@pushto/cli 0.4.9 → 0.5.0

package/dist/lib/project-name.d.ts

@@ -0,0 +1,6 @@
+/** The naming rules `pushto init` has always applied, shared with deploy's
+ *  create-on-first-push path so a directory name and an explicit name can
+ *  never slugify differently. */
+export declare const slugifyProjectName: (name: string) => string;
+export declare const MIN_SLUG_LENGTH = 3;
+//# sourceMappingURL=project-name.d.ts.map

package/dist/lib/project-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-name.d.ts","sourceRoot":"","sources":["../../src/lib/project-name.ts"],"names":[],"mappings":"AAAA;;iCAEiC;AACjC,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,MAKxB,CAAC;AAE3B,eAAO,MAAM,eAAe,IAAI,CAAC"}

package/dist/lib/project-name.js

@@ -0,0 +1,10 @@
+/** The naming rules `pushto init` has always applied, shared with deploy's
+ *  create-on-first-push path so a directory name and an explicit name can
+ *  never slugify differently. */
+export const slugifyProjectName = (name) => name
+    .toLowerCase()
+    .replace(/[^a-z0-9-]/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '');
+export const MIN_SLUG_LENGTH = 3;
+//# sourceMappingURL=project-name.js.map

package/dist/lib/project-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-name.js","sourceRoot":"","sources":["../../src/lib/project-name.ts"],"names":[],"mappings":"AAAA;;iCAEiC;AACjC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAU,EAAE,CACzD,IAAI;KACD,WAAW,EAAE;KACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;KAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;KACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE3B,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC"}

package/dist/lib/resolve-slug.d.ts

@@ -1,7 +1,17 @@
 /**
- * Resolve the project slug from:
+ * The slug linked to this directory by its .pushto file, or undefined.
+ *
+ * Commands that UPLOAD the directory (deploy, preview) must use this and
+ * never resolveSlug: the global slug points wherever init/use last ran —
+ * any directory on the machine — and following it shipped a brand-new
+ * project's files into an unrelated old project (soiaa → offload-test,
+ * 2026-07-30).
+ */
+export declare const readLocalSlug: (cwd?: string) => string | undefined;
+/**
+ * Resolve the project slug for CONTROL commands (logs, status, open, env…):
  * 1. .pushto file in the current directory
- * 2. Global config (last `pushto init`)
+ * 2. Global config (last `pushto init` / `pushto use`)
  */
-export declare const resolveSlug: () => string | undefined;
+export declare const resolveSlug: (cwd?: string) => string | undefined;
 //# sourceMappingURL=resolve-slug.d.ts.map

package/dist/lib/resolve-slug.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-slug.d.ts","sourceRoot":"","sources":["../../src/lib/resolve-slug.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,MAAM,GAAG,SAiBvC,CAAC"}
+{"version":3,"file":"resolve-slug.d.ts","sourceRoot":"","sources":["../../src/lib/resolve-slug.ts"],"names":[],"mappings":"AASA;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,GAAI,MAAK,MAAsB,KAAG,MAAM,GAAG,SAWpE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,WAAW,GAAI,MAAK,MAAsB,KAAG,MAAM,GAAG,SAOlE,CAAC"}

package/dist/lib/resolve-slug.js

@@ -5,24 +5,36 @@ import { getProjectSlug } from './config.js';
 const SAFE_SLUG_RE = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 const isValidSlug = (slug) => slug.length >= 2 && slug.length <= 63 && SAFE_SLUG_RE.test(slug);
 /**
- * Resolve the project slug from:
- * 1. .pushto file in the current directory
- * 2. Global config (last `pushto init`)
+ * The slug linked to this directory by its .pushto file, or undefined.
+ *
+ * Commands that UPLOAD the directory (deploy, preview) must use this and
+ * never resolveSlug: the global slug points wherever init/use last ran —
+ * any directory on the machine — and following it shipped a brand-new
+ * project's files into an unrelated old project (soiaa → offload-test,
+ * 2026-07-30).
  */
-export const resolveSlug = () => {
-    // Check for .pushto file in cwd
-    const pushtoFile = path.join(process.cwd(), '.pushto');
+export const readLocalSlug = (cwd = process.cwd()) => {
     try {
-        const content = fs.readFileSync(pushtoFile, 'utf-8');
+        const content = fs.readFileSync(path.join(cwd, '.pushto'), 'utf-8');
         const parsed = JSON.parse(content);
         if (typeof parsed.slug === 'string' && isValidSlug(parsed.slug)) {
             return parsed.slug;
         }
     }
     catch {
-        // No .pushto file or invalid JSON — fall through
+        // No .pushto file or invalid JSON — this directory simply isn't linked
     }
-    // Fall back to global config
+    return undefined;
+};
+/**
+ * Resolve the project slug for CONTROL commands (logs, status, open, env…):
+ * 1. .pushto file in the current directory
+ * 2. Global config (last `pushto init` / `pushto use`)
+ */
+export const resolveSlug = (cwd = process.cwd()) => {
+    const local = readLocalSlug(cwd);
+    if (local)
+        return local;
     const globalSlug = getProjectSlug();
     if (globalSlug && isValidSlug(globalSlug))
         return globalSlug;

package/dist/lib/resolve-slug.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-slug.js","sourceRoot":"","sources":["../../src/lib/resolve-slug.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,iFAAiF;AACjF,MAAM,YAAY,GAAG,8BAA8B,CAAC;AACpD,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE,CAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,GAAuB,EAAE;IAClD,gCAAgC;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IAED,6BAA6B;IAC7B,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,UAAU,IAAI,WAAW,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC7D,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC"}
+{"version":3,"file":"resolve-slug.js","sourceRoot":"","sources":["../../src/lib/resolve-slug.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,iFAAiF;AACjF,MAAM,YAAY,GAAG,8BAA8B,CAAC;AACpD,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE,CAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE,EAAsB,EAAE;IAC/E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE,EAAsB,EAAE;IAC7E,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,UAAU,IAAI,WAAW,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC7D,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC"}

package/dist/lib/snippet-insert.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Everything `pushto auth add` needs to put the widget in a project,
+ * as pure functions the tests can hold still.
+ *
+ * The snippet always points at the canonical host — it runs on the
+ * user's site, not against whatever apiUrl this CLI happens to target.
+ */
+export declare const WIDGET_SRC = "https://pushto.host/api/auth/widget.js";
+export declare const authSnippet: (projectId: string, apiKey: string) => string;
+export declare const isAlreadyWired: (source: string) => boolean;
+/** Insert before the LAST </body> (case-insensitive). Null = no anchor: print, don't guess. */
+export declare const insertBeforeBody: (html: string, snippet: string) => string | null;
+export type SnippetTarget = {
+    kind: 'html';
+    path: string;
+} | {
+    kind: 'react';
+} | {
+    kind: 'none';
+};
+/**
+ * html first, deliberately: a vite+react app has BOTH a root index.html
+ * and a react dependency, and the root index.html is its real entry —
+ * inserting there puts the widget on the served page without touching
+ * any component.
+ */
+export declare const detectTarget: (dir: string) => SnippetTarget;
+/**
+ * Kept in sync BY HAND with the dashboard's react snippet
+ * (apps/web/.../auth/page.tsx reactSnippet). Not imported from
+ * packages/shared: the CLI's NodeNext resolution and the shared barrel
+ * have a standing standoff (2026-07-25), and 20 lines is cheaper than
+ * reopening it.
+ */
+export declare const reactWrapperSource: (projectId: string, apiKey: string) => string;
+//# sourceMappingURL=snippet-insert.d.ts.map

package/dist/lib/snippet-insert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snippet-insert.d.ts","sourceRoot":"","sources":["../../src/lib/snippet-insert.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AAEH,eAAO,MAAM,UAAU,2CAA2C,CAAC;AAEnE,eAAO,MAAM,WAAW,GAAI,WAAW,MAAM,EAAE,QAAQ,MAAM,KAAG,MACwD,CAAC;AAEzH,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,KAAG,OAAsC,CAAC;AAEvF,+FAA+F;AAC/F,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,EAAE,SAAS,MAAM,KAAG,MAAM,GAAG,IAIzE,CAAC;AAEF,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErB;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,KAAG,aAgB1C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,WAAW,MAAM,EAAE,QAAQ,MAAM,KAAG,MAuBtE,CAAC"}

package/dist/lib/snippet-insert.js

@@ -0,0 +1,74 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * Everything `pushto auth add` needs to put the widget in a project,
+ * as pure functions the tests can hold still.
+ *
+ * The snippet always points at the canonical host — it runs on the
+ * user's site, not against whatever apiUrl this CLI happens to target.
+ */
+export const WIDGET_SRC = 'https://pushto.host/api/auth/widget.js';
+export const authSnippet = (projectId, apiKey) => `<div id="pushto-auth"></div>\n<script src="${WIDGET_SRC}" data-project="${projectId}" data-key="${apiKey}"></script>`;
+export const isAlreadyWired = (source) => source.includes(WIDGET_SRC);
+/** Insert before the LAST </body> (case-insensitive). Null = no anchor: print, don't guess. */
+export const insertBeforeBody = (html, snippet) => {
+    const idx = html.toLowerCase().lastIndexOf('</body>');
+    if (idx === -1)
+        return null;
+    return `${html.slice(0, idx)}  ${snippet}\n${html.slice(idx)}`;
+};
+/**
+ * html first, deliberately: a vite+react app has BOTH a root index.html
+ * and a react dependency, and the root index.html is its real entry —
+ * inserting there puts the widget on the served page without touching
+ * any component.
+ */
+export const detectTarget = (dir) => {
+    for (const candidate of [join(dir, 'index.html'), join(dir, 'public', 'index.html')]) {
+        if (existsSync(candidate))
+            return { kind: 'html', path: candidate };
+    }
+    const pkgPath = join(dir, 'package.json');
+    if (existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+            if (pkg.dependencies?.react)
+                return { kind: 'react' };
+        }
+        catch {
+            // broken package.json — fall through to none; add prints instead
+        }
+    }
+    return { kind: 'none' };
+};
+/**
+ * Kept in sync BY HAND with the dashboard's react snippet
+ * (apps/web/.../auth/page.tsx reactSnippet). Not imported from
+ * packages/shared: the CLI's NodeNext resolution and the shared barrel
+ * have a standing standoff (2026-07-25), and 20 lines is cheaper than
+ * reopening it.
+ */
+export const reactWrapperSource = (projectId, apiKey) => `// pushto auth — drop-in component backed by the hosted widget
+import { useEffect } from 'react';
+
+const SRC = '${WIDGET_SRC}';
+const PROJECT = '${projectId}';
+const KEY = '${apiKey}';
+
+export function PushtoAuth() {
+  useEffect(() => {
+    if (document.getElementById('pushto-auth-loader')) return;
+    const s = document.createElement('script');
+    s.id = 'pushto-auth-loader';
+    s.src = SRC;
+    s.setAttribute('data-project', PROJECT);
+    s.setAttribute('data-key', KEY);
+    document.body.appendChild(s);
+  }, []);
+  return <div id="pushto-auth" />;
+}
+
+// once loaded, session helpers live on window.pushtoAuth:
+// .getUser() .login(email, pw) .signup(email, pw) .logout() .onChange(cb)
+`;
+//# sourceMappingURL=snippet-insert.js.map

package/dist/lib/snippet-insert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snippet-insert.js","sourceRoot":"","sources":["../../src/lib/snippet-insert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,wCAAwC,CAAC;AAEnE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAE,MAAc,EAAU,EAAE,CACvE,8CAA8C,UAAU,mBAAmB,SAAS,eAAe,MAAM,aAAa,CAAC;AAEzH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAEvF,+FAA+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,OAAe,EAAiB,EAAE;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACjE,CAAC,CAAC;AAOF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAW,EAAiB,EAAE;IACzD,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QACrF,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAEnD,CAAC;YACF,IAAI,GAAG,CAAC,YAAY,EAAE,KAAK;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAE,MAAc,EAAU,EAAE,CAC9E;;;eAGa,UAAU;mBACN,SAAS;eACb,MAAM;;;;;;;;;;;;;;;;;CAiBpB,CAAC"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.4.9";
+export declare const VERSION = "0.5.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,6 +1,6 @@
 // AUTO-GENERATED FILE — DO NOT EDIT BY HAND.
 //
-// The literal "0.4.9" below is a placeholder. In CI release
+// The literal "0.5.0" below is a placeholder. In CI release
 // builds (scripts/build-binaries.sh), `sed` replaces it with the real version
 // string before each `bun build --compile` invocation, and the build asserts
 // the version was actually embedded by greping the binary. This is the
@@ -10,7 +10,7 @@
 // silent).
 //
 // In local dev (`tsx src/index.ts`) the placeholder stays put and `pushto
-// --version` reports the literal "0.4.9" — a giveaway
+// --version` reports the literal "0.5.0" — a giveaway
 // that you're on the source tree, not a release build.
-export const VERSION = "0.4.9";
+export const VERSION = "0.5.0";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushto/cli",
-  "version": "0.4.9",
+  "version": "0.5.0",
   "description": "Deploy to pushto.host from your terminal",
   "type": "module",
   "bin": {
@@ -18,6 +18,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "archiver": "^7.0.1",
     "chalk": "^5.4.0",
     "commander": "^13.0.0",