@sprigr/cli 0.1.2

package/dist/auth.js

@@ -0,0 +1,225 @@
+import { promises as fs, readFileSync, readdirSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+/**
+ * Resolve the Sprigr API key.
+ *
+ * Resolution order:
+ *   1. `--api-key <key>` flag
+ *   2. `SPRIGR_API_KEY` env var
+ *   3. Credential file
+ *      - When `profile` is set:      `~/.config/sprigr/credentials/<profile>.json`
+ *      - Otherwise (legacy default):  `~/.config/sprigr/credentials.json`
+ *
+ * If none are set, returns null. Callers must surface a clear "run
+ * `sprigr login` or set SPRIGR_API_KEY" message rather than failing
+ * silently.
+ */
+export function resolveApiKey(opts) {
+    const fromFlag = opts.flag?.trim();
+    if (fromFlag)
+        return fromFlag;
+    const fromEnv = process.env.SPRIGR_API_KEY?.trim();
+    if (fromEnv)
+        return fromEnv;
+    const fromFile = readApiKeyFromFileSync(opts.profile);
+    if (fromFile)
+        return fromFile;
+    return null;
+}
+/**
+ * Compute the credentials file path. Honors $XDG_CONFIG_HOME so users
+ * who customize their config layout still land in the right place;
+ * falls back to ~/.config/sprigr otherwise (Linux + macOS convention).
+ *
+ * When `profile` is given (e.g. `--profile staging` or `SPRIGR_PROFILE=...`),
+ * the file lives under `<config>/sprigr/credentials/<profile>.json` so
+ * multiple tenants can be logged in side-by-side without overwriting each
+ * other. When omitted, returns the legacy single-file path so existing
+ * setups keep working unchanged.
+ */
+export function credentialsFilePath(profile) {
+    const base = process.env.XDG_CONFIG_HOME?.trim() ||
+        path.join(os.homedir(), '.config');
+    if (profile && profile.length > 0) {
+        assertValidProfileName(profile);
+        return path.join(base, 'sprigr', 'credentials', `${profile}.json`);
+    }
+    return path.join(base, 'sprigr', 'credentials.json');
+}
+const PROFILE_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+/**
+ * Profile names map to filenames on disk; reject anything that could
+ * escape the credentials directory or look like a path traversal. The
+ * regex below also doubles as a sanity check on length (max 64 chars).
+ */
+export function assertValidProfileName(name) {
+    if (!PROFILE_NAME_RE.test(name)) {
+        throw new Error(`Invalid profile name "${name}". Use alphanumerics, dash, underscore; ` +
+            `1-64 chars, must start with an alphanumeric.`);
+    }
+}
+/**
+ * Sync read so it can sit in the same call-stack as `resolveApiKey`
+ * without making the function async. The file is small (a few hundred
+ * bytes) and lives on a local FS — sync I/O is a non-issue.
+ *
+ * `readFileSync` is imported at the top of the module rather than
+ * required dynamically — `@sprigr/cli` ships as ESM (`"type": "module"`
+ * in package.json), and `require` is not defined in ESM at runtime.
+ * The previous `require('node:fs')` form silently threw inside the
+ * try/catch and the function returned null, leaving every subsequent
+ * `sprigr <command>` reading "No API key found" even when a valid
+ * credentials.json existed on disk. Caught during the staging
+ * shakedown of #458.
+ */
+function readApiKeyFromFileSync(profile) {
+    try {
+        const raw = readFileSync(credentialsFilePath(profile), 'utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.apiKey === 'string' && parsed.apiKey.length > 0) {
+            return parsed.apiKey;
+        }
+        return null;
+    }
+    catch {
+        // ENOENT / parse error / etc. — treat as "no credentials".
+        return null;
+    }
+}
+/**
+ * Read the `endpoint` field from the credentials file written by
+ * `sprigr login`. Used by `resolveEndpoint` so a `--endpoint` passed
+ * to `login` sticks for subsequent commands in the same session
+ * without the user having to re-pass it (or export SPRIGR_ENDPOINT).
+ *
+ * Without this, `sprigr login --endpoint https://staging-api-team.sprigr.com`
+ * mints a key against staging, but the next `sprigr app publish` (no
+ * flag) sends that staging key to the prod gateway — which rejects it
+ * 401 because the key row only exists in the staging registry DB.
+ * The CLI then surfaces "HTTP 401 — Unauthorized" with no hint that
+ * the user is talking to the wrong env.
+ */
+export function readEndpointFromFileSync(profile) {
+    try {
+        const raw = readFileSync(credentialsFilePath(profile), 'utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.endpoint === 'string' && parsed.endpoint.length > 0) {
+            return parsed.endpoint;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Read the full credentials record (used by `whoami`). Returns null on miss. */
+export function readCredentialsSync(profile) {
+    try {
+        const raw = readFileSync(credentialsFilePath(profile), 'utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.apiKey === 'string' && parsed.apiKey.length > 0 &&
+            typeof parsed.loggedInAt === 'string') {
+            return parsed;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * List every profile we have credentials for. Returns the literal names
+ * (sans .json suffix); when only the legacy single-file credentials exist
+ * the special name `'(default)'` is included so `sprigr whoami --all` can
+ * show it. Returns an empty array if nothing is logged in.
+ */
+export function listProfilesSync() {
+    const out = [];
+    // Profile dir
+    try {
+        const dir = path.dirname(credentialsFilePath('placeholder')); // <config>/sprigr/credentials
+        const entries = readdirSync(dir, { withFileTypes: true });
+        for (const e of entries) {
+            if (!e.isFile() || !e.name.endsWith('.json'))
+                continue;
+            out.push({ name: e.name.replace(/\.json$/, ''), isLegacy: false });
+        }
+    }
+    catch { /* dir not present yet */ }
+    // Legacy single-file
+    try {
+        readFileSync(credentialsFilePath(), 'utf8');
+        out.push({ name: '(default)', isLegacy: true });
+    }
+    catch { /* */ }
+    return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+/**
+ * Write credentials to disk with mode 0600 (owner read/write only).
+ * The directory is created with mode 0700 if it doesn't yet exist —
+ * sibling tools like `vercel`, `gh`, `wrangler` follow the same
+ * convention. Overwrites any existing credentials.
+ *
+ * When `profile` is set the file lives at `<config>/sprigr/credentials/<profile>.json`
+ * (and the parent `credentials/` dir is created at 0700 too). Without a
+ * profile we write the legacy `<config>/sprigr/credentials.json` so
+ * existing setups stay byte-identical.
+ */
+export async function writeCredentials(creds, profile) {
+    const target = credentialsFilePath(profile);
+    const dir = path.dirname(target);
+    await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    // Stamp the profile on the record so `whoami` can echo it back.
+    const toWrite = profile
+        ? { ...creds, profile }
+        : creds;
+    // Write to a temp file then rename — atomic on POSIX so a crash mid-
+    // write can't leave a half-written credentials file.
+    const tmp = `${target}.${process.pid}.${Date.now()}.tmp`;
+    await fs.writeFile(tmp, JSON.stringify(toWrite, null, 2), { mode: 0o600 });
+    await fs.rename(tmp, target);
+    // chmod the target separately in case the filesystem dropped the mode
+    // on rename (uncommon but cheap).
+    try {
+        await fs.chmod(target, 0o600);
+    }
+    catch { /* best-effort */ }
+    return target;
+}
+/**
+ * Delete the credential file. Returns true if a file was removed,
+ * false if no file was there to begin with. Other errors (permission,
+ * etc.) propagate so the caller can surface a useful message.
+ */
+export async function deleteCredentials(profile) {
+    const target = credentialsFilePath(profile);
+    try {
+        await fs.unlink(target);
+        return true;
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return false;
+        throw err;
+    }
+}
+/** Friendly message shown when no API key is configured. */
+export const MISSING_API_KEY_MESSAGE = `No API key found.
+
+Run \`sprigr login\` to authenticate via the portal, or set
+SPRIGR_API_KEY in your shell:
+
+  export SPRIGR_API_KEY=sk_mcp_xxxxx
+
+You can also pass --api-key on the command line. Manage keys at
+team.sprigr.com under Settings → API keys.
+
+To log in to a specific tenant without overwriting another, use a profile:
+
+  sprigr login --profile staging --endpoint staging
+  sprigr login --profile prod    --endpoint prod
+  sprigr --profile staging app publish --dir <dir>
+  SPRIGR_PROFILE=prod sprigr app publish --dir <dir>
+`;
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,IAAyC;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE;QAC9C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACrC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,0CAA0C;YACvE,8CAA8C,CAC/C,CAAC;IACJ,CAAC;AACH,CAAC;AAwBD;;;;;;;;;;;;;GAaG;AACH,SAAS,sBAAsB,CAAC,OAAgB;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+B,CAAC;QAC7D,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+B,CAAC;QAC7D,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+B,CAAC;QAC7D,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAC7D,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,MAA2B,CAAC;QACrC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAA+C,EAAE,CAAC;IAC3D,cAAc;IACd,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAM,8BAA8B;QACjG,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACvD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;IACrC,qBAAqB;IACrB,IAAI,CAAC;QACH,YAAY,CAAC,mBAAmB,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAwB,EACxB,OAAgB;IAEhB,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,gEAAgE;IAChE,MAAM,OAAO,GAAsB,OAAO;QACxC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE;QACvB,CAAC,CAAC,KAAK,CAAC;IACV,qEAAqE;IACrE,qDAAqD;IACrD,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IACzD,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,sEAAsE;IACtE,kCAAkC;IAClC,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAgB;IACtD,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;CAgBtC,CAAC"}

package/dist/bin.d.ts

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+/**
+ * sprigr — Sprigr Team CLI.
+ *
+ * Subcommands:
+ *   sprigr deploy <siteId> --dir <dir> [--framework static|next|astro|remix] [--endpoint <url>] [--api-key <key>]
+ *   sprigr builds list <siteId> [--limit N] [--endpoint <url>] [--api-key <key>]
+ *   sprigr builds get <siteId> <buildId> [--endpoint <url>] [--api-key <key>]
+ *
+ * Auth: SPRIGR_API_KEY env var (or --api-key). Create a key in the portal
+ *       under Settings → API keys. PKCE login is on the roadmap.
+ *
+ * Endpoint: defaults to api.team.sprigr.com. Override with --endpoint or
+ *           SPRIGR_ENDPOINT (also accepts the literals `staging` / `prod`).
+ *
+ * Multi-tenant: pass `--profile <name>` (or set `SPRIGR_PROFILE=<name>`) to
+ * use a profile-scoped credentials file. Each profile stores its own
+ * endpoint + key, so staging and prod (or two different tenants) can be
+ * logged in at the same time without overwriting each other.
+ */
+export {};

package/dist/bin.js

@@ -0,0 +1,300 @@
+#!/usr/bin/env node
+/**
+ * sprigr — Sprigr Team CLI.
+ *
+ * Subcommands:
+ *   sprigr deploy <siteId> --dir <dir> [--framework static|next|astro|remix] [--endpoint <url>] [--api-key <key>]
+ *   sprigr builds list <siteId> [--limit N] [--endpoint <url>] [--api-key <key>]
+ *   sprigr builds get <siteId> <buildId> [--endpoint <url>] [--api-key <key>]
+ *
+ * Auth: SPRIGR_API_KEY env var (or --api-key). Create a key in the portal
+ *       under Settings → API keys. PKCE login is on the roadmap.
+ *
+ * Endpoint: defaults to api.team.sprigr.com. Override with --endpoint or
+ *           SPRIGR_ENDPOINT (also accepts the literals `staging` / `prod`).
+ *
+ * Multi-tenant: pass `--profile <name>` (or set `SPRIGR_PROFILE=<name>`) to
+ * use a profile-scoped credentials file. Each profile stores its own
+ * endpoint + key, so staging and prod (or two different tenants) can be
+ * logged in at the same time without overwriting each other.
+ */
+import { resolveEndpoint, resolveProfile } from './config.js';
+import { resolveApiKey, MISSING_API_KEY_MESSAGE } from './auth.js';
+import { runDeploy } from './commands/deploy.js';
+import { runBuildsList, runBuildsGet } from './commands/builds.js';
+import { runLogin, runLogout } from './commands/login.js';
+import { runAppDelete, runAppInstall, runAppPublish, runAppSetPublisherSecrets, runAppShare, runAppUpgrade, runAppValidate } from './commands/app.js';
+import { runWhoami } from './commands/whoami.js';
+function parseArgs(argv) {
+    const positional = [];
+    const flags = {};
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === undefined)
+            continue;
+        if (arg.startsWith('--')) {
+            const eq = arg.indexOf('=');
+            if (eq >= 0) {
+                flags[arg.slice(2, eq)] = arg.slice(eq + 1);
+            }
+            else {
+                const next = argv[i + 1];
+                if (next !== undefined && !next.startsWith('-')) {
+                    flags[arg.slice(2)] = next;
+                    i++;
+                }
+                else {
+                    flags[arg.slice(2)] = '';
+                }
+            }
+            continue;
+        }
+        positional.push(arg);
+    }
+    return { positional, flags };
+}
+function usage() {
+    return `sprigr — Sprigr Team CLI
+
+Commands:
+  sprigr login   [--profile <name>] [--no-browser]
+  sprigr logout  [--profile <name>]
+  sprigr whoami  [--profile <name>] [--all]
+  sprigr deploy <siteId> --dir <dir> [--framework static]
+  sprigr builds list <siteId> [--limit N]
+  sprigr builds get <siteId> <buildId> [--no-log]
+  sprigr app validate --dir <dir> [--manifest <path>]
+  sprigr app publish  --dir <dir> [--manifest <path>]
+  sprigr app upgrade  <slug>
+  sprigr app delete   <slug> --yes
+  sprigr app install  <slug> --scopes <list> [--secrets '<json>']
+  sprigr app share    <slug>
+  sprigr app set-publisher-secrets <slug> --secrets '<json>'
+
+Common flags:
+  --profile <name>   Use a profile-scoped credentials file (or SPRIGR_PROFILE)
+  --endpoint <url>   Override API endpoint (or SPRIGR_ENDPOINT, or 'staging'/'prod')
+  --api-key <key>    Sprigr API key (or SPRIGR_API_KEY env var)
+  --help             Show this help
+
+Multi-tenant example — staging and prod side-by-side, neither overwrites:
+
+  sprigr login --profile staging --endpoint staging
+  sprigr login --profile prod    --endpoint prod
+  sprigr --profile staging app publish --dir apps/foo
+  SPRIGR_PROFILE=prod sprigr app publish --dir apps/foo
+`;
+}
+async function main() {
+    const argv = process.argv.slice(2);
+    const { positional, flags } = parseArgs(argv);
+    if ('help' in flags || positional.length === 0) {
+        process.stdout.write(usage());
+        return positional.length === 0 ? 1 : 0;
+    }
+    let profile;
+    try {
+        profile = resolveProfile({ flag: flags.profile });
+    }
+    catch (err) {
+        process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+        return 2;
+    }
+    const endpoint = resolveEndpoint({ flag: flags.endpoint, profile });
+    const cmd = positional[0];
+    // login + logout are the only commands that don't require an existing
+    // API key — login produces one, logout removes one. Run before the
+    // resolveApiKey gate.
+    if (cmd === 'login') {
+        const r = await runLogin({
+            endpoint,
+            profile,
+            noBrowser: 'no-browser' in flags,
+        });
+        return r.exitCode;
+    }
+    if (cmd === 'logout') {
+        const r = await runLogout({ profile });
+        return r.exitCode;
+    }
+    if (cmd === 'whoami') {
+        const r = await runWhoami({ profile, all: 'all' in flags });
+        return r.exitCode;
+    }
+    // `app validate` doesn't need an API key — it's a pure local check.
+    if (cmd === 'app' && positional[1] === 'validate') {
+        const dir = flags.dir;
+        if (!dir) {
+            process.stderr.write(`usage: sprigr app validate --dir <dir> [--manifest <path>]\n`);
+            return 2;
+        }
+        const r = await runAppValidate({ dir, manifestPath: flags.manifest });
+        return r.exitCode;
+    }
+    const apiKey = resolveApiKey({ flag: flags['api-key'], profile });
+    if (!apiKey) {
+        process.stderr.write(MISSING_API_KEY_MESSAGE);
+        return 2;
+    }
+    if (cmd === 'deploy') {
+        const siteId = positional[1];
+        const dir = flags.dir;
+        if (!siteId || !dir) {
+            process.stderr.write(`usage: sprigr deploy <siteId> --dir <dir>\n`);
+            return 2;
+        }
+        const framework = (flags.framework ?? 'static');
+        const result = await runDeploy({ siteId, dir, framework, endpoint, apiKey });
+        return result.exitCode;
+    }
+    if (cmd === 'app') {
+        const sub = positional[1];
+        if (sub === 'publish') {
+            const dir = flags.dir;
+            if (!dir) {
+                process.stderr.write(`usage: sprigr app publish --dir <dir> [--manifest <path>]\n`);
+                return 2;
+            }
+            const r = await runAppPublish({
+                dir,
+                manifestPath: flags.manifest,
+                endpoint,
+                apiKey,
+            });
+            return r.exitCode;
+        }
+        if (sub === 'upgrade') {
+            const slug = positional[2];
+            if (!slug) {
+                process.stderr.write(`usage: sprigr app upgrade <slug> [--force]\n`);
+                return 2;
+            }
+            const force = 'force' in flags;
+            const r = await runAppUpgrade({ slug, endpoint, apiKey, force });
+            return r.exitCode;
+        }
+        if (sub === 'delete') {
+            const slug = positional[2];
+            if (!slug) {
+                process.stderr.write(`usage: sprigr app delete <slug> --yes\n`);
+                return 2;
+            }
+            const yes = 'yes' in flags;
+            const r = await runAppDelete({ slug, endpoint, apiKey, yes });
+            return r.exitCode;
+        }
+        if (sub === 'install') {
+            const slug = positional[2];
+            if (!slug) {
+                process.stderr.write(`usage: sprigr app install <slug> --scopes <list> [--secrets '<json>']\n`);
+                return 2;
+            }
+            const scopes = flags['scopes'];
+            // --secrets '<json>' accepts a JSON-encoded object of key->value
+            // pairs. JSON sidesteps the "commas in values" footgun a repeated
+            // --secret KEY=VALUE would have, at the cost of needing the caller
+            // to quote the JSON in their shell.
+            let secrets;
+            const rawSecrets = flags['secrets'];
+            if (rawSecrets) {
+                try {
+                    const parsed = JSON.parse(rawSecrets);
+                    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                        process.stderr.write(`--secrets must be a JSON object like {"KEY":"value"}\n`);
+                        return 2;
+                    }
+                    secrets = {};
+                    for (const [k, v] of Object.entries(parsed)) {
+                        if (typeof v !== 'string') {
+                            process.stderr.write(`--secrets value for "${k}" must be a string (got ${typeof v})\n`);
+                            return 2;
+                        }
+                        secrets[k] = v;
+                    }
+                }
+                catch (err) {
+                    process.stderr.write(`--secrets must be valid JSON: ${err.message}\n`);
+                    return 2;
+                }
+            }
+            const r = await runAppInstall({ slug, endpoint, apiKey, scopes, secrets });
+            return r.exitCode;
+        }
+        if (sub === 'share') {
+            const slug = positional[2];
+            if (!slug) {
+                process.stderr.write(`usage: sprigr app share <slug>\n`);
+                return 2;
+            }
+            const r = await runAppShare({ slug, endpoint, apiKey });
+            return r.exitCode;
+        }
+        if (sub === 'set-publisher-secrets') {
+            const slug = positional[2];
+            if (!slug) {
+                process.stderr.write(`usage: sprigr app set-publisher-secrets <slug> --secrets '<json>'\n`);
+                return 2;
+            }
+            const rawSecrets = flags['secrets'];
+            if (!rawSecrets) {
+                process.stderr.write(`--secrets is required. Pass a JSON object like {"SHOPIFY_CLIENT_ID":"...","SHOPIFY_CLIENT_SECRET":"..."}\n`);
+                return 2;
+            }
+            let secrets;
+            try {
+                const parsed = JSON.parse(rawSecrets);
+                if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                    process.stderr.write(`--secrets must be a JSON object like {"KEY":"value"}\n`);
+                    return 2;
+                }
+                secrets = {};
+                for (const [k, v] of Object.entries(parsed)) {
+                    if (typeof v !== 'string' || v.length === 0) {
+                        process.stderr.write(`--secrets value for "${k}" must be a non-empty string\n`);
+                        return 2;
+                    }
+                    secrets[k] = v;
+                }
+            }
+            catch (err) {
+                process.stderr.write(`--secrets must be valid JSON: ${err.message}\n`);
+                return 2;
+            }
+            const r = await runAppSetPublisherSecrets({ slug, endpoint, apiKey, secrets });
+            return r.exitCode;
+        }
+        process.stderr.write(`unknown subcommand: app ${sub}\n`);
+        return 2;
+    }
+    if (cmd === 'builds') {
+        const sub = positional[1];
+        if (sub === 'list') {
+            const siteId = positional[2];
+            if (!siteId) {
+                process.stderr.write(`usage: sprigr builds list <siteId> [--limit N]\n`);
+                return 2;
+            }
+            const limit = flags.limit ? Number.parseInt(flags.limit, 10) : 20;
+            return runBuildsList({ siteId, endpoint, apiKey, limit });
+        }
+        if (sub === 'get') {
+            const siteId = positional[2];
+            const buildId = positional[3];
+            if (!siteId || !buildId) {
+                process.stderr.write(`usage: sprigr builds get <siteId> <buildId>\n`);
+                return 2;
+            }
+            const showLog = !('no-log' in flags);
+            return runBuildsGet({ siteId, buildId, endpoint, apiKey, showLog });
+        }
+        process.stderr.write(`unknown subcommand: builds ${sub}\n`);
+        return 2;
+    }
+    process.stderr.write(`unknown command: ${cmd}\n${usage()}`);
+    return 2;
+}
+main().then((code) => process.exit(code), (err) => {
+    process.stderr.write(`fatal: ${err instanceof Error ? err.stack ?? err.message : String(err)}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,yBAAyB,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACtJ,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAOjD,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,KAAK,GAAuC,EAAE,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBACZ,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;oBAC3B,CAAC,EAAE,CAAC;gBACN,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,KAAK;IACZ,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BR,CAAC;AACF,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE9C,IAAI,MAAM,IAAI,KAAK,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9B,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QAAC,OAAO,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;IAC1D,OAAO,GAAG,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAE1B,sEAAsE;IACtE,mEAAmE;IACnE,sBAAsB;IACtB,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC;YACvB,QAAQ;YACR,OAAO;YACP,SAAS,EAAE,YAAY,IAAI,KAAK;SACjC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpB,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpB,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpB,CAAC;IAED,oEAAoE;IACpE,IAAI,GAAG,KAAK,KAAK,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;YACrF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,QAAQ,CAA0C,CAAC;QACzF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7E,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;YACtB,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;gBACpF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC;gBAC5B,GAAG;gBACH,YAAY,EAAE,KAAK,CAAC,QAAQ;gBAC5B,QAAQ;gBACR,MAAM;aACP,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,QAAQ,CAAC;QACpB,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBACrE,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,CAAC;YAC/B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,CAAC,QAAQ,CAAC;QACpB,CAAC;QACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAChE,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC;YAC3B,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,CAAC,QAAQ,CAAC;QACpB,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;gBAChG,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC/B,iEAAiE;YACjE,kEAAkE;YAClE,mEAAmE;YACnE,oCAAoC;YACpC,IAAI,OAA2C,CAAC;YAChD,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAY,CAAC;oBACjD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;wBAC/E,OAAO,CAAC,CAAC;oBACX,CAAC;oBACD,OAAO,GAAG,EAAE,CAAC;oBACb,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;wBACvE,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;4BAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,2BAA2B,OAAO,CAAC,KAAK,CAAC,CAAC;4BACxF,OAAO,CAAC,CAAC;wBACX,CAAC;wBACD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBACjB,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAkC,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;oBAClF,OAAO,CAAC,CAAC;gBACX,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3E,OAAO,CAAC,CAAC,QAAQ,CAAC;QACpB,CAAC;QACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBACzD,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,CAAC,QAAQ,CAAC;QACpB,CAAC;QACD,IAAI,GAAG,KAAK,uBAAuB,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;gBAC5F,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4GAA4G,CAC7G,CAAC;gBACF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,IAAI,OAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAY,CAAC;gBACjD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;oBAC/E,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;oBACvE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,CAAC;wBAChF,OAAO,CAAC,CAAC;oBACX,CAAC;oBACD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAkC,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;gBAClF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,yBAAyB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/E,OAAO,CAAC,CAAC,QAAQ,CAAC;QACpB,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,GAAG,IAAI,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACzE,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBACtE,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC;YACrC,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,KAAK,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,IAAI,EAAE,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,CAAC,GAAG,EAAE,EAAE;IACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CACF,CAAC"}

package/dist/bundler.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Walk a directory and produce a `{ path: SourceFile }` map suitable for
+ * the start-build API body.
+ *
+ * The wire shape is a tagged union per file so that text and binary assets
+ * can ride the same JSON envelope:
+ *   - UTF-8 text → bare string (back-compat with the original shape)
+ *   - Binary    → `{ encoding: 'base64', content: '<base64>' }`
+ *
+ * Rationale: the build container's BuildArtifact output already supports
+ * base64 (png/woff2/etc. are emitted that way for the post-build R2
+ * upload). Extending the *input* side closes the loop so a customer with
+ * `public/logo.png` doesn't get a "non-UTF-8 bytes" rejection at bundle
+ * time. The decoded byte length still counts against the 5 MiB-per-file
+ * and 500-files-per-build caps — the inflated base64 string isn't what
+ * the server enforces against.
+ *
+ * Constraints (mirror the server side at workers/provisioning/src/build-routes.ts):
+ *   - Caller-passed `dir` must contain index.html.
+ *   - Maximum 500 files per build.
+ *   - Each file capped at 5 MiB of *decoded* bytes (5 * 1024 * 1024).
+ *
+ * Default ignores: `node_modules/`, `.git/`, `.DS_Store`, anything starting
+ * with `.` at the top level (dotfiles often hold secrets), plus what's in a
+ * `.sprigrignore` if present (one glob/literal per line; `#` comments).
+ *
+ * Returns an object instead of throwing so callers can present a single
+ * grouped error message rather than a stack trace.
+ */
+export type SourceFile = string | {
+    encoding: 'base64';
+    content: string;
+};
+export interface BundleResult {
+    files: Record<string, SourceFile>;
+    /** Sum of decoded bytes (i.e. raw on-disk file size, not the base64
+     *  inflation). What the server's cap is enforced against. */
+    totalBytes: number;
+    fileCount: number;
+    /** How many entries in `files` ride as base64. Useful for the deploy
+     *  command's progress line — telegraphs the binary footprint without
+     *  forcing the caller to re-walk the map. */
+    binaryCount: number;
+}
+export interface BundleError {
+    errors: string[];
+}
+export type BundleFramework = 'static' | 'next' | 'astro' | 'remix';
+export declare function bundleDirectory(rootDir: string, framework?: BundleFramework): Promise<BundleResult | BundleError>;