@pushto/cli 0.4.6 → 0.4.10

package/dist/lib/__tests__/npm-packaging.test.js

@@ -0,0 +1,81 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import fs from 'node:fs';
+const execFileAsync = promisify(execFile);
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const CLI_ROOT = path.resolve(HERE, '../../..');
+const VERSION_TS = path.join(CLI_ROOT, 'src', 'version.ts');
+const PLACEHOLDER = '__PUSHTO_BUILD_VERSION__';
+/**
+ * PINs the version-embed mechanism shared by both release channels.
+ *
+ * The npm channel shipped `pushto --version` printing the literal
+ * __PUSHTO_BUILD_VERSION__ because only build-binaries.sh substituted it —
+ * the tsc output npm ships never was. Worse, getCurrentVersion() feeds
+ * isNewer(), so every npm user's update check compared against that string.
+ *
+ * version.ts's own header records that `bun build --define` and a `cat >`
+ * overwrite both failed SILENTLY on darwin-arm64. That scar is why this is
+ * one extracted script rather than a second copy of the sed.
+ */
+let original;
+beforeEach(() => { original = fs.readFileSync(VERSION_TS, 'utf8'); });
+afterEach(() => { fs.writeFileSync(VERSION_TS, original); });
+describe('embed-version.sh', () => {
+    it('replaces the placeholder with the given version', async () => {
+        await execFileAsync('bash', ['scripts/embed-version.sh'], {
+            cwd: CLI_ROOT,
+            env: { ...process.env, VERSION: '9.9.9' },
+        });
+        expect(fs.readFileSync(VERSION_TS, 'utf8')).toContain('export const VERSION = "9.9.9"');
+        expect(fs.readFileSync(VERSION_TS, 'utf8')).not.toContain(PLACEHOLDER);
+    });
+    it('refuses when VERSION is unset, rather than embedding an empty string', async () => {
+        const env = { ...process.env };
+        delete env.VERSION;
+        await expect(execFileAsync('bash', ['scripts/embed-version.sh'], { cwd: CLI_ROOT, env })).rejects.toThrow();
+        expect(fs.readFileSync(VERSION_TS, 'utf8')).toContain(PLACEHOLDER);
+    });
+    it('refuses when the placeholder is already gone, so a double-run cannot corrupt it', async () => {
+        fs.writeFileSync(VERSION_TS, 'export const VERSION = "1.2.3";\n');
+        await expect(execFileAsync('bash', ['scripts/embed-version.sh'], {
+            cwd: CLI_ROOT,
+            env: { ...process.env, VERSION: '9.9.9' },
+        })).rejects.toThrow();
+    });
+    it('leaves no .bak file behind', async () => {
+        await execFileAsync('bash', ['scripts/embed-version.sh'], {
+            cwd: CLI_ROOT,
+            env: { ...process.env, VERSION: '9.9.9' },
+        });
+        expect(fs.existsSync(`${VERSION_TS}.bak`)).toBe(false);
+    });
+});
+describe('prepare-npm.sh', () => {
+    const PKG = path.join(CLI_ROOT, 'package.json');
+    let originalPkg;
+    beforeEach(() => { originalPkg = fs.readFileSync(PKG, 'utf8'); });
+    afterEach(() => { fs.writeFileSync(PKG, originalPkg); });
+    it('produces a package with the version embedded and no devDependencies', async () => {
+        await execFileAsync('bash', ['scripts/prepare-npm.sh'], {
+            cwd: CLI_ROOT,
+            env: { ...process.env, VERSION: '9.9.9' },
+            timeout: 120_000,
+        });
+        const pkg = JSON.parse(fs.readFileSync(PKG, 'utf8'));
+        expect(pkg.version).toBe('9.9.9');
+        expect(pkg.devDependencies).toBeUndefined();
+        expect(pkg.bin).toEqual({ pushto: 'dist/cli.js' });
+        // The workspace devDep is the reason stripping exists: pnpm rewrites
+        // `workspace:*` into a version that can never resolve publicly.
+        expect(JSON.stringify(pkg)).not.toContain('@pushto/shared');
+        expect(Object.keys(pkg.dependencies).sort()).toEqual(['archiver', 'chalk', 'commander', 'conf', 'ignore', 'ora']);
+        const built = fs.readFileSync(path.join(CLI_ROOT, 'dist', 'version.js'), 'utf8');
+        expect(built).toContain('9.9.9');
+        expect(built).not.toContain(PLACEHOLDER);
+    }, 180_000);
+});
+//# sourceMappingURL=npm-packaging.test.js.map

package/dist/lib/__tests__/npm-packaging.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-packaging.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/npm-packaging.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAChD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;AAC5D,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C;;;;;;;;;;;GAWG;AAEH,IAAI,QAAgB,CAAC;AAErB,UAAU,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7D,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,0BAA0B,CAAC,EAAE;YACxD,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE;SAC1C,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QACxF,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,OAAO,GAAG,CAAC,OAAO,CAAC;QACnB,MAAM,MAAM,CACV,aAAa,CAAC,MAAM,EAAE,CAAC,0BAA0B,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAC5E,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,mCAAmC,CAAC,CAAC;QAClE,MAAM,MAAM,CACV,aAAa,CAAC,MAAM,EAAE,CAAC,0BAA0B,CAAC,EAAE;YAClD,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE;SAC1C,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,0BAA0B,CAAC,EAAE;YACxD,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE;SAC1C,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,UAAU,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAChD,IAAI,WAAmB,CAAC;IAExB,UAAU,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzD,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,wBAAwB,CAAC,EAAE;YACtD,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE;YACzC,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAKlD,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,aAAa,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QACnD,qEAAqE;QACrE,gEAAgE;QAChE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAClD,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAC5D,CAAC;QAEF,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC,EAAE,OAAO,CAAC,CAAC;AACd,CAAC,CAAC,CAAC"}

package/dist/lib/__tests__/resolve-slug.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=resolve-slug.test.d.ts.map

package/dist/lib/__tests__/resolve-slug.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-slug.test.d.ts","sourceRoot":"","sources":["../../../src/lib/__tests__/resolve-slug.test.ts"],"names":[],"mappings":""}

package/dist/lib/__tests__/resolve-slug.test.js

@@ -0,0 +1,54 @@
+import { describe, it, expect, vi } from 'vitest';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+vi.mock('../config.js', () => ({
+    getProjectSlug: vi.fn(() => 'global-fallback'),
+}));
+import { readLocalSlug, resolveSlug } from '../resolve-slug.js';
+/**
+ * PINs the split that fixes the soiaa → offload-test misdeploy (2026-07-30).
+ *
+ * The global slug is wherever the last `pushto init`/`pushto use` happened —
+ * any directory on the machine. Commands that upload the cwd must therefore
+ * resolve from the directory's own .pushto ONLY: readLocalSlug never falls
+ * back, while resolveSlug keeps the fallback for control commands (logs,
+ * status, open…), which is the behavior `pushto use` promises.
+ */
+const tmpDir = () => fs.mkdtempSync(path.join(os.tmpdir(), 'pushto-slug-'));
+const writeLink = (dir, content) => {
+    fs.writeFileSync(path.join(dir, '.pushto'), content);
+};
+describe('readLocalSlug', () => {
+    it('reads the slug from the directory .pushto file', () => {
+        const dir = tmpDir();
+        writeLink(dir, JSON.stringify({ slug: 'soiaa' }));
+        expect(readLocalSlug(dir)).toBe('soiaa');
+    });
+    it('returns undefined when the directory has no .pushto — never the global slug', () => {
+        const dir = tmpDir();
+        expect(readLocalSlug(dir)).toBeUndefined();
+    });
+    it('returns undefined on malformed .pushto JSON', () => {
+        const dir = tmpDir();
+        writeLink(dir, '{not json');
+        expect(readLocalSlug(dir)).toBeUndefined();
+    });
+    it('rejects slugs that fail the safe-slug shape', () => {
+        const dir = tmpDir();
+        writeLink(dir, JSON.stringify({ slug: '../../etc/passwd' }));
+        expect(readLocalSlug(dir)).toBeUndefined();
+    });
+});
+describe('resolveSlug (control commands)', () => {
+    it('prefers the directory link over the global slug', () => {
+        const dir = tmpDir();
+        writeLink(dir, JSON.stringify({ slug: 'linked-here' }));
+        expect(resolveSlug(dir)).toBe('linked-here');
+    });
+    it('still falls back to the global slug for unlinked directories', () => {
+        const dir = tmpDir();
+        expect(resolveSlug(dir)).toBe('global-fallback');
+    });
+});
+//# sourceMappingURL=resolve-slug.test.js.map

package/dist/lib/__tests__/resolve-slug.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-slug.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/resolve-slug.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7B,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC;CAC/C,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEhE;;;;;;;;GAQG;AAEH,MAAM,MAAM,GAAG,GAAW,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;AAEpF,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,OAAe,EAAQ,EAAE;IACvD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC,CAAC;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC5B,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/__tests__/snippet-insert.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=snippet-insert.test.d.ts.map

package/dist/lib/__tests__/snippet-insert.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snippet-insert.test.d.ts","sourceRoot":"","sources":["../../../src/lib/__tests__/snippet-insert.test.ts"],"names":[],"mappings":""}

package/dist/lib/__tests__/snippet-insert.test.js

@@ -0,0 +1,69 @@
+import { describe, it, expect } from 'vitest';
+import { mkdtempSync, writeFileSync, mkdirSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { WIDGET_SRC, authSnippet, isAlreadyWired, insertBeforeBody, detectTarget, reactWrapperSource, } from '../snippet-insert.js';
+const tmp = () => mkdtempSync(join(tmpdir(), 'pushto-auth-add-'));
+describe('authSnippet', () => {
+    it('is exactly two lines with the real values inline', () => {
+        const s = authSnippet('proj_x', 'pta_abc');
+        expect(s.split('\n')).toHaveLength(2);
+        expect(s).toContain('id="pushto-auth"');
+        expect(s).toContain(`src="${WIDGET_SRC}"`);
+        expect(s).toContain('data-project="proj_x"');
+        expect(s).toContain('data-key="pta_abc"');
+    });
+});
+describe('insertBeforeBody', () => {
+    it('inserts before the LAST closing body tag, case-insensitively', () => {
+        const html = '<html><body><p>hi</p></BODY></html>';
+        const out = insertBeforeBody(html, authSnippet('p', 'k'));
+        expect(out).not.toBeNull();
+        expect(out.indexOf('pushto-auth')).toBeLessThan(out.indexOf('</BODY>'));
+        expect(out).toContain('<p>hi</p>');
+    });
+    it('returns null when there is no closing body tag — print, do not guess', () => {
+        expect(insertBeforeBody('<div>fragment</div>', 'x')).toBeNull();
+    });
+});
+describe('isAlreadyWired', () => {
+    it('recognizes the widget src wherever it appears', () => {
+        expect(isAlreadyWired(`<script src="${WIDGET_SRC}"></script>`)).toBe(true);
+        expect(isAlreadyWired('<html></html>')).toBe(false);
+    });
+});
+describe('detectTarget', () => {
+    it('prefers root index.html', () => {
+        const dir = tmp();
+        writeFileSync(join(dir, 'index.html'), '<html></html>');
+        expect(detectTarget(dir)).toEqual({ kind: 'html', path: join(dir, 'index.html') });
+    });
+    it('falls back to public/index.html', () => {
+        const dir = tmp();
+        mkdirSync(join(dir, 'public'));
+        writeFileSync(join(dir, 'public', 'index.html'), '<html></html>');
+        expect(detectTarget(dir)).toEqual({ kind: 'html', path: join(dir, 'public', 'index.html') });
+    });
+    it('detects react from package.json dependencies', () => {
+        const dir = tmp();
+        writeFileSync(join(dir, 'package.json'), JSON.stringify({ dependencies: { react: '^18.0.0' } }));
+        expect(detectTarget(dir)).toEqual({ kind: 'react' });
+    });
+    it('returns none for an unrecognizable directory or broken package.json', () => {
+        const dir = tmp();
+        expect(detectTarget(dir)).toEqual({ kind: 'none' });
+        writeFileSync(join(dir, 'package.json'), '{not json');
+        expect(detectTarget(dir)).toEqual({ kind: 'none' });
+    });
+});
+describe('reactWrapperSource', () => {
+    it('bakes in the values and points at the hosted widget', () => {
+        const src = reactWrapperSource('proj_x', 'pta_abc');
+        expect(src).toContain(WIDGET_SRC);
+        expect(src).toContain("'proj_x'");
+        expect(src).toContain("'pta_abc'");
+        expect(src).toContain('PushtoAuth');
+        expect(src).toContain('<div id="pushto-auth"');
+    });
+});
+//# sourceMappingURL=snippet-insert.test.js.map

package/dist/lib/__tests__/snippet-insert.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snippet-insert.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/snippet-insert.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,UAAU,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAElE,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,UAAU,GAAG,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,IAAI,GAAG,qCAAqC,CAAC;QACnD,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,GAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,cAAc,CAAC,gBAAgB,UAAU,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC;QAClB,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC,CAAC;QACxD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC;QAClB,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/B,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC,CAAC;QAClE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC;QAClB,aAAa,CACX,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EACzB,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CACvD,CAAC;QACF,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC;QAClB,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACpD,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,WAAW,CAAC,CAAC;QACtD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/create-project.d.ts

@@ -0,0 +1,19 @@
+export type CreateProjectOutcome = {
+    ok: true;
+    projectId?: string;
+    message?: string;
+} | {
+    ok: false;
+    error: string;
+    network: boolean;
+};
+/**
+ * Create a project on the server and link this directory to it — the shared
+ * spine of `pushto init` and deploy's create-on-first-push. Writes .pushto
+ * in cwd and stores the slug globally so control commands follow along.
+ */
+export declare const createAndLinkProject: (slug: string, opts?: {
+    displayName?: string;
+    cwd?: string;
+}) => Promise<CreateProjectOutcome>;
+//# sourceMappingURL=create-project.d.ts.map

package/dist/lib/create-project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-project.d.ts","sourceRoot":"","sources":["../../src/lib/create-project.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAC/B,MAAM,MAAM,EACZ,OAAM;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,KAChD,OAAO,CAAC,oBAAoB,CA4C9B,CAAC"}

package/dist/lib/create-project.js

@@ -0,0 +1,51 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { api } from './api.js';
+import { safeJson } from './safe-json.js';
+import { setProjectSlug } from './config.js';
+/**
+ * Create a project on the server and link this directory to it — the shared
+ * spine of `pushto init` and deploy's create-on-first-push. Writes .pushto
+ * in cwd and stores the slug globally so control commands follow along.
+ */
+export const createAndLinkProject = async (slug, opts = {}) => {
+    const cwd = opts.cwd ?? process.cwd();
+    let res;
+    try {
+        res = await api('/cli/projects', {
+            method: 'POST',
+            body: JSON.stringify({ name: opts.displayName ?? slug, slug }),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : '';
+        const isNetwork = /fetch|enotfound|econnrefused|timeout|abort|network/i.test(msg);
+        return {
+            ok: false,
+            network: isNetwork,
+            error: isNetwork
+                ? 'could not reach pushto.host. check your internet.'
+                : `couldn't create the project: ${msg || 'unknown error'}`,
+        };
+    }
+    const data = await safeJson(res);
+    if (!res.ok) {
+        return { ok: false, network: false, error: data.error ?? 'something went wrong.' };
+    }
+    try {
+        fs.writeFileSync(path.join(cwd, '.pushto'), `${JSON.stringify({ slug, projectId: data.project?.id }, null, 2)}\n`);
+    }
+    catch (err) {
+        // The project exists server-side at this point — say so, and hand the
+        // user the command that finishes the half-done link.
+        const msg = err instanceof Error ? err.message : 'unknown error';
+        return {
+            ok: false,
+            network: false,
+            error: `${slug} was created, but linking this directory failed: ${msg}. finish with pushto link ${slug}.`,
+        };
+    }
+    setProjectSlug(slug);
+    return { ok: true, projectId: data.project?.id, message: data.message };
+};
+//# sourceMappingURL=create-project.js.map

package/dist/lib/create-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-project.js","sourceRoot":"","sources":["../../src/lib/create-project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAM7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EACvC,IAAY,EACZ,OAA+C,EAAE,EAClB,EAAE;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEtC,IAAI,GAAoC,CAAC;IACzC,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,eAAe,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,qDAAqD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,SAAS;gBACd,CAAC,CAAC,mDAAmD;gBACrD,CAAC,CAAC,gCAAgC,GAAG,IAAI,eAAe,EAAE;SAC7D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAiE,GAAG,CAAC,CAAC;IACjG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,uBAAuB,EAAE,CAAC;IACrF,CAAC;IAED,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EACzB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACtE,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,qDAAqD;QACrD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACjE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,GAAG,IAAI,oDAAoD,GAAG,6BAA6B,IAAI,GAAG;SAC1G,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AAC1E,CAAC,CAAC"}

package/dist/lib/project-name.d.ts

@@ -0,0 +1,6 @@
+/** The naming rules `pushto init` has always applied, shared with deploy's
+ *  create-on-first-push path so a directory name and an explicit name can
+ *  never slugify differently. */
+export declare const slugifyProjectName: (name: string) => string;
+export declare const MIN_SLUG_LENGTH = 3;
+//# sourceMappingURL=project-name.d.ts.map

package/dist/lib/project-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-name.d.ts","sourceRoot":"","sources":["../../src/lib/project-name.ts"],"names":[],"mappings":"AAAA;;iCAEiC;AACjC,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,MAKxB,CAAC;AAE3B,eAAO,MAAM,eAAe,IAAI,CAAC"}

package/dist/lib/project-name.js

@@ -0,0 +1,10 @@
+/** The naming rules `pushto init` has always applied, shared with deploy's
+ *  create-on-first-push path so a directory name and an explicit name can
+ *  never slugify differently. */
+export const slugifyProjectName = (name) => name
+    .toLowerCase()
+    .replace(/[^a-z0-9-]/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '');
+export const MIN_SLUG_LENGTH = 3;
+//# sourceMappingURL=project-name.js.map

package/dist/lib/project-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-name.js","sourceRoot":"","sources":["../../src/lib/project-name.ts"],"names":[],"mappings":"AAAA;;iCAEiC;AACjC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAU,EAAE,CACzD,IAAI;KACD,WAAW,EAAE;KACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;KAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;KACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE3B,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC"}

package/dist/lib/resolve-slug.d.ts

@@ -1,7 +1,17 @@
 /**
- * Resolve the project slug from:
+ * The slug linked to this directory by its .pushto file, or undefined.
+ *
+ * Commands that UPLOAD the directory (deploy, preview) must use this and
+ * never resolveSlug: the global slug points wherever init/use last ran —
+ * any directory on the machine — and following it shipped a brand-new
+ * project's files into an unrelated old project (soiaa → offload-test,
+ * 2026-07-30).
+ */
+export declare const readLocalSlug: (cwd?: string) => string | undefined;
+/**
+ * Resolve the project slug for CONTROL commands (logs, status, open, env…):
  * 1. .pushto file in the current directory
- * 2. Global config (last `pushto init`)
+ * 2. Global config (last `pushto init` / `pushto use`)
  */
-export declare const resolveSlug: () => string | undefined;
+export declare const resolveSlug: (cwd?: string) => string | undefined;
 //# sourceMappingURL=resolve-slug.d.ts.map

package/dist/lib/resolve-slug.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-slug.d.ts","sourceRoot":"","sources":["../../src/lib/resolve-slug.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,MAAM,GAAG,SAiBvC,CAAC"}
+{"version":3,"file":"resolve-slug.d.ts","sourceRoot":"","sources":["../../src/lib/resolve-slug.ts"],"names":[],"mappings":"AASA;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,GAAI,MAAK,MAAsB,KAAG,MAAM,GAAG,SAWpE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,WAAW,GAAI,MAAK,MAAsB,KAAG,MAAM,GAAG,SAOlE,CAAC"}

package/dist/lib/resolve-slug.js

@@ -5,24 +5,36 @@ import { getProjectSlug } from './config.js';
 const SAFE_SLUG_RE = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 const isValidSlug = (slug) => slug.length >= 2 && slug.length <= 63 && SAFE_SLUG_RE.test(slug);
 /**
- * Resolve the project slug from:
- * 1. .pushto file in the current directory
- * 2. Global config (last `pushto init`)
+ * The slug linked to this directory by its .pushto file, or undefined.
+ *
+ * Commands that UPLOAD the directory (deploy, preview) must use this and
+ * never resolveSlug: the global slug points wherever init/use last ran —
+ * any directory on the machine — and following it shipped a brand-new
+ * project's files into an unrelated old project (soiaa → offload-test,
+ * 2026-07-30).
  */
-export const resolveSlug = () => {
-    // Check for .pushto file in cwd
-    const pushtoFile = path.join(process.cwd(), '.pushto');
+export const readLocalSlug = (cwd = process.cwd()) => {
     try {
-        const content = fs.readFileSync(pushtoFile, 'utf-8');
+        const content = fs.readFileSync(path.join(cwd, '.pushto'), 'utf-8');
         const parsed = JSON.parse(content);
         if (typeof parsed.slug === 'string' && isValidSlug(parsed.slug)) {
             return parsed.slug;
         }
     }
     catch {
-        // No .pushto file or invalid JSON — fall through
+        // No .pushto file or invalid JSON — this directory simply isn't linked
     }
-    // Fall back to global config
+    return undefined;
+};
+/**
+ * Resolve the project slug for CONTROL commands (logs, status, open, env…):
+ * 1. .pushto file in the current directory
+ * 2. Global config (last `pushto init` / `pushto use`)
+ */
+export const resolveSlug = (cwd = process.cwd()) => {
+    const local = readLocalSlug(cwd);
+    if (local)
+        return local;
     const globalSlug = getProjectSlug();
     if (globalSlug && isValidSlug(globalSlug))
         return globalSlug;

package/dist/lib/resolve-slug.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-slug.js","sourceRoot":"","sources":["../../src/lib/resolve-slug.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,iFAAiF;AACjF,MAAM,YAAY,GAAG,8BAA8B,CAAC;AACpD,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE,CAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,GAAuB,EAAE;IAClD,gCAAgC;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IAED,6BAA6B;IAC7B,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,UAAU,IAAI,WAAW,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC7D,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC"}
+{"version":3,"file":"resolve-slug.js","sourceRoot":"","sources":["../../src/lib/resolve-slug.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,iFAAiF;AACjF,MAAM,YAAY,GAAG,8BAA8B,CAAC;AACpD,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE,CAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE,EAAsB,EAAE;IAC/E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE,EAAsB,EAAE;IAC7E,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,UAAU,IAAI,WAAW,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC7D,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC"}

package/dist/lib/snippet-insert.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Everything `pushto auth add` needs to put the widget in a project,
+ * as pure functions the tests can hold still.
+ *
+ * The snippet always points at the canonical host — it runs on the
+ * user's site, not against whatever apiUrl this CLI happens to target.
+ */
+export declare const WIDGET_SRC = "https://pushto.host/api/auth/widget.js";
+export declare const authSnippet: (projectId: string, apiKey: string) => string;
+export declare const isAlreadyWired: (source: string) => boolean;
+/** Insert before the LAST </body> (case-insensitive). Null = no anchor: print, don't guess. */
+export declare const insertBeforeBody: (html: string, snippet: string) => string | null;
+export type SnippetTarget = {
+    kind: 'html';
+    path: string;
+} | {
+    kind: 'react';
+} | {
+    kind: 'none';
+};
+/**
+ * html first, deliberately: a vite+react app has BOTH a root index.html
+ * and a react dependency, and the root index.html is its real entry —
+ * inserting there puts the widget on the served page without touching
+ * any component.
+ */
+export declare const detectTarget: (dir: string) => SnippetTarget;
+/**
+ * Kept in sync BY HAND with the dashboard's react snippet
+ * (apps/web/.../auth/page.tsx reactSnippet). Not imported from
+ * packages/shared: the CLI's NodeNext resolution and the shared barrel
+ * have a standing standoff (2026-07-25), and 20 lines is cheaper than
+ * reopening it.
+ */
+export declare const reactWrapperSource: (projectId: string, apiKey: string) => string;
+//# sourceMappingURL=snippet-insert.d.ts.map

package/dist/lib/snippet-insert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snippet-insert.d.ts","sourceRoot":"","sources":["../../src/lib/snippet-insert.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AAEH,eAAO,MAAM,UAAU,2CAA2C,CAAC;AAEnE,eAAO,MAAM,WAAW,GAAI,WAAW,MAAM,EAAE,QAAQ,MAAM,KAAG,MACwD,CAAC;AAEzH,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,KAAG,OAAsC,CAAC;AAEvF,+FAA+F;AAC/F,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,EAAE,SAAS,MAAM,KAAG,MAAM,GAAG,IAIzE,CAAC;AAEF,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErB;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,KAAG,aAgB1C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,WAAW,MAAM,EAAE,QAAQ,MAAM,KAAG,MAuBtE,CAAC"}

package/dist/lib/snippet-insert.js

@@ -0,0 +1,74 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * Everything `pushto auth add` needs to put the widget in a project,
+ * as pure functions the tests can hold still.
+ *
+ * The snippet always points at the canonical host — it runs on the
+ * user's site, not against whatever apiUrl this CLI happens to target.
+ */
+export const WIDGET_SRC = 'https://pushto.host/api/auth/widget.js';
+export const authSnippet = (projectId, apiKey) => `<div id="pushto-auth"></div>\n<script src="${WIDGET_SRC}" data-project="${projectId}" data-key="${apiKey}"></script>`;
+export const isAlreadyWired = (source) => source.includes(WIDGET_SRC);
+/** Insert before the LAST </body> (case-insensitive). Null = no anchor: print, don't guess. */
+export const insertBeforeBody = (html, snippet) => {
+    const idx = html.toLowerCase().lastIndexOf('</body>');
+    if (idx === -1)
+        return null;
+    return `${html.slice(0, idx)}  ${snippet}\n${html.slice(idx)}`;
+};
+/**
+ * html first, deliberately: a vite+react app has BOTH a root index.html
+ * and a react dependency, and the root index.html is its real entry —
+ * inserting there puts the widget on the served page without touching
+ * any component.
+ */
+export const detectTarget = (dir) => {
+    for (const candidate of [join(dir, 'index.html'), join(dir, 'public', 'index.html')]) {
+        if (existsSync(candidate))
+            return { kind: 'html', path: candidate };
+    }
+    const pkgPath = join(dir, 'package.json');
+    if (existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+            if (pkg.dependencies?.react)
+                return { kind: 'react' };
+        }
+        catch {
+            // broken package.json — fall through to none; add prints instead
+        }
+    }
+    return { kind: 'none' };
+};
+/**
+ * Kept in sync BY HAND with the dashboard's react snippet
+ * (apps/web/.../auth/page.tsx reactSnippet). Not imported from
+ * packages/shared: the CLI's NodeNext resolution and the shared barrel
+ * have a standing standoff (2026-07-25), and 20 lines is cheaper than
+ * reopening it.
+ */
+export const reactWrapperSource = (projectId, apiKey) => `// pushto auth — drop-in component backed by the hosted widget
+import { useEffect } from 'react';
+
+const SRC = '${WIDGET_SRC}';
+const PROJECT = '${projectId}';
+const KEY = '${apiKey}';
+
+export function PushtoAuth() {
+  useEffect(() => {
+    if (document.getElementById('pushto-auth-loader')) return;
+    const s = document.createElement('script');
+    s.id = 'pushto-auth-loader';
+    s.src = SRC;
+    s.setAttribute('data-project', PROJECT);
+    s.setAttribute('data-key', KEY);
+    document.body.appendChild(s);
+  }, []);
+  return <div id="pushto-auth" />;
+}
+
+// once loaded, session helpers live on window.pushtoAuth:
+// .getUser() .login(email, pw) .signup(email, pw) .logout() .onChange(cb)
+`;
+//# sourceMappingURL=snippet-insert.js.map

package/dist/lib/snippet-insert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snippet-insert.js","sourceRoot":"","sources":["../../src/lib/snippet-insert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,wCAAwC,CAAC;AAEnE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAE,MAAc,EAAU,EAAE,CACvE,8CAA8C,UAAU,mBAAmB,SAAS,eAAe,MAAM,aAAa,CAAC;AAEzH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAEvF,+FAA+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,OAAe,EAAiB,EAAE;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACjE,CAAC,CAAC;AAOF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAW,EAAiB,EAAE;IACzD,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QACrF,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAEnD,CAAC;YACF,IAAI,GAAG,CAAC,YAAY,EAAE,KAAK;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAE,MAAc,EAAU,EAAE,CAC9E;;;eAGa,UAAU;mBACN,SAAS;eACb,MAAM;;;;;;;;;;;;;;;;;CAiBpB,CAAC"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.4.6";
+export declare const VERSION = "0.4.10";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,OAAO,UAAU,CAAC"}
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,OAAO,WAAW,CAAC"}

package/dist/version.js

@@ -1,6 +1,6 @@
 // AUTO-GENERATED FILE — DO NOT EDIT BY HAND.
 //
-// The literal "0.4.6" below is a placeholder. In CI release
+// The literal "0.4.10" below is a placeholder. In CI release
 // builds (scripts/build-binaries.sh), `sed` replaces it with the real version
 // string before each `bun build --compile` invocation, and the build asserts
 // the version was actually embedded by greping the binary. This is the
@@ -10,7 +10,7 @@
 // silent).
 //
 // In local dev (`tsx src/index.ts`) the placeholder stays put and `pushto
-// --version` reports the literal "0.4.6" — a giveaway
+// --version` reports the literal "0.4.10" — a giveaway
 // that you're on the source tree, not a release build.
-export const VERSION = "0.4.6";
+export const VERSION = "0.4.10";
 //# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,4DAA4D;AAC5D,8EAA8E;AAC9E,6EAA6E;AAC7E,uEAAuE;AACvE,wEAAwE;AACxE,6EAA6E;AAC7E,wEAAwE;AACxE,WAAW;AACX,EAAE;AACF,0EAA0E;AAC1E,sDAAsD;AACtD,uDAAuD;AACvD,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC"}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,6DAA6D;AAC7D,8EAA8E;AAC9E,6EAA6E;AAC7E,uEAAuE;AACvE,wEAAwE;AACxE,6EAA6E;AAC7E,wEAAwE;AACxE,WAAW;AACX,EAAE;AACF,0EAA0E;AAC1E,uDAAuD;AACvD,uDAAuD;AACvD,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushto/cli",
-  "version": "0.4.6",
+  "version": "0.4.10",
   "description": "Deploy to pushto.host from your terminal",
   "type": "module",
   "bin": {