@oxprotocol/cli 0.1.0

package/dist/commands/protocol-register.js

@@ -0,0 +1,231 @@
+/**
+ * `oxp protocol-register` — register the `oxp://` URL scheme so clicks
+ * in the browser open `oxp install --from <url>` automatically.
+ *
+ * Per-OS strategy:
+ *
+ *   macOS    Generate a tiny `.app` bundle at
+ *            `~/Applications/OXP Helper.app` whose Info.plist declares
+ *            the `oxp` scheme. Its main binary is a shell script that
+ *            runs `oxp install --from "$1"`. Then ask Launch Services
+ *            to register it.
+ *
+ *   Linux    Drop a `.desktop` file in
+ *            `~/.local/share/applications/oxp-handler.desktop` with
+ *            `MimeType=x-scheme-handler/oxp;` and run `xdg-mime default`.
+ *
+ *   Windows  Write registry keys under `HKCU\Software\Classes\oxp`
+ *            pointing at the `oxp.cmd` shim.
+ *
+ * The command is **idempotent**: running it twice is safe and silent.
+ * It's also reversible — `oxp protocol-register --uninstall` removes
+ * everything it created.
+ *
+ * No network calls, no admin/sudo prompt. The handler simply re-invokes
+ * the user's installed `oxp` binary, so security stays inside the
+ * existing install pipeline (signature, TOFU, permission prompt).
+ */
+import { promises as fs } from "node:fs";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+import { fail, info } from "../util.js";
+const exec = promisify(execFile);
+const MAC_APP_NAME = "OXP Helper.app";
+const LINUX_DESKTOP_NAME = "oxp-handler.desktop";
+const HELP = `oxp protocol-register     Register the oxp:// URL scheme on this machine
+
+Flags:
+  --uninstall         Remove the registration
+  --oxp-bin <path>    Path to the oxp binary to invoke (default: detected)
+`;
+function parseArgs(args) {
+    let uninstall = false;
+    let oxpBin;
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === undefined)
+            continue;
+        if (a === "--uninstall")
+            uninstall = true;
+        else if (a === "--oxp-bin") {
+            oxpBin = args[++i];
+            if (!oxpBin)
+                fail("--oxp-bin requires a path");
+        }
+        else if (a.startsWith("--oxp-bin=")) {
+            oxpBin = a.slice("--oxp-bin=".length);
+        }
+        else if (a === "-h" || a === "--help") {
+            process.stdout.write(HELP);
+            process.exit(0);
+        }
+        else
+            fail(`unknown flag: ${a}`);
+    }
+    return { uninstall, oxpBin };
+}
+export async function protocolRegister(args) {
+    const opts = parseArgs(args);
+    const bin = opts.oxpBin ?? (await detectOxpBin());
+    if (!bin)
+        fail("could not locate oxp binary — pass --oxp-bin <path>");
+    switch (platform()) {
+        case "darwin":
+            return opts.uninstall ? unregisterMac() : registerMac(bin);
+        case "linux":
+            return opts.uninstall ? unregisterLinux() : registerLinux(bin);
+        case "win32":
+            return opts.uninstall ? unregisterWindows() : registerWindows(bin);
+        default:
+            fail(`unsupported platform: ${platform()}`);
+    }
+}
+async function detectOxpBin() {
+    // The CLI is most often launched via npx / pnpm dlx, which puts a
+    // shim on PATH. Prefer that. Fall back to argv[0] (process.execPath)
+    // when nothing matches.
+    try {
+        const { stdout } = await exec(platform() === "win32" ? "where" : "command", platform() === "win32" ? ["oxp"] : ["-v", "oxp"], { shell: platform() !== "win32", timeout: 1500 });
+        const first = stdout.split(/\r?\n/).find((s) => s.trim().length > 0);
+        if (first?.trim())
+            return first.trim();
+    }
+    catch {
+        // ignore
+    }
+    return process.execPath;
+}
+/* -------------------------------------------------------------------------- */
+/* macOS                                                                      */
+/* -------------------------------------------------------------------------- */
+async function registerMac(oxpBin) {
+    const root = join(homedir(), "Applications", MAC_APP_NAME);
+    const contents = join(root, "Contents");
+    const macOS = join(contents, "MacOS");
+    await fs.mkdir(macOS, { recursive: true });
+    const launcher = join(macOS, "oxp-helper");
+    const script = "#!/bin/sh\n" +
+        "# OXP url scheme handler. Auto-generated by `oxp protocol-register`.\n" +
+        `exec ${shQuote(oxpBin)} install --from "$1"\n`;
+    await fs.writeFile(launcher, script, { mode: 0o755 });
+    const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>CFBundleName</key>            <string>OXP Helper</string>
+  <key>CFBundleIdentifier</key>      <string>dev.oxp.helper</string>
+  <key>CFBundleVersion</key>         <string>1</string>
+  <key>CFBundleShortVersionString</key><string>1.0</string>
+  <key>CFBundlePackageType</key>     <string>APPL</string>
+  <key>CFBundleExecutable</key>      <string>oxp-helper</string>
+  <key>LSUIElement</key>             <true/>
+  <key>CFBundleURLTypes</key>
+  <array>
+    <dict>
+      <key>CFBundleURLName</key>     <string>OXP Install</string>
+      <key>CFBundleURLSchemes</key>
+      <array><string>oxp</string></array>
+    </dict>
+  </array>
+</dict>
+</plist>
+`;
+    await fs.writeFile(join(contents, "Info.plist"), plist);
+    // Tell Launch Services to (re)scan the bundle so the URL scheme takes
+    // effect immediately. Failure here isn't fatal — the OS will pick the
+    // app up on next login.
+    try {
+        await exec("/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister", ["-f", root], { timeout: 5000 });
+    }
+    catch {
+        // ignore
+    }
+    info(`✓ registered oxp:// scheme via ${root}`);
+    info(`  test: open 'oxp://install/@oxprotocol/example'`);
+    return 0;
+}
+async function unregisterMac() {
+    const root = join(homedir(), "Applications", MAC_APP_NAME);
+    await fs.rm(root, { recursive: true, force: true });
+    info(`✓ removed ${root}`);
+    return 0;
+}
+/* -------------------------------------------------------------------------- */
+/* Linux                                                                      */
+/* -------------------------------------------------------------------------- */
+async function registerLinux(oxpBin) {
+    const dir = join(process.env.XDG_DATA_HOME ?? join(homedir(), ".local", "share"), "applications");
+    await fs.mkdir(dir, { recursive: true });
+    const file = join(dir, LINUX_DESKTOP_NAME);
+    const desktop = "[Desktop Entry]\n" +
+        "Type=Application\n" +
+        "Name=OXP Install Helper\n" +
+        `Exec=${shQuote(oxpBin)} install --from %u\n` +
+        "NoDisplay=true\n" +
+        "MimeType=x-scheme-handler/oxp;\n" +
+        "Categories=Development;\n" +
+        "Terminal=false\n";
+    await fs.writeFile(file, desktop);
+    try {
+        await exec("update-desktop-database", [dir], { timeout: 5000 });
+    }
+    catch {
+        // not all distros ship update-desktop-database; that's fine
+    }
+    try {
+        await exec("xdg-mime", ["default", LINUX_DESKTOP_NAME, "x-scheme-handler/oxp"], { timeout: 5000 });
+    }
+    catch {
+        info(`note: xdg-mime not available — install xdg-utils to finalize`);
+    }
+    info(`✓ registered oxp:// scheme via ${file}`);
+    return 0;
+}
+async function unregisterLinux() {
+    const dir = join(process.env.XDG_DATA_HOME ?? join(homedir(), ".local", "share"), "applications");
+    const file = join(dir, LINUX_DESKTOP_NAME);
+    await fs.rm(file, { force: true });
+    info(`✓ removed ${file}`);
+    return 0;
+}
+/* -------------------------------------------------------------------------- */
+/* Windows                                                                    */
+/* -------------------------------------------------------------------------- */
+async function registerWindows(oxpBin) {
+    // Use `reg add` rather than touching the registry via FFI — it's
+    // built in and supports HKCU writes without elevation.
+    const cmd = `"${oxpBin}" install --from "%1"`;
+    const ops = [
+        ["HKCU\\Software\\Classes\\oxp", "", "REG_SZ", "URL:OXP Install Protocol"],
+        ["HKCU\\Software\\Classes\\oxp", "URL Protocol", "REG_SZ", ""],
+        ["HKCU\\Software\\Classes\\oxp\\shell\\open\\command", "", "REG_SZ", cmd],
+    ];
+    for (const [key, name, type, value] of ops) {
+        const args = ["add", key];
+        if (name)
+            args.push("/v", name);
+        else
+            args.push("/ve");
+        args.push("/t", type, "/d", value, "/f");
+        await exec("reg", args, { timeout: 5000 });
+    }
+    info(`✓ registered oxp:// scheme in HKCU\\Software\\Classes\\oxp`);
+    return 0;
+}
+async function unregisterWindows() {
+    await exec("reg", ["delete", "HKCU\\Software\\Classes\\oxp", "/f"], {
+        timeout: 5000,
+    });
+    info(`✓ removed HKCU\\Software\\Classes\\oxp`);
+    return 0;
+}
+/* -------------------------------------------------------------------------- */
+/* helpers                                                                    */
+/* -------------------------------------------------------------------------- */
+function shQuote(s) {
+    // Just enough to survive paths with spaces — we control the input.
+    return `"${s.replace(/"/g, '\\"')}"`;
+}
+//# sourceMappingURL=protocol-register.js.map

package/dist/commands/protocol-register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-register.js","sourceRoot":"","sources":["../../src/commands/protocol-register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,MAAM,YAAY,GAAG,gBAAgB,CAAC;AACtC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAOjD,MAAM,IAAI,GAAG;;;;;CAKZ,CAAC;AAEF,SAAS,SAAS,CAAC,IAAc;IAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,MAA0B,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,CAAC,KAAK,aAAa;YAAE,SAAS,GAAG,IAAI,CAAC;aACrC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAC3B,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACnB,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACtC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;;YAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAc;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,IAAI,CAAC,qDAAqD,CAAC,CAAC;IAEtE,QAAQ,QAAQ,EAAE,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7D,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACjE,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACrE;YACE,IAAI,CAAC,yBAAyB,QAAQ,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,kEAAkE;IAClE,qEAAqE;IACrE,wBAAwB;IACxB,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAC3B,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAC5C,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAChD,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CACjD,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrE,IAAI,KAAK,EAAE,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,KAAK,UAAU,WAAW,CAAC,MAAc;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC3C,MAAM,MAAM,GACV,aAAa;QACb,wEAAwE;QACxE,QAAQ,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAC;IAClD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBf,CAAC;IACA,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IAExD,sEAAsE;IACtE,sEAAsE;IACtE,wBAAwB;IACxB,IAAI,CAAC;QACH,MAAM,IAAI,CACR,0GAA0G,EAC1G,CAAC,IAAI,EAAE,IAAI,CAAC,EACZ,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IAED,IAAI,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,kDAAkD,CAAC,CAAC;IACzD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;IAC3D,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,KAAK,UAAU,aAAa,CAAC,MAAc;IACzC,MAAM,GAAG,GAAG,IAAI,CACd,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,EAC/D,cAAc,CACf,CAAC;IACF,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAE3C,MAAM,OAAO,GACX,mBAAmB;QACnB,oBAAoB;QACpB,2BAA2B;QAC3B,QAAQ,OAAO,CAAC,MAAM,CAAC,sBAAsB;QAC7C,kBAAkB;QAClB,kCAAkC;QAClC,2BAA2B;QAC3B,kBAAkB,CAAC;IACrB,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAElC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,CACR,UAAU,EACV,CAAC,SAAS,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,EACvD,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,8DAA8D,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,eAAe;IAC5B,MAAM,GAAG,GAAG,IAAI,CACd,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,EAC/D,cAAc,CACf,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC3C,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,KAAK,UAAU,eAAe,CAAC,MAAc;IAC3C,iEAAiE;IACjE,uDAAuD;IACvD,MAAM,GAAG,GAAG,IAAI,MAAM,uBAAuB,CAAC;IAC9C,MAAM,GAAG,GAA4C;QACnD,CAAC,8BAA8B,EAAE,EAAE,EAAE,QAAQ,EAAE,0BAA0B,CAAC;QAC1E,CAAC,8BAA8B,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC9D,CAAC,oDAAoD,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC;KAC1E,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC1B,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;;YAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,4DAA4D,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,iBAAiB;IAC9B,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,8BAA8B,EAAE,IAAI,CAAC,EAAE;QAClE,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAC/C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,SAAS,OAAO,CAAC,CAAS;IACxB,mEAAmE;IACnE,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AACvC,CAAC"}

package/dist/commands/publish.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `oxp publish [bundle] [--dry-run] [--json] [--no-prepublish]` — POST a
+ * `.oxp` + signature to the registry.
+ *
+ * If <bundle> is omitted, the most recent `dist/*.oxp` in the current project
+ * is used.
+ *
+ * Flags:
+ *   --dry-run         Validate everything (bundle exists, signature + public
+ *                     key files exist, manifest parses, target URL resolves)
+ *                     but do NOT send the POST. Useful in CI to catch broken
+ *                     bundles before they consume publish-rate budget.
+ *   --json            Emit a single-line JSON record instead of human prose.
+ *   --no-prepublish   Skip running `oxp.json#scripts.prepublish` (default: run it).
+ */
+export declare function publish(args: string[]): Promise<number>;
+//# sourceMappingURL=publish.d.ts.map

package/dist/commands/publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/commands/publish.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA6H7D"}

package/dist/commands/publish.js

@@ -0,0 +1,188 @@
+import { promises as fs } from "node:fs";
+import { spawn } from "node:child_process";
+import { basename, join, resolve } from "node:path";
+import { unpackBundle } from "@oxprotocol/bundle";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { fail, info, readCredentials, registryUrl, findProjectRoot, } from "../util.js";
+/**
+ * `oxp publish [bundle] [--dry-run] [--json] [--no-prepublish]` — POST a
+ * `.oxp` + signature to the registry.
+ *
+ * If <bundle> is omitted, the most recent `dist/*.oxp` in the current project
+ * is used.
+ *
+ * Flags:
+ *   --dry-run         Validate everything (bundle exists, signature + public
+ *                     key files exist, manifest parses, target URL resolves)
+ *                     but do NOT send the POST. Useful in CI to catch broken
+ *                     bundles before they consume publish-rate budget.
+ *   --json            Emit a single-line JSON record instead of human prose.
+ *   --no-prepublish   Skip running `oxp.json#scripts.prepublish` (default: run it).
+ */
+export async function publish(args) {
+    const dryRun = args.includes("--dry-run");
+    const json = args.includes("--json");
+    const noPrepublish = args.includes("--no-prepublish");
+    const positional = args.filter((a) => !a.startsWith("--"));
+    // --dry-run does not require credentials — it never talks to the registry.
+    const token = dryRun ? null : await readCredentials();
+    if (!dryRun && !token)
+        fail("not logged in. run `oxp login` first");
+    const bundlePath = await resolveBundle(positional[0]);
+    const sigPath = bundlePath.replace(/\.oxp$/, ".sig.json");
+    const pubPath = bundlePath.replace(/\.oxp$/, ".pub.pem");
+    const [oxpBytes, sigText, pubText] = await Promise.all([
+        fs.readFile(bundlePath),
+        fs.readFile(sigPath, "utf8"),
+        fs.readFile(pubPath, "utf8"),
+    ]);
+    // Read the manifest out of the bundle to learn id + version → URL path.
+    const tmp = await mkdtemp(join(tmpdir(), "oxp-publish-"));
+    let publisher;
+    let slug;
+    let version;
+    try {
+        const u = await unpackBundle(oxpBytes, tmp);
+        publisher = u.manifest.publisher;
+        const idSlug = u.manifest.id.split("/")[1];
+        if (!idSlug)
+            fail(`bad manifest id: ${u.manifest.id}`);
+        slug = idSlug;
+        version = u.manifest.version;
+    }
+    finally {
+        await rm(tmp, { recursive: true, force: true });
+    }
+    const url = `${registryUrl()}/api/v1/extensions/${publisher}/${slug}/versions`;
+    if (dryRun) {
+        const summary = {
+            ok: true,
+            dryRun: true,
+            bundle: bundlePath,
+            bytes: oxpBytes.length,
+            target: url,
+            manifest: { publisher, slug, version },
+        };
+        if (json) {
+            process.stdout.write(JSON.stringify(summary) + "\n");
+        }
+        else {
+            info(`✓ dry-run for @${publisher}/${slug}@${version}`);
+            info(`  bundle:    ${bundlePath} (${oxpBytes.length} bytes)`);
+            info(`  signature: ${sigPath}`);
+            info(`  pubkey:    ${pubPath}`);
+            info(`  target:    ${url}`);
+            info(`  (no network request was made)`);
+        }
+        return 0;
+    }
+    // Run scripts.prepublish (if set) after a successful pack and before upload.
+    if (!noPrepublish) {
+        const root = await findProjectRoot(process.cwd());
+        if (root) {
+            const cmd = await readPrepublishScript(root);
+            if (cmd) {
+                if (!json)
+                    info(`▶ scripts.prepublish: ${cmd}`);
+                const code = await runShell(cmd, root);
+                if (code !== 0) {
+                    fail(`scripts.prepublish exited with code ${code}`);
+                }
+            }
+        }
+    }
+    const form = new FormData();
+    form.append("bundle", new Blob([new Uint8Array(oxpBytes)], {
+        type: "application/vnd.oxp.bundle.v1.tar+zstd",
+    }), basename(bundlePath));
+    form.append("signature", sigText);
+    form.append("publicKey", pubText);
+    if (!json)
+        info(`POST ${url}`);
+    const res = await fetch(url, {
+        method: "POST",
+        headers: { authorization: `Bearer ${token}` },
+        body: form,
+    });
+    const body = await res.text();
+    if (!res.ok) {
+        if (json) {
+            process.stdout.write(JSON.stringify({
+                ok: false,
+                status: res.status,
+                statusText: res.statusText,
+                body,
+            }) + "\n");
+        }
+        else {
+            process.stderr.write(`oxp: ${res.status} ${res.statusText}\n${body}\n`);
+        }
+        return 1;
+    }
+    if (json) {
+        let parsed = body;
+        try {
+            parsed = JSON.parse(body);
+        }
+        catch {
+            /* keep as string */
+        }
+        process.stdout.write(JSON.stringify({ ok: true, publisher, slug, version, response: parsed }) +
+            "\n");
+    }
+    else {
+        info(`✓ published @${publisher}/${slug}@${version}`);
+        info(body);
+    }
+    return 0;
+}
+async function resolveBundle(arg) {
+    if (arg)
+        return resolve(arg);
+    const root = await findProjectRoot(process.cwd());
+    if (!root)
+        fail("not inside an OXP project. pass a bundle path explicitly");
+    const distDir = join(root, "dist");
+    let entries;
+    try {
+        entries = (await fs.readdir(distDir)).filter((n) => n.endsWith(".oxp"));
+    }
+    catch {
+        fail(`no dist/ directory in ${root}. run \`oxp pack\` first`);
+    }
+    if (entries.length === 0)
+        fail("no .oxp files in dist/. run `oxp pack` first");
+    const stats = await Promise.all(entries.map(async (n) => ({
+        name: n,
+        mtime: (await fs.stat(join(distDir, n))).mtimeMs,
+    })));
+    stats.sort((a, b) => b.mtime - a.mtime);
+    return join(distDir, stats[0].name);
+}
+async function readPrepublishScript(root) {
+    try {
+        const txt = await fs.readFile(join(root, "oxp.json"), "utf8");
+        const parsed = JSON.parse(txt);
+        const cmd = parsed.scripts?.prepublish;
+        return typeof cmd === "string" && cmd.trim().length > 0 ? cmd.trim() : null;
+    }
+    catch {
+        return null;
+    }
+}
+function runShell(cmd, cwd) {
+    return new Promise((resolveExit) => {
+        const child = spawn("sh", ["-c", cmd], {
+            cwd,
+            stdio: "inherit",
+            env: process.env,
+        });
+        child.on("exit", (code) => resolveExit(code ?? 1));
+        child.on("error", (err) => {
+            process.stderr.write(`oxp publish: prepublish hook failed to start: ${err.message}\n`);
+            resolveExit(1);
+        });
+    });
+}
+//# sourceMappingURL=publish.js.map

package/dist/commands/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../src/commands/publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,eAAe,EACf,WAAW,EACX,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3D,2EAA2E;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC;IACtD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAEpE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEzD,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACrD,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;QACvB,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAC5B,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC7B,CAAC,CAAC;IAEH,wEAAwE;IACxE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAC1D,IAAI,SAAiB,CAAC;IACtB,IAAI,IAAY,CAAC;IACjB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5C,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,GAAG,MAAM,CAAC;QACd,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,WAAW,EAAE,sBAAsB,SAAS,IAAI,IAAI,WAAW,CAAC;IAE/E,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG;YACd,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE;SACvC,CAAC;QACF,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,kBAAkB,SAAS,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;YACvD,IAAI,CAAC,gBAAgB,UAAU,KAAK,QAAQ,CAAC,MAAM,SAAS,CAAC,CAAC;YAC9D,IAAI,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;YAC5B,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,6EAA6E;IAC7E,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAClD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,IAAI;oBAAE,IAAI,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;gBAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACvC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,IAAI,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CACT,QAAQ,EACR,IAAI,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE;QACnC,IAAI,EAAE,wCAAwC;KAC/C,CAAC,EACF,QAAQ,CAAC,UAAU,CAAC,CACrB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAElC,IAAI,CAAC,IAAI;QAAE,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAM,EAAE,EAAE;QAC9C,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAE9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;gBACb,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,IAAI;aACL,CAAC,GAAG,IAAI,CACV,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,MAAM,GAAY,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACtE,IAAI,CACP,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,gBAAgB,SAAS,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAuB;IAClD,IAAI,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI;QAAE,IAAI,CAAC,0DAA0D,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,yBAAyB,IAAI,0BAA0B,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QACtB,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAEvD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,IAAI,EAAE,CAAC;QACP,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;KACjD,CAAC,CAAC,CACJ,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2C,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC;QACvC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAW;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE;YACrC,GAAG;YACH,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACnD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iDAAiD,GAAG,CAAC,OAAO,IAAI,CACjE,CAAC;YACF,WAAW,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/token.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `oxp token` — manage the bearer token stored in `~/.oxp/credentials`.
+ *
+ * Subcommands:
+ *   oxp token rotate [--days N] [--name "label"] [--scope publish:@a/b ...]
+ *
+ * `rotate` POSTs to /api/v1/tokens/rotate with the current token, then
+ * overwrites `~/.oxp/credentials` with the new secret returned by the
+ * registry. The previous token continues to work for ROTATION_GRACE_MS
+ * (5 min server-side) so a publish in flight does not break.
+ *
+ * If `--scope` is passed one or more times, the new token is NARROWED
+ * to that subset. Without it the new token inherits all scopes from
+ * the current token.
+ */
+export declare function token(args: string[]): Promise<number>;
+//# sourceMappingURL=token.d.ts.map

package/dist/commands/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/commands/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAuCH,wBAAsB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAO3D"}

package/dist/commands/token.js

@@ -0,0 +1,110 @@
+/**
+ * `oxp token` — manage the bearer token stored in `~/.oxp/credentials`.
+ *
+ * Subcommands:
+ *   oxp token rotate [--days N] [--name "label"] [--scope publish:@a/b ...]
+ *
+ * `rotate` POSTs to /api/v1/tokens/rotate with the current token, then
+ * overwrites `~/.oxp/credentials` with the new secret returned by the
+ * registry. The previous token continues to work for ROTATION_GRACE_MS
+ * (5 min server-side) so a publish in flight does not break.
+ *
+ * If `--scope` is passed one or more times, the new token is NARROWED
+ * to that subset. Without it the new token inherits all scopes from
+ * the current token.
+ */
+import { readCredentials, writeCredentials, registryUrl, info, } from "../util.js";
+function parseRotate(args) {
+    const out = {};
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--days") {
+            const v = args[++i];
+            const n = Number(v);
+            if (!Number.isFinite(n) || n <= 0)
+                return { error: "--days must be a positive number" };
+            out.days = Math.floor(n);
+        }
+        else if (a === "--name") {
+            const v = args[++i];
+            if (!v)
+                return { error: "--name requires a value" };
+            out.name = v;
+        }
+        else if (a === "--scope") {
+            const v = args[++i];
+            if (!v)
+                return { error: "--scope requires a value" };
+            (out.scopes ??= []).push(v);
+        }
+        else {
+            return { error: `unknown flag: ${a}` };
+        }
+    }
+    return out;
+}
+export async function token(args) {
+    const [sub, ...rest] = args;
+    if (sub === "rotate")
+        return rotate(rest);
+    process.stderr.write("usage:\n  oxp token rotate [--days N] [--name LABEL] [--scope publish:@h/s ...]\n");
+    return 2;
+}
+async function rotate(args) {
+    const parsed = parseRotate(args);
+    if ("error" in parsed) {
+        process.stderr.write(`oxp: ${parsed.error}\n`);
+        return 2;
+    }
+    const current = await readCredentials();
+    if (!current) {
+        process.stderr.write("oxp: no credentials on disk; run `oxp login` first\n");
+        return 1;
+    }
+    const url = registryUrl();
+    info(`Rotating token at ${url}…`);
+    const body = {};
+    if (parsed.days !== undefined)
+        body.ttlDays = parsed.days;
+    if (parsed.name !== undefined)
+        body.name = parsed.name;
+    if (parsed.scopes !== undefined)
+        body.scopes = parsed.scopes;
+    let res;
+    try {
+        res = await fetch(`${url}/api/v1/tokens/rotate`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${current}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (e) {
+        process.stderr.write(`oxp: rotation request failed: ${e.message}\n`);
+        return 1;
+    }
+    let payload;
+    try {
+        payload = (await res.json());
+    }
+    catch {
+        process.stderr.write(`oxp: rotation returned ${res.status} with non-JSON body\n`);
+        return 1;
+    }
+    if (!res.ok || !payload.ok || !payload.token) {
+        process.stderr.write(`oxp: rotation failed (${res.status}): ${payload.error ?? "unknown error"}\n`);
+        return 1;
+    }
+    await writeCredentials(payload.token);
+    info("✓ new token saved to ~/.oxp/credentials");
+    if (payload.scopes)
+        info(`  scopes: ${payload.scopes.join(", ")}`);
+    if (payload.expiresAt)
+        info(`  expires: ${payload.expiresAt}`);
+    if (payload.previousExpiresAt)
+        info(`  old token valid until: ${payload.previousExpiresAt}`);
+    return 0;
+}
+//# sourceMappingURL=token.js.map

package/dist/commands/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/commands/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,IAAI,GACL,MAAM,YAAY,CAAC;AAQpB,SAAS,WAAW,CAAC,IAAc;IACjC,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACnB,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;YACxF,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;YACpD,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;QACf,CAAC;aAAM,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;YACrD,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAc;IACxC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mFAAmF,CACpF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAc;IAClC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sDAAsD,CACvD,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAI,CAAC,qBAAqB,GAAG,GAAG,CAAC,CAAC;IAElC,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACvD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE7D,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,uBAAuB,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,EAAE;gBAClC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAkC,CAAW,CAAC,OAAO,IAAI,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAQH,CAAC;IACF,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,GAAG,CAAC,MAAM,uBAAuB,CAC5D,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yBAAyB,GAAG,CAAC,MAAM,MAAM,OAAO,CAAC,KAAK,IAAI,eAAe,IAAI,CAC9E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,aAAa,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,SAAS;QAAE,IAAI,CAAC,cAAc,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,iBAAiB;QAC3B,IAAI,CAAC,4BAA4B,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/whoami.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `oxp whoami [--json]` — print the identity behind the local credentials.
+ *
+ * Hits GET /api/v1/auth/whoami with the stored bearer token and prints
+ * handle, email, scopes, and expiry. Prints nothing sensitive (the token
+ * itself is never echoed back).
+ *
+ * Exit codes:
+ *   0  authenticated
+ *   1  not logged in / token invalid / network error
+ */
+export declare function whoami(args: string[]): Promise<number>;
+//# sourceMappingURL=whoami.d.ts.map

package/dist/commands/whoami.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAkBH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA0E5D"}