@the-focus-ai/artifacts 1.0.0

package/README.md

@@ -0,0 +1,83 @@
+# artifacts.thefocus.ai
+
+CLI-first Artifact publishing for TheFocus.AI.
+
+The CLI is packaged as `@the-focus-ai/artifacts` and exposes the `artifacts` executable:
+
+```bash
+npx @the-focus-ai/artifacts publish ./dist
+```
+
+## Development
+
+This repo uses mise and pnpm:
+
+```bash
+mise trust
+mise install
+mise run setup
+mise run install
+mise run lint
+mise run test
+```
+
+See [docs/development.md](docs/development.md) for the Neon/Postgres and Vercel Blob environment contract, migration setup, and local fake adapter notes.
+
+See [docs/deploy.md](docs/deploy.md) for Vercel project, custom domain, pull-request Preview deployment, and environment configuration. See [docs/smoke-test.md](docs/smoke-test.md) for the integrated smoke flow and [docs/release.md](docs/release.md) for npm release steps.
+
+## Publishing Artifacts
+
+Install/run the CLI through npm or the repo-local script:
+
+```bash
+npx @the-focus-ai/artifacts publish ./artifact.html
+pnpm artifacts publish ./artifact.html
+```
+
+Log in once with a browser, or store a pre-issued Publisher Token non-interactively:
+
+```bash
+pnpm artifacts login
+pnpm artifacts login --token tfai_pub_...
+pnpm artifacts whoami
+```
+
+The publishing path accepts one local HTML file or one local directory and returns a canonical unlisted Publication URL:
+
+```bash
+THEFOCUS_ARTIFACTS_TOKEN=tfai_pub_... \
+fnox exec -- pnpm artifacts publish ./artifact.html
+```
+
+Publisher Tokens are issued only to verified emails ending exactly in `@thefocus.ai`, are stored hashed server-side, and can be stored locally with `artifacts login --token <token>` or supplied non-interactively with `THEFOCUS_ARTIFACTS_TOKEN` (which overrides local config). Local CLI token state is stored under `~/.config/thefocus-artifacts/` with restricted file permissions where supported; `artifacts whoami` validates the active token, `artifacts list` shows the current Publisher's active and removed Publications, and `artifacts logout` removes local token state.
+
+Remove a Publication with an interactive confirmation, or pass `--yes` for non-interactive scripted Removal:
+
+```bash
+THEFOCUS_ARTIFACTS_TOKEN=tfai_pub_... \
+fnox exec -- pnpm artifacts remove https://artifacts.thefocus.ai/a/Ab3xY9kQ --yes
+```
+
+Removal marks the Publication as removed, clears matching Local Source state when present, deletes the active Artifact contents from Blob storage, and makes the Publication URL return 404.
+
+Directory Artifacts require a root `index.html` by default and preserve nested Artifact Paths:
+
+```bash
+THEFOCUS_ARTIFACTS_TOKEN=tfai_pub_... \
+fnox exec -- pnpm artifacts publish ./dist
+```
+
+Use `--entry-page path/to/page.html` to choose a different HTML Entry Page inside a directory Artifact. Use `--new` to force a fresh Publication during the Revision Window, or `--update <Publication URL>` to intentionally update an older active Publication URL.
+
+Other CLI management commands:
+
+```bash
+pnpm artifacts list
+pnpm artifacts remove https://artifacts.thefocus.ai/a/Ab3xY9kQ
+pnpm artifacts remove https://artifacts.thefocus.ai/a/Ab3xY9kQ --yes
+pnpm artifacts logout
+```
+
+Packaging applies built-in safety rules before upload: obvious secret, dependency, cache, and hidden paths are excluded by default, except `.well-known/`; `.gitignore` is not read in v1; symlinks are rejected; and preflight fails before upload if any file exceeds 25 MB, total Artifact size exceeds 100 MB, or the Artifact has more than 1,000 files. Exclusion output is concise by default; add `--verbose` to print excluded paths.
+
+`ARTIFACTS_PUBLIC_BASE_URL` defaults to `https://artifacts.thefocus.ai`; set it only when publishing against a Vercel Preview or another host that serves this app. Published Artifacts are served by the Vercel rewrite from `/a/{opaque}` and nested `/a/{opaque}/{path}` URLs to the API functions with `Cache-Control: no-store` and `X-Robots-Tag: noindex, nofollow` headers.

package/dist/src/auth-clerk.d.ts

@@ -0,0 +1,21 @@
+import type { IncomingMessage } from "node:http";
+export interface ClerkVerification {
+    email: string;
+    userId: string;
+}
+export type ClerkAuthResult = {
+    kind: "authenticated";
+    verification: ClerkVerification;
+} | {
+    kind: "redirect";
+    headers: Headers;
+} | {
+    kind: "unauthenticated";
+    message: string;
+};
+export interface ClerkVerifier {
+    authenticateRequest(request: IncomingMessage): Promise<ClerkAuthResult>;
+}
+export declare function buildClerkSignInUrl(returnUrl: string, signInDomain?: string): string;
+export declare function createServerClerkVerifier(secretKey?: string, publishableKey?: string): ClerkVerifier;
+//# sourceMappingURL=auth-clerk.d.ts.map

package/dist/src/auth-clerk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-clerk.d.ts","sourceRoot":"","sources":["../../src/auth-clerk.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAuB,eAAe,EAAE,MAAM,WAAW,CAAC;AAEtE,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,iBAAiB,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,WAAW,aAAa;IAC5B,mBAAmB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACzE;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,YAAY,SACsB,GACjC,MAAM,CAIR;AAED,wBAAgB,yBAAyB,CACvC,SAAS,SAAkC,EAC3C,cAAc,SAAmD,GAChE,aAAa,CAiDf"}

package/dist/src/auth-clerk.js

@@ -0,0 +1,97 @@
+import { createClerkClient } from "@clerk/backend";
+export function buildClerkSignInUrl(returnUrl, signInDomain = process.env["CLERK_SIGN_IN_DOMAIN"] ??
+    "possible-shrew-37.accounts.dev") {
+    const signInUrl = new URL(`https://${signInDomain}/sign-in`);
+    signInUrl.searchParams.set("redirect_url", returnUrl);
+    return signInUrl.toString();
+}
+export function createServerClerkVerifier(secretKey = requiredEnv("CLERK_SECRET_KEY"), publishableKey = requiredEnv("NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY")) {
+    const clerkClient = createClerkClient({ secretKey, publishableKey });
+    return {
+        async authenticateRequest(request) {
+            const webRequest = toWebRequest(request);
+            const requestState = await clerkClient.authenticateRequest(webRequest, {
+                authorizedParties: authorizedPartiesFor(request),
+            });
+            if (requestState.status === "handshake") {
+                return { kind: "redirect", headers: requestState.headers };
+            }
+            if (!requestState.isAuthenticated) {
+                return {
+                    kind: "unauthenticated",
+                    message: requestState.message ||
+                        requestState.reason ||
+                        "Could not verify your Clerk session.",
+                };
+            }
+            const auth = requestState.toAuth();
+            if (!auth.userId) {
+                return {
+                    kind: "unauthenticated",
+                    message: "Clerk authenticated the request but did not return a user.",
+                };
+            }
+            const email = await primaryEmailForUser(clerkClient, auth.userId);
+            if (!email) {
+                return {
+                    kind: "unauthenticated",
+                    message: "Clerk authenticated the request but no email was available.",
+                };
+            }
+            return {
+                kind: "authenticated",
+                verification: { email, userId: auth.userId },
+            };
+        },
+    };
+}
+async function primaryEmailForUser(clerkClient, userId) {
+    const user = await clerkClient.users.getUser(userId);
+    const primaryEmail = user.emailAddresses.find((email) => email.id === user.primaryEmailAddressId) ?? user.emailAddresses[0];
+    return primaryEmail?.emailAddress ?? null;
+}
+function toWebRequest(request) {
+    return new Request(requestToUrl(request), {
+        method: request.method ?? "GET",
+        headers: toWebHeaders(request.headers),
+    });
+}
+function toWebHeaders(headers) {
+    const webHeaders = new Headers();
+    for (const [name, value] of Object.entries(headers)) {
+        if (value === undefined)
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                webHeaders.append(name, item);
+            continue;
+        }
+        webHeaders.set(name, value);
+    }
+    return webHeaders;
+}
+function authorizedPartiesFor(request) {
+    const configured = process.env["CLERK_AUTHORIZED_PARTIES"];
+    if (configured) {
+        return configured
+            .split(",")
+            .map((origin) => origin.trim())
+            .filter(Boolean);
+    }
+    return [requestToUrl(request).origin];
+}
+function requestToUrl(request) {
+    const host = firstHeader(request.headers.host) ?? "localhost";
+    const protocol = firstHeader(request.headers["x-forwarded-proto"]) ?? "https";
+    return new URL(request.url ?? "/", `${protocol}://${host}`);
+}
+function firstHeader(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+function requiredEnv(name) {
+    const value = process.env[name];
+    if (!value)
+        throw new Error(`${name} is required`);
+    return value;
+}
+//# sourceMappingURL=auth-clerk.js.map

package/dist/src/auth-clerk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-clerk.js","sourceRoot":"","sources":["../../src/auth-clerk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAChD,gCAAgC;IAElC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,YAAY,UAAU,CAAC,CAAC;IAC7D,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACtD,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,SAAS,GAAG,WAAW,CAAC,kBAAkB,CAAC,EAC3C,cAAc,GAAG,WAAW,CAAC,mCAAmC,CAAC;IAEjE,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;IAErE,OAAO;QACL,KAAK,CAAC,mBAAmB,CACvB,OAAwB;YAExB,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,UAAU,EAAE;gBACrE,iBAAiB,EAAE,oBAAoB,CAAC,OAAO,CAAC;aACjD,CAAC,CAAC;YAEH,IAAI,YAAY,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBACxC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;YAC7D,CAAC;YAED,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC;gBAClC,OAAO;oBACL,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EACL,YAAY,CAAC,OAAO;wBACpB,YAAY,CAAC,MAAM;wBACnB,sCAAsC;iBACzC,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO;oBACL,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,4DAA4D;iBACtE,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EACL,6DAA6D;iBAChE,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aAC7C,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,WAAiD,EACjD,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,YAAY,GAChB,IAAI,CAAC,cAAc,CAAC,IAAI,CACtB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,qBAAqB,CACnD,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IAE9B,OAAO,YAAY,EAAE,YAAY,IAAI,IAAI,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,OAAwB;IAC5C,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;QAC/B,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;KACvC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,OAA4B;IAChD,MAAM,UAAU,GAAG,IAAI,OAAO,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAwB;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC3D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU;aACd,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;aAC9B,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,YAAY,CAAC,OAAwB;IAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;IAC9D,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,IAAI,OAAO,CAAC;IAC9E,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,KAAoC;IACvD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/auth.d.ts

@@ -0,0 +1,68 @@
+import type { ClockOptions, SqlClient } from "./storage/publication-metadata.js";
+export interface PublisherTokenRecord {
+    tokenHash: string;
+    publisherEmail: string;
+    createdAt: Date;
+    lastUsedAt: Date | null;
+}
+export interface PublisherTokenStore {
+    create(input: {
+        tokenHash: string;
+        publisherEmail: string;
+        createdAt: Date;
+    }): Promise<PublisherTokenRecord>;
+    getByTokenHash(tokenHash: string): Promise<PublisherTokenRecord | null>;
+    markUsed(tokenHash: string, usedAt: Date): Promise<void>;
+}
+export interface IssuePublisherTokenResult {
+    token: string;
+    tokenHash: string;
+    publisherEmail: string;
+}
+export declare class InvalidPublisherEmailError extends Error {
+    constructor(email: string);
+}
+export declare class InvalidPublisherTokenError extends Error {
+    constructor();
+}
+export declare class InMemoryPublisherTokenStore implements PublisherTokenStore {
+    private readonly rows;
+    private readonly now;
+    constructor(options?: ClockOptions);
+    create(input: {
+        tokenHash: string;
+        publisherEmail: string;
+        createdAt?: Date;
+    }): Promise<PublisherTokenRecord>;
+    getByTokenHash(tokenHash: string): Promise<PublisherTokenRecord | null>;
+    markUsed(tokenHash: string, usedAt: Date): Promise<void>;
+}
+export declare class PostgresPublisherTokenStore implements PublisherTokenStore {
+    private readonly sql;
+    private readonly now;
+    constructor(sql: SqlClient, options?: ClockOptions);
+    create(input: {
+        tokenHash: string;
+        publisherEmail: string;
+        createdAt?: Date;
+    }): Promise<PublisherTokenRecord>;
+    getByTokenHash(tokenHash: string): Promise<PublisherTokenRecord | null>;
+    markUsed(tokenHash: string, usedAt: Date): Promise<void>;
+}
+export declare function issuePublisherToken(input: {
+    email: string;
+    store: PublisherTokenStore;
+    now?: () => Date;
+    tokenFactory?: () => string;
+}): Promise<IssuePublisherTokenResult>;
+export declare function authenticatePublisherToken(input: {
+    token: string | null | undefined;
+    store: PublisherTokenStore;
+    now?: () => Date;
+}): Promise<string>;
+export declare function normalizePublisherEmail(email: string): string;
+export declare function isTheFocusPublisherEmail(email: string): boolean;
+export declare function createPublisherToken(): string;
+export declare function hashPublisherToken(token: string): string;
+export declare function createNeonPublisherTokenStore(databaseUrl?: string): PostgresPublisherTokenStore;
+//# sourceMappingURL=auth.d.ts.map

package/dist/src/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACV,MAAM,mCAAmC,CAAC;AAE3C,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE;QACZ,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,IAAI,CAAC;KACjB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAClC,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,KAAK,EAAE,MAAM;CAM1B;AAED,qBAAa,0BAA2B,SAAQ,KAAK;;CAKpD;AAED,qBAAa,2BAA4B,YAAW,mBAAmB;IACrE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2C;IAChE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;gBAErB,OAAO,GAAE,YAAiB;IAIhC,MAAM,CAAC,KAAK,EAAE;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,CAAC,EAAE,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAW3B,cAAc,CAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAKjC,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAK/D;AAED,qBAAa,2BAA4B,YAAW,mBAAmB;IAInE,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;gBAGd,GAAG,EAAE,SAAS,EAC/B,OAAO,GAAE,YAAiB;IAKtB,MAAM,CAAC,KAAK,EAAE;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,CAAC,EAAE,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAa3B,cAAc,CAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAQjC,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAM/D;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,mBAAmB,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAUrC;AAED,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjC,KAAK,EAAE,mBAAmB,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,OAAO,CAAC,MAAM,CAAC,CASlB;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM7D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,6BAA6B,CAC3C,WAAW,SAA8B,GACxC,2BAA2B,CAW7B"}

package/dist/src/auth.js

@@ -0,0 +1,141 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { neon } from "@neondatabase/serverless";
+export class InvalidPublisherEmailError extends Error {
+    constructor(email) {
+        super(`Publishing is limited to verified email addresses ending exactly in @thefocus.ai: ${email}`);
+        this.name = "InvalidPublisherEmailError";
+    }
+}
+export class InvalidPublisherTokenError extends Error {
+    constructor() {
+        super("A valid Publisher Token is required");
+        this.name = "InvalidPublisherTokenError";
+    }
+}
+export class InMemoryPublisherTokenStore {
+    rows = new Map();
+    now;
+    constructor(options = {}) {
+        this.now = options.now ?? (() => new Date());
+    }
+    async create(input) {
+        const row = {
+            tokenHash: input.tokenHash,
+            publisherEmail: input.publisherEmail,
+            createdAt: input.createdAt ?? this.now(),
+            lastUsedAt: null,
+        };
+        this.rows.set(row.tokenHash, row);
+        return clonePublisherTokenRecord(row);
+    }
+    async getByTokenHash(tokenHash) {
+        const row = this.rows.get(tokenHash);
+        return row ? clonePublisherTokenRecord(row) : null;
+    }
+    async markUsed(tokenHash, usedAt) {
+        const row = this.rows.get(tokenHash);
+        if (!row)
+            return;
+        this.rows.set(tokenHash, { ...row, lastUsedAt: usedAt });
+    }
+}
+export class PostgresPublisherTokenStore {
+    sql;
+    now;
+    constructor(sql, options = {}) {
+        this.sql = sql;
+        this.now = options.now ?? (() => new Date());
+    }
+    async create(input) {
+        const createdAt = input.createdAt ?? this.now();
+        const result = await this.sql.query(`
+        insert into publisher_tokens (token_hash, publisher_email, created_at)
+        values ($1, $2, $3)
+        returning *
+      `, [input.tokenHash, input.publisherEmail, createdAt]);
+        return mapPublisherTokenRow(result.rows[0]);
+    }
+    async getByTokenHash(tokenHash) {
+        const result = await this.sql.query("select * from publisher_tokens where token_hash = $1", [tokenHash]);
+        return result.rows[0] ? mapPublisherTokenRow(result.rows[0]) : null;
+    }
+    async markUsed(tokenHash, usedAt) {
+        await this.sql.query("update publisher_tokens set last_used_at = $2 where token_hash = $1", [tokenHash, usedAt]);
+    }
+}
+export async function issuePublisherToken(input) {
+    const publisherEmail = normalizePublisherEmail(input.email);
+    const token = input.tokenFactory?.() ?? createPublisherToken();
+    const tokenHash = hashPublisherToken(token);
+    await input.store.create({
+        tokenHash,
+        publisherEmail,
+        createdAt: input.now?.() ?? new Date(),
+    });
+    return { token, tokenHash, publisherEmail };
+}
+export async function authenticatePublisherToken(input) {
+    if (!input.token)
+        throw new InvalidPublisherTokenError();
+    const tokenHash = hashPublisherToken(input.token);
+    const record = await input.store.getByTokenHash(tokenHash);
+    if (!record || !constantTimeEqual(record.tokenHash, tokenHash)) {
+        throw new InvalidPublisherTokenError();
+    }
+    await input.store.markUsed(tokenHash, input.now?.() ?? new Date());
+    return record.publisherEmail;
+}
+export function normalizePublisherEmail(email) {
+    const normalized = email.trim().toLowerCase();
+    if (!isTheFocusPublisherEmail(normalized)) {
+        throw new InvalidPublisherEmailError(email);
+    }
+    return normalized;
+}
+export function isTheFocusPublisherEmail(email) {
+    return /^[^@\s]+@thefocus\.ai$/.test(email.trim().toLowerCase());
+}
+export function createPublisherToken() {
+    return `tfai_pub_${randomBytes(32).toString("base64url")}`;
+}
+export function hashPublisherToken(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+export function createNeonPublisherTokenStore(databaseUrl = requiredEnv("DATABASE_URL")) {
+    const sql = neon(databaseUrl);
+    return new PostgresPublisherTokenStore({
+        async query(text, params = []) {
+            const rows = (await sql.query(text, params));
+            return { rows };
+        },
+    });
+}
+function mapPublisherTokenRow(row) {
+    if (!row)
+        throw new Error("Expected Publisher Token row");
+    return {
+        tokenHash: row.token_hash,
+        publisherEmail: row.publisher_email,
+        createdAt: new Date(row.created_at),
+        lastUsedAt: row.last_used_at ? new Date(row.last_used_at) : null,
+    };
+}
+function clonePublisherTokenRecord(row) {
+    return {
+        ...row,
+        createdAt: new Date(row.createdAt),
+        lastUsedAt: row.lastUsedAt ? new Date(row.lastUsedAt) : null,
+    };
+}
+function constantTimeEqual(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+function requiredEnv(name) {
+    const value = process.env[name];
+    if (!value)
+        throw new Error(`${name} is required`);
+    return value;
+}
+//# sourceMappingURL=auth.js.map

package/dist/src/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AA8BhD,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,KAAa;QACvB,KAAK,CACH,qFAAqF,KAAK,EAAE,CAC7F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD;QACE,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,2BAA2B;IACrB,IAAI,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC/C,GAAG,CAAa;IAEjC,YAAY,UAAwB,EAAE;QACpC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAIZ;QACC,MAAM,GAAG,GAAyB;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YACxC,UAAU,EAAE,IAAI;SACjB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAClC,OAAO,yBAAyB,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,SAAiB;QAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,MAAY;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF;AAED,MAAM,OAAO,2BAA2B;IAInB;IAHF,GAAG,CAAa;IAEjC,YACmB,GAAc,EAC/B,UAAwB,EAAE;QADT,QAAG,GAAH,GAAG,CAAW;QAG/B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAIZ;QACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CACjC;;;;OAIC,EACD,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,cAAc,EAAE,SAAS,CAAC,CACnD,CAAC;QACF,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,SAAiB;QAEjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CACjC,sDAAsD,EACtD,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,MAAY;QAC5C,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAClB,qEAAqE,EACrE,CAAC,SAAS,EAAE,MAAM,CAAC,CACpB,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAKzC;IACC,MAAM,cAAc,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,EAAE,IAAI,oBAAoB,EAAE,CAAC;IAC/D,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QACvB,SAAS;QACT,cAAc;QACd,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE;KACvC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAIhD;IACC,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,MAAM,IAAI,0BAA0B,EAAE,CAAC;IACzD,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,0BAA0B,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,cAAc,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,OAAO,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,YAAY,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,WAAW,GAAG,WAAW,CAAC,cAAc,CAAC;IAEzC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9B,OAAO,IAAI,2BAA2B,CAAC;QACrC,KAAK,CAAC,KAAK,CACT,IAAY,EACZ,SAAoB,EAAE;YAEtB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAQ,CAAC;YACpD,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AASD,SAAS,oBAAoB,CAAC,GAAkC;IAC9D,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC1D,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,cAAc,EAAE,GAAG,CAAC,eAAe;QACnC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QACnC,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,GAAyB;IAEzB,OAAO;QACL,GAAG,GAAG;QACN,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/cli.d.ts

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import { type PublisherTokenStore } from "./auth.js";
+import type { BrowserLoginResult } from "./login-flow.js";
+import { type RemovePublicationResult } from "./publication.js";
+import { type PublicationMetadataStore } from "./storage/publication-metadata.js";
+export interface CliDependencies {
+    env?: NodeJS.ProcessEnv;
+    stdout?: Pick<NodeJS.WriteStream, "write">;
+    stderr?: Pick<NodeJS.WriteStream, "write">;
+    tokenStore?: PublisherTokenStore;
+    metadataStore?: PublicationMetadataStore;
+    configDir?: string;
+    openBrowser?: (url: string) => Promise<void>;
+    stdin?: NodeJS.ReadStream;
+    removePublication?: (publicationUrl: string) => Promise<RemovePublicationResult>;
+    confirmRemoval?: (publicationUrl: string) => Promise<boolean>;
+    loginFlow?: (deps: {
+        baseUrl: string;
+        openBrowser?: (url: string) => Promise<void>;
+    }) => Promise<BrowserLoginResult>;
+}
+export declare function runCli(argv: string[], dependencies?: CliDependencies): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/src/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AAKA,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,WAAW,CAAC;AAOnB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EAML,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,mCAAmC,CAAC;AAE3C,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3C,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC1B,iBAAiB,CAAC,EAAE,CAClB,cAAc,EAAE,MAAM,KACnB,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACtC,cAAc,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9C,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACnC;AAED,wBAAsB,MAAM,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,YAAY,GAAE,eAAoB,GACjC,OAAO,CAAC,MAAM,CAAC,CAuIjB"}

package/dist/src/cli.js

@@ -0,0 +1,186 @@
+#!/usr/bin/env node
+import { createInterface } from "node:readline/promises";
+import { fileURLToPath } from "node:url";
+import { authenticatePublisherToken, createNeonPublisherTokenStore, } from "./auth.js";
+import { clearLocalPublisherConfig, defaultConfigDir, resolvePublisherToken, writeLocalPublisherConfig, } from "./local-config.js";
+import { loginWithBrowserFlow } from "./login-flow.js";
+import { absolutePublicationUrl, publishArtifactFromEnvironment, publishArtifactSummary, removePublicationFromEnvironment, removePublicationSummary, } from "./publication.js";
+import { createNeonPublicationMetadataStore, } from "./storage/publication-metadata.js";
+export async function runCli(argv, dependencies = {}) {
+    const [command, firstArg, ...flags] = argv;
+    const options = parseFlags(command === "publish" ? flags : argv.slice(1));
+    const env = dependencies.env ?? process.env;
+    const stdout = dependencies.stdout ?? process.stdout;
+    const stderr = dependencies.stderr ?? process.stderr;
+    const configDir = dependencies.configDir ?? defaultConfigDir(env);
+    try {
+        if (!command ||
+            command === "help" ||
+            command === "--help" ||
+            command === "-h") {
+            printUsage(stdout);
+            return 0;
+        }
+        if (command === "publish" && firstArg) {
+            const result = await publishArtifactFromEnvironment(firstArg, {
+                publicBaseUrl: options["base-url"],
+                entryPage: options["entry-page"],
+                env,
+                configDir,
+                forceNew: Object.hasOwn(options, "new"),
+                updatePublicationUrl: options.update,
+            });
+            stdout.write(`${publishArtifactSummary(result, { verbose: options.verbose === "true" })}\n`);
+            return 0;
+        }
+        if (command === "remove" && firstArg) {
+            if (!Object.hasOwn(options, "yes")) {
+                const confirm = dependencies.confirmRemoval ??
+                    ((publicationUrl) => confirmRemoval(publicationUrl, dependencies.stdin ?? process.stdin, stdout));
+                const confirmed = await confirm(firstArg);
+                if (!confirmed) {
+                    stdout.write("Removal cancelled.\n");
+                    return 1;
+                }
+            }
+            const remove = dependencies.removePublication ??
+                ((publicationUrl) => removePublicationFromEnvironment(publicationUrl, {
+                    env,
+                    configDir,
+                }));
+            const result = await remove(firstArg);
+            stdout.write(`${removePublicationSummary(result)}\n`);
+            return 0;
+        }
+        if (command === "login") {
+            if (options.token) {
+                await writeLocalPublisherConfig({ token: options.token }, configDir);
+                stdout.write(`Publisher Token stored in ${configDir}\n`);
+                return 0;
+            }
+            const baseUrl = options["base-url"] ?? "https://artifacts.thefocus.ai";
+            const loginUrl = new URL("/login", baseUrl);
+            stdout.write("Opening browser to complete login...\n");
+            stdout.write(`If the browser does not open, visit: ${loginUrl.toString()}\n`);
+            try {
+                const flow = dependencies.loginFlow ?? loginWithBrowserFlow;
+                const result = await flow({
+                    baseUrl,
+                    openBrowser: dependencies.openBrowser,
+                });
+                await writeLocalPublisherConfig({ token: result.token }, configDir);
+                stdout.write(`Publisher Token stored in ${configDir}\n`);
+                return 0;
+            }
+            catch (error) {
+                stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+                return 1;
+            }
+        }
+        if (command === "logout") {
+            await clearLocalPublisherConfig(configDir);
+            stdout.write("Removed local Publisher Token state.\n");
+            return 0;
+        }
+        if (command === "whoami") {
+            const token = await resolvePublisherToken({ env, configDir });
+            if (!token.token)
+                throw new Error("Not logged in");
+            const email = await authenticatePublisherToken({
+                token: token.token,
+                store: dependencies.tokenStore ?? createNeonPublisherTokenStore(),
+            });
+            stdout.write(`${email}\n`);
+            return 0;
+        }
+        if (command === "list") {
+            const token = await resolvePublisherToken({ env, configDir });
+            if (!token.token)
+                throw new Error("A valid Publisher Token is required");
+            const publisherEmail = await authenticatePublisherToken({
+                token: token.token,
+                store: dependencies.tokenStore ?? createNeonPublisherTokenStore(),
+            });
+            const publications = await (dependencies.metadataStore ?? createNeonPublicationMetadataStore()).listByPublisherEmail(publisherEmail);
+            stdout.write(`${formatPublicationList(publications, {
+                publicBaseUrl: options["base-url"] ??
+                    env.ARTIFACTS_PUBLIC_BASE_URL ??
+                    "https://artifacts.thefocus.ai",
+            })}\n`);
+            return 0;
+        }
+        printUsage(stderr);
+        return 1;
+    }
+    catch (error) {
+        stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        return 1;
+    }
+}
+function parseFlags(flags) {
+    const parsed = {};
+    for (let index = 0; index < flags.length; index += 1) {
+        const flag = flags[index];
+        if (!flag?.startsWith("--"))
+            continue;
+        const [name, inlineValue] = flag.slice(2).split("=", 2);
+        if (inlineValue !== undefined) {
+            parsed[name] = inlineValue;
+            continue;
+        }
+        const next = flags[index + 1];
+        if (!next || next.startsWith("--")) {
+            parsed[name] = "true";
+            continue;
+        }
+        parsed[name] = next;
+        index += 1;
+    }
+    return parsed;
+}
+function formatPublicationList(publications, options) {
+    const lines = ["LAST UPDATED              STATUS    PUBLICATION URL"];
+    if (publications.length === 0) {
+        lines.push("No Publications found.");
+        return lines.join("\n");
+    }
+    for (const publication of publications) {
+        lines.push(`${publication.updatedAt.toISOString()}  ${publication.status.padEnd(8)} ${absolutePublicationUrl(options.publicBaseUrl, publication.publicationUrlPath)}`);
+    }
+    return lines.join("\n");
+}
+async function confirmRemoval(publicationUrl, stdin, stdout) {
+    if (!stdin.isTTY) {
+        throw new Error("Removal requires --yes in non-interactive terminals.");
+    }
+    const readline = createInterface({
+        input: stdin,
+        output: stdout,
+    });
+    try {
+        const answer = await readline.question(`Remove ${publicationUrl}? Removal cannot be undone. Type yes to continue: `);
+        return answer.trim().toLowerCase() === "yes";
+    }
+    finally {
+        readline.close();
+        stdout.write("");
+    }
+}
+function printUsage(output) {
+    output.write("Usage: artifacts <login|logout|whoami|publish|remove|list>\n" +
+        "  artifacts login [--base-url https://artifacts.thefocus.ai]\n" +
+        "  artifacts publish <file.html|directory> [--entry-page index.html] [--base-url https://artifacts.thefocus.ai] [--new] [--update <Publication URL>] [--verbose]\n" +
+        "  artifacts remove <Publication URL> [--yes]\n" +
+        "  artifacts list [--base-url https://artifacts.thefocus.ai]\n" +
+        "  artifacts whoami\n" +
+        "  artifacts logout\n");
+}
+const isDirectRun = process.argv[1]
+    ? fileURLToPath(import.meta.url) === process.argv[1]
+    : false;
+if (isDirectRun) {
+    runCli(process.argv.slice(2)).then((exitCode) => {
+        process.exitCode = exitCode;
+    });
+}
+//# sourceMappingURL=cli.js.map