@pushto/cli 0.2.0 → 0.4.6

package/dist/lib/file-walker.js

@@ -0,0 +1,114 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import ignore from 'ignore';
+// Always-exclude footguns: things that should never be deployed regardless of
+// what the user's gitignore says. Catches secrets, pushto-internal files, and
+// universally non-deployable build/cache artifacts even if the user forgot
+// to gitignore them. Patterns without a slash match at any directory level
+// per gitignore semantics — so `.venv` here also catches `sdks/python/.venv`
+// (the chartmuse-engine case that had us shipping a 76MB zip).
+//
+// Conservative: only includes things that are NEVER the deployable artifact.
+// `dist`, `build`, `out` are intentionally NOT here — for static sites those
+// ARE what gets deployed.
+export const ALWAYS_IGNORE = [
+    // pushto-internal + secrets
+    '.git',
+    '.pushto',
+    '.env',
+    '.env.local',
+    '.env.*.local',
+    '.DS_Store',
+    // Node
+    'node_modules',
+    '.next',
+    '.vercel',
+    '.turbo',
+    // Python — venvs (~hundreds of MB), bytecode (regenerated on import),
+    // and test/type-check caches. None of these are ever deployed.
+    '.venv',
+    'venv',
+    '__pycache__',
+    '*.pyc',
+    '.pytest_cache',
+    '.mypy_cache',
+    '.ruff_cache',
+    // Rust / Java / generic build dirs — multi-GB build output. Source-only
+    // deploys; if the user wants to ship a prebuilt binary, they put it
+    // somewhere other than `target/`.
+    'target',
+];
+// Build an ignore filter that combines ALWAYS_IGNORE with the project's own
+// .gitignore and an optional .pushtoignore. Both files use gitignore syntax
+// (negations, glob patterns, dir-only `foo/` markers).
+//
+// This is what unblocks non-Node projects: every Rust project has `target/`
+// in .gitignore, every Python project has `__pycache__/` and `.venv/`, every
+// Go project has `bin/`. Without reading gitignore, the zipper walked into
+// those and either hit the 500MB cap or ground to a halt on tens of
+// thousands of intermediate files.
+export const loadIgnoreFilter = (rootDir) => {
+    const ig = ignore().add(ALWAYS_IGNORE);
+    const gitignorePath = path.join(rootDir, '.gitignore');
+    if (fs.existsSync(gitignorePath)) {
+        ig.add(fs.readFileSync(gitignorePath, 'utf-8'));
+    }
+    const pushtoignorePath = path.join(rootDir, '.pushtoignore');
+    if (fs.existsSync(pushtoignorePath)) {
+        ig.add(fs.readFileSync(pushtoignorePath, 'utf-8'));
+    }
+    return ig;
+};
+/**
+ * Walk a project directory using the same ignore semantics deploy.ts uses
+ * to build the deploy zip. Skips symlinks (traversal protection) and
+ * caps depth at 20.
+ *
+ * Both deploy.ts (zip the matched files) and doctor.ts (preview the
+ * matched files: count, total size, biggest) call this. If the two ever
+ * disagreed, doctor's "looks fine" would mismatch deploy's "exceeds limit"
+ * — frustrating to debug. One source = one truth.
+ */
+export const walkProject = (rootDir) => {
+    const ig = loadIgnoreFilter(rootDir);
+    const files = [];
+    const MAX_DEPTH = 20;
+    const recurse = (dirPath, prefix, depth) => {
+        if (depth > MAX_DEPTH)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(dirPath, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (entry.isSymbolicLink())
+                continue;
+            const archivePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+            // Gitignore syntax: directory-only patterns (`target/`) match only when
+            // the test path ends in a slash. Always append `/` for directories so
+            // both file and dir patterns resolve correctly.
+            const testPath = entry.isDirectory() ? `${archivePath}/` : archivePath;
+            if (ig.ignores(testPath))
+                continue;
+            const fullPath = path.join(dirPath, entry.name);
+            if (entry.isFile()) {
+                try {
+                    const stat = fs.statSync(fullPath);
+                    files.push({ fullPath, archivePath, sizeBytes: stat.size });
+                }
+                catch {
+                    // skip unreadable files
+                }
+            }
+            else if (entry.isDirectory()) {
+                recurse(fullPath, archivePath, depth + 1);
+            }
+        }
+    };
+    recurse(rootDir, '', 0);
+    return files;
+};
+//# sourceMappingURL=file-walker.js.map

package/dist/lib/file-walker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-walker.js","sourceRoot":"","sources":["../../src/lib/file-walker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAuB,MAAM,QAAQ,CAAC;AAE7C,8EAA8E;AAC9E,8EAA8E;AAC9E,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,+DAA+D;AAC/D,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,0BAA0B;AAC1B,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,4BAA4B;IAC5B,MAAM;IACN,SAAS;IACT,MAAM;IACN,YAAY;IACZ,cAAc;IACd,WAAW;IACX,OAAO;IACP,cAAc;IACd,OAAO;IACP,SAAS;IACT,QAAQ;IACR,sEAAsE;IACtE,+DAA+D;IAC/D,OAAO;IACP,MAAM;IACN,aAAa;IACb,OAAO;IACP,eAAe;IACf,aAAa;IACb,aAAa;IACb,wEAAwE;IACxE,oEAAoE;IACpE,kCAAkC;IAClC,QAAQ;CACT,CAAC;AAEF,4EAA4E;AAC5E,4EAA4E;AAC5E,uDAAuD;AACvD,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,oEAAoE;AACpE,mCAAmC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAU,EAAE;IAC1D,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAEvC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACvD,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAWF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAgB,EAAE;IAC3D,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,EAAE,CAAC;IAErB,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,KAAa,EAAQ,EAAE;QACvE,IAAI,KAAK,GAAG,SAAS;YAAE,OAAO;QAC9B,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YAErC,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YACpE,wEAAwE;YACxE,sEAAsE;YACtE,gDAAgD;YAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;YACvE,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAEhD,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACnC,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,wBAAwB;gBAC1B,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC/B,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/dist/lib/interactive.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The single source of truth for whether a command may block on a human.
+ *
+ * No command reads process.stdin.isTTY itself — a guard in
+ * apps/web/scripts/guard-cli-interactive.mjs fails the build if one does.
+ * That centralisation is the whole point: the deploy hang existed because
+ * one call site made this decision privately and got it wrong.
+ */
+export declare const canPrompt: (flags?: {
+    json?: boolean;
+    yes?: boolean;
+}) => boolean;
+//# sourceMappingURL=interactive.d.ts.map

package/dist/lib/interactive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactive.d.ts","sourceRoot":"","sources":["../../src/lib/interactive.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,eAAO,MAAM,SAAS,GAAI,QAAQ;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,OAIrE,CAAC"}

package/dist/lib/interactive.js

@@ -0,0 +1,24 @@
+/**
+ * The single source of truth for whether a command may block on a human.
+ *
+ * No command reads process.stdin.isTTY itself — a guard in
+ * apps/web/scripts/guard-cli-interactive.mjs fails the build if one does.
+ * That centralisation is the whole point: the deploy hang existed because
+ * one call site made this decision privately and got it wrong.
+ */
+/** "", "0" and "false" all mean not-set, matching shell convention. */
+const envFlagSet = (name) => {
+    const raw = process.env[name];
+    if (!raw)
+        return false;
+    const v = raw.toLowerCase();
+    return v !== '0' && v !== 'false';
+};
+export const canPrompt = (flags) => {
+    if (flags?.json || flags?.yes)
+        return false;
+    if (envFlagSet('CI') || envFlagSet('PUSHTO_NONINTERACTIVE'))
+        return false;
+    return Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
+};
+//# sourceMappingURL=interactive.js.map

package/dist/lib/interactive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactive.js","sourceRoot":"","sources":["../../src/lib/interactive.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,uEAAuE;AACvE,MAAM,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC5B,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC;AACpC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAyC,EAAW,EAAE;IAC9E,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,GAAG;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,uBAAuB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC,CAAC"}

package/dist/lib/output.d.ts

@@ -0,0 +1,24 @@
+import type { PushtoError } from '@pushto/shared/errors';
+import { buildError, type PushtoErrorCode } from './errors.js';
+export interface OutputOpts {
+    json?: boolean;
+}
+/**
+ * Under --json, stdout carries exactly one JSON object and nothing else, so
+ * `pushto deploy --json | jq` works unfiltered. Everything a human would
+ * enjoy — spinners, colour, progress — goes to stderr instead.
+ *
+ * lib/api.ts already wrote its session-expired notice to stderr to keep user
+ * pipes clean; this module finishes that discipline for the whole spine.
+ */
+/** Human-only progress. Never stdout; in json mode it still goes to stderr. */
+export declare const progress: (line: string, opts: OutputOpts) => void;
+/** ora writes to stdout by default. In json mode that would corrupt the payload. */
+export declare const spinnerStream: (opts: OutputOpts) => NodeJS.WriteStream;
+export declare const emitOk: (payload: Record<string, unknown> & {
+    human?: string;
+}, opts: OutputOpts) => void;
+export declare const emitErr: (err: PushtoError, opts: OutputOpts) => void;
+/** Render the error and exit on the band its code derives. Never returns. */
+export declare const fail: (code: PushtoErrorCode, human: string, opts: OutputOpts, extra?: Parameters<typeof buildError>[2]) => never;
+//# sourceMappingURL=output.d.ts.map

package/dist/lib/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAe,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAE5E,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;GAOG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,QAAQ,GAAI,MAAM,MAAM,EAAE,MAAM,UAAU,KAAG,IAEzD,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,aAAa,GAAI,MAAM,UAAU,KAAG,MAAM,CAAC,WACX,CAAC;AAE9C,eAAO,MAAM,MAAM,GACjB,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EACrD,MAAM,UAAU,KACf,IAOF,CAAC;AAEF,eAAO,MAAM,OAAO,GAAI,KAAK,WAAW,EAAE,MAAM,UAAU,KAAG,IA4C5D,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,IAAI,GACf,MAAM,eAAe,EACrB,OAAO,MAAM,EACb,MAAM,UAAU,EAChB,QAAQ,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,KACvC,KAGF,CAAC"}

package/dist/lib/output.js

@@ -0,0 +1,71 @@
+import chalk from 'chalk';
+import { buildError, exitCodeFor } from './errors.js';
+/**
+ * Under --json, stdout carries exactly one JSON object and nothing else, so
+ * `pushto deploy --json | jq` works unfiltered. Everything a human would
+ * enjoy — spinners, colour, progress — goes to stderr instead.
+ *
+ * lib/api.ts already wrote its session-expired notice to stderr to keep user
+ * pipes clean; this module finishes that discipline for the whole spine.
+ */
+/** Human-only progress. Never stdout; in json mode it still goes to stderr. */
+export const progress = (line, opts) => {
+    process.stderr.write(opts.json ? `${line}\n` : `${chalk.dim(line)}\n`);
+};
+/** ora writes to stdout by default. In json mode that would corrupt the payload. */
+export const spinnerStream = (opts) => opts.json ? process.stderr : process.stdout;
+export const emitOk = (payload, opts) => {
+    if (opts.json) {
+        const { human: _human, ...rest } = payload;
+        process.stdout.write(`${JSON.stringify({ ok: true, ...rest })}\n`);
+        return;
+    }
+    if (payload.human)
+        process.stdout.write(`${payload.human}\n`);
+};
+export const emitErr = (err, opts) => {
+    if (opts.json) {
+        // `prose` is a human-render hint carrying a {cmd} placeholder. Machines
+        // read label/cmd/href, so it is stripped here rather than shipped as a
+        // half-interpolated string a caller might print raw.
+        const machineFix = err.fix
+            ? {
+                label: err.fix.label,
+                ...(err.fix.cmd ? { cmd: err.fix.cmd } : {}),
+                ...(err.fix.href ? { href: err.fix.href } : {}),
+            }
+            : undefined;
+        // Keys are spread in a fixed order so the payload shape stays stable for
+        // consumers that diff or snapshot it. Optional keys are omitted, not set
+        // to undefined, because JSON.stringify would drop them inconsistently.
+        process.stdout.write(`${JSON.stringify({
+            ok: false,
+            ...(err.stage ? { stage: err.stage } : {}),
+            retryable: err.retryable,
+            ...(err.details ? { details: err.details } : {}),
+            error: { code: err.code, human: err.human, ...(machineFix ? { fix: machineFix } : {}) },
+        })}\n`);
+        return;
+    }
+    process.stderr.write(`${chalk.red(`> ${err.human}`)}\n`);
+    if (!err.fix)
+        return;
+    const target = err.fix.cmd ?? err.fix.href;
+    if (!target)
+        return;
+    // `prose` wins so hand-written copy survives the structured shape: the
+    // sentence is split on its single {cmd} placeholder and the command is
+    // highlighted in place, reproducing the original line exactly.
+    if (err.fix.prose) {
+        const [before = '', after = ''] = err.fix.prose.split('{cmd}');
+        process.stderr.write(`${chalk.dim(`  ${before}`)}${chalk.cyan(target)}${chalk.dim(after)}\n`);
+        return;
+    }
+    process.stderr.write(`${chalk.dim(`  ${err.fix.label}: `)}${chalk.cyan(target)}\n`);
+};
+/** Render the error and exit on the band its code derives. Never returns. */
+export const fail = (code, human, opts, extra) => {
+    emitErr(buildError(code, human, extra), opts);
+    process.exit(exitCodeFor(code));
+};
+//# sourceMappingURL=output.js.map

package/dist/lib/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAwB,MAAM,aAAa,CAAC;AAM5E;;;;;;;GAOG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,IAAgB,EAAQ,EAAE;IAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzE,CAAC,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAgB,EAAsB,EAAE,CACpE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;AAE9C,MAAM,CAAC,MAAM,MAAM,GAAG,CACpB,OAAqD,EACrD,IAAgB,EACV,EAAE;IACR,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;AAChE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,GAAgB,EAAE,IAAgB,EAAQ,EAAE;IAClE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,wEAAwE;QACxE,uEAAuE;QACvE,qDAAqD;QACrD,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG;YACxB,CAAC,CAAC;gBACE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK;gBACpB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD;YACH,CAAC,CAAC,SAAS,CAAC;QACd,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC;YAChB,EAAE,EAAE,KAAK;YACT,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACxF,CAAC,IAAI,CACP,CAAC;QACF,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,OAAO;IAErB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,uEAAuE;IACvE,uEAAuE;IACvE,+DAA+D;IAC/D,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CACxE,CAAC;QACF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACtF,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,IAAqB,EACrB,KAAa,EACb,IAAgB,EAChB,KAAwC,EACjC,EAAE;IACT,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC"}

package/dist/lib/prepare-artifact.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The one entry point deploy + preview share: decide whether this
+ * directory deploys as-is (source) or gets built first (artifact).
+ * Keeping it here means `pushto` and `pushto preview` cannot drift —
+ * the exact failure the spec calls out (working deploys, blank previews).
+ */
+export type ArtifactPrep = {
+    kind: 'source';
+    zipDir: string;
+} | {
+    kind: 'artifact';
+    zipDir: string;
+    framework: string;
+    typeWarnings: string | null;
+    cleanup: () => void;
+} | {
+    kind: 'failed';
+    message: string;
+    buildOutput: string;
+};
+export declare const prepareArtifact: (cwd: string, log: (line: string) => void) => Promise<ArtifactPrep>;
+//# sourceMappingURL=prepare-artifact.d.ts.map

package/dist/lib/prepare-artifact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepare-artifact.d.ts","sourceRoot":"","sources":["../../src/lib/prepare-artifact.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,GACzG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D,eAAO,MAAM,eAAe,GAC1B,KAAK,MAAM,EACX,KAAK,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,KAC1B,OAAO,CAAC,YAAY,CAsBtB,CAAC"}

package/dist/lib/prepare-artifact.js

@@ -0,0 +1,26 @@
+import { detectStaticFramework } from './detect-static-framework.js';
+import { runStaticBuild, writeArtifactMeta } from './build-runner.js';
+export const prepareArtifact = async (cwd, log) => {
+    const detection = detectStaticFramework(cwd);
+    if (!detection)
+        return { kind: 'source', zipDir: cwd };
+    const build = await runStaticBuild(cwd, detection, { log });
+    if (!build.ok)
+        return { kind: 'failed', message: build.message, buildOutput: build.buildOutput };
+    const cleanup = writeArtifactMeta(build.outputDir, {
+        framework: detection.framework,
+        spa: detection.spa,
+    });
+    // The marker must never outlive the command: registering cleanup on
+    // process exit covers every failure branch (process.exit calls
+    // included), so no call site can forget it. cleanup is idempotent.
+    process.once('exit', cleanup);
+    return {
+        kind: 'artifact',
+        zipDir: build.outputDir,
+        framework: detection.framework,
+        typeWarnings: build.typeWarnings,
+        cleanup,
+    };
+};
+//# sourceMappingURL=prepare-artifact.js.map

package/dist/lib/prepare-artifact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepare-artifact.js","sourceRoot":"","sources":["../../src/lib/prepare-artifact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAatE,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,GAAW,EACX,GAA2B,EACJ,EAAE;IACzB,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAEvD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;IAEjG,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE;QACjD,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;KACnB,CAAC,CAAC;IACH,oEAAoE;IACpE,+DAA+D;IAC/D,mEAAmE;IACnE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,KAAK,CAAC,SAAS;QACvB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO;KACR,CAAC;AACJ,CAAC,CAAC"}

package/dist/lib/preview-args.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The `pushto preview` action grammar, as one pure function.
+ *
+ * The command's help and docs/cli teach "(create, ls, rm)". Before this
+ * seam the dispatcher had no `create` verb — any unknown action word was
+ * treated as a directory, so the documented `pushto preview create` died
+ * with "not a directory: create". A bare positional directory
+ * (`pushto preview dist`) still works.
+ */
+export type PreviewAction = {
+    kind: 'create';
+    dir: string;
+} | {
+    kind: 'ls';
+} | {
+    kind: 'rm';
+    ref: string | undefined;
+};
+export declare const resolvePreviewAction: (action: string, args: string[]) => PreviewAction;
+//# sourceMappingURL=preview-args.d.ts.map

package/dist/lib/preview-args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-args.d.ts","sourceRoot":"","sources":["../../src/lib/preview-args.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,GACd;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAE5C,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,EAAE,MAAM,MAAM,EAAE,KAAG,aAKrE,CAAC"}

package/dist/lib/preview-args.js

@@ -0,0 +1,19 @@
+/**
+ * The `pushto preview` action grammar, as one pure function.
+ *
+ * The command's help and docs/cli teach "(create, ls, rm)". Before this
+ * seam the dispatcher had no `create` verb — any unknown action word was
+ * treated as a directory, so the documented `pushto preview create` died
+ * with "not a directory: create". A bare positional directory
+ * (`pushto preview dist`) still works.
+ */
+export const resolvePreviewAction = (action, args) => {
+    if (action === 'ls' || action === 'list')
+        return { kind: 'ls' };
+    if (action === 'rm' || action === 'delete')
+        return { kind: 'rm', ref: args[0] };
+    if (action === 'create')
+        return { kind: 'create', dir: args[0] ?? '.' };
+    return { kind: 'create', dir: action.length > 0 ? action : '.' };
+};
+//# sourceMappingURL=preview-args.js.map

package/dist/lib/preview-args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-args.js","sourceRoot":"","sources":["../../src/lib/preview-args.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAE,IAAc,EAAiB,EAAE;IACpF,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IACxE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACnE,CAAC,CAAC"}

package/dist/lib/resolve-slug.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-slug.d.ts","sourceRoot":"","sources":["../../src/lib/resolve-slug.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,MAAM,GAAG,SAavC,CAAC"}
+{"version":3,"file":"resolve-slug.d.ts","sourceRoot":"","sources":["../../src/lib/resolve-slug.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,MAAM,GAAG,SAiBvC,CAAC"}

package/dist/lib/resolve-slug.js

@@ -1,6 +1,9 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { getProjectSlug } from './config.js';
+/** Validate a slug is safe for use in URL paths (no traversal, no injection). */
+const SAFE_SLUG_RE = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+const isValidSlug = (slug) => slug.length >= 2 && slug.length <= 63 && SAFE_SLUG_RE.test(slug);
 /**
  * Resolve the project slug from:
  * 1. .pushto file in the current directory
@@ -12,13 +15,17 @@ export const resolveSlug = () => {
     try {
         const content = fs.readFileSync(pushtoFile, 'utf-8');
         const parsed = JSON.parse(content);
-        if (parsed.slug)
+        if (typeof parsed.slug === 'string' && isValidSlug(parsed.slug)) {
             return parsed.slug;
+        }
     }
     catch {
         // No .pushto file or invalid JSON — fall through
     }
     // Fall back to global config
-    return getProjectSlug();
+    const globalSlug = getProjectSlug();
+    if (globalSlug && isValidSlug(globalSlug))
+        return globalSlug;
+    return undefined;
 };
 //# sourceMappingURL=resolve-slug.js.map

package/dist/lib/resolve-slug.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-slug.js","sourceRoot":"","sources":["../../src/lib/resolve-slug.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,GAAuB,EAAE;IAClD,gCAAgC;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IAED,6BAA6B;IAC7B,OAAO,cAAc,EAAE,CAAC;AAC1B,CAAC,CAAC"}
+{"version":3,"file":"resolve-slug.js","sourceRoot":"","sources":["../../src/lib/resolve-slug.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,iFAAiF;AACjF,MAAM,YAAY,GAAG,8BAA8B,CAAC;AACpD,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE,CAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,GAAuB,EAAE;IAClD,gCAAgC;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IAED,6BAA6B;IAC7B,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,UAAU,IAAI,WAAW,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC7D,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC"}

package/dist/lib/safe-json.d.ts

@@ -1,7 +1,12 @@
 /**
  * Safely parse a Response as JSON.
- * Returns the parsed object, or a fallback error object if the response
- * isn't valid JSON (e.g., HTML error pages from the server).
+ * Returns the parsed object, or an `{ error }` envelope when the body
+ * isn't valid JSON. The error string includes the HTTP status, the
+ * request path, and a body preview so a downstream "> ${data.error}"
+ * print still tells the user (and us) what actually failed.
+ *
+ * Replaces the old "server returned non-JSON: " message that lost all
+ * context when the body was empty (e.g. an unhandled 500 from the API).
  */
 export declare const safeJson: <T = Record<string, unknown>>(res: Response) => Promise<T>;
 //# sourceMappingURL=safe-json.d.ts.map

package/dist/lib/safe-json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safe-json.d.ts","sourceRoot":"","sources":["../../src/lib/safe-json.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,QAAQ,GAAU,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxD,KAAK,QAAQ,KACZ,OAAO,CAAC,CAAC,CAOX,CAAC"}
+{"version":3,"file":"safe-json.d.ts","sourceRoot":"","sources":["../../src/lib/safe-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,GAAU,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxD,KAAK,QAAQ,KACZ,OAAO,CAAC,CAAC,CAuBX,CAAC"}

package/dist/lib/safe-json.js

@@ -1,15 +1,34 @@
 /**
  * Safely parse a Response as JSON.
- * Returns the parsed object, or a fallback error object if the response
- * isn't valid JSON (e.g., HTML error pages from the server).
+ * Returns the parsed object, or an `{ error }` envelope when the body
+ * isn't valid JSON. The error string includes the HTTP status, the
+ * request path, and a body preview so a downstream "> ${data.error}"
+ * print still tells the user (and us) what actually failed.
+ *
+ * Replaces the old "server returned non-JSON: " message that lost all
+ * context when the body was empty (e.g. an unhandled 500 from the API).
  */
 export const safeJson = async (res) => {
     const text = await res.text();
+    if (text) {
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            // fall through
+        }
+    }
+    let path = '';
     try {
-        return JSON.parse(text);
+        path = new URL(res.url).pathname;
     }
     catch {
-        return { error: `server returned non-JSON: ${text.slice(0, 100)}` };
+        // res.url may be empty in some runtimes
     }
+    const where = path ? ` from ${path}` : '';
+    const error = text
+        ? `pushto.host returned ${res.status}${where}. body: ${text.slice(0, 200)}`
+        : `pushto.host returned ${res.status}${where} with an empty body — likely a server crash. try again, or email support@pushto.host if it sticks.`;
+    return { error };
 };
 //# sourceMappingURL=safe-json.js.map

package/dist/lib/safe-json.js.map

@@ -1 +1 @@
-{"version":3,"file":"safe-json.js","sourceRoot":"","sources":["../../src/lib/safe-json.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAC3B,GAAa,EACD,EAAE;IACd,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,6BAA6B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAO,CAAC;IAC3E,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"safe-json.js","sourceRoot":"","sources":["../../src/lib/safe-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAC3B,GAAa,EACD,EAAE;IACd,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IAED,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1C,MAAM,KAAK,GAAG,IAAI;QAChB,CAAC,CAAC,wBAAwB,GAAG,CAAC,MAAM,GAAG,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;QAC3E,CAAC,CAAC,wBAAwB,GAAG,CAAC,MAAM,GAAG,KAAK,oGAAoG,CAAC;IAEnJ,OAAO,EAAE,KAAK,EAAO,CAAC;AACxB,CAAC,CAAC"}

package/dist/lib/update-check.d.ts

@@ -0,0 +1,17 @@
+interface UpdateInfo {
+    current: string;
+    latest: string;
+    needsUpdate: boolean;
+}
+/**
+ * Check npm registry for a newer version of @pushto/cli.
+ * Caches the result for 24 hours to avoid slowing down every invocation.
+ * Returns null if the check was skipped (cached) or failed (network error).
+ */
+export declare const checkForUpdate: (force?: boolean) => Promise<UpdateInfo | null>;
+/** Read the version baked into this CLI build. The build script overwrites
+ *  src/version.ts with the real value before each `bun build --compile`.
+ *  Local dev (tsx src/index.ts) keeps the committed "0.0.0-dev". */
+export declare const getCurrentVersion: () => string;
+export {};
+//# sourceMappingURL=update-check.d.ts.map

package/dist/lib/update-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-check.d.ts","sourceRoot":"","sources":["../../src/lib/update-check.ts"],"names":[],"mappings":"AAGA,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;CACtB;AAID;;;;GAIG;AACH,eAAO,MAAM,cAAc,GACzB,eAAa,KACZ,OAAO,CAAC,UAAU,GAAG,IAAI,CAiC3B,CAAC;AAoCF;;oEAEoE;AACpE,eAAO,MAAM,iBAAiB,QAAO,MAAiB,CAAC"}

package/dist/lib/update-check.js

@@ -0,0 +1,81 @@
+import { config } from './config.js';
+import { VERSION } from '../version.js';
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
+/**
+ * Check npm registry for a newer version of @pushto/cli.
+ * Caches the result for 24 hours to avoid slowing down every invocation.
+ * Returns null if the check was skipped (cached) or failed (network error).
+ */
+export const checkForUpdate = async (force = false) => {
+    const lastCheck = config.get('lastUpdateCheck');
+    if (!force && lastCheck && Date.now() - lastCheck < CHECK_INTERVAL_MS) {
+        // Return cached result if we checked recently
+        const cached = config.get('latestVersion');
+        if (cached) {
+            const current = getCurrentVersion();
+            return { current, latest: cached, needsUpdate: isNewer(cached, current) };
+        }
+        return null;
+    }
+    try {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 3000);
+        const latest = await fetchLatestVersion(controller.signal);
+        clearTimeout(timeout);
+        if (!latest)
+            return null;
+        config.set('lastUpdateCheck', Date.now());
+        config.set('latestVersion', latest);
+        const current = getCurrentVersion();
+        return { current, latest, needsUpdate: isNewer(latest, current) };
+    }
+    catch {
+        // Network error, offline, timeout — don't bother the user
+        return null;
+    }
+};
+// Pick the right "latest version" source for how this CLI was installed.
+// Homebrew binaries get versioned by GitHub releases on the homebrew-tap
+// repo (the source repo is private). npm-installed CLIs check the npm
+// registry. Mixing them caused the infinite "upgrade available → brew says
+// already current → re-prompt" loop in <0.4.0.
+const fetchLatestVersion = async (signal) => {
+    if (isBrewBinary()) {
+        const res = await fetch('https://api.github.com/repos/mydude-industries/homebrew-tap/releases/latest', { signal, headers: { Accept: 'application/vnd.github+json' } });
+        if (!res.ok)
+            return null;
+        const data = (await res.json());
+        return data.tag_name?.replace(/^v/, '') ?? null;
+    }
+    const res = await fetch('https://registry.npmjs.org/@pushto/cli/latest', { signal });
+    if (!res.ok)
+        return null;
+    const data = (await res.json());
+    return data.version ?? null;
+};
+const isBrewBinary = () => {
+    const exe = process.execPath;
+    return (exe.includes('/Cellar/') ||
+        exe.startsWith('/opt/homebrew/') ||
+        exe.includes('/linuxbrew/') ||
+        exe.includes('/home/linuxbrew/'));
+};
+/** Read the version baked into this CLI build. The build script overwrites
+ *  src/version.ts with the real value before each `bun build --compile`.
+ *  Local dev (tsx src/index.ts) keeps the committed "0.0.0-dev". */
+export const getCurrentVersion = () => VERSION;
+/** True if `a` is a newer semver than `b`. */
+const isNewer = (a, b) => {
+    const pa = a.split('.').map(Number);
+    const pb = b.split('.').map(Number);
+    for (let i = 0; i < 3; i++) {
+        const av = pa[i] ?? 0;
+        const bv = pb[i] ?? 0;
+        if (av > bv)
+            return true;
+        if (av < bv)
+            return false;
+    }
+    return false;
+};
+//# sourceMappingURL=update-check.js.map

package/dist/lib/update-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-check.js","sourceRoot":"","sources":["../../src/lib/update-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAQxC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,KAAK,GAAG,KAAK,EACe,EAAE;IAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,iBAA0B,CAE1C,CAAC;IAEd,IAAI,CAAC,KAAK,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtE,8CAA8C;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,eAAwB,CAAuB,CAAC;QAC1E,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3D,YAAY,CAAC,OAAO,CAAC,CAAC;QAEtB,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,CAAC,GAAG,CAAC,iBAA0B,EAAE,IAAI,CAAC,GAAG,EAAW,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,eAAwB,EAAE,MAAe,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,yEAAyE;AACzE,yEAAyE;AACzE,sEAAsE;AACtE,2EAA2E;AAC3E,+CAA+C;AAC/C,MAAM,kBAAkB,GAAG,KAAK,EAAE,MAAmB,EAA0B,EAAE;IAC/E,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,6EAA6E,EAC7E,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,EAAE,CAC/D,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;IAClD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+CAA+C,EAC/C,EAAE,MAAM,EAAE,CACX,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;IACxD,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,GAAY,EAAE;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;QACxB,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAChC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC3B,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CACjC,CAAC;AACJ,CAAC,CAAC;AAEF;;oEAEoE;AACpE,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAW,EAAE,CAAC,OAAO,CAAC;AAEvD,8CAA8C;AAC9C,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IAChD,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/dist/lib/upload-limits.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Upload-size cap that matches the server-side validation in
+ * apps/web/app/api/cli/projects/[slug]/upload/route.ts (line ~83).
+ *
+ * Single source of truth so doctor and deploy can't disagree:
+ * - doctor uses it to warn before the user even tries
+ * - deploy uses it to fail fast LOCALLY before wasting a ~30s upload
+ *   that the server will 413 anyway
+ *
+ * If you bump this, bump the server check at the same time. Pre-fix,
+ * deploy.ts had its own MAX_ZIP_BYTES = 500MB constant — uploads
+ * between 50MB and 500MB went up the wire and got rejected after
+ * the long upload finished.
+ */
+export declare const SERVER_UPLOAD_CAP_BYTES: number;
+export declare const fmtMB: (bytes: number) => string;
+//# sourceMappingURL=upload-limits.d.ts.map

package/dist/lib/upload-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-limits.d.ts","sourceRoot":"","sources":["../../src/lib/upload-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,QAAmB,CAAC;AAExD,eAAO,MAAM,KAAK,GAAI,OAAO,MAAM,KAAG,MAAiD,CAAC"}