl) === "null") {
+    die(`invalid --base-url: ${baseUrl} (e.g. --base-url https://host0.ai)`);
+  }
+  const { key, source } = resolveApiKey(flags["api-key"]);
+  const agent = resolveAgent(flags.client);
+  return {
+    baseUrl,
+    baseOrigin: urlOrigin(baseUrl),
+    allowNonDefaultBaseUrl: flags["allow-nonhost0-base-url"] === true,
+    apiKey: key,
+    apiKeySource: source,
+    agent,
+    clientHeader: clientHeaderValue(agent),
+    json: flags.json === true
+  };
+}
+function guardBaseUrl(ctx, sendsKey) {
+  if (ctx.baseUrl === DEFAULT_BASE_URL || ctx.allowNonDefaultBaseUrl) return;
+  if (sendsKey && ctx.apiKey) {
+    die("refusing to send API key to non-default base URL; pass --allow-nonhost0-base-url to override");
+  }
+  die("refusing to sign in against a non-default base URL; pass --allow-nonhost0-base-url to override");
+}
+
+// src/commands/common.ts
+function requireKey(ctx) {
+  if (!ctx.apiKey) {
+    die(
+      "not signed in \u2014 run host0 login (the user approves a link + code in their browser, nothing personal is typed here), or pass --api-key / set HOST0_API_KEY."
+    );
+  }
+  guardBaseUrl(ctx, true);
+}
+async function call(ctx, method, path, body, what) {
+  try {
+    const res = await apiRequest(ctx, method, path, body);
+    return { json: checkApiError(ctx, res.text, what, "control"), text: res.text };
+  } catch (e) {
+    if (e instanceof NetError) die(`${what}: ${e.message}`);
+    throw e;
+  }
+}
+function printRaw(text) {
+  out(text.endsWith("\n") ? text.slice(0, -1) : text);
+}
+function seg(ref) {
+  return encodeURIComponent(ref);
+}
+function when(iso) {
+  return typeof iso === "string" && iso.length >= 16 ? iso.slice(0, 16).replace("T", " ") : "";
+}
+function bytes(n) {
+  const v = typeof n === "number" ? n : 0;
+  if (v < 1024) return `${v} B`;
+  if (v < 1024 * 1024) return `${(v / 1024).toFixed(1)} KB`;
+  return `${(v / 1024 / 1024).toFixed(1)} MB`;
+}
+var ACCESS_LABELS = {
+  private: "private (you + invited emails)",
+  link: "anyone with the link (never indexed)",
+  public: "public on the web (indexable)"
+};
+function table(rows) {
+  const widths = [];
+  for (const row of rows) row.forEach((cell, i) => widths[i] = Math.max(widths[i] ?? 0, cell.length));
+  for (const row of rows) {
+    out(row.map((cell, i) => i === row.length - 1 ? cell : cell.padEnd(widths[i] ?? 0)).join("  ").trimEnd());
+  }
+}
+function fields(pairs) {
+  const width = Math.max(...pairs.map(([k]) => k.length)) + 1;
+  for (const [k, v] of pairs) out(`${`${k}:`.padEnd(width)} ${v}`);
+}
+
+// src/commands/api.ts
+async function apiCommand(ctx, given, method, data) {
+  let rawPath = given;
+  if (/^[a-z][a-z0-9+.-]*:/i.test(given)) {
+    if (urlOrigin(given) !== ctx.baseOrigin) {
+      die(`refusing to send the API key to ${urlOrigin(given)} \u2014 host0 api only calls the base url (${ctx.baseOrigin}); pass a path like /api/v1/apps`);
+    }
+    const u = new URL(given);
+    rawPath = u.pathname + u.search;
+  }
+  if (!rawPath.startsWith("/")) {
+    die(`pass a path on the base url, e.g. host0 api /api/v1/apps \u2014 got ${given} (the key is never sent to another host)`);
+  }
+  const path = rawPath.startsWith("/api/") ? rawPath : `/api/v1${rawPath}`;
+  const verb = (method || (data !== void 0 ? "POST" : "GET")).toUpperCase();
+  if (!/^[A-Z]+$/.test(verb)) die(`invalid method: ${method}`);
+  if (data !== void 0) {
+    try {
+      JSON.parse(data);
+    } catch {
+      die(`-d must be JSON, e.g. -d '{"visibility": "link"}'`);
+    }
+  }
+  requireKey(ctx);
+  let res;
+  try {
+    res = await request(`${ctx.baseUrl}${path}`, {
+      method: verb,
+      headers: apiHeaders(ctx, data !== void 0),
+      body: data,
+      idempotent: verb !== "POST"
+    });
+  } catch (e) {
+    if (e instanceof NetError) die(`${verb} ${path}: ${e.message}`);
+    throw e;
+  }
+  if (res.text !== "") printRaw(res.text);
+  if (res.status < 200 || res.status >= 300) die(`${verb} ${path}: HTTP ${res.status}`);
+}
+
+// src/device.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, rmSync as rmSync2 } from "node:fs";
+var now = () => Math.floor(Date.now() / 1e3);
+function loadPendingLogin(baseUrl) {
+  const file = deviceFile();
+  if (!existsSync2(file)) return null;
+  const saved = parseJson(readFileSync2(file, "utf8"));
+  if (!saved || typeof saved !== "object" || saved.base_url !== baseUrl || !saved.device_code) return null;
+  const interval = saved.interval ?? 5;
+  const expiresAt = saved.expires_at ?? 0;
+  if (!Number.isInteger(interval) || interval < 0 || !Number.isInteger(expiresAt) || expiresAt < 0) return null;
+  return {
+    base_url: saved.base_url,
+    device_code: String(saved.device_code),
+    user_code: String(saved.user_code ?? ""),
+    verification_uri: String(saved.verification_uri ?? ""),
+    verification_uri_complete: String(saved.verification_uri_complete ?? ""),
+    interval,
+    expires_at: expiresAt
+  };
+}
+function isExpired(login2) {
+  return now() >= login2.expires_at;
+}
+function clearPendingLogin() {
+  rmSync2(deviceFile(), { force: true });
+}
+function printPendingLogin(login2, opts) {
+  const left = Math.max(0, login2.expires_at - now());
+  const minutes = Math.floor((left + 59) / 60);
+  const next = opts.mode === "rerun" ? `then run this same command again \u2014 it waits up to ${opts.waitSeconds}s for the approval and carries on.` : `then run host0 login --wait \u2014 it waits up to ${opts.waitSeconds}s for the approval and saves the key.`;
+  err("host0: sign-in needed \u2014 approve this agent in your browser (no email or password is typed here).");
+  err("");
+  err(`  Open:  ${login2.verification_uri_complete}`);
+  err(`  Code:  ${login2.user_code}   (the page shows the same code \u2014 check it matches)`);
+  err(`  Expires in ${minutes} minutes.`);
+  err("");
+  err(`Next: show the link and code to the user, ${next}`);
+  err("");
+  err("login_result.status=pending");
+  err(`login_result.verification_url=${login2.verification_uri_complete}`);
+  err(`login_result.user_code=${login2.user_code}`);
+  err(`login_result.expires_in=${left}`);
+}
+function deviceHeaders(ctx) {
+  return { "x-host0-client": ctx.clientHeader, "content-type": "application/json" };
+}
+async function startLogin(ctx, opts, note) {
+  if (note) err(note);
+  let text;
+  try {
+    const res = await request(`${ctx.baseUrl}/api/v1/auth/device`, {
+      method: "POST",
+      headers: deviceHeaders(ctx),
+      body: "{}",
+      idempotent: false
+    });
+    text = res.text;
+  } catch (e) {
+    if (e instanceof NetError) die(`start sign-in: ${e.message}`);
+    throw e;
+  }
+  const resp = checkApiError(ctx, text, "start sign-in", "contract");
+  const deviceCode = typeof resp.device_code === "string" ? resp.device_code : "";
+  const userCode = typeof resp.user_code === "string" ? resp.user_code : "";
+  if (!deviceCode || !userCode) die(`start sign-in: unexpected response: ${text}`);
+  const login2 = {
+    base_url: ctx.baseUrl,
+    device_code: deviceCode,
+    user_code: userCode,
+    verification_uri: String(resp.verification_uri ?? ""),
+    verification_uri_complete: String(resp.verification_uri_complete ?? ""),
+    interval: typeof resp.interval === "number" ? resp.interval : 5,
+    expires_at: now() + (typeof resp.expires_in === "number" ? resp.expires_in : 600)
+  };
+  writePrivateFile(deviceFile(), JSON.stringify(login2, null, 2) + "\n");
+  printPendingLogin(login2, opts);
+  throw new Exit(3);
+}
+function sleep2(seconds) {
+  return new Promise((resolve3) => setTimeout(resolve3, seconds * 1e3));
+}
+async function waitForApproval(ctx, login2, opts) {
+  const deadline = now() + opts.waitSeconds;
+  let interval = login2.interval;
+  err(`Waiting for approval of code ${login2.user_code} (up to ${opts.waitSeconds}s)\u2026`);
+  for (; ; ) {
+    let res = null;
+    try {
+      res = await request(`${ctx.baseUrl}/api/v1/auth/device/token`, {
+        method: "POST",
+        headers: deviceHeaders(ctx),
+        body: JSON.stringify({ device_code: login2.device_code }),
+        idempotent: true
+      });
+    } catch (e) {
+      if (!(e instanceof NetError)) throw e;
+      err(`warning: could not reach ${ctx.baseUrl} to check the sign-in \u2014 trying again.`);
+    }
+    if (res) {
+      const body = parseJson(res.text);
+      const key = typeof body?.api_key === "string" ? body.api_key : "";
+      const code = typeof body?.error === "string" ? body.error : "";
+      if (res.status === 200 && key) {
+        const email = typeof body.email === "string" ? body.email : "";
+        const prefix = typeof body.key_prefix === "string" ? body.key_prefix : "";
+        saveApiKey(key);
+        clearPendingLogin();
+        err(`Signed in as ${email || "your account"} \u2014 API key saved to ${credentialsFile()}.`);
+        err("login_result.status=approved");
+        err(`login_result.email=${email}`);
+        err(`login_result.key_prefix=${prefix}`);
+        err(`login_result.credentials_file=${credentialsFile()}`);
+        return key;
+      }
+      switch (code) {
+        case "authorization_pending":
+          break;
+        case "slow_down":
+          interval = Number.isInteger(body.interval) && body.interval >= 0 ? body.interval : 10;
+          break;
+        case "access_denied":
+          clearPendingLogin();
+          err("login_result.status=denied");
+          die("the sign-in was denied in the browser \u2014 run again to start a new one only if the user asks.");
+        case "expired_token":
+          clearPendingLogin();
+          return startLogin(ctx, opts, "The previous code expired \u2014 here is a new one.");
+        case "invalid_device_code":
+          clearPendingLogin();
+          return startLogin(ctx, opts, "The previous sign-in is no longer valid \u2014 here is a new one.");
+        default:
+          checkApiError(ctx, res.text, "sign-in", "contract");
+          die(`sign-in: unexpected response (HTTP ${res.status}): ${res.text.slice(0, 300)}`);
+      }
+    }
+    if (now() + interval > deadline) {
+      printPendingLogin({ ...login2, interval }, opts);
+      throw new Exit(3);
+    }
+    await sleep2(interval);
+  }
+}
+async function ensureApiKey(ctx, opts) {
+  if (ctx.apiKey) return;
+  if (opts.noLogin) {
+    die(
+      "no API key found (--no-login). Run host0 login to sign in \u2014 the user approves a link + code in their browser, nothing personal is typed here \u2014 or pass --api-key / set HOST0_API_KEY."
+    );
+  }
+  const pending = loadPendingLogin(ctx.baseUrl);
+  if (!pending) await startLogin(ctx, opts);
+  else if (isExpired(pending)) {
+    clearPendingLogin();
+    await startLogin(ctx, opts, "the previous code expired \u2014 here is a new one.");
+  }
+  ctx.apiKey = await waitForApproval(ctx, pending, opts);
+  ctx.apiKeySource = "device";
+}
+
+// src/commands/account.ts
+async function login(ctx, opts) {
+  guardBaseUrl(ctx, false);
+  const loginOpts = { mode: "login", waitSeconds: opts.waitSeconds };
+  if (!opts.wait) {
+    const pending2 = loadPendingLogin(ctx.baseUrl);
+    if (pending2 && !isExpired(pending2)) {
+      printPendingLogin(pending2, loginOpts);
+      throw new Exit(3);
+    }
+    await startLogin(ctx, loginOpts);
+  }
+  const pending = loadPendingLogin(ctx.baseUrl);
+  if (!pending) die("no sign-in in progress \u2014 run host0 login first");
+  if (isExpired(pending)) {
+    clearPendingLogin();
+    await startLogin(ctx, loginOpts, "The previous code expired \u2014 here is a new one.");
+  }
+  await waitForApproval(ctx, pending, loginOpts);
+}
+async function logout(ctx) {
+  const file = credentialsFile();
+  const key = readCredentialsFile();
+  if (!key) {
+    out(`Not signed in \u2014 no API key in ${file}.`);
+  } else {
+    const keyCtx = { ...ctx, apiKey: key, apiKeySource: "credentials" };
+    guardBaseUrl(keyCtx, true);
+    let revoked = "";
+    try {
+      const list = await apiRequest(keyCtx, "GET", "/api/v1/keys");
+      const body = parseJson(list.text);
+      if (list.status !== 200 || !Array.isArray(body?.keys)) throw new Error(body?.message ?? `HTTP ${list.status}`);
+      const mine = body.keys.filter(
+        (k) => typeof k?.key_prefix === "string" && k.key_prefix !== "" && key.startsWith(k.key_prefix) && !k.revoked_at
+      );
+      if (mine.length !== 1) {
+        throw new Error(mine.length === 0 ? "it isn't in this account's key list" : "more than one key has its prefix");
+      }
+      const del = await apiRequest(keyCtx, "DELETE", `/api/v1/keys/${encodeURIComponent(mine[0].key_id)}`);
+      if (del.status < 200 || del.status >= 300) throw new Error(parseJson(del.text)?.message ?? `HTTP ${del.status}`);
+      revoked = mine[0].key_prefix;
+    } catch (e) {
+      err(
+        `warning: could not revoke the key on the server (${e instanceof Error ? e.message : String(e)}) \u2014 deleting the local copy anyway; revoke it in the dashboard if it may have leaked.`
+      );
+    }
+    deleteCredentials();
+    out(revoked ? `Signed out \u2014 revoked ${revoked}\u2026 and deleted ${file}.` : `Signed out \u2014 deleted ${file}.`);
+  }
+  if (ctx.apiKeySource === "env") {
+    err("note: the API key from env (HOST0_API_KEY) was not revoked \u2014 unset HOST0_API_KEY to stop using it.");
+  } else if (ctx.apiKeySource === "flag") {
+    err("note: the API key from flag (--api-key) was not revoked \u2014 revoke it in the dashboard if you no longer need it.");
+  }
+}
+async function whoami(ctx) {
+  requireKey(ctx);
+  const { json, text } = await call(ctx, "GET", "/api/v1/account", void 0, "account");
+  if (ctx.json) return printRaw(text);
+  const plan = json.plan ?? {};
+  let label;
+  if (!plan.billing_enabled) label = "beta (free during the beta)";
+  else if (plan.id === "pro") {
+    label = "Pro";
+    if (plan.status) label += ` \xB7 ${plan.status}`;
+    if (plan.ends_at) label += ` \xB7 ends ${String(plan.ends_at).slice(0, 10)}`;
+    else if (plan.renews_at) label += ` \xB7 renews ${String(plan.renews_at).slice(0, 10)}`;
+  } else label = "Free";
+  out(json.email ?? "(no email)");
+  out(`plan: ${label}`);
+}
+
+// src/commands/apps.ts
+import { createInterface } from "node:readline/promises";
+
+// src/commands/deploy.ts
+import { readFileSync as readFileSync4 } from "node:fs";
+import { join as join3 } from "node:path";
+
+// src/exit.ts
+var hooks = [];
+var running = null;
+function onFailure(hook) {
+  hooks.push(hook);
+}
+function runFailureHooks() {
+  running ??= (async () => {
+    for (const hook of hooks) {
+      try {
+        await hook();
+      } catch {
+      }
+    }
+  })();
+  return running;
+}
+function flush(stream) {
+  return new Promise((resolve3) => stream.write("", () => resolve3()));
+}
+async function exitProcess(code) {
+  await Promise.all([flush(process.stdout), flush(process.stderr)]);
+  process.exit(code);
+}
+function installSignalHandlers() {
+  const handle = (code) => () => {
+    interrupt(code);
+    void runFailureHooks().then(() => exitProcess(code));
+  };
+  process.on("SIGINT", handle(130));
+  process.on("SIGTERM", handle(143));
+}
+
+// src/state.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+function readState(file) {
+  if (!existsSync3(file)) return { apps: {} };
+  const state = parseJson(readFileSync3(file, "utf8"));
+  if (!state || typeof state !== "object" || Array.isArray(state)) {
+    err(`warning: ${file} isn't valid JSON \u2014 ignoring it (it is rewritten after this publish).`);
+    return { apps: {} };
+  }
+  return state;
+}
+function appsOf(state) {
+  const apps = state?.apps;
+  return apps && typeof apps === "object" && !Array.isArray(apps) ? apps : {};
+}
+var orNull = (v, fallback) => v === void 0 || v === null || v === false ? fallback : v;
+function stateCandidates(state, baseUrl, source) {
+  const list = Object.entries(appsOf(state)).filter(([, v]) => v && typeof v === "object").filter(([, v]) => orNull(v.base_url, baseUrl) === baseUrl).filter(([, v]) => orNull(v.source, ".") === source).map(([slug, v]) => ({ slug, app_id: String(orNull(v.app_id, "")), updated_at: String(orNull(v.updated_at, "")) })).filter((c) => c.app_id !== "");
+  list.sort((a, b) => a.updated_at < b.updated_at ? -1 : a.updated_at > b.updated_at ? 1 : 0);
+  return list.reverse().map(({ app_id, slug }) => ({ app_id, slug }));
+}
+function utcStamp(date = /* @__PURE__ */ new Date()) {
+  return date.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+function writeStateEntry(file, entry, staleSlugs = []) {
+  const state = readState(file);
+  const apps = { ...appsOf(state) };
+  for (const stale of staleSlugs) delete apps[stale];
+  const kept = Object.fromEntries(Object.entries(apps).filter(([, v]) => v?.app_id !== entry.app_id));
+  kept[entry.slug] = entry;
+  state.apps = kept;
+  mkdirSync2(dirname2(file), { recursive: true });
+  writeFileSync2(file, JSON.stringify(state, null, 2) + "\n");
+}
+
+// src/walk.ts
+import { createHash } from "node:crypto";
+import { createReadStream, readdirSync, statSync as statSync2 } from "node:fs";
+import { basename, dirname as dirname3, join as join2, resolve } from "node:path";
+
+// src/content-type.ts
+var TYPES = {
+  html: "text/html; charset=utf-8",
+  htm: "text/html; charset=utf-8",
+  css: "text/css; charset=utf-8",
+  js: "text/javascript; charset=utf-8",
+  mjs: "text/javascript; charset=utf-8",
+  json: "application/json",
+  map: "application/json",
+  svg: "image/svg+xml",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  ico: "image/x-icon",
+  txt: "text/plain; charset=utf-8",
+  md: "text/plain; charset=utf-8",
+  markdown: "text/plain; charset=utf-8",
+  xml: "application/xml",
+  woff: "font/woff",
+  woff2: "font/woff2",
+  wasm: "application/wasm",
+  webmanifest: "application/manifest+json",
+  pdf: "application/pdf",
+  avif: "image/avif",
+  mp4: "video/mp4",
+  webm: "video/webm",
+  mp3: "audio/mpeg",
+  csv: "text/csv; charset=utf-8"
+};
+function guessContentType(path) {
+  const ext = path.slice(path.lastIndexOf(".") + 1).replace(/[A-Z]/g, (c) => c.toLowerCase());
+  return Object.prototype.hasOwnProperty.call(TYPES, ext) ? TYPES[ext] : "application/octet-stream";
+}
+
+// src/walk.ts
+var MAX_LOCAL_FILE_BYTES = 2 * 1024 * 1024 * 1024 - 1;
+function sizeLabel(bytes2) {
+  if (bytes2 >= 1024 ** 3) return `${(bytes2 / 1024 ** 3).toFixed(1)} GB`;
+  return `${(bytes2 / 1024 ** 2).toFixed(1)} MB`;
+}
+async function sha256File(abs) {
+  const hash = createHash("sha256");
+  let size = 0;
+  for await (const chunk of createReadStream(abs)) {
+    size += chunk.length;
+    hash.update(chunk);
+  }
+  return { size, sha256: hash.digest("hex") };
+}
+async function localFile(path, abs) {
+  const size = statSync2(abs).size;
+  if (size > MAX_LOCAL_FILE_BYTES) {
+    die(`${path} is ${sizeLabel(size)} \u2014 too big to publish; host0's largest plan takes 50 MB per file. Leave it out (move it outside the folder), or host it elsewhere and link to it.`);
+  }
+  return { path, abs, ...await sha256File(abs), content_type: guessContentType(abs) };
+}
+function walk(root, rel, into) {
+  for (const entry of readdirSync(join2(root, rel), { withFileTypes: true })) {
+    const childRel = rel ? `${rel}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) {
+      if (!entry.name.startsWith(".")) walk(root, childRel, into);
+    } else if (entry.isFile() && entry.name !== ".DS_Store") {
+      into.push(childRel);
+    }
+  }
+}
+function resolveTarget(target) {
+  let stat;
+  try {
+    stat = statSync2(target);
+  } catch {
+    stat = null;
+  }
+  const abs = resolve(target);
+  if (stat?.isDirectory()) {
+    return { kind: "dir", given: target, abs, stateDir: join2(abs, ".host0"), stateSource: ".", defaultName: basename(abs) };
+  }
+  if (stat?.isFile()) {
+    const name = basename(abs);
+    const dot = name.lastIndexOf(".");
+    const stem = dot >= 0 ? name.slice(0, dot) : name;
+    return { kind: "file", given: target, abs, stateDir: join2(dirname3(abs), ".host0"), stateSource: name, defaultName: stem || name };
+  }
+  die(`not a file or directory: ${target} \u2014 publish the directory that contains index.html, or a single file`);
+}
+async function collectFiles(target) {
+  if (target.kind === "file") return [await localFile(target.stateSource, target.abs)];
+  const rels = [];
+  walk(target.abs, "", rels);
+  rels.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+  if (rels.length === 0) {
+    die(`no files found in ${target.given} (resolved from ${process.cwd()}) \u2014 pass the folder that contains index.html, or a single file`);
+  }
+  const files = [];
+  for (const rel of rels) files.push(await localFile(rel, join2(target.abs, rel)));
+  return files;
+}
+
+// src/commands/deploy.ts
+var VISIBILITIES = ["private", "link", "public"];
+var str = (v) => v === void 0 || v === null ? "" : jqRaw(v);
+async function deploy(ctx, opts) {
+  const target = resolveTarget(opts.target);
+  if (opts.visibility && !VISIBILITIES.includes(opts.visibility)) {
+    die(`invalid --visibility: ${opts.visibility} (must be private, link, or public)`);
+  }
+  guardBaseUrl(ctx, true);
+  await ensureApiKey(ctx, { mode: "rerun", waitSeconds: opts.waitSeconds, noLogin: opts.noLogin });
+  const stateFile = join3(target.stateDir, "state.json");
+  const files = await collectFiles(target);
+  let action = "update";
+  let appId = opts.appId ?? "";
+  let appSlug = "";
+  let appVisibility = "";
+  const staleSlugs = [];
+  let createdApp = null;
+  if (appId) {
+    const app = await apiJson(ctx, "GET", `/api/v1/apps/${seg(appId)}`, void 0, "app lookup", "contract");
+    appSlug = str(app.slug);
+    appVisibility = str(app.visibility);
+  } else if (opts.slug) {
+    const list = await apiJson(ctx, "GET", "/api/v1/apps", void 0, "app lookup", "contract");
+    const app = (Array.isArray(list.apps) ? list.apps : []).find((a) => a?.slug === opts.slug);
+    if (!app?.app_id) {
+      die(
+        `no app with slug '${opts.slug}' in this account \u2014 drop --slug to create a new app, or list yours with: host0 ls`
+      );
+    }
+    appId = str(app.app_id);
+    appSlug = opts.slug;
+    appVisibility = str(app.visibility);
+  } else {
+    for (const cand of stateCandidates(readState(stateFile), ctx.baseUrl, target.stateSource)) {
+      const probe = await apiProbe(ctx, `/api/v1/apps/${seg(cand.app_id)}`);
+      if (probe.status === 200 && probe.body && typeof probe.body === "object" && !("error" in probe.body)) {
+        appId = cand.app_id;
+        appSlug = str(probe.body.slug);
+        appVisibility = str(probe.body.visibility);
+        break;
+      }
+      const code = probe.status === 0 ? "000" : String(probe.status);
+      if ([401, 403, 404, 410].includes(probe.status)) {
+        err(
+          `warning: cached app "${cand.slug}" (${cand.app_id}) is not available to this API key (HTTP ${code}) \u2014 dropping it from ${stateFile}`
+        );
+        staleSlugs.push(cand.slug);
+      } else {
+        die(
+          `app lookup for cached app "${cand.slug}" failed (HTTP ${code}) \u2014 not creating a duplicate; retry, or name the app explicitly with --slug/--app-id`
+        );
+      }
+    }
+    if (!appId) {
+      if (staleSlugs.length > 0) {
+        err(
+          `warning: no app cached in ${stateFile} is usable with this API key \u2014 creating a new app. If you meant to update an existing one, stop and re-run with --slug <slug>.`
+        );
+      }
+      action = "create";
+      const appName = opts.name || target.defaultName;
+      err(`Creating app "${appName}"...`);
+      const created = await apiJson(ctx, "POST", "/api/v1/apps", { name: appName }, "create app", "contract");
+      appId = str(created.app_id);
+      appSlug = str(created.slug);
+      appVisibility = str(created.visibility);
+      if (!appId || appId === "null") die(`create app: unexpected response: ${JSON.stringify(created)}`);
+      createdApp = { id: appId, slug: appSlug };
+      onFailure(async () => {
+        if (createdApp) await deleteOrphan(ctx, createdApp);
+      });
+    }
+  }
+  err(`Creating deployment (${files.length} files)...`);
+  const manifest = files.map((f) => ({ path: f.path, size: f.size, content_type: f.content_type, sha256: f.sha256 }));
+  const deployBody = opts.message ? { files: manifest, message: opts.message } : { files: manifest };
+  const dep = await apiJson(ctx, "POST", `/api/v1/apps/${seg(appId)}/deployments`, deployBody, "create deployment", "contract");
+  const deploymentId = str(dep.deployment_id);
+  const finalizeUrl = str(dep.upload?.finalize_url);
+  const targets = Array.isArray(dep.upload?.targets) ? dep.upload.targets : [];
+  const skipped = Array.isArray(dep.upload?.skipped) ? dep.upload.skipped.length : 0;
+  if (!deploymentId || deploymentId === "null") die(`create deployment: unexpected response: ${JSON.stringify(dep)}`);
+  if (createdApp) createdApp.deploymentId = deploymentId;
+  const minted = [
+    ...targets.map((t) => str(t?.url)).filter((u) => /^[a-z]+:\/\/[^/]+\/api\//.test(u)),
+    finalizeUrl
+  ].filter((u) => u !== "" && u !== "null");
+  for (const url of minted) {
+    const origin = urlOrigin(url);
+    if (origin !== ctx.baseOrigin) {
+      die(
+        `upload targets are on ${origin} but --base-url is ${ctx.baseOrigin} \u2014 the server mints these URLs from its configured platform origin. Re-run with --base-url ${origin} (or set H0_PLATFORM_ORIGIN on the server to match).`
+      );
+    }
+  }
+  err(
+    skipped > 0 ? `Uploading ${targets.length} files (${skipped} unchanged, skipped)...` : `Uploading ${targets.length} files...`
+  );
+  const byPath = new Map(files.map((f) => [f.path, f]));
+  for (const t of targets) {
+    const path = str(t?.path);
+    const url = str(t?.url);
+    const local = byPath.get(path);
+    if (!local) die(`missing local file for upload target: ${path}`);
+    const headers = {};
+    for (const [k, v] of Object.entries(t?.headers ?? {})) headers[k] = jqRaw(v);
+    if (urlOrigin(url) === ctx.baseOrigin) headers.authorization = `Bearer ${ctx.apiKey}`;
+    let bytes2;
+    try {
+      bytes2 = readFileSync4(local.abs);
+    } catch (e) {
+      const code = e.code;
+      if (code === "ENOENT") die(`missing local file for upload target: ${path}`);
+      die(`could not read ${path} (${code ?? (e instanceof Error ? e.message : String(e))}) \u2014 check the file, then publish again`);
+    }
+    let text;
+    try {
+      text = (await request(url, { method: "PUT", headers, body: bytes2, idempotent: true })).text;
+    } catch (e) {
+      if (e instanceof NetError) die(`upload ${path}: ${e.message}`);
+      throw e;
+    }
+    checkApiError(ctx, text, `upload ${path}`, "contract");
+  }
+  err("Finalizing...");
+  let finText;
+  try {
+    finText = (await request(finalizeUrl, {
+      method: "POST",
+      headers: { authorization: `Bearer ${ctx.apiKey}`, "x-host0-client": ctx.clientHeader, "content-type": "application/json" },
+      body: "{}",
+      idempotent: true
+    })).text;
+  } catch (e) {
+    if (e instanceof NetError) die(`finalize: ${e.message}`);
+    throw e;
+  }
+  let fin = safeParse(finText);
+  if (fin?.error === "not_pending") {
+    try {
+      const status = await apiRequest(ctx, "GET", `/api/v1/deployments/${seg(deploymentId)}`);
+      const parsed = safeParse(status.text);
+      if (parsed?.live === true) {
+        finText = status.text;
+        fin = parsed;
+      }
+    } catch (e) {
+      if (!(e instanceof NetError)) throw e;
+    }
+  }
+  fin = checkApiError(ctx, finText, "finalize", "contract");
+  const liveUrl = str(fin.url);
+  if (!liveUrl || liveUrl === "null") die(`finalize: unexpected response: ${finText}`);
+  const liveVersion = fin.version === void 0 || fin.version === null ? "" : str(fin.version);
+  const previousVersion = fin.previous_version === void 0 || fin.previous_version === null ? "" : str(fin.previous_version);
+  createdApp = null;
+  writeStateEntry(
+    stateFile,
+    { app_id: appId, slug: appSlug, url: liveUrl, base_url: ctx.baseUrl, source: target.stateSource, updated_at: utcStamp() },
+    staleSlugs
+  );
+  if (opts.visibility) {
+    err(`Setting visibility to ${opts.visibility}...`);
+    const vis = await apiJson(ctx, "PATCH", `/api/v1/apps/${seg(appId)}`, { visibility: opts.visibility }, "set visibility", "contract");
+    appVisibility = str(vis.visibility);
+  }
+  out(liveUrl);
+  err("");
+  err(`publish_result.url=${liveUrl}`);
+  err(`publish_result.app_id=${appId}`);
+  err(`publish_result.slug=${appSlug}`);
+  err(`publish_result.action=${action}`);
+  err(`publish_result.deployment_id=${deploymentId}`);
+  err(`publish_result.version=${liveVersion}`);
+  err(`publish_result.previous_version=${previousVersion}`);
+  err(`publish_result.visibility=${appVisibility}`);
+  err(`publish_result.api_key_source=${ctx.apiKeySource}`);
+  err(`publish_result.files_total=${files.length}`);
+  err(`publish_result.files_uploaded=${targets.length}`);
+  err(`publish_result.files_skipped=${skipped}`);
+  err(`publish_result.state_pruned=${staleSlugs.length}`);
+}
+function safeParse(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+async function deleteOrphan(ctx, app) {
+  const headers = { authorization: `Bearer ${ctx.apiKey}`, "x-host0-client": ctx.clientHeader };
+  const failed = (warning) => {
+    err(warning);
+    err("publish_result.cleanup=failed");
+    err(`publish_result.cleanup_slug=${app.slug}`);
+  };
+  if (app.deploymentId) {
+    let live;
+    try {
+      const res = await request(`${ctx.baseUrl}/api/v1/deployments/${seg(app.deploymentId)}`, {
+        method: "GET",
+        headers,
+        idempotent: true,
+        ignoreInterrupt: true
+      });
+      const body = safeParse(res.text);
+      if (res.status === 200 && body && typeof body.live === "boolean") live = body.live;
+    } catch {
+      live = void 0;
+    }
+    if (live === void 0) {
+      return failed(
+        `warning: could not check whether the app this run created (${app.slug}, ${app.id}) went live \u2014 not deleting it; check your dashboard and delete it there if it isn't live.`
+      );
+    }
+    if (live) {
+      return failed(`warning: the app this run created (${app.slug}) went live after all \u2014 keeping it.`);
+    }
+  }
+  let status = 0;
+  try {
+    status = (await request(`${ctx.baseUrl}/api/v1/apps/${seg(app.id)}`, {
+      method: "DELETE",
+      headers,
+      // publish.sh's cleanup is a `once` call: only never-reached failures retry
+      idempotent: false,
+      ignoreInterrupt: true
+    })).status;
+  } catch {
+    status = 0;
+  }
+  if (status >= 200 && status < 300) {
+    err(`Cleaning up: deleted the app this run created (${app.slug}) \u2014 it never went live.`);
+    err("publish_result.cleanup=deleted");
+    err(`publish_result.cleanup_slug=${app.slug}`);
+  } else {
+    const code = status === 0 ? "000" : String(status);
+    failed(`warning: could not delete the app this run created (${app.slug}, ${app.id}) \u2014 delete it from your dashboard (HTTP ${code}).`);
+  }
+}
+
+// src/commands/apps.ts
+async function ls(ctx) {
+  requireKey(ctx);
+  const { json, text } = await call(ctx, "GET", "/api/v1/apps", void 0, "list apps");
+  if (ctx.json) return printRaw(text);
+  const apps = Array.isArray(json.apps) ? json.apps : [];
+  if (apps.length === 0) return out("No apps yet \u2014 deploy one with: host0 deploy <dir|file>");
+  table([
+    ["Slug", "Name", "Access", "Last deploy", "URL"],
+    ...apps.map((a) => [
+      String(a.slug ?? ""),
+      String(a.name ?? ""),
+      String(a.visibility ?? ""),
+      a.live_since ? when(a.live_since) : "never",
+      String(a.url ?? "")
+    ])
+  ]);
+}
+async function inspect(ctx, app) {
+  requireKey(ctx);
+  const { json: a, text } = await call(ctx, "GET", `/api/v1/apps/${seg(app)}`, void 0, "app lookup");
+  if (ctx.json) return printRaw(text);
+  const shares = Array.isArray(a.shares) ? a.shares : [];
+  fields([
+    ["Name", String(a.name ?? "")],
+    ["URL", String(a.url ?? "")],
+    ["Access", ACCESS_LABELS[a.visibility] ?? String(a.visibility ?? "")],
+    ["Live version", a.live_version ? `v${a.live_version} (since ${when(a.live_since)})` : "not live yet"],
+    ["Owner", String(a.owner_email ?? "")],
+    ["Shared with", shares.length > 0 ? shares.join(", ") : "nobody"],
+    ["App ID", String(a.app_id ?? "")],
+    ["Created", when(a.created_at)]
+  ]);
+}
+async function visibility(ctx, app, mode) {
+  if (!VISIBILITIES.includes(mode)) {
+    die(`invalid visibility: ${mode} (must be private, link, or public)`);
+  }
+  requireKey(ctx);
+  const { json, text } = await call(ctx, "PATCH", `/api/v1/apps/${seg(app)}`, { visibility: mode }, "set visibility");
+  if (ctx.json) return printRaw(text);
+  out(`${json.slug} is now ${ACCESS_LABELS[json.visibility] ?? json.visibility} \u2014 ${json.url}`);
+}
+async function rename(ctx, app, to) {
+  if (to.slug === void 0 && to.name === void 0) die("rename needs --slug <new-slug> and/or --name <display name>");
+  requireKey(ctx);
+  const body = {};
+  if (to.slug !== void 0) body.slug = to.slug;
+  if (to.name !== void 0) body.name = to.name;
+  const { json, text } = await call(ctx, "PATCH", `/api/v1/apps/${seg(app)}`, body, "rename");
+  if (ctx.json) return printRaw(text);
+  out(`Renamed: ${json.name} \u2014 ${json.url}`);
+  if (json.old_slug) out(`The old URL (${json.old_slug}) redirects here for 30 days and stays reserved for you.`);
+}
+async function share(ctx, app, emails) {
+  if (emails.length === 0) die("share needs at least one email: host0 share <app> <email\u2026>");
+  requireKey(ctx);
+  const { json, text } = await call(ctx, "POST", `/api/v1/apps/${seg(app)}/shares`, { emails }, "share");
+  if (ctx.json) return printRaw(text);
+  out(`Shared ${json.slug} with:`);
+  const delivery = Array.isArray(json.invite_delivery) ? json.invite_delivery : [];
+  for (const d of delivery) out(`  ${d.email}  invite: ${d.status}`);
+  const shares = Array.isArray(json.shares) ? json.shares : [];
+  out(`Everyone with access: ${shares.length > 0 ? shares.join(", ") : "nobody"}`);
+}
+async function unshare(ctx, app, email) {
+  requireKey(ctx);
+  const { text } = await call(ctx, "DELETE", `/api/v1/apps/${seg(app)}/shares/${seg(email)}`, void 0, "unshare");
+  if (ctx.json) return printRaw(text);
+  out(`Removed ${email} from ${app} \u2014 their access ends now.`);
+}
+async function confirm(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    return /^y(es)?$/i.test((await rl.question(question)).trim());
+  } finally {
+    rl.close();
+  }
+}
+async function rm(ctx, app, yes) {
+  requireKey(ctx);
+  if (!yes) {
+    if (!process.stdin.isTTY || ctx.agent) {
+      die(`refusing to delete ${app} without confirmation \u2014 pass --yes (it deletes the app, its versions, shares and records for good)`);
+    }
+    const { json: a } = await call(ctx, "GET", `/api/v1/apps/${seg(app)}`, void 0, "app lookup");
+    if (!await confirm(`Delete ${a.slug} (${a.url})? [y/N] `)) die("not deleted");
+  }
+  const { json, text } = await call(ctx, "DELETE", `/api/v1/apps/${seg(app)}`, void 0, "delete app");
+  if (ctx.json) return printRaw(text);
+  out(`Deleted ${json.slug}.`);
+}
+
+// src/commands/data.ts
+function top(title, rows) {
+  if (!Array.isArray(rows) || rows.length === 0) return;
+  out("");
+  out(`${title}:`);
+  table(rows.slice(0, 5).map((r) => [`  ${r.key === "" ? "(none)" : r.key}`, `${r.visitors} visitors`, `${r.pageviews} views`]));
+}
+async function analytics(ctx, app, period) {
+  requireKey(ctx);
+  const query = period ? `?period=${encodeURIComponent(period)}` : "";
+  const { json: a, text } = await call(ctx, "GET", `/api/v1/apps/${seg(app)}/analytics${query}`, void 0, "analytics");
+  if (ctx.json) return printRaw(text);
+  if (a.locked) {
+    out(`${a.slug}: ${a.visits_this_month} visits this month (since ${a.month})`);
+    if (a.message) out(a.message);
+    if (a.upgrade_url) out(`Upgrade: ${a.upgrade_url}`);
+    return;
+  }
+  out(`${a.slug} \xB7 last ${a.period}`);
+  out(`Visitors:   ${a.totals?.visitors ?? 0} (previous ${a.period}: ${a.previous?.visitors ?? 0})`);
+  out(`Page views: ${a.totals?.pageviews ?? 0} (previous ${a.period}: ${a.previous?.pageviews ?? 0})`);
+  top("Pages", a.pages);
+  top("Referrers", (a.referrers ?? []).map((r) => ({ ...r, key: r.key === "" ? "(direct)" : r.key })));
+  top("Countries", a.countries);
+  top("Devices", a.devices);
+}
+async function records(ctx, app, collection, exportAll) {
+  requireKey(ctx);
+  if (!collection) {
+    if (exportAll) die("--export needs a collection: host0 records <app> <collection> --export");
+    const { json: json2, text: text2 } = await call(ctx, "GET", `/api/v1/apps/${seg(app)}/records`, void 0, "records");
+    if (ctx.json) return printRaw(text2);
+    const declared = Array.isArray(json2.collections) ? json2.collections : [];
+    const retained = Array.isArray(json2.retained) ? json2.retained : [];
+    if (declared.length === 0 && retained.length === 0) {
+      return out(`${json2.slug} has no shared data \u2014 declare collections in an h0.json to add some.`);
+    }
+    table([
+      ["Collection", "Records", "Latest", "Fields"],
+      ...declared.map((c) => [
+        String(c.collection),
+        String(c.count ?? 0),
+        when(c.latest),
+        Object.entries(c.fields ?? {}).map(([k, t]) => `${k}:${t}`).join(", ")
+      ])
+    ]);
+    if (retained.length > 0) {
+      out("");
+      out(
+        `Kept from collections the live version no longer declares: ${retained.map((c) => `${c.collection} (${c.count})`).join(", ")}`
+      );
+    }
+    return;
+  }
+  const path = `/api/v1/apps/${seg(app)}/records/${seg(collection)}`;
+  if (exportAll) {
+    const { text: text2 } = await call(ctx, "GET", `${path}?format=export`, void 0, "export");
+    return printRaw(text2);
+  }
+  const { json, text } = await call(ctx, "GET", path, void 0, "records");
+  if (ctx.json) return printRaw(text);
+  const list = Array.isArray(json.records) ? json.records : [];
+  if (list.length === 0) {
+    const { json: all } = await call(ctx, "GET", `/api/v1/apps/${seg(app)}/records`, void 0, "records");
+    const known = [...all.collections ?? [], ...all.retained ?? []].some((c) => c?.collection === collection);
+    if (!known) die(`no collection named ${collection} in ${all.slug} \u2014 host0 records ${app} lists them`);
+    return out(`${collection} has no records.`);
+  }
+  for (const r of list) {
+    out(`${r.id}  ${when(r.created_at)}  ${r.created_by_email ?? "anonymous"}  ${JSON.stringify(r.data)}`);
+  }
+}
+
+// src/commands/pull.ts
+import { createHash as createHash2 } from "node:crypto";
+import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync3, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join4, resolve as resolve2 } from "node:path";
+var str2 = (v) => v === void 0 || v === null ? "" : jqRaw(v);
+function isSafeRelativePath(path) {
+  const parts = `/${path}/`.split(/[\\/]/).slice(1, -1);
+  return path !== "" && parts[0] !== ".host0" && !parts.some((p) => p === "" || p === "." || p === "..");
+}
+function isSymlink(path) {
+  try {
+    return lstatSync(path).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+async function pull(ctx, opts) {
+  guardBaseUrl(ctx, true);
+  await ensureApiKey(ctx, { mode: "rerun", waitSeconds: opts.waitSeconds, noLogin: opts.noLogin });
+  err(`Listing the live files of ${opts.app}...`);
+  const live = await apiJson(ctx, "GET", `/api/v1/apps/${seg(opts.app)}/files`, void 0, "list files", "contract");
+  const appId = str2(live.app_id);
+  const appSlug = str2(live.slug);
+  const liveUrl = str2(live.url);
+  const liveVersion = str2(live.version);
+  const dest = opts.dir || appSlug;
+  if (existsSync4(dest) && !statSync3(dest).isDirectory()) {
+    die(`${dest} is a file \u2014 pass an empty or new folder to pull into`);
+  }
+  if (existsSync4(dest) && readdirSync2(dest).some((name) => name !== ".host0")) {
+    die(
+      `${dest} isn't empty \u2014 pull into a new folder (e.g. host0 pull ${appSlug} ./${appSlug}-live) so nothing local is overwritten`
+    );
+  }
+  const files = Array.isArray(live.files) ? live.files : [];
+  for (const f of files) {
+    if (!isSafeRelativePath(str2(f?.path))) die(`refusing an unsafe path from the api: ${str2(f?.path)}`);
+  }
+  mkdirSync3(dest, { recursive: true });
+  const destAbs = resolve2(dest);
+  const stateDir = join4(destAbs, ".host0");
+  if (isSymlink(stateDir) || existsSync4(stateDir) && !statSync3(stateDir).isDirectory()) {
+    die(`${stateDir} isn't a plain folder \u2014 remove it, or pull into a new folder`);
+  }
+  let count = 0;
+  for (const f of files) {
+    const path = str2(f.path);
+    const url = str2(f.download_url);
+    const headers = urlOrigin(url) === ctx.baseOrigin ? { authorization: `Bearer ${ctx.apiKey}`, "x-host0-client": ctx.clientHeader } : {};
+    let bytes2;
+    try {
+      const res = await request(url, { method: "GET", headers, idempotent: true });
+      if (res.status < 200 || res.status >= 300) throw new Error(`HTTP ${res.status}`);
+      bytes2 = res.body;
+    } catch {
+      die(`could not download ${path}`);
+    }
+    const target = join4(destAbs, path);
+    mkdirSync3(dirname4(target), { recursive: true });
+    writeFileSync3(target, bytes2);
+    const want = str2(f.sha256);
+    if (want) {
+      const got = createHash2("sha256").update(bytes2).digest("hex");
+      if (got !== want) die(`${path} downloaded with the wrong hash (${got}, expected ${want}) \u2014 run host0 pull again`);
+    }
+    count++;
+  }
+  writeStateEntry(join4(destAbs, ".host0", "state.json"), {
+    app_id: appId,
+    slug: appSlug,
+    url: liveUrl,
+    base_url: ctx.baseUrl,
+    source: ".",
+    updated_at: utcStamp()
+  });
+  out(destAbs);
+  err("");
+  err(`pull_result.dir=${destAbs}`);
+  err(`pull_result.app_id=${appId}`);
+  err(`pull_result.slug=${appSlug}`);
+  err(`pull_result.url=${liveUrl}`);
+  err(`pull_result.version=${liveVersion}`);
+  err(`pull_result.files=${count}`);
+}
+
+// src/commands/versions.ts
+async function versions(ctx, app) {
+  requireKey(ctx);
+  const { json, text } = await call(ctx, "GET", `/api/v1/apps/${seg(app)}/versions`, void 0, "list versions");
+  if (ctx.json) return printRaw(text);
+  const list = Array.isArray(json.versions) ? json.versions : [];
+  if (list.length === 0) return out(`${json.slug} has no versions yet \u2014 deploy it first.`);
+  table([
+    ["Version", "Live", "Published", "Files", "Size", "Note"],
+    ...list.map((v) => [
+      `v${v.version}`,
+      v.live ? "live" : "",
+      when(v.created_at),
+      String(v.file_count ?? ""),
+      bytes(v.total_bytes),
+      [v.message ?? "", v.restored_from_version ? `(restored from v${v.restored_from_version})` : ""].filter(Boolean).join(" ")
+    ])
+  ]);
+  out("");
+  out(
+    json.retention_days ? `Versions replaced in the last ${json.retention_days} days are kept \u2014 restore one with: host0 rollback ${json.slug} <version>` : "Only the live version is kept on this plan."
+  );
+}
+async function rollback(ctx, app, version, message) {
+  requireKey(ctx);
+  const body = message !== void 0 ? { message } : {};
+  const { json, text } = await call(
+    ctx,
+    "POST",
+    `/api/v1/apps/${seg(app)}/versions/${seg(version)}/restore`,
+    body,
+    "restore"
+  );
+  if (ctx.json) return printRaw(text);
+  if (json.already_live) out(`v${json.version} is already live \u2014 ${json.url}`);
+  else out(`Restored v${json.restored_from_version} as v${json.version} \u2014 ${json.url}`);
+}
+
+// src/cli.ts
+var GLOBAL_OPTIONS = {
+  "base-url": { type: "string" },
+  "allow-nonhost0-base-url": { type: "boolean" },
+  "api-key": { type: "string" },
+  client: { type: "string" },
+  json: { type: "boolean" },
+  help: { type: "boolean", short: "h" },
+  version: { type: "boolean", short: "v" }
+};
+var LOGIN_WAIT = {
+  "no-login": { type: "boolean" },
+  timeout: { type: "string" },
+  // publish.sh's spelling of --timeout
+  wait: { type: "string" }
+};
+var COMMANDS = {
+  deploy: {
+    usage: "host0 deploy <dir|file> [options]",
+    summary: "Publish a folder or one file and print its live URL",
+    options: {
+      name: { type: "string" },
+      slug: { type: "string" },
+      "app-id": { type: "string" },
+      visibility: { type: "string" },
+      message: { type: "string" },
+      ...LOGIN_WAIT
+    },
+    help: `A directory's contents become the site root; a single file (a PDF, an image,
+one HTML page) is served at the app's root URL. The folder remembers its app in
+.host0/state.json (shared with publish.sh), so the next deploy is a new version
+of the same app.
+
+With no API key it starts a device login: it prints a link + code and exits 3 \u2014
+show them to the user, then run the same command again.
+
+Options:
+  --name <text>          Display name when creating (default: the folder or file name)
+  --slug <slug>          Update the existing app with this slug
+  --app-id <uuid>        Update the existing app with this id
+  --visibility <mode>    After publishing: private (default: you + invited emails) |
+                         link (anyone with the URL, never indexed) | public (indexable)
+  --message <text>       A note for this version (\u2264 200 characters)
+  --no-login             With no API key, fail instead of starting a login
+  --timeout <seconds>    How long to wait for a login approval (default 90)`
+  },
+  login: {
+    usage: "host0 login [--wait] [--timeout <seconds>]",
+    summary: "Sign in with a link + code the user approves in their browser",
+    options: { wait: { type: "boolean" }, timeout: { type: "string" } },
+    help: `Starts a device login (or re-shows the pending one) and exits 3: show the link
+and code to the user. Then \`host0 login --wait\` waits for the approval and saves
+the key to ~/.host0/credentials (exit 0; 3 = still pending; 1 = denied).`
+  },
+  logout: {
+    usage: "host0 logout",
+    summary: "Revoke the stored API key and delete ~/.host0/credentials",
+    options: {}
+  },
+  whoami: { usage: "host0 whoami", summary: "Show the signed-in account and plan", options: {} },
+  ls: { usage: "host0 ls", summary: "List your apps", options: {} },
+  inspect: { usage: "host0 inspect <app>", summary: "Show one app: URL, access, live version, shares", options: {} },
+  pull: {
+    usage: "host0 pull <app> [dir]",
+    summary: "Download an app's live files into a new folder to edit them",
+    options: { slug: { type: "string" }, "app-id": { type: "string" }, ...LOGIN_WAIT },
+    help: `Downloads every live file (sha256-checked) into [dir] (default: ./<slug>; it
+must be empty or new) and sets the folder up so \`host0 deploy <dir>\` publishes
+the app's next version.`
+  },
+  versions: { usage: "host0 versions <app>", summary: "List an app's versions", options: {} },
+  rollback: {
+    usage: "host0 rollback <app> <version> [--message <text>]",
+    summary: "Put an earlier version live again, as a new version",
+    options: { message: { type: "string" } }
+  },
+  visibility: {
+    usage: "host0 visibility <app> <private|link|public>",
+    summary: "Change who can open an app",
+    options: {}
+  },
+  rename: {
+    usage: "host0 rename <app> [--slug <new-slug>] [--name <display name>]",
+    summary: "Rename an app's URL and/or display name",
+    options: { slug: { type: "string" }, name: { type: "string" } }
+  },
+  share: { usage: "host0 share <app> <email\u2026>", summary: "Invite people by email", options: {} },
+  unshare: { usage: "host0 unshare <app> <email>", summary: "Remove someone's access", options: {} },
+  rm: {
+    usage: "host0 rm <app> --yes",
+    summary: "Delete an app for good",
+    options: { yes: { type: "boolean", short: "y" } }
+  },
+  analytics: {
+    usage: "host0 analytics <app> [--period 24h|7d|30d|90d|365d]",
+    summary: "Visitors and page views",
+    options: { period: { type: "string" } }
+  },
+  records: {
+    usage: "host0 records <app> [collection] [--export]",
+    summary: "An app's shared data: its collections, or one collection's records",
+    options: { export: { type: "boolean" } }
+  },
+  api: {
+    usage: "host0 api <path> [-X <method>] [-d <json>]",
+    summary: "An authenticated request to the host0 API (/api/v1/\u2026)",
+    options: { method: { type: "string", short: "X" }, data: { type: "string", short: "d" } }
+  }
+};
+var ALIASES = { publish: "deploy", restore: "rollback" };
+function mainUsage() {
+  const short = (c) => c.usage.replace(/^host0 /, "");
+  const width = Math.max(...Object.values(COMMANDS).map((c) => short(c).length));
+  return `host0 ${VERSION} \u2014 hosting for whatever your agent creates
+
+Usage: host0 <command> [options]
+       host0 <dir|file>          Same as host0 deploy <dir|file>
+
+Commands:
+${Object.values(COMMANDS).map((c) => `  ${short(c).padEnd(width)}  ${c.summary}`).join("\n")}
+
+Aliases: publish = deploy, restore = rollback. <app> is a slug or an app id.
+
+Global options:
+  --json                       Print the API's JSON (control commands)
+  --api-key <key>              API key (default: $HOST0_API_KEY, then ~/.host0/credentials)
+  --base-url <url>             API base (default: https://host0.ai, or $HOST0_BASE_URL)
+  --allow-nonhost0-base-url    Allow sending the API key to a non-default base URL
+  --client <name>              Agent name for attribution (default: $HOST0_CLIENT or detected)
+  -h, --help                   Show help (host0 <command> --help for a command)
+  -v, --version                Show the version
+
+deploy and pull print one result on stdout (the URL, the folder) and
+publish_result.* / pull_result.* / login_result.* lines on stderr \u2014 the same
+contract as the host0 skill's publish.sh.
+Exit codes: 0 ok \xB7 1 error \xB7 3 waiting for the user to approve a sign-in`;
+}
+function commandUsage(name) {
+  const spec = COMMANDS[name];
+  return `Usage: ${spec.usage}
+
+${spec.summary}.${spec.help ? `
+
+${spec.help}` : ""}`;
+}
+function commandIndex(argv) {
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--") return i + 1 < argv.length ? i + 1 : -1;
+    if (!a.startsWith("-") || a === "-") return i;
+    const name = a.replace(/^--?/, "");
+    if (!a.includes("=") && GLOBAL_OPTIONS[name]?.type === "string") i++;
+  }
+  return -1;
+}
+function parse(argv, options) {
+  try {
+    const { values, positionals } = parseArgs({ args: argv, options, allowPositionals: true, strict: true });
+    return { values, positionals };
+  } catch (e) {
+    const code = e.code;
+    const message = e instanceof Error ? e.message : String(e);
+    if (code === "ERR_PARSE_ARGS_UNKNOWN_OPTION") {
+      die(`unknown option: ${/'([^']+)'/.exec(message)?.[1] ?? message}`);
+    }
+    if (code === "ERR_PARSE_ARGS_INVALID_OPTION_VALUE") {
+      const missing = /^Option '(-\S+?)(?:, (--\S+))?(?: <value>)?' argument missing/.exec(message);
+      if (missing) die(`missing value for ${missing[2] ?? missing[1]}`);
+    }
+    die(message.charAt(0).toLowerCase() + message.slice(1));
+  }
+}
+function waitSeconds(values, flag) {
+  const fromFlag = typeof values.timeout === "string" ? values.timeout : typeof values.wait === "string" ? values.wait : void 0;
+  const raw = fromFlag ?? process.env.HOST0_LOGIN_WAIT_SECONDS ?? "90";
+  const name = typeof values.timeout === "string" ? "timeout" : typeof values.wait === "string" ? "wait" : flag;
+  if (!/^[0-9]+$/.test(raw)) die(`invalid --${name}: ${raw} (seconds, e.g. --${name} 90)`);
+  return Number(raw);
+}
+function need(positionals, count, max, usage) {
+  if (positionals.length < count) die(`usage: ${usage}`);
+  if (positionals.length > max) die(`unexpected argument: ${positionals[max]}`);
+}
+async function run(argv) {
+  const at = commandIndex(argv);
+  const word = at >= 0 ? argv[at] : void 0;
+  let command;
+  let rest = argv;
+  if (word !== void 0) {
+    if (COMMANDS[word]) command = word;
+    else if (ALIASES[word]) command = ALIASES[word];
+    else if (word === "help") {
+      const topic = argv[at + 1];
+      const named = topic && (COMMANDS[topic] ? topic : ALIASES[topic]);
+      return out(named ? commandUsage(named) : mainUsage());
+    } else if (existsSync5(word) || /[/.\\]/.test(word)) command = "deploy";
+    else die(`unknown command: ${word} \u2014 run host0 --help`);
+    rest = command === "deploy" && !COMMANDS[word] && !ALIASES[word] ? argv : [...argv.slice(0, at), ...argv.slice(at + 1)];
+  }
+  const spec = command ? COMMANDS[command] : void 0;
+  const { values, positionals } = parse(rest, { ...GLOBAL_OPTIONS, ...spec?.options ?? {} });
+  if (values.version) return out(VERSION);
+  if (!command || !spec) return out(mainUsage());
+  if (values.help) return out(commandUsage(command));
+  const v = (k) => typeof values[k] === "string" ? values[k] : void 0;
+  const flag = (k) => values[k] === true;
+  const p = positionals;
+  switch (command) {
+    case "deploy": {
+      need(p, 1, 1, spec.usage);
+      const wait = waitSeconds(values, "wait");
+      const ctx = buildContext(values);
+      return deploy(ctx, {
+        target: p[0],
+        name: v("name"),
+        slug: v("slug"),
+        appId: v("app-id"),
+        visibility: v("visibility"),
+        message: v("message"),
+        noLogin: flag("no-login"),
+        waitSeconds: wait
+      });
+    }
+    case "pull": {
+      const byFlag = v("slug") ?? v("app-id");
+      need(p, byFlag ? 0 : 1, byFlag ? 1 : 2, spec.usage);
+      const wait = waitSeconds(values, "wait");
+      const ctx = buildContext(values);
+      return pull(ctx, {
+        app: byFlag ?? p[0],
+        dir: byFlag ? p[0] : p[1],
+        noLogin: flag("no-login"),
+        waitSeconds: wait
+      });
+    }
+    case "login": {
+      need(p, 0, 0, spec.usage);
+      const wait = waitSeconds(values, "timeout");
+      return login(buildContext(values), { wait: flag("wait"), waitSeconds: wait });
+    }
+    case "logout":
+      need(p, 0, 0, spec.usage);
+      return logout(buildContext(values));
+    case "whoami":
+      need(p, 0, 0, spec.usage);
+      return whoami(buildContext(values));
+    case "ls":
+      need(p, 0, 0, spec.usage);
+      return ls(buildContext(values));
+    case "inspect":
+      need(p, 1, 1, spec.usage);
+      return inspect(buildContext(values), p[0]);
+    case "versions":
+      need(p, 1, 1, spec.usage);
+      return versions(buildContext(values), p[0]);
+    case "rollback":
+      need(p, 2, 2, spec.usage);
+      return rollback(buildContext(values), p[0], p[1], v("message"));
+    case "visibility":
+      need(p, 2, 2, spec.usage);
+      return visibility(buildContext(values), p[0], p[1]);
+    case "rename":
+      need(p, 1, 1, spec.usage);
+      return rename(buildContext(values), p[0], { slug: v("slug"), name: v("name") });
+    case "share":
+      need(p, 2, Infinity, spec.usage);
+      return share(buildContext(values), p[0], p.slice(1));
+    case "unshare":
+      need(p, 2, 2, spec.usage);
+      return unshare(buildContext(values), p[0], p[1]);
+    case "rm":
+      need(p, 1, 1, spec.usage);
+      return rm(buildContext(values), p[0], flag("yes"));
+    case "analytics":
+      need(p, 1, 1, spec.usage);
+      return analytics(buildContext(values), p[0], v("period"));
+    case "records":
+      need(p, 1, 2, spec.usage);
+      return records(buildContext(values), p[0], p[1], flag("export"));
+    case "api":
+      need(p, 1, 1, spec.usage);
+      return apiCommand(buildContext(values), p[0], v("method"), v("data"));
+  }
+}
+
+// src/main.ts
+var emitWarning = process.emitWarning.bind(process);
+process.emitWarning = ((warning, ...rest) => {
+  const text = typeof warning === "string" ? warning : warning?.message;
+  if (/Fetch API is an experimental feature/.test(String(text))) return;
+  return emitWarning(warning, ...rest);
+});
+async function main(argv) {
+  installSignalHandlers();
+  process.stdout.on("error", (e) => {
+    if (e.code === "EPIPE") process.exit(0);
+  });
+  let code = 0;
+  try {
+    await run(argv);
+  } catch (e) {
+    code = 1;
+    if (interruptedExitCode()) {
+    } else if (e instanceof Exit) code = e.exitCode;
+    else if (e instanceof CliError) {
+      err(`error: ${e.message}`);
+      code = e.exitCode;
+    } else {
+      err(`error: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+  if (interruptedExitCode()) code = interruptedExitCode();
+  if (code !== 0) await runFailureHooks();
+  return code;
+}
+void main(process.argv.slice(2)).then(exitProcess);