@unbound-app/cli 0.4.0 → 0.7.0

package/dist/index.mjs

@@ -1,15 +1,23 @@
 #!/usr/bin/env node
 import { cli, command } from "cleye";
 import { z } from "zod";
-import { existsSync, mkdirSync, readFileSync, readdirSync, watch, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, watch, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { ControllerClient } from "@unbound-app/debugger-protocol/controller";
 import { CONTROLLER_ENDPOINT_MARKER, DEFAULT_BRIDGE_PORT } from "@unbound-app/debugger-protocol";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { cancel, confirm, intro, isCancel, note, outro, select, text } from "@clack/prompts";
-import { spawn, spawnSync } from "node:child_process";
+import { API_KEY_HEADER, ApiRequestError, CLI_CLIENT_ID, createApiClient } from "@unbound-app/web/client";
+import toError from "@unbound-app/utils/to-error";
 import { glob } from "node:fs/promises";
+import { spawn, spawnSync } from "node:child_process";
+import { addonManifestSchema } from "@unbound-app/contracts/manifest";
+import { publishArtifact } from "@unbound-app/web/publish";
+import { apiUrlSchema } from "@unbound-app/contracts/api";
+import { homedir } from "node:os";
+import { cancel, confirm, intro, isCancel, note, outro, select, text } from "@clack/prompts";
+import { deviceAuthorizationClient } from "better-auth/client/plugins";
+import { createAuthClient } from "better-auth/client";
 import pc from "picocolors";
 //#region src/lib/stdin.ts
 /**
@@ -33,7 +41,7 @@ async function readStdin() {
 //#region src/lib/config.ts
 /** The filename walked up the directory tree to locate a workspace root. */
 const CONFIG_FILENAME = "unbound.config.json";
-const schema = z.object({
+const schema$2 = z.object({
 	$schema: z.string().optional(),
 	addons: z.array(z.string()).default(["plugins/*", "themes/*"]),
 	build: z.string().default("bun run build"),
@@ -49,13 +57,13 @@ const schema = z.object({
 function loadConfig(cwd = process.cwd()) {
 	const found = findConfigFile(cwd);
 	if (!found) return {
-		config: schema.parse({}),
+		config: schema$2.parse({}),
 		dir: resolve(cwd),
 		bare: true
 	};
 	const raw = JSON.parse(readFileSync(found, "utf8"));
 	return {
-		config: schema.parse(raw),
+		config: schema$2.parse(raw),
 		dir: dirname(found),
 		bare: false
 	};
@@ -66,7 +74,7 @@ function findConfigFile(from) {
 		const candidate = resolve(dir, CONFIG_FILENAME);
 		if (existsSync(candidate)) return candidate;
 		const parent = dirname(dir);
-		if (parent === dir) return void 0;
+		if (parent === dir) return;
 		dir = parent;
 	}
 }
@@ -251,6 +259,292 @@ function toMcpTool(server, definition, context) {
 	});
 }
 //#endregion
+//#region src/lib/discovery.ts
+/**
+* @description Discovers every addon reachable through the config's `addons` globs. A directory is an
+* addon iff it contains a `manifest.json`; its kind is derived from the manifest `main` (a `.json`
+* entry point is a theme, anything else a plugin) and it is static when its directory carries no
+* `package.json` with a `build` script.
+* @param resolved The loaded config paired with the directory its globs resolve relative to.
+* @returns Every discovered addon, keyed implicitly by directory.
+*/
+async function discoverAddons(resolved) {
+	const { config, dir, bare } = resolved;
+	const dirs = /* @__PURE__ */ new Set();
+	if (bare) dirs.add(dir);
+	else for (const pattern of config.addons) for await (const match of glob(pattern, { cwd: dir })) dirs.add(resolve(dir, match));
+	const addons = [];
+	for (const addonDir of dirs) {
+		const addon = readAddon(addonDir, config.output);
+		if (addon) addons.push(addon);
+	}
+	return addons;
+}
+/**
+* @description Reads a single directory as an addon, returning `undefined` when it has no
+* `manifest.json` or the manifest lacks the fields discovery needs.
+* @param addonDir The absolute directory to inspect.
+* @param output The config's output directory, relative to the addon.
+* @returns The discovered addon, or `undefined` if the directory is not an addon.
+*/
+function readAddon(addonDir, output) {
+	const manifestPath = join(addonDir, "manifest.json");
+	if (!existsSync(manifestPath)) return;
+	let manifest;
+	try {
+		manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+	} catch (error) {
+		process.stderr.write(`Skipping ${addonDir}: its manifest.json could not be read: ${String(error)}\n`);
+		return;
+	}
+	if (typeof manifest.id !== "string" || typeof manifest.main !== "string") return;
+	const kind = manifest.main.endsWith(".json") ? "theme" : "plugin";
+	const isStatic = !hasBuildScript(addonDir);
+	return {
+		id: manifest.id,
+		kind,
+		dir: addonDir,
+		output: isStatic ? addonDir : join(addonDir, output),
+		static: isStatic
+	};
+}
+function hasBuildScript(addonDir) {
+	const packagePath = join(addonDir, "package.json");
+	if (!existsSync(packagePath)) return false;
+	try {
+		const pkg = JSON.parse(readFileSync(packagePath, "utf8"));
+		return Boolean(pkg.scripts?.build);
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/lib/build-addon.ts
+/**
+* @description Builds a single addon by running the config's `build` command with cwd set to the
+* addon directory. Static addons carry no build step, so they resolve immediately as successful.
+* stdout and stderr are inherited so the build's own output surfaces live.
+* @param addon The addon to build.
+* @param buildCommand The shell command to run in the addon directory.
+* @returns Whether the build succeeded (always `true` for static addons).
+*/
+function buildAddon(addon, buildCommand) {
+	if (addon.static) return Promise.resolve(true);
+	return new Promise((resolve) => {
+		const child = spawn(buildCommand, {
+			cwd: addon.dir,
+			shell: true,
+			stdio: "inherit"
+		});
+		child.on("error", () => resolve(false));
+		child.on("close", (code) => resolve(code === 0));
+	});
+}
+//#endregion
+//#region src/lib/bundle-name.ts
+/**
+* @description Names an addon's bundle inside its output directory. A static addon ships the file
+* named by `main` as-is; a built addon's bundle is the JavaScript the build emits for `main`.
+* @param addon The addon.
+* @param main The manifest's `main`.
+* @returns The bundle's path relative to the addon's output directory.
+*/
+function getBundleName(addon, main) {
+	return addon.static ? main : basename(main).replace(/\.\w+$/, ".js");
+}
+//#endregion
+//#region src/lib/env.ts
+const schema$1 = z.object({
+	/** The origin of the Unbound web API that `ubd login` and `ubd publish` talk to. */
+	UNBOUND_API_URL: apiUrlSchema,
+	/** An API key for CI; when set, `ubd publish` sends it instead of the stored login. */
+	UNBOUND_API_KEY: z.string().min(1).optional(),
+	XDG_CONFIG_HOME: z.string().min(1).optional()
+});
+/**
+* @description Parses the environment the account commands read, throwing a readable error when a
+* variable is invalid.
+* @param source The variables to parse.
+* @returns The validated environment.
+*/
+function parseEnv(source = process.env) {
+	const parsed = schema$1.safeParse(source);
+	if (!parsed.success) throw new Error(`Invalid environment:\n${z.prettifyError(parsed.error)}`);
+	return parsed.data;
+}
+/**
+* @description Resolves where `ubd login` stores credentials, following the XDG base directory spec.
+* @param env The validated environment.
+* @returns The absolute path of `unbound/credentials.json` in the user's config directory.
+*/
+function getCredentialsPath(env) {
+	const configHome = env.XDG_CONFIG_HOME ?? join(homedir(), ".config");
+	return join(configHome, "unbound", "credentials.json");
+}
+//#endregion
+//#region src/lib/credentials.ts
+const schema = z.object({
+	/** The API origin the session belongs to; it is never sent to any other origin. */
+	apiUrl: z.url(),
+	/** The Better Auth session token from the device authorization flow, sent as a bearer token. */
+	token: z.string().min(1)
+});
+/**
+* @description Reads the stored credentials, throwing when the file exists but is not valid.
+* @param path The credentials file.
+* @returns The credentials, or `undefined` when nobody is logged in.
+*/
+function readCredentials(path) {
+	if (!existsSync(path)) return;
+	const parsed = schema.safeParse(JSON.parse(readFileSync(path, "utf8")));
+	if (!parsed.success) throw new Error(`Invalid credentials in ${path}:\n${z.prettifyError(parsed.error)}`);
+	return parsed.data;
+}
+/**
+* @description Stores credentials readable by the current user only.
+* @param path The credentials file.
+* @param credentials The session to store.
+*/
+function writeCredentials(path, credentials) {
+	mkdirSync(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	rmSync(path, { force: true });
+	writeFileSync(path, `${JSON.stringify(credentials, null, "	")}\n`, { mode: 384 });
+}
+/**
+* @description Deletes the stored credentials.
+* @param path The credentials file.
+* @returns Whether there were credentials to delete.
+*/
+function removeCredentials(path) {
+	if (!existsSync(path)) return false;
+	rmSync(path);
+	return true;
+}
+//#endregion
+//#region src/lib/api-client.ts
+/**
+* @description Builds the credentials the API is called with: the `UNBOUND_API_KEY` when set (CI),
+* otherwise the session `ubd login` stored for this API origin.
+* @param env The validated environment.
+* @returns The authentication headers.
+*/
+function getAuthHeaders(env) {
+	if (env.UNBOUND_API_KEY) return new Headers({ [API_KEY_HEADER]: env.UNBOUND_API_KEY });
+	const credentials = readCredentials(getCredentialsPath(env));
+	if (!credentials) throw new Error("Not logged in. Run `ubd login`, or set UNBOUND_API_KEY.");
+	if (credentials.apiUrl !== env.UNBOUND_API_URL) throw new Error(`Logged in to ${credentials.apiUrl}, not ${env.UNBOUND_API_URL}. Run \`ubd login\` again.`);
+	return new Headers({ authorization: `Bearer ${credentials.token}` });
+}
+/**
+* @description Creates the typed Unbound API client, authenticated as {@link getAuthHeaders} resolves.
+* @param env The validated environment.
+* @returns The typed `request(route, options)` function.
+*/
+function createClient(env) {
+	return createApiClient({
+		baseUrl: env.UNBOUND_API_URL,
+		headers: getAuthHeaders(env)
+	});
+}
+//#endregion
+//#region src/lib/publish.ts
+function readArtifact(addon) {
+	const path = join(addon.dir, "manifest.json");
+	const parsed = addonManifestSchema.safeParse(JSON.parse(readFileSync(path, "utf8")));
+	if (!parsed.success) throw new Error(`Invalid ${path}:\n${z.prettifyError(parsed.error)}`);
+	const main = getBundleName(addon, parsed.data.main);
+	return {
+		manifest: {
+			...parsed.data,
+			main
+		},
+		bundle: Bun.file(join(addon.output, main))
+	};
+}
+/**
+* @description Publishes a built addon for review: opens a submission (the server refuses it, before
+* anything is uploaded, when the bundle is over its size limit or a spam gate applies), uploads the
+* bundle to the presigned URL and finalizes the submission.
+* @param options The environment, the addon and the submission details.
+* @returns The submission, pending review.
+*/
+async function publish({ env, addon, repository, changelog }) {
+	const { manifest, bundle } = readArtifact(addon);
+	if (!await bundle.exists()) throw new Error(`Built bundle not found at ${bundle.name}. Build ${addon.id} first.`);
+	return publishArtifact(createClient(env), {
+		manifest,
+		bundle,
+		repository,
+		changelog
+	});
+}
+//#endregion
+//#region src/commands/publish.ts
+const publishCommand = {
+	name: "publish",
+	description: "Build an addon and submit it for review on Unbound. Authenticates with UNBOUND_API_KEY when set, otherwise with the `ubd login` session.",
+	surfaces: {
+		cli: true,
+		mcp: false
+	},
+	schema: z.object({
+		addon: z.string().optional().describe("The id of the addon to publish; required when the workspace has several."),
+		skipBuild: z.boolean().default(false).describe("Publish the existing build output instead of building first."),
+		repository: z.string().optional().describe("The GitHub owner/name the addon is built from, to verify its source."),
+		changelog: z.string().optional().describe("What changed in this version.")
+	}),
+	async handler({ addon: id, skipBuild, repository, changelog }) {
+		try {
+			const env = parseEnv();
+			const resolved = loadConfig();
+			const addon = selectAddon(await discoverAddons(resolved), id);
+			if (!skipBuild && !await buildAddon(addon, resolved.config.build)) return {
+				ok: false,
+				text: `Failed to build ${addon.id}.`
+			};
+			const submission = await publish({
+				env,
+				addon,
+				repository,
+				changelog
+			});
+			const source = submission.unverifiedSource ? " (unverified source)" : "";
+			return {
+				ok: true,
+				text: `Submitted ${submission.addonId} ${submission.version} as ${submission.kind} ${submission.id}${source}: ${submission.status}.`,
+				data: submission
+			};
+		} catch (error) {
+			return toFailure(error);
+		}
+	}
+};
+function selectAddon(addons, id) {
+	const ids = addons.map((addon) => addon.id).join(", ");
+	if (id) {
+		const found = addons.find((addon) => addon.id === id);
+		if (!found) throw new Error(`No addon ${id} in this workspace. Found: ${ids || "none"}.`);
+		return found;
+	}
+	const [only] = addons;
+	if (!only) throw new Error("No addons found.");
+	if (addons.length > 1) throw new Error(`Several addons found (${ids}); choose one with --addon.`);
+	return only;
+}
+function toFailure(error) {
+	if (error instanceof ApiRequestError) return {
+		ok: false,
+		text: `${error.message} (${error.code})`
+	};
+	return {
+		ok: false,
+		text: toError(error).message
+	};
+}
+//#endregion
 //#region src/lib/templates.ts
 /** The base of every documentation link surfaced by `ubd create`. */
 const DOCS_BASE_URL = "https://docs.unbound.rip";
@@ -594,87 +888,34 @@ function printOutro(result) {
 	outro(`${result.name} ready.`);
 }
 //#endregion
-//#region src/lib/discovery.ts
-/**
-* @description Discovers every addon reachable through the config's `addons` globs. A directory is an
-* addon iff it contains a `manifest.json`; its kind is derived from the manifest `main` (a `.json`
-* entry point is a theme, anything else a plugin) and it is static when its directory carries no
-* `package.json` with a `build` script.
-* @param resolved The loaded config paired with the directory its globs resolve relative to.
-* @returns Every discovered addon, keyed implicitly by directory.
-*/
-async function discoverAddons(resolved) {
-	const { config, dir, bare } = resolved;
-	const dirs = /* @__PURE__ */ new Set();
-	if (bare) dirs.add(dir);
-	else for (const pattern of config.addons) for await (const match of glob(pattern, { cwd: dir })) dirs.add(resolve(dir, match));
-	const addons = [];
-	for (const addonDir of dirs) {
-		const addon = readAddon(addonDir, config.output);
-		if (addon) addons.push(addon);
-	}
-	return addons;
-}
-/**
-* @description Reads a single directory as an addon, returning `undefined` when it has no
-* `manifest.json` or the manifest lacks the fields discovery needs.
-* @param addonDir The absolute directory to inspect.
-* @param output The config's output directory, relative to the addon.
-* @returns The discovered addon, or `undefined` if the directory is not an addon.
-*/
-function readAddon(addonDir, output) {
-	const manifestPath = join(addonDir, "manifest.json");
-	if (!existsSync(manifestPath)) return void 0;
-	let manifest;
-	try {
-		manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-	} catch (error) {
-		process.stderr.write(`Skipping ${addonDir}: its manifest.json could not be read: ${error}\n`);
-		return;
-	}
-	if (typeof manifest.id !== "string" || typeof manifest.main !== "string") return void 0;
-	const kind = manifest.main.endsWith(".json") ? "theme" : "plugin";
-	const isStatic = !hasBuildScript(addonDir);
-	return {
-		id: manifest.id,
-		kind,
-		dir: addonDir,
-		output: isStatic ? addonDir : join(addonDir, output),
-		static: isStatic
-	};
-}
-function hasBuildScript(addonDir) {
-	const packagePath = join(addonDir, "package.json");
-	if (!existsSync(packagePath)) return false;
-	try {
-		const pkg = JSON.parse(readFileSync(packagePath, "utf8"));
-		return Boolean(pkg.scripts?.build);
-	} catch {
-		return false;
+//#region src/commands/logout.ts
+const logoutCommand = {
+	name: "logout",
+	description: "Delete the credentials `ubd login` stored.",
+	surfaces: {
+		cli: true,
+		mcp: false
+	},
+	schema: z.object({}),
+	async handler() {
+		try {
+			const path = getCredentialsPath(parseEnv());
+			if (!removeCredentials(path)) return {
+				ok: true,
+				text: "Not logged in."
+			};
+			return {
+				ok: true,
+				text: `Logged out. Deleted ${path}.`
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				text: toError(error).message
+			};
+		}
 	}
-}
-//#endregion
-//#region src/lib/build-addon.ts
-/**
-* @description Builds a single addon by running the config's `build` command with cwd set to the
-* addon directory. Static addons carry no build step, so they resolve immediately as successful.
-* stdout and stderr are inherited so the build's own output surfaces live.
-* @param addon The addon to build.
-* @param buildCommand The shell command to run in the addon directory.
-* @returns Whether the build succeeded (always `true` for static addons).
-*/
-function buildAddon(addon, buildCommand) {
-	if (addon.static) return Promise.resolve(true);
-	return new Promise((resolve) => {
-		const child = spawn(buildCommand, {
-			cwd: addon.dir,
-			shell: true,
-			stdio: "inherit"
-		});
-		child.on("error", () => resolve(false));
-		child.on("close", (code) => resolve(code === 0));
-	});
-}
+};
 //#endregion
 //#region src/commands/build.ts
 const buildCommand = {
@@ -716,6 +957,90 @@ const buildCommand = {
 	}
 };
 //#endregion
+//#region src/lib/login.ts
+/** The grant type of an RFC 8628 device access token request. */
+const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+/** How much RFC 8628 says to lengthen the polling interval on every `slow_down`. */
+const SLOW_DOWN_STEP_MS = 5e3;
+/**
+* @description Logs in through Better Auth's device authorization flow: requests a code, shows it,
+* polls at the server's interval until the user approves it on the website, and stores the session.
+* @param options The environment, the polling delay and how to show the code.
+* @returns The path the credentials were stored at.
+*/
+async function login({ env, delay, prompt }) {
+	const auth = createAuthClient({
+		baseURL: env.UNBOUND_API_URL,
+		plugins: [deviceAuthorizationClient()]
+	});
+	const code = await auth.device.code({ client_id: CLI_CLIENT_ID });
+	if (code.error) throw new Error(`Could not start the login: ${code.error.error_description} (${code.error.error}).`);
+	prompt({
+		userCode: code.data.user_code,
+		verificationUri: code.data.verification_uri,
+		verificationUriComplete: code.data.verification_uri_complete
+	});
+	let interval = code.data.interval * 1e3;
+	while (true) {
+		await delay(interval);
+		const token = await auth.device.token({
+			grant_type: DEVICE_CODE_GRANT,
+			device_code: code.data.device_code,
+			client_id: CLI_CLIENT_ID
+		});
+		if (token.data) {
+			const path = getCredentialsPath(env);
+			writeCredentials(path, {
+				apiUrl: env.UNBOUND_API_URL,
+				token: token.data.access_token
+			});
+			return path;
+		}
+		if (token.error.error === "authorization_pending") continue;
+		if (token.error.error === "slow_down") {
+			interval += SLOW_DOWN_STEP_MS;
+			continue;
+		}
+		throw new Error(`Login failed: ${token.error.error_description} (${token.error.error}).`);
+	}
+}
+//#endregion
+//#region src/commands/login.ts
+const loginCommand = {
+	name: "login",
+	description: "Log in to Unbound by approving a code on the website, so `ubd publish` can submit addons. Not needed in CI when UNBOUND_API_KEY is set.",
+	surfaces: {
+		cli: true,
+		mcp: false
+	},
+	schema: z.object({}),
+	async handler() {
+		try {
+			const env = parseEnv();
+			if (env.UNBOUND_API_KEY) return {
+				ok: true,
+				text: "UNBOUND_API_KEY is set, so ubd uses it and needs no login."
+			};
+			return {
+				ok: true,
+				text: `Logged in. Credentials stored in ${await login({
+					env,
+					delay: Bun.sleep,
+					prompt: printCode
+				})}.`
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				text: toError(error).message
+			};
+		}
+	}
+};
+function printCode(code) {
+	process.stdout.write(`Open ${code.verificationUriComplete} and confirm the code ${code.userCode}.\n(Or go to ${code.verificationUri} and enter it.)\nWaiting for approval…\n`);
+}
+//#endregion
 //#region src/lib/format.ts
 /**
 * @description Renders an {@link EvalResult} into the human-readable transcript both surfaces print:
@@ -769,9 +1094,8 @@ const evalCommand = {
 //#endregion
 //#region src/lib/reload-transport.ts
 /**
-* How long the watcher waits for a dropped device to reconnect before warning and dropping a reload.
-* Longer than a one-shot command's poll (`DEVICE_WAIT_TIMEOUT_MS`): a `ubd dev` session runs for
-* hours, and a backgrounded app or slept device can take a few seconds to redial the bridge.
+* How long the watcher waits for a dropped device to reconnect before dropping a reload. Longer than
+* a one-shot command's poll, since a backgrounded app or slept device can take seconds to redial.
 */
 const RECONNECT_WAIT_MS = 5e3;
 /**
@@ -807,7 +1131,7 @@ function createReloadTransport(context, reconnectWaitMs = RECONNECT_WAIT_MS) {
 			if (result.ok) process.stdout.write(`Reloaded ${addon.id}.\n`);
 			else process.stderr.write(`Failed to reload ${addon.id}: ${result.error}\n`);
 		} catch (error) {
-			process.stderr.write(`Failed to reload ${addon.id}: ${error?.message ?? error}\n`);
+			process.stderr.write(`Failed to reload ${addon.id}: ${toError(error).message}\n`);
 		}
 	} };
 }
@@ -820,7 +1144,7 @@ function createReloadTransport(context, reconnectWaitMs = RECONNECT_WAIT_MS) {
 */
 function readBuiltAddon(addon) {
 	const manifest = JSON.parse(readFileSync(join(addon.dir, "manifest.json"), "utf8"));
-	const bundleName = addon.static ? manifest.main : basename(manifest.main).replace(/\.\w+$/, ".js");
+	const bundleName = getBundleName(addon, manifest.main);
 	const bundlePath = join(addon.output, bundleName);
 	if (!existsSync(bundlePath)) throw new Error(`Built bundle not found at ${bundlePath}. Hot reload expects the build to emit ${bundleName} into ${addon.output}.`);
 	return {
@@ -833,10 +1157,8 @@ function readBuiltAddon(addon) {
 /** How long file changes inside one addon settle before that addon rebuilds. */
 const DEBOUNCE_MS = 150;
 /**
-* Watches every discovered addon and rebuilds only the addon whose files changed, debounced per
-* addon. Directory creates and deletes under the workspace re-run discovery so addons added or
-* removed while the server runs are picked up. After each successful build the reload transport is
-* called; static addons skip the build step but still count as a successful build for reload.
+* Watches every discovered addon and rebuilds (debounced) and reloads only the one that changed.
+* Directory creates and deletes re-run discovery; static addons skip the build but still reload.
 */
 var DevServer = class {
 	resolved;
@@ -951,7 +1273,10 @@ const commands = [
 			return new Promise(() => {});
 		}
 	},
-	createCommand
+	createCommand,
+	loginCommand,
+	logoutCommand,
+	publishCommand
 ];
 //#endregion
 //#region src/commands/mcp.ts
@@ -989,6 +1314,9 @@ const SUMMARIES = {
 	create: "Scaffold a new addon or workspace.",
 	dev: "Watch addons and rebuild on change.",
 	build: "Build every addon in the workspace.",
+	publish: "Build an addon and submit it for review.",
+	login: "Log in to Unbound for publishing.",
+	logout: "Delete the stored login.",
 	eval: "Run JavaScript on the connected device.",
 	mcp: "Serve the debugger as an MCP server."
 };
@@ -997,6 +1325,9 @@ const ORDER = [
 	"create",
 	"dev",
 	"build",
+	"publish",
+	"login",
+	"logout",
 	"eval",
 	"mcp"
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@unbound-app/cli",
-	"version": "0.4.0",
+	"version": "0.7.0",
 	"description": "The `ubd` command line for the Unbound client: evaluate on-device code and serve the debugger as an MCP.",
 	"author": {
 		"name": "Mario P.",
@@ -22,13 +22,18 @@
 	"type": "module",
 	"module": "./dist/index.mjs",
 	"scripts": {
-		"build": "tsdown"
+		"build": "tsdown",
+		"typecheck": "bun run --filter @unbound-app/web build:types && tsc --noEmit -p ."
 	},
 	"dependencies": {
 		"@clack/prompts": "^1.7.0",
 		"@modelcontextprotocol/sdk": "^1.29.0",
-		"@unbound-app/debugger-protocol": "0.4.0",
-		"@unbound-app/types": "0.4.0",
+		"@unbound-app/contracts": "0.7.0",
+		"@unbound-app/debugger-protocol": "0.7.0",
+		"@unbound-app/types": "0.7.0",
+		"@unbound-app/utils": "0.7.0",
+		"@unbound-app/web": "0.7.0",
+		"better-auth": "1.7.10",
 		"cleye": "^1.3.4",
 		"picocolors": "^1.1.1",
 		"zod": "^4.0.0"