@sirup/cli 0.1.0

package/README.md

@@ -0,0 +1,155 @@
+# Sirup CLI
+
+Deploy anything instantly from the command line — no auth required.
+
+```bash
+npx sirup deploy .
+```
+
+## Install
+
+```bash
+# Use directly (no install needed)
+npx sirup deploy .
+
+# Or install globally
+npm install -g sirup
+```
+
+## Commands
+
+### `sirup deploy [directory]`
+
+Deploy a directory to sirup.gg. No account needed.
+
+```bash
+sirup deploy .
+sirup deploy ./my-app --name my-dashboard
+sirup deploy . --framework react
+```
+
+**Flags:**
+- `-n, --name <name>` — Display name for the drop
+- `-f, --framework <framework>` — Override auto-detection
+
+**What it does:**
+1. Zips the directory (respects `.gitignore` and `.sirupignore`)
+2. Uploads to `POST /v1/deploy`
+3. Streams build logs in real-time (SSE)
+4. Prints the live URL + claim token
+5. Saves claim token to `~/.sirup/tokens.json`
+
+### `sirup status <slug>`
+
+Check the status of a drop.
+
+```bash
+sirup status k7x9m
+```
+
+### `sirup logs <slug>`
+
+Stream logs from a running drop.
+
+```bash
+sirup logs k7x9m                    # Runtime logs, follow mode
+sirup logs k7x9m --no-follow        # Print and exit
+sirup logs k7x9m --type build       # Build logs
+sirup logs k7x9m --type access      # HTTP access logs
+sirup logs k7x9m --tail 50          # Last 50 lines
+```
+
+**Flags:**
+- `--follow / --no-follow` — Live stream or print and exit (default: follow)
+- `--tail <n>` — Number of lines from end (default: 200)
+- `--type <type>` — `runtime`, `build`, or `access` (default: runtime)
+
+### `sirup claim <slug>`
+
+Claim ownership of a drop.
+
+```bash
+sirup claim k7x9m --token ct_a8f29c3e...
+sirup claim k7x9m    # Uses saved token from ~/.sirup/tokens.json
+```
+
+### `sirup delete <slug>`
+
+Delete a drop.
+
+```bash
+sirup delete k7x9m
+sirup delete k7x9m --yes    # Skip confirmation
+```
+
+### `sirup list`
+
+List your owned drops (requires login).
+
+```bash
+sirup list
+```
+
+### `sirup login / logout / whoami`
+
+```bash
+sirup login      # GitHub device flow auth
+sirup logout     # Clear saved credentials
+sirup whoami     # Show current user
+```
+
+## File Ignoring
+
+The CLI automatically excludes these from deploys:
+
+- `node_modules/`, `.git/`, `.env`, `__pycache__/`, `dist/`, `build/`
+- `.next/`, `.nuxt/`, `.cache/`, `coverage/`, `.venv/`, `venv/`
+- `.DS_Store`, `Thumbs.db`, `*.pyc`
+
+Add a `.sirupignore` file for custom patterns (same format as `.gitignore`).
+
+## Token Storage
+
+- Claim tokens: `~/.sirup/tokens.json`
+- Auth session: `~/.sirup/auth.json`
+
+## Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `SIRUP_API_URL` | `https://api.sirup.gg` | API base URL (for local dev) |
+
+## GitHub Secrets Required
+
+Set these in repo Settings → Secrets → Actions:
+
+| Secret | What it is |
+|--------|-----------|
+| `NPM_TOKEN` | npm access token (Automation type) |
+
+## CI/CD
+
+Push a version tag triggers npm publish:
+
+```bash
+npm version patch    # bumps version in package.json
+git push --tags      # triggers CI → npm publish
+```
+
+## Project Structure
+
+```
+src/
+├── index.js                 # CLI entry (commander)
+├── commands/
+│   ├── deploy.js            # Zip + upload + SSE build logs
+│   ├── status.js            # Fetch + display drop info
+│   ├── claim.js             # Claim with saved/provided token
+│   ├── logs.js              # SSE log streaming with color
+│   ├── delete.js            # Delete with confirmation prompt
+│   ├── list.js              # Table of owned drops
+│   └── login.js             # GitHub device flow + logout + whoami
+└── util/
+    ├── api.js               # API client, token storage (~/.sirup/)
+    └── zip.js               # Archiver with .gitignore/.sirupignore support
+```

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@sirup/cli",
+  "version": "0.1.0",
+  "description": "Deploy anything instantly — no auth required. npx sirup deploy .",
+  "type": "module",
+  "bin": {
+    "sirup": "./src/index.js"
+  },
+  "files": [
+    "src/"
+  ],
+  "keywords": [
+    "deploy",
+    "hosting",
+    "serverless",
+    "cli",
+    "ai-agents"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/sirup-repos/cli"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "archiver": "^7.0.1",
+    "chalk": "^5.4.1",
+    "commander": "^13.1.0",
+    "eventsource": "^3.0.7",
+    "ora": "^8.2.0"
+  }
+}

package/src/commands/claim.js

@@ -0,0 +1,49 @@
+import chalk from 'chalk';
+import ora from 'ora';
+import { request, getClaimToken, getAuthToken } from '../util/api.js';
+
+export function registerClaim(program) {
+  program
+    .command('claim <slug>')
+    .description('Claim ownership of a drop')
+    .option('-t, --token <token>', 'Claim token (uses saved token if not provided)')
+    .action(async (slug, opts) => {
+      try {
+        await claim(slug, opts);
+      } catch (err) {
+        console.error(chalk.red(`Error: ${err.message}`));
+        process.exit(1);
+      }
+    });
+}
+
+async function claim(slug, opts) {
+  // Resolve claim token: flag > saved > none
+  const claimToken = opts.token || getClaimToken(slug);
+
+  if (!claimToken && !getAuthToken()) {
+    console.error(chalk.red('Error: No claim token provided and not logged in.'));
+    console.error(chalk.gray('  Use --token <token> or run: sirup login'));
+    process.exit(1);
+  }
+
+  const spinner = ora(`Claiming ${slug}...`).start();
+
+  const body = {};
+  if (claimToken) {
+    body.claim_token = claimToken;
+  }
+
+  const data = await request('POST', `/drops/${slug}/claim`, {
+    body,
+    claimToken,
+  });
+
+  spinner.succeed(`Claimed ${chalk.bold(slug)} successfully!`);
+
+  console.log('');
+  console.log(`  ${chalk.gray('URL:')}    ${chalk.cyan(data.drop?.url || `https://${slug}.sirup.gg`)}`);
+  console.log(`  ${chalk.gray('Owner:')}  ${data.drop?.owner_name || 'you'}`);
+  console.log(`  ${chalk.gray('TTL:')}    ${chalk.green('permanent (no expiry)')}`);
+  console.log('');
+}

package/src/commands/delete.js

@@ -0,0 +1,48 @@
+import chalk from 'chalk';
+import ora from 'ora';
+import { request, getClaimToken } from '../util/api.js';
+
+export function registerDelete(program) {
+  program
+    .command('delete <slug>')
+    .description('Delete a drop')
+    .option('-t, --token <token>', 'Claim token (uses saved token if not provided)')
+    .option('-y, --yes', 'Skip confirmation')
+    .action(async (slug, opts) => {
+      try {
+        await deleteDrop(slug, opts);
+      } catch (err) {
+        console.error(chalk.red(`Error: ${err.message}`));
+        process.exit(1);
+      }
+    });
+}
+
+async function deleteDrop(slug, opts) {
+  // Confirm unless --yes
+  if (!opts.yes) {
+    const readline = await import('node:readline');
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+
+    const answer = await new Promise((resolve) => {
+      rl.question(chalk.yellow(`Delete drop "${slug}"? This cannot be undone. [y/N] `), resolve);
+    });
+    rl.close();
+
+    if (answer.toLowerCase() !== 'y' && answer.toLowerCase() !== 'yes') {
+      console.log(chalk.gray('Cancelled.'));
+      return;
+    }
+  }
+
+  const claimToken = opts.token || getClaimToken(slug);
+
+  const spinner = ora(`Deleting ${slug}...`).start();
+
+  await request('DELETE', `/drops/${slug}`, { claimToken });
+
+  spinner.succeed(`Deleted ${chalk.bold(slug)}`);
+}

package/src/commands/deploy.js

@@ -0,0 +1,196 @@
+import chalk from 'chalk';
+import ora from 'ora';
+import { readFileSync, existsSync } from 'fs';
+import { EventSource } from 'eventsource';
+import { zipDirectory } from '../util/zip.js';
+import { request, saveClaimToken, API_BASE } from '../util/api.js';
+
+export function registerDeploy(program) {
+  program
+    .command('deploy [directory]')
+    .description('Deploy a directory to sirup.gg')
+    .option('-n, --name <name>', 'Display name for the drop')
+    .option('-f, --framework <framework>', 'Override framework detection')
+    .option('-e, --env <KEY=VALUE...>', 'Set environment variables (repeatable)')
+    .option('--env-file <path>', 'Load environment variables from a .env file')
+    .action(async (directory = '.', opts) => {
+      try {
+        await deploy(directory, opts);
+      } catch (err) {
+        console.error(chalk.red(`\nError: ${err.message}`));
+        process.exit(1);
+      }
+    });
+}
+
+async function deploy(directory, opts) {
+  // Collect environment variables
+  const envVars = collectEnvVars(opts);
+  const envCount = Object.keys(envVars).length;
+
+  // Step 1: Zip the directory
+  const spinner = ora('Packaging files...').start();
+  const { buffer, fileCount } = await zipDirectory(directory);
+  const sizeMB = (buffer.length / 1024 / 1024).toFixed(2);
+  spinner.succeed(`Packaged ${fileCount} files (${sizeMB} MB)`);
+
+  // Step 2: Upload
+  spinner.start('Uploading to sirup.gg...');
+
+  const formData = new FormData();
+  formData.append('files', new Blob([buffer], { type: 'application/zip' }), 'project.zip');
+  if (opts.name) formData.append('name', opts.name);
+  if (opts.framework) formData.append('framework', opts.framework);
+  if (envCount > 0) formData.append('env', JSON.stringify(envVars));
+
+  const data = await request('POST', '/deploy', { body: formData });
+  const drop = data.drop;
+
+  spinner.succeed('Uploaded successfully');
+
+  // Save claim token
+  if (drop.claim_token) {
+    saveClaimToken(drop.slug, drop.claim_token);
+  }
+
+  console.log('');
+  console.log(chalk.bold('  Drop created:'));
+  console.log(`  ${chalk.gray('Slug:')}      ${drop.slug}`);
+  console.log(`  ${chalk.gray('URL:')}       ${chalk.cyan(drop.url)}`);
+  console.log(`  ${chalk.gray('Type:')}      ${drop.type}`);
+  console.log(`  ${chalk.gray('Framework:')} ${drop.framework || 'auto-detected'}`);
+  console.log(`  ${chalk.gray('Status:')}    ${formatStatus(drop.status)}`);
+  if (envCount > 0) {
+    console.log(`  ${chalk.gray('Env vars:')}  ${envCount} variable${envCount > 1 ? 's' : ''} set`);
+  }
+  console.log(`  ${chalk.gray('Expires:')}   ${new Date(drop.expires_at).toLocaleDateString()}`);
+  console.log('');
+
+  if (drop.claim_token) {
+    console.log(chalk.yellow(`  Claim token: ${drop.claim_token}`));
+    console.log(chalk.gray('  (saved to ~/.sirup/tokens.json)'));
+    console.log('');
+  }
+
+  // Step 3: Stream build logs if building
+  if (drop.status === 'building') {
+    console.log(chalk.gray('  Streaming build logs...\n'));
+    await streamBuildLogs(drop.slug);
+  }
+}
+
+function streamBuildLogs(slug) {
+  return new Promise((resolve) => {
+    const url = `${API_BASE}/v1/drops/${slug}/logs?type=build&follow=true`;
+    const es = new EventSource(url);
+
+    es.onmessage = (event) => {
+      try {
+        const data = JSON.parse(event.data);
+
+        if (data.stream === 'stderr') {
+          process.stderr.write(chalk.red(data.line) + '\n');
+        } else {
+          process.stdout.write(chalk.gray(data.line) + '\n');
+        }
+
+        // Check for build completion signals
+        if (data.line?.includes('Build complete') || data.line?.includes('Deploy complete')) {
+          console.log('');
+          console.log(chalk.green('  Build complete! Your drop is live.'));
+          es.close();
+          resolve();
+        }
+      } catch {
+        // Raw text line
+        process.stdout.write(chalk.gray(event.data) + '\n');
+      }
+    };
+
+    es.onerror = () => {
+      es.close();
+      // Build might be done — check status
+      checkFinalStatus(slug).then(resolve);
+    };
+
+    // Timeout after 10 minutes
+    setTimeout(() => {
+      es.close();
+      console.log(chalk.yellow('\n  Build log stream timed out. Check status with: sirup status ' + slug));
+      resolve();
+    }, 10 * 60 * 1000);
+  });
+}
+
+async function checkFinalStatus(slug) {
+  try {
+    const data = await request('GET', `/drops/${slug}`);
+    const status = data.drop.status;
+    if (status === 'live') {
+      console.log(chalk.green(`\n  Drop is live at ${data.drop.url}`));
+    } else if (status === 'failed') {
+      console.log(chalk.red(`\n  Build failed. Check logs: sirup logs ${slug} --type build`));
+    } else {
+      console.log(chalk.yellow(`\n  Status: ${status}. Check again: sirup status ${slug}`));
+    }
+  } catch {
+    // Ignore
+  }
+}
+
+/**
+ * Collect environment variables from --env and --env-file flags.
+ * --env accepts KEY=VALUE pairs (array from commander)
+ * --env-file reads a .env file (KEY=VALUE per line, # comments, blank lines skipped)
+ */
+function collectEnvVars(opts) {
+  const vars = {};
+
+  // Load from --env-file first (so --env can override)
+  if (opts.envFile) {
+    if (!existsSync(opts.envFile)) {
+      throw new Error(`Env file not found: ${opts.envFile}`);
+    }
+    const content = readFileSync(opts.envFile, 'utf-8');
+    for (const line of content.split('\n')) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith('#')) continue;
+      const eqIndex = trimmed.indexOf('=');
+      if (eqIndex === -1) continue;
+      const key = trimmed.slice(0, eqIndex).trim();
+      let value = trimmed.slice(eqIndex + 1).trim();
+      // Strip surrounding quotes
+      if ((value.startsWith('"') && value.endsWith('"')) ||
+          (value.startsWith("'") && value.endsWith("'"))) {
+        value = value.slice(1, -1);
+      }
+      if (key) vars[key] = value;
+    }
+  }
+
+  // Load from --env flags (overrides file values)
+  if (opts.env && Array.isArray(opts.env)) {
+    for (const pair of opts.env) {
+      const eqIndex = pair.indexOf('=');
+      if (eqIndex === -1) {
+        throw new Error(`Invalid env var format: "${pair}" — expected KEY=VALUE`);
+      }
+      const key = pair.slice(0, eqIndex).trim();
+      const value = pair.slice(eqIndex + 1);
+      if (key) vars[key] = value;
+    }
+  }
+
+  return vars;
+}
+
+function formatStatus(status) {
+  const colors = {
+    building: chalk.yellow,
+    live: chalk.green,
+    failed: chalk.red,
+    expired: chalk.gray,
+    suspended: chalk.red,
+  };
+  return (colors[status] || chalk.white)(status);
+}

package/src/commands/list.js

@@ -0,0 +1,75 @@
+import chalk from 'chalk';
+import ora from 'ora';
+import { request, getAuthToken } from '../util/api.js';
+
+export function registerList(program) {
+  program
+    .command('list')
+    .description('List your owned drops (requires login)')
+    .action(async () => {
+      try {
+        await list();
+      } catch (err) {
+        console.error(chalk.red(`Error: ${err.message}`));
+        process.exit(1);
+      }
+    });
+}
+
+async function list() {
+  if (!getAuthToken()) {
+    console.error(chalk.red('Error: Not logged in. Run: sirup login'));
+    process.exit(1);
+  }
+
+  const spinner = ora('Fetching your drops...').start();
+  const data = await request('GET', '/drops');
+  spinner.stop();
+
+  const drops = data.drops || [];
+
+  if (drops.length === 0) {
+    console.log(chalk.gray('\n  No drops found. Deploy something with: sirup deploy .\n'));
+    return;
+  }
+
+  console.log('');
+  console.log(chalk.bold(`  Your drops (${drops.length}):`));
+  console.log('');
+
+  // Table header
+  console.log(
+    `  ${pad('SLUG', 12)} ${pad('NAME', 20)} ${pad('STATUS', 10)} ${pad('FRAMEWORK', 12)} ${pad('URL', 30)}`
+  );
+  console.log(chalk.gray('  ' + '─'.repeat(88)));
+
+  for (const drop of drops) {
+    const status = formatStatus(drop.status);
+    const name = drop.name || chalk.gray('—');
+    const framework = drop.framework || chalk.gray('—');
+    const url = chalk.cyan(`https://${drop.slug}.sirup.gg`);
+
+    console.log(
+      `  ${pad(drop.slug, 12)} ${pad(drop.name || '—', 20)} ${pad(drop.status, 10, status)} ${pad(drop.framework || '—', 12)} ${url}`
+    );
+  }
+
+  console.log('');
+}
+
+function pad(str, len, display) {
+  const text = display || str;
+  const padding = Math.max(0, len - str.length);
+  return text + ' '.repeat(padding);
+}
+
+function formatStatus(status) {
+  const colors = {
+    building: chalk.yellow,
+    live: chalk.green,
+    failed: chalk.red,
+    expired: chalk.gray,
+    suspended: chalk.red,
+  };
+  return (colors[status] || chalk.white)(status);
+}

package/src/commands/login.js

@@ -0,0 +1,173 @@
+import chalk from 'chalk';
+import ora from 'ora';
+import { saveAuthToken, clearAuthToken, getAuthToken, API_BASE } from '../util/api.js';
+
+export function registerLogin(program) {
+  program
+    .command('login')
+    .description('Sign in with GitHub')
+    .action(async () => {
+      try {
+        await login();
+      } catch (err) {
+        console.error(chalk.red(`Error: ${err.message}`));
+        process.exit(1);
+      }
+    });
+
+  program
+    .command('logout')
+    .description('Sign out and clear saved credentials')
+    .action(async () => {
+      clearAuthToken();
+      console.log(chalk.green('Logged out successfully.'));
+    });
+
+  program
+    .command('whoami')
+    .description('Show current logged-in user')
+    .action(async () => {
+      try {
+        await whoami();
+      } catch (err) {
+        console.error(chalk.red(`Error: ${err.message}`));
+        process.exit(1);
+      }
+    });
+}
+
+async function login() {
+  const token = getAuthToken();
+  if (token) {
+    console.log(chalk.yellow('Already logged in. Run "sirup logout" first to switch accounts.'));
+    return;
+  }
+
+  // Use GitHub Device Flow for CLI auth
+  // Step 1: Request device code from our API
+  console.log(chalk.bold('\n  Sign in with GitHub\n'));
+
+  const spinner = ora('Requesting device code...').start();
+
+  const res = await fetch(`${API_BASE}/v1/auth/device/code`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+  });
+
+  if (!res.ok) {
+    spinner.fail('Failed to start login flow');
+    // Fallback: manual token entry
+    console.log(chalk.gray('\n  Alternatively, visit the dashboard and copy your API token:\n'));
+    console.log(`  ${chalk.cyan(`${API_BASE.replace('api.', '')}/dashboard`)}`);
+    console.log('');
+
+    const readline = await import('node:readline');
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+
+    const manualToken = await new Promise((resolve) => {
+      rl.question('  Paste your API token: ', resolve);
+    });
+    rl.close();
+
+    if (manualToken?.trim()) {
+      saveAuthToken(manualToken.trim());
+      console.log(chalk.green('\n  Logged in successfully!'));
+    }
+    return;
+  }
+
+  const deviceData = await res.json();
+  spinner.stop();
+
+  console.log(`  Open this URL in your browser:\n`);
+  console.log(`  ${chalk.cyan.bold(deviceData.verification_uri)}\n`);
+  console.log(`  Enter code: ${chalk.bold.yellow(deviceData.user_code)}\n`);
+
+  // Try to open the browser automatically
+  try {
+    const { exec } = await import('node:child_process');
+    const platform = process.platform;
+    const cmd = platform === 'win32' ? 'start' : platform === 'darwin' ? 'open' : 'xdg-open';
+    exec(`${cmd} ${deviceData.verification_uri}`);
+  } catch {
+    // Ignore — user can open manually
+  }
+
+  // Step 2: Poll for completion
+  const pollSpinner = ora('Waiting for authorization...').start();
+  const interval = (deviceData.interval || 5) * 1000;
+  const expiresAt = Date.now() + (deviceData.expires_in || 900) * 1000;
+
+  while (Date.now() < expiresAt) {
+    await sleep(interval);
+
+    try {
+      const pollRes = await fetch(`${API_BASE}/v1/auth/device/token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ device_code: deviceData.device_code }),
+      });
+
+      if (pollRes.ok) {
+        const tokenData = await pollRes.json();
+        saveAuthToken(tokenData.token);
+        pollSpinner.succeed('Logged in successfully!');
+        console.log(chalk.gray(`\n  Credentials saved to ~/.sirup/auth.json\n`));
+        return;
+      }
+
+      const pollError = await pollRes.json();
+      if (pollError.error === 'authorization_pending') {
+        continue; // Keep polling
+      } else if (pollError.error === 'slow_down') {
+        await sleep(5000); // Back off
+      } else {
+        pollSpinner.fail(`Login failed: ${pollError.error}`);
+        return;
+      }
+    } catch {
+      // Network error, keep trying
+    }
+  }
+
+  pollSpinner.fail('Login timed out. Please try again.');
+}
+
+async function whoami() {
+  const token = getAuthToken();
+  if (!token) {
+    console.log(chalk.yellow('Not logged in. Run: sirup login'));
+    return;
+  }
+
+  const spinner = ora('Checking...').start();
+
+  try {
+    const res = await fetch(`${API_BASE}/v1/auth/me`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+
+    if (!res.ok) {
+      spinner.fail('Session expired. Run: sirup login');
+      clearAuthToken();
+      return;
+    }
+
+    const data = await res.json();
+    spinner.stop();
+
+    console.log('');
+    console.log(`  ${chalk.gray('User:')}  ${chalk.bold(data.user?.name || data.user?.github_username)}`);
+    console.log(`  ${chalk.gray('Email:')} ${data.user?.email || chalk.gray('—')}`);
+    console.log('');
+  } catch {
+    spinner.fail('Failed to check auth status');
+  }
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/src/commands/logs.js

@@ -0,0 +1,98 @@
+import chalk from 'chalk';
+import { EventSource } from 'eventsource';
+import { getLogsUrl } from '../util/api.js';
+
+export function registerLogs(program) {
+  program
+    .command('logs <slug>')
+    .description('Stream logs from a drop')
+    .option('--follow', 'Follow log output (default: true)')
+    .option('--no-follow', 'Don\'t follow, just print existing logs')
+    .option('--tail <n>', 'Number of lines to show from the end', '200')
+    .option('--type <type>', 'Log type: runtime, build, access', 'runtime')
+    .action(async (slug, opts) => {
+      try {
+        await logs(slug, opts);
+      } catch (err) {
+        console.error(chalk.red(`Error: ${err.message}`));
+        process.exit(1);
+      }
+    });
+}
+
+async function logs(slug, opts) {
+  const follow = opts.follow !== false;
+  const params = {
+    type: opts.type,
+    tail: opts.tail,
+    follow: follow ? 'true' : 'false',
+  };
+
+  const url = getLogsUrl(slug, params);
+
+  console.log(chalk.gray(`Connecting to ${slug} ${opts.type} logs...\n`));
+
+  const es = new EventSource(url);
+  let lineCount = 0;
+
+  es.onmessage = (event) => {
+    try {
+      const data = JSON.parse(event.data);
+      const ts = data.ts ? chalk.gray(new Date(data.ts).toLocaleTimeString()) + ' ' : '';
+
+      if (data.stream === 'stderr') {
+        process.stderr.write(`${ts}${chalk.red(data.line)}\n`);
+      } else if (data.method) {
+        // Access log format
+        const statusColor = data.status >= 400 ? chalk.red : data.status >= 300 ? chalk.yellow : chalk.green;
+        process.stdout.write(
+          `${ts}${chalk.blue(data.method)} ${data.path} ${statusColor(data.status)} ${chalk.gray(data.duration)}\n`
+        );
+      } else {
+        process.stdout.write(`${ts}${data.line}\n`);
+      }
+
+      lineCount++;
+    } catch {
+      // Raw text
+      process.stdout.write(event.data + '\n');
+      lineCount++;
+    }
+  };
+
+  es.onerror = (err) => {
+    if (!follow) {
+      // Expected close when not following
+      es.close();
+      if (lineCount === 0) {
+        console.log(chalk.yellow('No logs available.'));
+      }
+      process.exit(0);
+    }
+
+    // Reconnect for follow mode happens automatically via EventSource
+    console.error(chalk.yellow('\nConnection lost, reconnecting...'));
+  };
+
+  es.onopen = () => {
+    // Connection established
+  };
+
+  // Handle Ctrl+C gracefully
+  process.on('SIGINT', () => {
+    es.close();
+    console.log(chalk.gray('\nDisconnected.'));
+    process.exit(0);
+  });
+
+  // If not following, set a timeout to close
+  if (!follow) {
+    setTimeout(() => {
+      es.close();
+      if (lineCount === 0) {
+        console.log(chalk.yellow('No logs available.'));
+      }
+      process.exit(0);
+    }, 5000);
+  }
+}

package/src/commands/status.js

@@ -0,0 +1,68 @@
+import chalk from 'chalk';
+import ora from 'ora';
+import { request } from '../util/api.js';
+
+export function registerStatus(program) {
+  program
+    .command('status <slug>')
+    .description('Check the status of a drop')
+    .action(async (slug) => {
+      try {
+        await status(slug);
+      } catch (err) {
+        console.error(chalk.red(`Error: ${err.message}`));
+        process.exit(1);
+      }
+    });
+}
+
+async function status(slug) {
+  const spinner = ora('Fetching status...').start();
+  const data = await request('GET', `/drops/${slug}`);
+  spinner.stop();
+
+  const drop = data.drop;
+
+  console.log('');
+  console.log(chalk.bold(`  Drop: ${drop.name || drop.slug}`));
+  console.log('');
+  console.log(`  ${chalk.gray('Slug:')}       ${drop.slug}`);
+  console.log(`  ${chalk.gray('URL:')}        ${chalk.cyan(drop.url)}`);
+  console.log(`  ${chalk.gray('Status:')}     ${formatStatus(drop.status)}`);
+  console.log(`  ${chalk.gray('Type:')}       ${drop.type || 'unknown'}`);
+  console.log(`  ${chalk.gray('Framework:')}  ${drop.framework || 'unknown'}`);
+  console.log(`  ${chalk.gray('Claimed:')}    ${drop.claimed ? chalk.green('yes') : chalk.yellow('no')}`);
+
+  if (drop.owner_name) {
+    console.log(`  ${chalk.gray('Owner:')}      ${drop.owner_name}`);
+  }
+
+  console.log(`  ${chalk.gray('Created:')}    ${new Date(drop.created_at).toLocaleString()}`);
+
+  if (drop.expires_at && !drop.claimed) {
+    const expires = new Date(drop.expires_at);
+    const now = new Date();
+    const daysLeft = Math.ceil((expires - now) / (1000 * 60 * 60 * 24));
+    const expiresStr = daysLeft > 0
+      ? chalk.yellow(`${expires.toLocaleDateString()} (${daysLeft} days left)`)
+      : chalk.red('expired');
+    console.log(`  ${chalk.gray('Expires:')}    ${expiresStr}`);
+  }
+
+  if (drop.node_id) {
+    console.log(`  ${chalk.gray('Node:')}       ${drop.node_id}`);
+  }
+
+  console.log('');
+}
+
+function formatStatus(status) {
+  const colors = {
+    building: chalk.yellow,
+    live: chalk.green,
+    failed: chalk.red,
+    expired: chalk.gray,
+    suspended: chalk.red,
+  };
+  return (colors[status] || chalk.white)(status);
+}

package/src/index.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+
+import { Command } from 'commander';
+import { registerDeploy } from './commands/deploy.js';
+import { registerStatus } from './commands/status.js';
+import { registerClaim } from './commands/claim.js';
+import { registerLogs } from './commands/logs.js';
+import { registerDelete } from './commands/delete.js';
+import { registerList } from './commands/list.js';
+import { registerLogin } from './commands/login.js';
+
+const program = new Command();
+
+program
+  .name('sirup')
+  .description('Deploy anything instantly — no auth required')
+  .version('0.1.0');
+
+// Register all commands
+registerDeploy(program);
+registerStatus(program);
+registerClaim(program);
+registerLogs(program);
+registerDelete(program);
+registerList(program);
+registerLogin(program);  // Also registers logout + whoami
+
+program.parse();

package/src/util/api.js

@@ -0,0 +1,141 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+
+const API_BASE = process.env.SIRUP_API_URL || 'https://api.sirup.gg';
+
+/**
+ * Make an API request to the Sirup API.
+ */
+export async function request(method, endpoint, opts = {}) {
+  const url = `${API_BASE}/v1${endpoint}`;
+  const headers = { ...opts.headers };
+
+  // Attach claim token if provided
+  if (opts.claimToken) {
+    headers['X-Claim-Token'] = opts.claimToken;
+  }
+
+  // Attach auth token if available
+  const token = getAuthToken();
+  if (token) {
+    headers['Authorization'] = `Bearer ${token}`;
+  }
+
+  const fetchOpts = { method, headers };
+
+  if (opts.body instanceof FormData || opts.body instanceof globalThis.FormData) {
+    fetchOpts.body = opts.body;
+    // Let fetch set Content-Type with boundary for multipart
+  } else if (opts.body) {
+    headers['Content-Type'] = 'application/json';
+    fetchOpts.body = JSON.stringify(opts.body);
+  }
+
+  const res = await fetch(url, fetchOpts);
+
+  if (!res.ok) {
+    let message;
+    try {
+      const json = await res.json();
+      message = json.error?.message || json.message || res.statusText;
+    } catch {
+      message = res.statusText;
+    }
+    const err = new Error(message);
+    err.status = res.status;
+    throw err;
+  }
+
+  const contentType = res.headers.get('content-type') || '';
+  if (contentType.includes('application/json')) {
+    return res.json();
+  }
+  return res;
+}
+
+/**
+ * Get the SSE URL for log streaming.
+ */
+export function getLogsUrl(slug, params = {}) {
+  const url = new URL(`${API_BASE}/v1/drops/${slug}/logs`);
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== undefined && value !== null) {
+      url.searchParams.set(key, String(value));
+    }
+  }
+  return url.toString();
+}
+
+// --- Token storage ---
+
+const TOKEN_DIR = path.join(os.homedir(), '.sirup');
+const TOKEN_FILE = path.join(TOKEN_DIR, 'tokens.json');
+const AUTH_FILE = path.join(TOKEN_DIR, 'auth.json');
+
+function ensureDir() {
+  if (!fs.existsSync(TOKEN_DIR)) {
+    fs.mkdirSync(TOKEN_DIR, { recursive: true });
+  }
+}
+
+/**
+ * Save a claim token for a slug.
+ */
+export function saveClaimToken(slug, token) {
+  ensureDir();
+  const tokens = loadClaimTokens();
+  tokens[slug] = token;
+  fs.writeFileSync(TOKEN_FILE, JSON.stringify(tokens, null, 2));
+}
+
+/**
+ * Load all saved claim tokens.
+ */
+export function loadClaimTokens() {
+  try {
+    return JSON.parse(fs.readFileSync(TOKEN_FILE, 'utf-8'));
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Get a saved claim token for a slug.
+ */
+export function getClaimToken(slug) {
+  return loadClaimTokens()[slug] || null;
+}
+
+/**
+ * Save auth session token (from login).
+ */
+export function saveAuthToken(token) {
+  ensureDir();
+  fs.writeFileSync(AUTH_FILE, JSON.stringify({ token }, null, 2));
+}
+
+/**
+ * Get saved auth session token.
+ */
+export function getAuthToken() {
+  try {
+    const data = JSON.parse(fs.readFileSync(AUTH_FILE, 'utf-8'));
+    return data.token || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Clear auth session token.
+ */
+export function clearAuthToken() {
+  try {
+    fs.unlinkSync(AUTH_FILE);
+  } catch {
+    // ignore
+  }
+}
+
+export { API_BASE };

package/src/util/zip.js

@@ -0,0 +1,143 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import archiver from 'archiver';
+
+/**
+ * Default ignore patterns (always excluded).
+ */
+const DEFAULT_IGNORES = [
+  'node_modules',
+  '.git',
+  '.env',
+  '.env.local',
+  '.env.*.local',
+  '.DS_Store',
+  'Thumbs.db',
+  '__pycache__',
+  '*.pyc',
+  '.venv',
+  'venv',
+  'dist',
+  'build',
+  '.next',
+  '.nuxt',
+  '.cache',
+  'coverage',
+  '.sirup',
+];
+
+/**
+ * Parse a .gitignore/.sirupignore file into an array of patterns.
+ */
+function parseIgnoreFile(filePath) {
+  try {
+    return fs
+      .readFileSync(filePath, 'utf-8')
+      .split('\n')
+      .map((line) => line.trim())
+      .filter((line) => line && !line.startsWith('#'));
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Check if a relative path matches any ignore pattern (simple glob matching).
+ */
+function shouldIgnore(relativePath, patterns) {
+  const parts = relativePath.split(path.sep);
+
+  for (const pattern of patterns) {
+    // Exact directory name match (e.g., "node_modules")
+    if (!pattern.includes('/') && !pattern.includes('*')) {
+      if (parts.includes(pattern)) return true;
+    }
+
+    // Simple wildcard extension match (e.g., "*.pyc")
+    if (pattern.startsWith('*.')) {
+      const ext = pattern.slice(1); // ".pyc"
+      if (relativePath.endsWith(ext)) return true;
+    }
+
+    // Path prefix match (e.g., "dist/")
+    if (pattern.endsWith('/')) {
+      const dir = pattern.slice(0, -1);
+      if (parts.includes(dir)) return true;
+    }
+
+    // Exact file match
+    if (relativePath === pattern || parts[parts.length - 1] === pattern) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Collect all files in a directory, respecting ignore patterns.
+ * Returns an array of { absolute, relative } paths.
+ */
+function collectFiles(dir, baseDir, patterns) {
+  const results = [];
+  const entries = fs.readdirSync(dir, { withFileTypes: true });
+
+  for (const entry of entries) {
+    const abs = path.join(dir, entry.name);
+    const rel = path.relative(baseDir, abs);
+
+    if (shouldIgnore(rel, patterns)) continue;
+
+    if (entry.isDirectory()) {
+      results.push(...collectFiles(abs, baseDir, patterns));
+    } else if (entry.isFile() || entry.isSymbolicLink()) {
+      results.push({ absolute: abs, relative: rel });
+    }
+  }
+
+  return results;
+}
+
+/**
+ * Create a zip archive of a directory, respecting .gitignore and .sirupignore.
+ * Returns a Buffer of the zip contents.
+ */
+export async function zipDirectory(dir) {
+  const absDir = path.resolve(dir);
+
+  if (!fs.existsSync(absDir)) {
+    throw new Error(`Directory not found: ${dir}`);
+  }
+
+  if (!fs.statSync(absDir).isDirectory()) {
+    throw new Error(`Not a directory: ${dir}`);
+  }
+
+  // Build ignore patterns
+  const patterns = [
+    ...DEFAULT_IGNORES,
+    ...parseIgnoreFile(path.join(absDir, '.gitignore')),
+    ...parseIgnoreFile(path.join(absDir, '.sirupignore')),
+  ];
+
+  const files = collectFiles(absDir, absDir, patterns);
+
+  if (files.length === 0) {
+    throw new Error('No files found to deploy (all files matched ignore patterns)');
+  }
+
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    const archive = archiver('zip', { zlib: { level: 6 } });
+
+    archive.on('data', (chunk) => chunks.push(chunk));
+    archive.on('end', () => resolve({ buffer: Buffer.concat(chunks), fileCount: files.length }));
+    archive.on('error', reject);
+
+    for (const file of files) {
+      archive.file(file.absolute, { name: file.relative });
+    }
+
+    archive.finalize();
+  });
+}