@shoplifter/cli 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

package/NOTICE

@@ -0,0 +1,9 @@
+Shoplifter presentation tooling
+
+Shoplifter-owned code in this package is licensed under Apache License 2.0.
+This license does not apply to the Shoplifter backend, private repository, customer
+content, or third-party components. Third-party components retain their own
+copyrights and licenses; see THIRD_PARTY_NOTICES and the bundled notice inventory.
+
+Shared first-party rendering code is adapted from the Shoplifter storefront.
+Generated release manifests record the repository-relative source provenance.

package/README.md

@@ -1,3 +1,52 @@
-# Temporary Holding Version
+# Shoplifter CLI
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Requires Node 24. Install with `npm install --global @shoplifter/cli@0.1.0`.
+The public SDK, contract and CLI release versions match.
+
+## Authoring
+
+`shoplifter init ./site site` downloads the matching public SDK and contract with
+integrity verification, without a dashboard session. For existing local archives:
+
+```sh
+shoplifter init ./site site /absolute/sdk.tgz /absolute/contract.tgz
+cd site
+npm install
+shoplifter fixtures generate
+shoplifter types
+shoplifter validate
+npm run dev
+npm run build
+```
+
+Commands include `fields`, `editor`, `assets`, `data`, `design`, `migrations`,
+`fixtures`, `types`, `validate`, `scaffold`, `files`, `dependencies`, `login`,
+`logout` and `publication`. Authoring commands and manual edits share validation.
+Use explicit `scaffold` or `fixtures reset` to create components or reset fixtures;
+ordinary generation preserves valid edits and authored markup/styles.
+
+## Upload safety and publishing
+
+`shoplifter files` prints only included file paths, byte sizes and the total size.
+Uploads use that same file selection. Root and nested `.gitignore` and
+`.shoplifterignore` rules are supported; missing required files are errors.
+Mandatory credential/key/environment exclusions always win, including over negation.
+Do not store private records or hardcoded credentials in project source.
+
+Set `SHOPLIFTER_API_URL=https://<platform-api-host>` before production operations.
+`shoplifter dependencies sync` anonymously downloads the platform-approved public
+runtime, verifies hashes and explicitly updates local archives and the lockfile.
+It preserves authored files. Run `npm ci --ignore-scripts` after synchronization.
+
+`shoplifter login` opens dashboard approval for a specific channel. One-hour credentials
+are stored with private permissions outside the project. Use `shoplifter logout` to revoke.
+`shoplifter publication upload <channel-id>` uploads source; `stage`, `preview`,
+`build`, `activate`, `publish`, `status`, `logs`, `retry`, `retry-deployment` and
+`rollback` operate on channel-scoped revisions. `preview-link` requests protected
+preview access. Source changes require exact-input preview and explicit activation.
+Downloading the SDK never grants publication permission. The loopback bypass is
+development-only and cannot be used remotely or in production.
+
+Shoplifter-owned code is Apache-2.0; separately installed dependencies retain their
+licenses. See `LICENSE`, `NOTICE` and `THIRD_PARTY_NOTICES`. This does not license
+the private backend, repository or customer content.

package/THIRD_PARTY_NOTICES

@@ -0,0 +1,8 @@
+Third-party components retain their original licenses.
+
+Complete notices for code actually bundled into this package are generated from
+the build inputs and included in dist/THIRD_PARTY_NOTICES. The matching
+dist/release-manifest.json records dependency versions and file digests.
+
+Dependencies installed separately by npm retain their own package licenses and
+notices. This package's Apache-2.0 license does not replace those licenses.

package/dist/THIRD_PARTY_NOTICES

@@ -0,0 +1,2 @@
+Bundled dependencies retain their original licenses.
+

package/dist/auth.d.ts

@@ -0,0 +1,9 @@
+export declare function apiOrigin(): URL;
+export declare function credentials(required?: boolean): Promise<{
+    token: string;
+    channelId: string;
+    expiresAt: string;
+} | undefined>;
+export declare function login(): Promise<void>;
+export declare function logout(): Promise<void>;
+export declare function syncDependencies(): Promise<void>;

package/dist/auth.js

@@ -0,0 +1,106 @@
+import { mkdir, readFile, writeFile, rename, chmod, stat, rm } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { resolve } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { setTimeout as pause } from 'node:timers/promises';
+import { downloadRuntime } from './runtime.js';
+export function apiOrigin() {
+    const url = new URL(process.env.SHOPLIFTER_API_URL ?? 'http://localhost:3000');
+    if (url.username || url.password || url.pathname !== '/' || url.search || url.hash
+        || url.protocol !== 'https:' && !(url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)))
+        throw new Error('Use an HTTPS API origin (HTTP is allowed only on loopback)');
+    return url;
+}
+const directory = () => resolve(process.env.SHOPLIFTER_CONFIG_DIRECTORY ?? resolve(homedir(), '.config/shoplifter'));
+const filename = () => resolve(directory(), createHash('sha256').update(apiOrigin().origin).digest('hex') + '.json');
+export async function credentials(required = true) {
+    try {
+        if (process.platform !== 'win32' && (await stat(filename())).mode & 0o077)
+            throw new Error('CLI credential file must be private (mode 0600)');
+        const value = JSON.parse(await readFile(filename(), 'utf8'));
+        if (!/^slw_[A-Za-z0-9_-]{43}$/.test(value.token) || !/^\d+$/.test(value.channelId) || !Number.isFinite(Date.parse(value.expiresAt)) || Date.parse(value.expiresAt) <= Date.now())
+            throw new Error('CLI session expired; run shoplifter login');
+        return value;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        if (required)
+            throw new Error('Run shoplifter login first');
+        return undefined;
+    }
+}
+async function response(value) { if (!value.ok)
+    throw new Error(`CLI request failed (${value.status})`); return value.json(); }
+export async function login() {
+    const origin = apiOrigin();
+    const grant = await response(await fetch(new URL('/shoplifter-cli/device', origin), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ scopes: ['read', 'content', 'source'] }), signal: AbortSignal.timeout(15000) }));
+    const url = new URL(grant.verificationUri);
+    if (url.origin !== origin.origin || !/^[A-F0-9]{10}$/.test(grant.userCode))
+        throw new Error('Invalid CLI approval response');
+    url.searchParams.set('code', grant.userCode);
+    console.log(`Approve code ${grant.userCode} in your dashboard: ${url}`);
+    if (['darwin', 'linux'].includes(process.platform)) {
+        const child = spawn(process.platform === 'darwin' ? 'open' : 'xdg-open', [url.href], { stdio: 'ignore', detached: true });
+        child.on('error', () => undefined);
+        child.unref();
+    }
+    for (let attempt = 0; attempt < 120; attempt++) {
+        await pause(5000);
+        const result = await response(await fetch(new URL('/shoplifter-cli/poll', origin), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ deviceCode: grant.deviceCode }), signal: AbortSignal.timeout(15000) }));
+        if (['pending', 'slow_down'].includes(result.status))
+            continue;
+        if (result.status !== 'approved')
+            throw new Error('CLI authorization denied or expired');
+        if (!/^slw_[A-Za-z0-9_-]{43}$/.test(result.token) || !/^\d+$/.test(result.channelId)
+            || !Number.isFinite(Date.parse(result.expiresAt)) || Date.parse(result.expiresAt) <= Date.now()
+            || Date.parse(result.expiresAt) > Date.now() + 3600000)
+            throw new Error('Invalid CLI credential response');
+        await mkdir(directory(), { recursive: true, mode: 0o700 });
+        await chmod(directory(), 0o700);
+        const temporary = filename() + '.' + randomUUID();
+        await writeFile(temporary, JSON.stringify({ token: result.token, channelId: result.channelId, expiresAt: result.expiresAt }), { mode: 0o600, flag: 'wx' });
+        await rename(temporary, filename());
+        console.log(`Authorized channel ${result.channelId} until ${result.expiresAt}`);
+        return;
+    }
+    throw new Error('CLI approval timed out');
+}
+export async function logout() {
+    try {
+        const session = await credentials(false);
+        if (session)
+            await response(await fetch(new URL('/shoplifter-cli/logout', apiOrigin()), { method: 'POST', headers: { authorization: 'Bearer ' + session.token }, signal: AbortSignal.timeout(15000) }));
+    }
+    finally {
+        await rm(filename(), { force: true });
+    }
+    console.log('CLI session removed');
+}
+export async function syncDependencies() {
+    await readFile(resolve('shoplifter.json'));
+    const { sdk, contract } = await downloadRuntime(process.env.SHOPLIFTER_API_URL ? apiOrigin() : undefined);
+    const pkg = JSON.parse(await readFile(resolve('package.json'), 'utf8'));
+    await mkdir(resolve('vendor'), { recursive: true });
+    await writeFile(resolve('vendor/sdk.tgz'), sdk);
+    await writeFile(resolve('vendor/contract.tgz'), contract);
+    pkg.dependencies = { ...pkg.dependencies, '@shoplifter/presentation-sdk': 'file:vendor/sdk.tgz', '@shoplifter/presentation-contract': 'file:vendor/contract.tgz' };
+    await writeFile(resolve('package.json'), JSON.stringify(pkg, null, 2) + '\n');
+    // Local archives can change while their package version and filename stay stable. Explicit sync must re-resolve their integrity.
+    try {
+        const lock = JSON.parse(await readFile(resolve('package-lock.json'), 'utf8'));
+        if (lock.packages)
+            for (const key of Object.keys(lock.packages))
+                if (/(?:^|\/)node_modules\/@shoplifter\/presentation-(?:sdk|contract)$/.test(key))
+                    delete lock.packages[key];
+        await writeFile(resolve('package-lock.json'), JSON.stringify(lock, null, 2) + '\n');
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    const child = spawn('npm', ['install', '--package-lock-only', '--ignore-scripts', '--no-audit', '--no-fund'], { cwd: process.cwd(), stdio: 'inherit' });
+    await new Promise((done, reject) => { child.once('error', reject); child.once('exit', code => code === 0 ? done() : reject(new Error('Dependency lock synchronization failed'))); });
+    console.log('Platform archives and package-lock.json synchronized; authored components preserved');
+}

package/dist/author.d.ts

@@ -0,0 +1,4 @@
+export declare function editProject(group: string, action: string, path: string, raw?: string): Promise<void>;
+/** Explicit scaffolding never replaces an authored component. */
+export declare function scaffold(component: string): Promise<void>;
+export declare function initialize(directory: string, id: string, sdkArchive?: string, contractArchive?: string): Promise<void>;

package/dist/author.js

@@ -0,0 +1,139 @@
+import { mkdir, writeFile, access, readFile, lstat } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { json, readProject, writeJson, generate, projectFiles } from './files.js';
+import { validateProject, validateMigrations, presentationAstroConfig } from '@shoplifter/presentation-contract';
+import { downloadRuntime } from './runtime.js';
+import { apiOrigin } from './auth.js';
+function safeParts(path) {
+    const parts = path.split('.');
+    if (parts.some(part => !/^[a-zA-Z0-9_-]+$/.test(part) || ['constructor', 'prototype', '__proto__'].includes(part)))
+        throw new Error('Invalid path');
+    return parts;
+}
+function edit(value, action, path, next) {
+    const parts = safeParts(path), key = parts.pop();
+    let parent = value;
+    for (const part of parts) {
+        if (!parent || typeof parent !== 'object' || !Object.hasOwn(parent, part))
+            throw new Error('Unknown parent path');
+        parent = parent[part];
+    }
+    if (!parent || typeof parent !== 'object')
+        throw new Error('Invalid parent');
+    if (action === 'remove') {
+        if (!Object.hasOwn(parent, key))
+            throw new Error('Unknown path');
+        if (Array.isArray(parent))
+            parent.splice(Number(key), 1);
+        else
+            delete parent[key];
+    }
+    else if (action === 'set')
+        parent[key] = next;
+    else if (action === 'append') {
+        if (!Array.isArray(parent[key]))
+            throw new Error('Append requires a list');
+        parent[key].push(next);
+    }
+    else
+        throw new Error('Choose set, append or remove');
+}
+export async function editProject(group, action, path, raw) {
+    const directory = process.cwd(), project = await readProject(directory);
+    const next = raw === undefined ? undefined : raw.startsWith('@') ? await json(resolve(raw.slice(1))) : JSON.parse(raw);
+    if (group === 'migrations') {
+        const migrations = await json(resolve(directory, 'migrations.json'));
+        if (action === 'append' && path === 'operations')
+            throw new Error('Append a versioned migration, not a top-level operation');
+        if (action === 'append' && path === 'migrations')
+            migrations.push(next);
+        else
+            edit(migrations, action, path, next);
+        validateMigrations(migrations);
+        await writeJson(resolve(directory, 'migrations.json'), migrations);
+        return;
+    }
+    const key = group === 'fields' ? 'definition' : group;
+    if (!(key in projectFiles))
+        throw new Error('Unknown authoring group');
+    const file = key;
+    if (path === '$' && action === 'set')
+        project[file] = next;
+    else
+        edit(project[file], action, path, next);
+    validateProject(project);
+    // Files remain authoritative. Fixture errors are reported by validate/generate.
+    await writeJson(resolve(directory, projectFiles[file]), project[file]);
+}
+/** Explicit scaffolding never replaces an authored component. */
+export async function scaffold(component) {
+    if (!['homepage', 'header', 'footer'].includes(component))
+        throw new Error('Choose homepage, header or footer');
+    const root = process.cwd();
+    const project = validateProject(Object.fromEntries(await Promise.all(Object.entries(projectFiles).map(async ([key, file]) => [key, await json(resolve(root, file))]))));
+    const path = project.manifest.components[component];
+    let directory = root;
+    for (const part of path.split('/').slice(0, -1)) {
+        directory = resolve(directory, part);
+        try {
+            await mkdir(directory);
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+        if ((await lstat(directory)).isSymbolicLink())
+            throw new Error('Component directories cannot be symlinks');
+    }
+    const templates = {
+        homepage: '---\nconst { content } = Astro.props;\n---\n<main><h1>{content.title}</h1></main>\n',
+        header: '<header><a href="/">Home</a></header>\n', footer: '<footer>Built with Shoplifter</footer>\n',
+    };
+    await writeFile(resolve(root, path), templates[component], { flag: 'wx' });
+}
+export async function initialize(directory, id, sdkArchive, contractArchive) {
+    if (!/^[a-z][a-z0-9-]{0,63}$/.test(id))
+        throw new Error('Invalid presentation ID');
+    const root = resolve(directory);
+    try {
+        await access(root);
+        throw new Error('Initialization requires a new directory');
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    if (Boolean(sdkArchive) !== Boolean(contractArchive))
+        throw new Error('Provide both SDK and contract archives, or neither');
+    for (const archive of [sdkArchive, contractArchive].filter((value) => Boolean(value)))
+        if (!archive.endsWith('.tgz'))
+            throw new Error('Provide SDK and contract tarballs');
+    const runtime = sdkArchive && contractArchive ? { sdk: await readFile(resolve(sdkArchive)), contract: await readFile(resolve(contractArchive)) }
+        : await downloadRuntime(process.env.SHOPLIFTER_API_URL ? apiOrigin() : undefined);
+    await mkdir(resolve(root, 'src/components'), { recursive: true });
+    await mkdir(resolve(root, 'assets'), { recursive: true });
+    const project = {
+        manifest: { contractVersion: 1, components: { homepage: 'src/components/HomePage.astro', header: 'src/components/Header.astro', footer: 'src/components/Footer.astro' } },
+        definition: { contractVersion: 1, presentationId: id, version: 1, name: id, routes: ['/', '/pages/:slug', '/blogs/:blogSlug', '/blogs/:blogSlug/:slug', '/contact-us'], fields: [{ id: 'title', label: 'Title', type: 'text', required: true }], defaults: { title: id } },
+        editor: null, data: { content: { source: 'content' } }, assets: {}, design: {},
+    };
+    validateProject(project);
+    for (const [key, file] of Object.entries(projectFiles))
+        await writeJson(resolve(root, file), project[key]);
+    await writeJson(resolve(root, 'migrations.json'), []);
+    await mkdir(resolve(root, 'vendor'));
+    await writeFile(resolve(root, 'vendor/sdk.tgz'), runtime.sdk);
+    await writeFile(resolve(root, 'vendor/contract.tgz'), runtime.contract);
+    await writeJson(resolve(root, 'package.json'), {
+        name: id, private: true, type: 'module',
+        scripts: { dev: 'astro dev', build: 'astro build', preview: 'astro preview' },
+        engines: { node: '>=24 <25' },
+        dependencies: { astro: '^7.4.3', '@shoplifter/presentation-sdk': 'file:vendor/sdk.tgz', '@shoplifter/presentation-contract': 'file:vendor/contract.tgz' },
+    });
+    await writeFile(resolve(root, 'astro.config.mjs'), presentationAstroConfig);
+    await writeFile(resolve(root, 'src/components/HomePage.astro'), '---\nconst { content } = Astro.props;\n---\n<main><h1>{content.title}</h1></main>\n');
+    await writeFile(resolve(root, 'src/components/Header.astro'), '<header><a href="/">Home</a></header>\n');
+    await writeFile(resolve(root, 'src/components/Footer.astro'), '<footer>Built with Shoplifter</footer>\n');
+    await generate(root);
+    console.log(`Created ${root}. Run npm install, then npm run dev.`);
+}

package/dist/files.d.ts

@@ -0,0 +1,15 @@
+import { type PresentationProject, type Fixture } from '@shoplifter/presentation-contract';
+export declare const projectFiles: {
+    readonly manifest: "shoplifter.json";
+    readonly definition: "definition.json";
+    readonly editor: "editor.json";
+    readonly data: "data.json";
+    readonly assets: "assets.json";
+    readonly design: "design.json";
+};
+export declare function json(path: string): Promise<any>;
+export declare function writeJson(path: string, value: unknown): Promise<void>;
+export declare function readProject(directory?: string): Promise<PresentationProject>;
+export declare function generate(directory?: string, reset?: boolean): Promise<Fixture>;
+/** Check author source and built HTML. Raster rendering belongs to SDK Picture. */
+export declare function validateImages(directory: string, output?: boolean): Promise<void>;

package/dist/files.js

@@ -0,0 +1,76 @@
+import { readFile, writeFile, rename, mkdir, realpath, readdir } from 'node:fs/promises';
+import { resolve, relative, sep } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { validateProject, validateMigrations, generateFixtures, generateContentType, generateDataType, projectPath, validateImageMarkup, validateAstroConfig, } from '@shoplifter/presentation-contract';
+export const projectFiles = {
+    manifest: 'shoplifter.json', definition: 'definition.json', editor: 'editor.json',
+    data: 'data.json', assets: 'assets.json', design: 'design.json',
+};
+export async function json(path) { return JSON.parse(await readFile(path, 'utf8')); }
+export async function writeJson(path, value) {
+    const temporary = path + '.' + randomUUID() + '.tmp';
+    await writeFile(temporary, JSON.stringify(value, null, 2) + '\n', { flag: 'wx' });
+    await rename(temporary, path);
+}
+export async function readProject(directory = process.cwd()) {
+    const entries = await Promise.all(Object.entries(projectFiles).map(async ([key, file]) => [key, await json(resolve(directory, file))]));
+    const project = validateProject(Object.fromEntries(entries));
+    validateMigrations(await json(resolve(directory, 'migrations.json')));
+    validateAstroConfig(await readFile(resolve(directory, 'astro.config.mjs'), 'utf8'));
+    const root = await realpath(directory);
+    for (const path of [...Object.values(project.manifest.components), ...Object.values(project.assets).map(asset => asset.file)]) {
+        const actual = await realpath(resolve(root, path));
+        const local = relative(root, actual);
+        if (local.startsWith('..' + sep) || local === '..' || !projectPath(local.split(sep).join('/')))
+            throw new Error('Project files must stay inside the project');
+    }
+    await validateImages(directory);
+    return project;
+}
+export async function generate(directory = process.cwd(), reset = false) {
+    const project = await readProject(directory), fixturePath = resolve(directory, 'fixtures.json');
+    let previous;
+    if (!reset) {
+        try {
+            previous = await json(fixturePath);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    const fixture = generateFixtures(project, previous);
+    await writeJson(fixturePath, fixture);
+    await mkdir(resolve(directory, 'src/generated'), { recursive: true });
+    await writeFile(resolve(directory, 'src/generated/content.d.ts'), generateContentType(project.definition.fields));
+    await writeFile(resolve(directory, 'src/generated/project.d.ts'), generateDataType(project));
+    return fixture;
+}
+async function sourceFiles(directory) {
+    const entries = await readdir(directory, { withFileTypes: true });
+    return (await Promise.all(entries.map(async (entry) => {
+        const path = resolve(directory, entry.name);
+        if (entry.isSymbolicLink())
+            throw new Error('Source symlinks are unsupported');
+        return entry.isDirectory() ? sourceFiles(path) : [path];
+    }))).flat();
+}
+/** Check author source and built HTML. Raster rendering belongs to SDK Picture. */
+export async function validateImages(directory, output = false) {
+    const files = await sourceFiles(resolve(directory, output ? 'dist' : 'src'));
+    if (!output) {
+        try {
+            files.push(...await sourceFiles(resolve(directory, 'assets')));
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    if (!output && files.some(path => relative(directory, path).split(sep).join('/').startsWith('src/pages/')))
+        throw new Error('Additional routes are unsupported; SDK owns all page routes');
+    for (const path of files.filter(path => /\.(astro|[cm]?[jt]sx?|css|html|svg)$/.test(path))) {
+        const source = await readFile(path, 'utf8');
+        validateImageMarkup(source, path, output);
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,204 @@
+#!/usr/bin/env node
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { program, command, requiredArg, optionalArg, description, version } from 'commander-ts';
+import { spawn } from 'node:child_process';
+import { initialize, editProject, scaffold } from './author.js';
+import { generate, validateImages } from './files.js';
+import { publication, previewUpload } from './publication.js';
+import { login, logout, syncDependencies } from './auth.js';
+let Shoplifter = class Shoplifter {
+    async files() { await previewUpload(); }
+    async login() { await login(); }
+    async logout() { await logout(); }
+    async dependencies(action) { if (action !== 'sync')
+        throw new Error('Choose dependencies sync'); await syncDependencies(); }
+    run() {
+        if (process.argv.length === 2)
+            console.log('Commands: login, logout, dependencies, init, scaffold, fields, editor, assets, data, design, migrations, fixtures, dev, validate, types, files, publication');
+    }
+    async scaffold(component) { await scaffold(component); }
+    async init(directory, id, sdk, contract) {
+        await initialize(directory, id, sdk, contract);
+    }
+    async fields(action, path, json) { await editProject('fields', action, path, json); }
+    async editor(action, path, json) { await editProject('editor', action, path, json); }
+    async assets(action, path, json) { await editProject('assets', action, path, json); }
+    async data(action, path, json) { await editProject('data', action, path, json); }
+    async design(action, path, json) { await editProject('design', action, path, json); }
+    async migrations(action, path, json) { await editProject('migrations', action, path, json); }
+    async fixtures(action = 'generate') {
+        if (!['generate', 'reset'].includes(action))
+            throw new Error('Choose generate or reset');
+        await generate(process.cwd(), action === 'reset');
+    }
+    async types() { await generate(); }
+    async validate(mode) {
+        if (mode && mode !== 'output')
+            throw new Error('Unknown validation mode');
+        await generate();
+        if (mode === 'output')
+            await validateImages(process.cwd(), true);
+        console.log('Presentation is valid');
+    }
+    async dev() {
+        await generate();
+        const child = spawn('npm', ['run', 'dev'], { stdio: 'inherit', cwd: process.cwd() });
+        const code = await new Promise((resolve, reject) => { child.once('error', reject); child.once('exit', code => resolve(code ?? 1)); });
+        if (code)
+            throw new Error(`Astro exited with status ${code}`);
+    }
+    async publication(action, channel, revision, language) {
+        await publication(action, channel, revision, language);
+    }
+};
+__decorate([
+    command(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "files", null);
+__decorate([
+    command(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "login", null);
+__decorate([
+    command(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "logout", null);
+__decorate([
+    command(),
+    __param(0, requiredArg('action')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "dependencies", null);
+__decorate([
+    command(),
+    __param(0, requiredArg('component')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "scaffold", null);
+__decorate([
+    command(),
+    __param(0, requiredArg('directory')),
+    __param(1, requiredArg('id')),
+    __param(2, optionalArg('sdk-tarball')),
+    __param(3, optionalArg('contract-tarball')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, String, String]),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "init", null);
+__decorate([
+    command(),
+    __param(0, requiredArg('action')),
+    __param(1, requiredArg('path')),
+    __param(2, optionalArg('json')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, String]),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "fields", null);
+__decorate([
+    command(),
+    __param(0, requiredArg('action')),
+    __param(1, requiredArg('path')),
+    __param(2, optionalArg('json')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, String]),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "editor", null);
+__decorate([
+    command(),
+    __param(0, requiredArg('action')),
+    __param(1, requiredArg('path')),
+    __param(2, optionalArg('json')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, String]),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "assets", null);
+__decorate([
+    command(),
+    __param(0, requiredArg('action')),
+    __param(1, requiredArg('path')),
+    __param(2, optionalArg('json')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, String]),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "data", null);
+__decorate([
+    command(),
+    __param(0, requiredArg('action')),
+    __param(1, requiredArg('path')),
+    __param(2, optionalArg('json')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, String]),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "design", null);
+__decorate([
+    command(),
+    __param(0, requiredArg('action')),
+    __param(1, requiredArg('path')),
+    __param(2, optionalArg('json')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, String]),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "migrations", null);
+__decorate([
+    command(),
+    __param(0, optionalArg('action')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "fixtures", null);
+__decorate([
+    command(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "types", null);
+__decorate([
+    command(),
+    __param(0, optionalArg('mode')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "validate", null);
+__decorate([
+    command(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "dev", null);
+__decorate([
+    command(),
+    __param(0, requiredArg('action')),
+    __param(1, requiredArg('channel')),
+    __param(2, optionalArg('revision')),
+    __param(3, optionalArg('language')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, String, String]),
+    __metadata("design:returntype", Promise)
+], Shoplifter.prototype, "publication", null);
+Shoplifter = __decorate([
+    program(),
+    version('0.1.0'),
+    description('Author and publish independent Shoplifter presentations')
+], Shoplifter);
+if (Number(process.versions.node.split('.')[0]) !== 24)
+    throw new Error('Shoplifter requires Node 24');
+new Shoplifter();

package/dist/publication.d.ts

@@ -0,0 +1,8 @@
+export declare function previewUpload(directory?: string): Promise<{
+    files: {
+        path: string;
+        size: number;
+    }[];
+    totalBytes: number;
+}>;
+export declare function publication(action: string, channel: string, revision?: string, languageCode?: string): Promise<void>;

package/dist/publication.js

@@ -0,0 +1,40 @@
+import { apiOrigin, credentials } from './auth.js';
+import { readProject } from './files.js';
+import { collectUploadFiles } from './upload-files.js';
+export async function previewUpload(directory = process.cwd()) {
+    const files = await collectUploadFiles(directory, await readProject(directory));
+    const preview = { files: files.map(file => ({ path: file.path, size: file.bytes.length })), totalBytes: files.reduce((sum, file) => sum + file.bytes.length, 0) };
+    console.log(JSON.stringify(preview, null, 2));
+    return preview;
+}
+export async function publication(action, channel, revision, languageCode) {
+    if (!['upload', 'stage', 'preview', 'preview-link', 'build', 'publish', 'status', 'logs', 'retry', 'retry-deployment', 'activate', 'rollback'].includes(action))
+        throw new Error('Unknown publication operation');
+    const base = apiOrigin(), session = await credentials(false);
+    if (session && session.channelId !== channel)
+        throw new Error('CLI session belongs to another channel; run shoplifter login');
+    if (!session && !['localhost', '127.0.0.1', '[::1]'].includes(base.hostname))
+        throw new Error('Run shoplifter login before publishing remotely');
+    if (!['http:', 'https:'].includes(base.protocol) || base.username || base.password)
+        throw new Error('Invalid API origin');
+    const body = { channelId: channel, revisionId: revision, ...(languageCode ? { languageCode } : {}) };
+    if (action === 'upload') {
+        body.project = await readProject();
+        body.files = (await collectUploadFiles(process.cwd(), body.project)).map(file => ({ path: file.path, bytes: file.bytes.toString('base64') }));
+    }
+    if (['stage', 'preview', 'preview-link', 'build', 'retry', 'retry-deployment', 'activate', 'rollback'].includes(action) && !revision)
+        throw new Error('Revision ID is required');
+    if (action === 'preview-link' && !session)
+        throw new Error('Protected preview access requires shoplifter login');
+    const operation = action === 'preview' ? 'preview-candidate' : action === 'build' ? 'build-candidate' : action === 'preview-link' ? 'preview-access' : action;
+    const response = await fetch(new URL(session ? '/shoplifter-cli/operation' : '/shoplifter-development/' + operation, base), {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', ...(session ? { authorization: 'Bearer ' + session.token } : {}) },
+        body: JSON.stringify(session ? { channelId: channel, languageCode, action: operation, input: body } : body),
+        signal: AbortSignal.timeout(120000),
+    });
+    const result = await response.text();
+    if (!response.ok)
+        throw new Error(`Publication failed (${response.status}): ${result}`);
+    console.log(result);
+}

package/dist/release-manifest.json

@@ -0,0 +1,67 @@
+{
+  "version": 1,
+  "files": [
+    {
+      "path": "THIRD_PARTY_NOTICES",
+      "sha256": "f62b711e14475f3192779513371ef989b1eadd2737843f2dedcb7227b55fecd2"
+    },
+    {
+      "path": "auth.d.ts",
+      "sha256": "796dd7dad86e0c8865d78e10cdad471948121fa5d838f9f7f88c162d8e3f6734"
+    },
+    {
+      "path": "auth.js",
+      "sha256": "0f91582d678556c8d16f9f6be10993d5a47989914c06358c20ed25c213d90f6a"
+    },
+    {
+      "path": "author.d.ts",
+      "sha256": "6e545588915a50c89278b10c12e1870fd9331311b97d1971f2d86effa41fa120"
+    },
+    {
+      "path": "author.js",
+      "sha256": "fd7769a92839f79f625dee80357b7cae5ad26ee21b0fc142c1f544a7ee991cbe"
+    },
+    {
+      "path": "files.d.ts",
+      "sha256": "9394acb0d3434a82ef7589a4ec7bd2399837d0c1ef45f20b53a83f26a839a6cc"
+    },
+    {
+      "path": "files.js",
+      "sha256": "47947b274a0d4adb0c09224ddcb6b1ae91be662a2f65567875ffc38966d7ddec"
+    },
+    {
+      "path": "index.d.ts",
+      "sha256": "43e818adf60173644896298637f47b01d5819b17eda46eaa32d0c7d64724d012"
+    },
+    {
+      "path": "index.js",
+      "sha256": "69c7e98bf5dbcd110c84e975ae90837cd05d8364fbdbdb13bc8ca97f492ee867"
+    },
+    {
+      "path": "publication.d.ts",
+      "sha256": "d867e9cb1291895fbbc99fa0eae91f51c2dd0958cb8ab3128ae47b30051f5afb"
+    },
+    {
+      "path": "publication.js",
+      "sha256": "cfba2d5a39d1e1c3f713493f4fd58b886adc26573ee3691a660b23d827ca9d98"
+    },
+    {
+      "path": "runtime.d.ts",
+      "sha256": "1c64241a526c3d82e04df81089f4f9e0d4fd49b5aeb11929d857e20b9d752bca"
+    },
+    {
+      "path": "runtime.js",
+      "sha256": "134ba8b055ace5ee9ca375915a24848ba1cf677685da051462b6319cc1d637f7"
+    },
+    {
+      "path": "upload-files.d.ts",
+      "sha256": "72da98e62d7f85a523accb4f1148e2939ab2a5b9fb238b8e849168b98edcdb7c"
+    },
+    {
+      "path": "upload-files.js",
+      "sha256": "7c3c0a489e2ae2d4d8313660ffe645e92d69aaa59be6fc2a0c9a0f0520167ae5"
+    }
+  ],
+  "firstPartySources": [],
+  "bundledDependencies": []
+}

package/dist/runtime.d.ts

@@ -0,0 +1,5 @@
+/** Public code needs no publishing session. Production admission still pins the platform's exact runtime bytes. */
+export declare function downloadRuntime(origin?: URL): Promise<{
+    sdk: Buffer;
+    contract: Buffer;
+}>;

package/dist/runtime.js

@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: Apache-2.0
+import { readFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+const maximumArchive = 12 * 1024 * 1024;
+async function bytes(response, maximum) {
+    if (!response.ok || !response.body)
+        throw new Error(`Public SDK download failed (${response.status}); use explicit local archives for an unpublished release`);
+    const chunks = [];
+    let size = 0;
+    try {
+        for await (const chunk of response.body) {
+            size += chunk.length;
+            if (size > maximum)
+                throw new Error('SDK download exceeds limit');
+            chunks.push(Buffer.from(chunk));
+        }
+    }
+    catch (error) {
+        await response.body.cancel().catch(() => undefined);
+        throw error;
+    }
+    return Buffer.concat(chunks);
+}
+const get = (url) => fetch(url, { redirect: 'error', signal: AbortSignal.timeout(30000) });
+/** Public code needs no publishing session. Production admission still pins the platform's exact runtime bytes. */
+export async function downloadRuntime(origin) {
+    if (origin) {
+        const result = JSON.parse((await bytes(await get(new URL('/shoplifter-cli/runtime', origin)), maximumArchive * 3)).toString());
+        const runtime = { sdk: Buffer.from(result.sdk ?? '', 'base64'), contract: Buffer.from(result.contract ?? '', 'base64') };
+        for (const kind of ['sdk', 'contract'])
+            if (!runtime[kind].length || runtime[kind].length > maximumArchive
+                || createHash('sha256').update(runtime[kind]).digest('hex') !== result[kind + 'Sha256'])
+                throw new Error('Invalid platform runtime archive');
+        return runtime;
+    }
+    const { version } = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8'));
+    const archive = async (kind) => {
+        const name = '@shoplifter/presentation-' + kind;
+        const metadata = JSON.parse((await bytes(await get(`https://registry.npmjs.org/${encodeURIComponent(name)}/${version}`), 512 * 1024)).toString());
+        if (metadata.name !== name || metadata.version !== version || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(metadata.dist?.integrity ?? ''))
+            throw new Error('Invalid SDK release metadata');
+        const url = new URL(metadata.dist.tarball);
+        if (url.origin !== 'https://registry.npmjs.org' || url.username || url.password || url.search || url.hash
+            || !url.pathname.startsWith('/' + name + '/-/'))
+            throw new Error('Invalid SDK registry archive URL');
+        const buffer = await bytes(await get(url), maximumArchive);
+        if ('sha512-' + createHash('sha512').update(buffer).digest('base64') !== metadata.dist.integrity)
+            throw new Error('SDK release integrity mismatch');
+        return buffer;
+    };
+    const [sdk, contract] = await Promise.all([archive('sdk'), archive('contract')]);
+    return { sdk, contract };
+}

package/dist/upload-files.d.ts

@@ -0,0 +1,5 @@
+import { type PresentationProject } from '@shoplifter/presentation-contract';
+export declare function collectUploadFiles(directory: string, project: PresentationProject): Promise<{
+    path: string;
+    bytes: Buffer;
+}[]>;

package/dist/upload-files.js

@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: Apache-2.0
+import { readFile, readdir, lstat } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import ignore from 'ignore';
+import { assertPresentationSource, isPresentationSourceDirectory, isPresentationSourcePath } from '@shoplifter/presentation-contract';
+export async function collectUploadFiles(directory, project) {
+    const files = [];
+    let totalBytes = 0;
+    async function walk(path = '', inherited = []) {
+        const rules = [...inherited];
+        for (const name of ['.gitignore', '.shoplifterignore']) {
+            try {
+                const file = resolve(directory, path, name), stat = await lstat(file);
+                if (!stat.isFile() || stat.size > 64 * 1024)
+                    throw new Error('Ignore rules must be regular files smaller than 64 KiB');
+                rules.push({ base: path, matcher: ignore().add(await readFile(file, 'utf8')) });
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+        for (const entry of (await readdir(resolve(directory, path), { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+            const local = path ? path + '/' + entry.name : entry.name;
+            if (entry.isDirectory() ? !isPresentationSourceDirectory(local) : !isPresentationSourcePath(local, project))
+                continue;
+            let excluded = false;
+            for (const rule of rules) {
+                const relative = rule.base ? local.slice(rule.base.length + 1) : local;
+                const result = rule.matcher.test(relative + (entry.isDirectory() ? '/' : ''));
+                if (result.ignored)
+                    excluded = true;
+                else if (result.unignored)
+                    excluded = false;
+            }
+            if (excluded)
+                continue;
+            if (entry.isSymbolicLink() || !entry.isFile() && !entry.isDirectory())
+                throw new Error('Source files must be regular files, without symlinks');
+            if (entry.isDirectory()) {
+                await walk(local, rules);
+                continue;
+            }
+            const stat = await lstat(resolve(directory, local));
+            if (!stat.isFile())
+                throw new Error('Source files must be regular files, without symlinks');
+            if (stat.size > 12 * 1024 * 1024)
+                throw new Error(`Source file too large: ${JSON.stringify(local)}`);
+            if (files.length >= 2000 || totalBytes + stat.size > 96 * 1024 * 1024)
+                throw new Error('Source bundle exceeds limits');
+            const bytes = await readFile(resolve(directory, local));
+            assertPresentationSource(local, bytes, project);
+            if (bytes.length > 12 * 1024 * 1024)
+                throw new Error(`Source file too large: ${JSON.stringify(local)}`);
+            files.push({ path: local, bytes });
+            totalBytes += bytes.length;
+            if (totalBytes > 96 * 1024 * 1024)
+                throw new Error('Source bundle exceeds limits');
+        }
+    }
+    await walk();
+    if (files.length > 2000 || files.reduce((sum, file) => sum + file.bytes.length, 0) > 96 * 1024 * 1024)
+        throw new Error('Source bundle exceeds limits');
+    const required = ['shoplifter.json', 'definition.json', 'editor.json', 'data.json', 'assets.json', 'design.json', 'migrations.json', 'package.json', 'astro.config.mjs',
+        ...Object.values(project.manifest.components), ...Object.values(project.assets).map(asset => asset.file)];
+    for (const path of required)
+        if (!files.some(file => file.path === path))
+            throw new Error(`Required project file is missing or ignored: ${JSON.stringify(path)}`);
+    return files;
+}

package/package.json

@@ -1,6 +1,39 @@
 {
   "name": "@shoplifter/cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "private": false,
+  "license": "Apache-2.0",
+  "description": "Author, validate and publish independent Shoplifter Astro presentations",
+  "engines": {
+    "node": ">=24 <25"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "type": "module",
+  "bin": {
+    "shoplifter": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "NOTICE",
+    "THIRD_PARTY_NOTICES",
+    "README.md"
+  ],
+  "dependencies": {
+    "commander-ts": "0.2.0",
+    "ignore": "^7.0.14",
+    "reflect-metadata": "^0.1.14",
+    "@shoplifter/presentation-contract": "0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.19.2",
+    "typescript": "5.8.2"
+  },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "test": "node --test test/*.test.mjs"
+  }
 }