@scrthq/runlog 0.0.37 → 0.0.39

package/README.md

@@ -12,6 +12,9 @@ npx @scrthq/runlog sign my-game.yaml --key my-key.json --as "Your Name"
 npx @scrthq/runlog issue my-game.yaml --to "Buyer" --ref order-1 --key my-key.json --seal
 ```
 
+`npx @scrthq/runlog login` signs in through your browser, so that `claim`
+can tie a signing key to your account and the app names you beside what you
+sign. In CI, set `RUNLOG_API_KEY` to a key from your profile page instead.
 `npx @scrthq/runlog help` lists everything.
 
 The same package is a library for a seller's own backend: `seal`, `open`,

package/dist/runlog.js

@@ -7368,9 +7368,9 @@ var require_dist = __commonJS({
 });
 
 // packages/cli/src/bin.ts
-var import_yaml3 = __toESM(require_dist(), 1);
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync, existsSync as existsSync2 } from "node:fs";
-import { basename, dirname, resolve as resolve2 } from "node:path";
+var import_yaml4 = __toESM(require_dist(), 1);
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2, existsSync as existsSync3 } from "node:fs";
+import { basename, dirname, resolve as resolve3 } from "node:path";
 import { createHash } from "node:crypto";
 
 // node_modules/zod/v4/classic/external.js
@@ -27813,6 +27813,11 @@ async function signPack(document, privateKey, signedBy) {
     ...signedBy ? { signedBy } : {}
   };
 }
+async function signBytes(bytes2, privateKey) {
+  const key = await crypto.subtle.importKey("pkcs8", fromBase64Url(privateKey), ALGORITHM, false, ["sign"]);
+  const value = await crypto.subtle.sign(SIGN, key, bytes2);
+  return toBase64Url(new Uint8Array(value));
+}
 async function derivePublicKey(privateKey) {
   const key = await crypto.subtle.importKey(
     "pkcs8",
@@ -28203,9 +28208,346 @@ function runFixtures(pack) {
 }
 
 // packages/cli/src/sign.ts
+var import_yaml3 = __toESM(require_dist(), 1);
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, chmodSync as chmodSync2 } from "node:fs";
+import { resolve as resolve2 } from "node:path";
+
+// packages/cli/src/account.ts
 var import_yaml2 = __toESM(require_dist(), 1);
-import { readFileSync, writeFileSync, existsSync, chmodSync } from "node:fs";
-import { resolve } from "node:path";
+import { spawn } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { createInterface } from "node:readline";
+var DEFAULT_API = "https://runlog.scrthq.com/api";
+var RENEW_MARGIN_MS = 6e4;
+var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+function configDir() {
+  const base = process.env["RUNLOG_CONFIG_DIR"] ?? (process.platform === "win32" ? join(process.env["APPDATA"] ?? join(homedir(), "AppData", "Roaming"), "runlog") : join(process.env["XDG_CONFIG_HOME"] ?? join(homedir(), ".config"), "runlog"));
+  return base;
+}
+var credentialsPath = () => join(configDir(), "credentials.json");
+function credentials() {
+  const fromEnv = process.env["RUNLOG_API_KEY"];
+  if (fromEnv) return { api: process.env["RUNLOG_API"] ?? DEFAULT_API, key: fromEnv, savedAt: "" };
+  try {
+    const raw = JSON.parse(readFileSync(credentialsPath(), "utf8"));
+    if (typeof raw.api !== "string") return null;
+    if (typeof raw.key === "string") return { api: raw.api, key: raw.key, savedAt: raw.savedAt ?? "" };
+    const s = raw.session;
+    if (s && typeof s.accessToken === "string" && typeof s.refreshToken === "string" && typeof s.clientId === "string") {
+      return {
+        api: raw.api,
+        session: { clientId: s.clientId, issuer: s.issuer ?? WORKOS, accessToken: s.accessToken, refreshToken: s.refreshToken, expiresAt: s.expiresAt ?? "" },
+        savedAt: raw.savedAt ?? ""
+      };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function save(creds) {
+  const dir = configDir();
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(credentialsPath(), `${JSON.stringify(creds, null, 2)}
+`, "utf8");
+  try {
+    chmodSync(credentialsPath(), 384);
+  } catch {
+  }
+}
+async function ask(prompt, hidden = false) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+  return new Promise((done) => {
+    if (hidden) {
+      const out = process.stdout;
+      process.stdout.write(prompt);
+      const original = out.write.bind(out);
+      out.write = ((chunk, ...rest) => {
+        if (typeof chunk === "string" && chunk !== "\n" && chunk !== "\r\n") return true;
+        return original(chunk, ...rest);
+      });
+      rl.question("", (answer) => {
+        out.write = original;
+        process.stdout.write("\n");
+        rl.close();
+        done(answer.trim());
+      });
+    } else {
+      rl.question(prompt, (answer) => {
+        rl.close();
+        done(answer.trim());
+      });
+    }
+  });
+}
+var WORKOS = "https://api.workos.com";
+var realDeps = {
+  fetch: (input2, init) => fetch(input2, init),
+  sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+  say: (line) => console.log(line),
+  open: (url2) => {
+    try {
+      const [cmd, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url2]] : process.platform === "darwin" ? ["open", [url2]] : ["xdg-open", [url2]];
+      spawn(cmd, args, { detached: true, stdio: "ignore" }).on("error", () => {
+      }).unref();
+    } catch {
+    }
+  },
+  now: () => Date.now()
+};
+async function postForm(deps, url2, form) {
+  const response = await deps.fetch(url2, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+    body: new URLSearchParams(form).toString()
+  });
+  const text = await response.text();
+  try {
+    return { status: response.status, body: JSON.parse(text) };
+  } catch {
+    throw new Error(`WorkOS did not answer as expected (${response.status})`);
+  }
+}
+function expiryOf(accessToken, now) {
+  try {
+    const payload = JSON.parse(Buffer.from(accessToken.split(".")[1] ?? "", "base64url").toString("utf8"));
+    if (typeof payload.exp === "number") return new Date(payload.exp * 1e3).toISOString();
+  } catch {
+  }
+  return new Date(now + 5 * 6e4).toISOString();
+}
+async function deviceFlow(clientId, issuer, deps = realDeps) {
+  const start = await postForm(deps, `${issuer}/user_management/authorize/device`, { client_id: clientId });
+  const s = start.body;
+  if (start.status >= 400 || !s.device_code || !s.user_code || !s.verification_uri) {
+    throw new Error(s.error_description ?? `WorkOS would not start a sign-in (${start.status})`);
+  }
+  deps.say("");
+  deps.say(`  Open  ${s.verification_uri}`);
+  deps.say(`  Code  ${s.user_code}`);
+  deps.say("");
+  deps.say("Waiting for you to confirm it there. Ctrl-C gives up.");
+  if (s.verification_uri_complete) deps.open(s.verification_uri_complete);
+  let interval = Math.max(1, s.interval ?? 5);
+  const deadline = deps.now() + (s.expires_in ?? 300) * 1e3;
+  while (deps.now() < deadline) {
+    await deps.sleep(interval * 1e3);
+    const poll = await postForm(deps, `${issuer}/user_management/authenticate`, { grant_type: DEVICE_GRANT, device_code: s.device_code, client_id: clientId });
+    const a = poll.body;
+    if (a.access_token && a.refresh_token) {
+      return { clientId, issuer, accessToken: a.access_token, refreshToken: a.refresh_token, expiresAt: expiryOf(a.access_token, deps.now()) };
+    }
+    switch (a.error) {
+      case "authorization_pending":
+        continue;
+      case "slow_down":
+        interval += 1;
+        continue;
+      case "access_denied":
+        throw new Error("the sign-in was refused in the browser");
+      case "expired_token":
+        throw new Error("the code expired before it was confirmed; run `runlog login` again");
+      default:
+        throw new Error(a.error_description ?? a.error ?? `WorkOS answered ${poll.status}`);
+    }
+  }
+  throw new Error("the code expired before it was confirmed; run `runlog login` again");
+}
+async function renew(session, deps = realDeps) {
+  const answer = await postForm(deps, `${session.issuer}/user_management/authenticate`, {
+    grant_type: "refresh_token",
+    refresh_token: session.refreshToken,
+    client_id: session.clientId
+  });
+  const a = answer.body;
+  if (!a.access_token || !a.refresh_token) {
+    throw new Error("your sign-in has lapsed; run `runlog login` again");
+  }
+  return { ...session, accessToken: a.access_token, refreshToken: a.refresh_token, expiresAt: expiryOf(a.access_token, deps.now()) };
+}
+async function bearer(creds, force = false, deps = realDeps) {
+  if (creds.key) return creds.key;
+  if (!creds.session) throw new Error("not signed in: run `runlog login`");
+  const lapsing = !creds.session.expiresAt || Date.parse(creds.session.expiresAt) - deps.now() < RENEW_MARGIN_MS;
+  if (!force && !lapsing) return creds.session.accessToken;
+  const session = await renew(creds.session, deps);
+  creds.session = session;
+  if (!process.env["RUNLOG_API_KEY"]) save(creds);
+  return session.accessToken;
+}
+async function api(method, path, body) {
+  const creds = credentials();
+  if (!creds) throw new Error("not signed in: run `runlog login`");
+  const once = async (token) => {
+    const response = await fetch(`${creds.api.replace(/\/$/, "")}${path}`, {
+      method,
+      headers: { authorization: `Bearer ${token}`, ...body !== void 0 ? { "content-type": "application/json" } : {} },
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+    });
+    const text = await response.text();
+    let parsed = null;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      throw new Error(`the API at ${creds.api} did not answer as expected (${response.status})`);
+    }
+    return { status: response.status, parsed };
+  };
+  let answer = await once(await bearer(creds));
+  if (answer.status === 401 && creds.session) answer = await once(await bearer(creds, true));
+  if (answer.status === 401) {
+    throw new Error(creds.key ? "that key is not accepted; make a new one on your profile page and `runlog login --key` again" : "your sign-in has lapsed; run `runlog login` again");
+  }
+  if (answer.status >= 400) {
+    const said = answer.parsed?.error;
+    throw new Error(said ?? `the API said ${answer.status}`);
+  }
+  return answer.parsed;
+}
+async function greet(apiUrl) {
+  const me = await api("GET", "/me");
+  const who = me.profile?.name ?? me.profile?.email ?? "you";
+  console.log(`signed in as ${who} at ${apiUrl}`);
+}
+async function cmdLogin(args, deps = realDeps) {
+  const apiUrl = (flag(args, "--api") ?? process.env["RUNLOG_API"] ?? DEFAULT_API).replace(/\/$/, "");
+  if (process.env["RUNLOG_API_KEY"]) {
+    console.error("RUNLOG_API_KEY is set, so that is what every command will use; unset it to sign in as yourself");
+    return 1;
+  }
+  if (args.includes("--key")) {
+    console.log("Paste a command-line key from your profile page in Runlog. It is not shown as you type.");
+    const key = await ask("key: ", true);
+    if (!key.startsWith("rl_")) {
+      console.error("that does not look like a Runlog key; they begin with rl_");
+      return 1;
+    }
+    save({ api: apiUrl, key, savedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    try {
+      await greet(apiUrl);
+      return 0;
+    } catch (error61) {
+      unlinkSync(credentialsPath());
+      console.error(error61 instanceof Error ? error61.message : String(error61));
+      return 1;
+    }
+  }
+  try {
+    const response = await deps.fetch(`${apiUrl}/auth/cli`, { headers: { accept: "application/json" } });
+    const text = await response.text();
+    let about = {};
+    try {
+      about = JSON.parse(text);
+    } catch {
+      throw new Error(`the API at ${apiUrl} did not answer as expected (${response.status})`);
+    }
+    if (!about.clientId) throw new Error(`the API at ${apiUrl} cannot sign in a terminal yet; use \`runlog login --key\` with a key from your profile page`);
+    const session = await deviceFlow(about.clientId, about.issuer ?? WORKOS, deps);
+    save({ api: apiUrl, session, savedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    await greet(apiUrl);
+    return 0;
+  } catch (error61) {
+    console.error(error61 instanceof Error ? error61.message : String(error61));
+    return 1;
+  }
+}
+function cmdLogout() {
+  const creds = credentials();
+  if (existsSync(credentialsPath())) {
+    unlinkSync(credentialsPath());
+    console.log(creds?.key ? "signed out; the key is still valid until you revoke it on your profile page" : "signed out");
+  } else {
+    console.log("not signed in");
+  }
+  return 0;
+}
+async function cmdWhoami() {
+  try {
+    const creds = credentials();
+    const me = await api("GET", "/me");
+    const claims = await api("GET", "/claims");
+    const how = process.env["RUNLOG_API_KEY"] ? "with RUNLOG_API_KEY" : creds?.key ? "with a key from the profile page" : "from the browser";
+    console.log(`${me.profile?.name ?? "(no name)"} <${me.profile?.email ?? "?"}>  ${me.sub}`);
+    console.log(`signed in ${how} at ${creds?.api ?? DEFAULT_API}`);
+    console.log(claims.claims.length > 0 ? `claimed signing keys: ${claims.claims.map((c) => c.fingerprint).join(", ")}` : "no claimed signing keys yet: `runlog claim key.json`");
+    return 0;
+  } catch (error61) {
+    console.error(error61 instanceof Error ? error61.message : String(error61));
+    return 1;
+  }
+}
+function readKey(path) {
+  const key = JSON.parse(readFileSync(resolve(path), "utf8"));
+  if (!key.privateKey || !key.publicKey) throw new Error(`${path} is not a runlog signing key`);
+  return { publicKey: key.publicKey, privateKey: key.privateKey, fingerprint: key.fingerprint ?? "" };
+}
+async function cmdClaim(args) {
+  const keyPath = args.filter((a) => !a.startsWith("-"))[0];
+  if (!keyPath) {
+    console.error("usage: runlog claim key.json");
+    return 2;
+  }
+  try {
+    const key = readKey(keyPath);
+    const { nonce } = await api("POST", "/claims/nonce");
+    const signature = await signBytes(new TextEncoder().encode(nonce), key.privateKey);
+    const { claim: claim2 } = await api("POST", "/claims", { publicKey: key.publicKey, nonce, signature });
+    console.log(`claimed ${claim2.fingerprint}${claim2.name ? ` as ${claim2.name}` : ""}`);
+    console.log("packs signed with this key now show your name in the app");
+    return 0;
+  } catch (error61) {
+    console.error(error61 instanceof Error ? error61.message : String(error61));
+    return 1;
+  }
+}
+async function requireClaimed(publicKey) {
+  const fp = await fingerprint(publicKey);
+  const { claims } = await api("GET", "/claims");
+  if (!claims.some((c) => c.fingerprint === fp)) {
+    throw new Error(`this key (${fp}) is not claimed by your account: run \`runlog claim key.json\` first, so the app can name you`);
+  }
+}
+async function cmdPublish(args) {
+  const input2 = args.filter((a) => !a.startsWith("-"))[0];
+  if (!input2) {
+    console.error("usage: runlog publish <pack.yaml|pack.json>");
+    return 2;
+  }
+  try {
+    const path = resolve(input2);
+    const text = readFileSync(path, "utf8");
+    const format = detectFormat(path);
+    const doc = format === "json" ? JSON.parse(text) : import_yaml2.default.parse(text);
+    const id = String(doc["id"] ?? "");
+    if (!id) throw new Error("the pack has no id");
+    const { createHash: createHash2 } = await import("node:crypto");
+    const hash2 = createHash2("sha256").update(text).digest("hex").slice(0, 16);
+    const at = (/* @__PURE__ */ new Date()).toISOString();
+    await api("PUT", `/packs/${encodeURIComponent(id)}`, {
+      title: String(doc["title"] ?? id),
+      version: String(doc["version"] ?? ""),
+      format,
+      filename: input2.split(/[\\/]/).pop(),
+      importedAt: at,
+      updatedAt: at,
+      hash: hash2,
+      source: text
+    });
+    console.log(`published ${id} to your library; it reaches your devices on their next sync`);
+    return 0;
+  } catch (error61) {
+    console.error(error61 instanceof Error ? error61.message : String(error61));
+    return 1;
+  }
+}
+function flag(args, name) {
+  const at = args.indexOf(name);
+  return at === -1 ? void 0 : args[at + 1];
+}
+
+// packages/cli/src/sign.ts
 var RED = "\x1B[31m";
 var GREEN = "\x1B[32m";
 var YELLOW = "\x1B[33m";
@@ -28213,13 +28555,13 @@ var DIM = "\x1B[2m";
 var RESET = "\x1B[0m";
 var useColor = process.stdout.isTTY && !process.env.NO_COLOR;
 var paint = (code, text) => useColor ? `${code}${text}${RESET}` : text;
-function flag(args, name) {
+function flag2(args, name) {
   const at = args.indexOf(name);
   return at === -1 ? void 0 : args[at + 1];
 }
 async function cmdKeygen(args) {
-  const out = resolve(flag(args, "-o") ?? flag(args, "--out") ?? "runlog-key.json");
-  if (existsSync(out)) {
+  const out = resolve2(flag2(args, "-o") ?? flag2(args, "--out") ?? "runlog-key.json");
+  if (existsSync2(out)) {
     console.error(paint(RED, `refusing to overwrite ${out}`));
     console.error(paint(DIM, "  a signing key cannot be recovered; delete it yourself if you mean to"));
     return 1;
@@ -28232,10 +28574,10 @@ async function cmdKeygen(args) {
     fingerprint: await fingerprint(pair.publicKey),
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  writeFileSync(out, `${JSON.stringify(key, null, 2)}
+  writeFileSync2(out, `${JSON.stringify(key, null, 2)}
 `, "utf8");
   try {
-    chmodSync(out, 384);
+    chmodSync2(out, 384);
   } catch {
   }
   console.log(`wrote ${out}`);
@@ -28253,14 +28595,14 @@ async function cmdKeygen(args) {
 }
 async function cmdSign(args) {
   const input2 = args.filter((a) => !a.startsWith("-"))[0];
-  const keyPath = flag(args, "--key") ?? flag(args, "-k");
+  const keyPath = flag2(args, "--key") ?? flag2(args, "-k");
   if (!input2 || !keyPath) {
     console.error('usage: runlog sign <pack.yaml> --key runlog-key.json [--as "Your Name"]');
     return 2;
   }
   let key;
   try {
-    key = JSON.parse(readFileSync(resolve(keyPath), "utf8"));
+    key = JSON.parse(readFileSync2(resolve2(keyPath), "utf8"));
   } catch {
     console.error(paint(RED, `could not read the key at ${keyPath}`));
     return 1;
@@ -28269,16 +28611,22 @@ async function cmdSign(args) {
     console.error(paint(RED, `${keyPath} has no private key in it`));
     return 1;
   }
-  const path = resolve(input2);
-  const text = readFileSync(path, "utf8");
+  try {
+    await requireClaimed(key.publicKey);
+  } catch (error61) {
+    console.error(paint(RED, error61 instanceof Error ? error61.message : String(error61)));
+    return 1;
+  }
+  const path = resolve2(input2);
+  const text = readFileSync2(path, "utf8");
   const format = detectFormat(path);
-  const document = import_yaml2.default.parse(text);
-  const signature = await signPack(document, key.privateKey, flag(args, "--as"));
+  const document = import_yaml3.default.parse(text);
+  const signature = await signPack(document, key.privateKey, flag2(args, "--as"));
   const signed = { ...document, signature };
-  writeFileSync(
+  writeFileSync2(
     path,
     format === "json" ? `${JSON.stringify(signed, null, 2)}
-` : import_yaml2.default.stringify(signed, { lineWidth: 90 }),
+` : import_yaml3.default.stringify(signed, { lineWidth: 90 }),
     "utf8"
   );
   console.log(`${paint(GREEN, "signed")} ${input2}`);
@@ -28292,65 +28640,71 @@ async function cmdSign(args) {
 }
 async function cmdIssue(args) {
   const input2 = args.filter((a) => !a.startsWith("-"))[0];
-  const to = flag(args, "--to");
+  const to = flag2(args, "--to");
   if (!input2 || !to) {
     console.error(
       'usage: runlog issue <pack.yaml> --to "Buyer Name" [--ref order-123] [--key key.json] [-o out.yaml]'
     );
     return 2;
   }
-  const path = resolve(input2);
-  const text = readFileSync(path, "utf8");
+  const path = resolve2(input2);
+  const text = readFileSync2(path, "utf8");
   const format = detectFormat(path);
-  const document = import_yaml2.default.parse(text);
+  const document = import_yaml3.default.parse(text);
   const { signature: _old, ...base } = document;
   const stamped = {
     ...base,
     issue: {
       to,
-      ...flag(args, "--ref") ? { reference: flag(args, "--ref") } : {},
+      ...flag2(args, "--ref") ? { reference: flag2(args, "--ref") } : {},
       issuedAt: (/* @__PURE__ */ new Date()).toISOString()
     }
   };
-  const keyPath = flag(args, "--key") ?? flag(args, "-k");
+  const keyPath = flag2(args, "--key") ?? flag2(args, "-k");
   let fingerprintText = "";
   if (keyPath) {
     let key;
     try {
-      key = JSON.parse(readFileSync(resolve(keyPath), "utf8"));
+      key = JSON.parse(readFileSync2(resolve2(keyPath), "utf8"));
     } catch {
       console.error(paint(RED, `could not read the key at ${keyPath}`));
       return 1;
     }
-    stamped.signature = await signPack(stamped, key.privateKey, flag(args, "--as"));
+    try {
+      await requireClaimed(key.publicKey);
+    } catch (error61) {
+      console.error(paint(RED, error61 instanceof Error ? error61.message : String(error61)));
+      return 1;
+    }
+    stamped.signature = await signPack(stamped, key.privateKey, flag2(args, "--as"));
     fingerprintText = key.fingerprint;
   }
   const sealing = args.includes("--seal");
-  const licenseKey = sealing ? flag(args, "--license") ?? generateLicenseKey() : null;
+  const licenseKey = sealing ? flag2(args, "--license") ?? generateLicenseKey() : null;
   const extension = sealing ? "rlpack" : format;
-  const out = resolve(
-    flag(args, "-o") ?? flag(args, "--out") ?? defaultIssueName(document, to, extension)
+  const out = resolve2(
+    flag2(args, "-o") ?? flag2(args, "--out") ?? defaultIssueName(document, to, extension)
   );
-  if (existsSync(out)) {
+  if (existsSync2(out)) {
     console.error(paint(RED, `refusing to overwrite ${out}`));
     return 1;
   }
   if (licenseKey) {
     const bytes2 = await seal(stamped, licenseKey, {
-      ...flag(args, "--ref") ? { ref: flag(args, "--ref") } : {},
+      ...flag2(args, "--ref") ? { ref: flag2(args, "--ref") } : {},
       ...typeof stamped.title === "string" ? { title: stamped.title } : {}
     });
-    writeFileSync(out, bytes2);
+    writeFileSync2(out, bytes2);
   } else {
-    writeFileSync(
+    writeFileSync2(
       out,
       format === "json" ? `${JSON.stringify(stamped, null, 2)}
-` : import_yaml2.default.stringify(stamped, { lineWidth: 90 }),
+` : import_yaml3.default.stringify(stamped, { lineWidth: 90 }),
       "utf8"
     );
   }
   console.log(`${paint(GREEN, "issued")} ${out}`);
-  console.log(paint(DIM, `  to ${to}${flag(args, "--ref") ? ` \xB7 ref ${flag(args, "--ref")}` : ""}`));
+  console.log(paint(DIM, `  to ${to}${flag2(args, "--ref") ? ` \xB7 ref ${flag2(args, "--ref")}` : ""}`));
   if (keyPath) {
     console.log(paint(DIM, `  signed \xB7 fingerprint ${fingerprintText}`));
     console.log(
@@ -28440,12 +28794,12 @@ function printDiagnostics(diagnostics, file2) {
   console.error(`  ${parts.join(", ")} in ${file2}`);
 }
 function read(path) {
-  const abs = resolve2(path);
-  if (!existsSync2(abs)) {
+  const abs = resolve3(path);
+  if (!existsSync3(abs)) {
     console.error(paint2(RED2, `no such file: ${path}`));
     process.exit(2);
   }
-  const text = readFileSync2(abs, "utf8");
+  const text = readFileSync3(abs, "utf8");
   const result = loadPackText(text, detectFormat(abs));
   return { text, pack: result.pack, diagnostics: result.diagnostics };
 }
@@ -28476,7 +28830,7 @@ async function cmdValidate(args) {
       console.log(
         `${paint2(GREEN2, "ok")} ${paint2(BOLD, pack.title)} ${paint2(DIM2, `v${pack.version}`)} \u2014 ${tables} table${tables === 1 ? "" : "s"}, ${entries} entries, ${Object.keys(pack.modes).length} mode(s)` + (diagnostics.length ? paint2(YELLOW2, `, ${diagnostics.length} warning(s)`) : "")
       );
-      await reportSignature(import_yaml3.default.parse(readFileSync2(resolve2(file2), "utf8")));
+      await reportSignature(import_yaml4.default.parse(readFileSync3(resolve3(file2), "utf8")));
     }
   }
   return worst;
@@ -28501,9 +28855,9 @@ function cmdBundle(args) {
   const body = JSON.stringify(pack, null, 2);
   const hash2 = createHash("sha256").update(body).digest("hex").slice(0, 16);
   const bundled = { ...pack, bundledAt: (/* @__PURE__ */ new Date()).toISOString(), contentHash: hash2 };
-  const out = outIndex >= 0 && args[outIndex + 1] ? resolve2(args[outIndex + 1]) : resolve2(`${pack.id}-${pack.version}.pack.json`);
-  mkdirSync(dirname(out), { recursive: true });
-  writeFileSync2(out, `${JSON.stringify(bundled, null, 2)}
+  const out = outIndex >= 0 && args[outIndex + 1] ? resolve3(args[outIndex + 1]) : resolve3(`${pack.id}-${pack.version}.pack.json`);
+  mkdirSync2(dirname(out), { recursive: true });
+  writeFileSync3(out, `${JSON.stringify(bundled, null, 2)}
 `, "utf8");
   console.log(`${paint2(GREEN2, "bundled")} ${out} ${paint2(DIM2, `sha256:${hash2}`)}`);
   if (!pack.license.redistributable) {
@@ -28556,12 +28910,12 @@ function cmdTest(args) {
 }
 function cmdInit(args) {
   const name = args.filter((a) => !a.startsWith("-"))[0] ?? "my-pack";
-  const out = resolve2(`${name}.yaml`);
-  if (existsSync2(out)) {
+  const out = resolve3(`${name}.yaml`);
+  if (existsSync3(out)) {
     console.error(paint2(RED2, `refusing to overwrite ${out}`));
     return 1;
   }
-  writeFileSync2(out, SKELETON.replaceAll("__NAME__", name), "utf8");
+  writeFileSync3(out, SKELETON.replaceAll("__NAME__", name), "utf8");
   console.log(`${paint2(GREEN2, "created")} ${out}`);
   console.log(paint2(DIM2, `  next: runlog validate ${name}.yaml`));
   return 0;
@@ -28628,11 +28982,22 @@ usage:
   runlog issue    <pack> --to "Name"     stamp a copy with a buyer's name and sign it
                     [--seal]             \u2026and seal it, so it needs a license key to open
 
---strict makes warnings fail, which is what you want in CI.
+  runlog login    [--api URL]            sign in: a code to confirm in your browser
+                    [--key]              \u2026or paste a key from your profile page, for a machine with no browser
+  runlog whoami                          who the command line is acting as
+  runlog claim    key.json               prove a signing key is yours; the app then names you
+  runlog publish  <pack>                 put a pack in your library, on every device
+  runlog logout                          forget the sign-in
+
+--strict makes warnings fail, which is what you want in CI. In CI, set
+RUNLOG_API_KEY to a key from your profile page instead of running login;
+nobody is there to confirm a code.
 
 Signing proves authorship. It does not restrict copying and cannot: the app
 has to read every word of a pack to play it. What it gives you is that an
-altered copy can no longer claim to be yours.
+altered copy can no longer claim to be yours \u2014 and, once the key is claimed
+by your account, that the app names you beside it. sign and issue refuse a
+key that is not claimed.
 `;
 async function main(argv) {
   const [command, ...args] = argv;
@@ -28649,6 +29014,16 @@ async function main(argv) {
       return cmdSign(args);
     case "issue":
       return cmdIssue(args);
+    case "login":
+      return cmdLogin(args);
+    case "logout":
+      return cmdLogout();
+    case "whoami":
+      return cmdWhoami();
+    case "claim":
+      return cmdClaim(args);
+    case "publish":
+      return cmdPublish(args);
     case "init":
       return cmdInit(args);
     case "-h":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scrthq/runlog",
-  "version": "0.0.37",
+  "version": "0.0.39",
   "description": "Validate, lint, bundle and test Runlog rule packs.",
   "type": "module",
   "license": "MIT",