@offsida/cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Offsida
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/bundle.d.ts

@@ -0,0 +1,3 @@
+export declare function bundlePackage(dir: string, opts?: {
+    alias?: Record<string, string>;
+}): Promise<string>;

package/dist/bundle.js

@@ -0,0 +1,34 @@
+import * as esbuild from 'esbuild-wasm';
+import { join } from 'node:path';
+let initialized = false;
+async function ensureInit() {
+    if (initialized)
+        return;
+    await esbuild.initialize({});
+    initialized = true;
+}
+// Bundle <dir>/index.ts (and its local imports) into a single ESM module string,
+// preserving the package's `export default {...}`. Used by `offsida build` and by
+// the platform conformance test. `opts.alias` lets callers resolve bare import
+// prefixes (e.g. the `@core` workspace alias) — esbuild rewrites subpaths, so
+// `{ '@core': '/abs/lib/core/src' }` maps `@core/services/x` → `/abs/lib/core/src/services/x`.
+export async function bundlePackage(dir, opts) {
+    await ensureInit();
+    const result = await esbuild.build({
+        entryPoints: [join(dir, 'index.ts')],
+        bundle: true,
+        format: 'esm',
+        platform: 'neutral',
+        mainFields: ['module', 'main'],
+        conditions: ['workerd', 'worker', 'browser', 'default'],
+        external: ['cloudflare:workers', 'cloudflare:test', 'node:*', 'fs', 'fs/promises', 'path'],
+        alias: opts?.alias,
+        target: 'es2022',
+        write: false,
+        legalComments: 'none',
+    });
+    const out = result.outputFiles?.[0]?.text;
+    if (!out)
+        throw new Error('esbuild produced no output');
+    return out;
+}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+import { writeFile } from 'node:fs/promises';
+import { bundlePackage } from './bundle.js';
+import { pushPackage } from './push.js';
+function arg(flags, name) {
+    const i = flags.indexOf(`--${name}`);
+    return i >= 0 ? flags[i + 1] : undefined;
+}
+async function main() {
+    const [cmd, dir, ...flags] = process.argv.slice(2);
+    if (cmd === 'build') {
+        if (!dir)
+            throw new Error('usage: offsida build <dir> [--out <file>]');
+        const code = await bundlePackage(dir);
+        const out = arg(flags, 'out');
+        if (out) {
+            await writeFile(out, code);
+            process.stdout.write(`wrote ${out}\n`);
+        }
+        else {
+            process.stdout.write(code);
+        }
+        return;
+    }
+    if (cmd === 'push') {
+        if (!dir)
+            throw new Error('usage: offsida push <dir> --url <u> --org <id> [--token <t> | --email <e> --code <c>]');
+        await pushPackage({
+            dir,
+            url: arg(flags, 'url') ?? process.env.OFFSIDA_URL ?? 'http://localhost:3808',
+            org: arg(flags, 'org') ?? process.env.OFFSIDA_ORG ?? '',
+            // Non-interactive CI auth (preferred for automation): a publish token. Takes precedence.
+            token: arg(flags, 'token') ?? process.env.OFFSIDA_TOKEN,
+            // Interactive fallback: emailed login code → session cookie.
+            email: arg(flags, 'email') ?? process.env.OFFSIDA_EMAIL,
+            code: arg(flags, 'code') ?? process.env.OFFSIDA_CODE,
+            name: arg(flags, 'name'),
+            allowRemote: flags.includes('--allow-remote') || process.env.OFFSIDA_ALLOW_REMOTE === '1',
+        });
+        return;
+    }
+    throw new Error(`unknown command: ${cmd ?? '(none)'} — use "build" or "push"`);
+}
+main().catch((e) => {
+    process.stderr.write(`${e.message}\n`);
+    process.exit(1);
+});

package/dist/push.d.ts

@@ -0,0 +1,11 @@
+export type PushOpts = {
+    dir: string;
+    url: string;
+    org: string;
+    email?: string;
+    code?: string;
+    token?: string;
+    name?: string;
+    allowRemote?: boolean;
+};
+export declare function pushPackage(opts: PushOpts): Promise<void>;

package/dist/push.js

@@ -0,0 +1,58 @@
+import { basename } from 'node:path';
+import { ORG_HEADER } from '@offsida/types';
+import { bundlePackage } from './bundle.js';
+function isLocal(url) {
+    try {
+        const h = new URL(url).hostname;
+        return h === 'localhost' || h === '127.0.0.1' || h === '0.0.0.0';
+    }
+    catch {
+        return false;
+    }
+}
+// Two auth modes:
+//   • token   — non-interactive (CI): send `Authorization: Bearer <osk_…>`; no login round-trip. The
+//     token must hold the `code:publish` scope (an org API token, Story 022).
+//   • email+code — interactive: exchange an emailed login code for a session cookie, then upload.
+// A non-local --url is refused without an explicit --allow-remote opt-in (both modes).
+export async function pushPackage(opts) {
+    if (!opts.org)
+        throw new Error('--org is required');
+    if (!opts.token && !(opts.email && opts.code))
+        throw new Error('provide --token (CI), or --email and --code (interactive)');
+    if (!isLocal(opts.url) && !opts.allowRemote) {
+        throw new Error(`refusing to push to non-local URL ${opts.url} without --allow-remote (or OFFSIDA_ALLOW_REMOTE=1)`);
+    }
+    const name = opts.name ?? basename(opts.dir);
+    const code = await bundlePackage(opts.dir);
+    // Resolve the auth header: a bearer token, or a session cookie from the emailed-code exchange.
+    const authHeaders = {};
+    if (opts.token) {
+        authHeaders['authorization'] = `Bearer ${opts.token}`;
+    }
+    else {
+        const verify = await fetch(`${opts.url}/api/auth/verify`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ email: opts.email, code: opts.code }),
+            redirect: 'manual',
+        });
+        if (!verify.ok)
+            throw new Error(`login failed: HTTP ${verify.status}`);
+        const cookie = (verify.headers.get('set-cookie') ?? '').match(/session=[^;]+/)?.[0];
+        if (!cookie)
+            throw new Error('login did not return a session cookie');
+        authHeaders['cookie'] = cookie;
+    }
+    const res = await fetch(`${opts.url}/api/code`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', [ORG_HEADER]: opts.org, ...authHeaders },
+        body: JSON.stringify({ name, modules: { 'index.js': code } }),
+    });
+    if (res.status === 401)
+        throw new Error('auth rejected (HTTP 401) — token invalid/revoked, or login expired');
+    const body = (await res.json());
+    if (!body.ok)
+        throw new Error(`publish failed (${body.status ?? res.status}): ${body.failureReason ?? 'unknown'}`);
+    process.stdout.write(`pushed ${name}@${body.version} — ${body.status}\n`);
+}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@offsida/cli",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "The `offsida` CLI — bundle an integration package and publish it to a running Offsida environment.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mark-ironbarklabs/offsida.web.git",
+    "directory": "lib/offsida/cli"
+  },
+  "bin": {
+    "offsida": "./dist/cli.js"
+  },
+  "exports": {
+    "./bundle": {
+      "types": "./dist/bundle.d.ts",
+      "default": "./dist/bundle.js"
+    },
+    "./push": {
+      "types": "./dist/push.d.ts",
+      "default": "./dist/push.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "esbuild-wasm": "^0.25.12",
+    "@offsida/types": "0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.9.3",
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.6"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  }
+}