@velven/cli 0.0.1 → 0.1.0

package/dist/velven.js

@@ -0,0 +1,1353 @@
+#!/usr/bin/env node
+
+// src/errors.ts
+var EXIT = {
+  ok: 0,
+  failed: 1,
+  usage: 2,
+  auth: 3,
+  refused: 4,
+  rateLimited: 5,
+  notLive: 6
+};
+
+class CliError extends Error {
+  exitCode;
+  code;
+  fields;
+  constructor(message, exitCode, code, fields) {
+    super(message);
+    this.exitCode = exitCode;
+    this.code = code;
+    this.fields = fields;
+  }
+}
+// package.json
+var version = "0.1.0";
+
+// src/version.ts
+var VERSION = version;
+
+// src/api.ts
+var USER_AGENT = `velven-cli/${VERSION}`;
+var REFUSED_CODES = new Set(["not_owner", "too_large", "too_many_files", "not_found", "invalid_fields", "forbidden"]);
+function errorFromResponse(status, body, path, creds, retryAfter) {
+  const b = body && typeof body === "object" ? body : {};
+  const errorText = typeof b.error === "string" ? b.error : undefined;
+  const code = typeof b.code === "string" ? b.code : errorText && /^[a-z_]+$/.test(errorText) ? errorText : `http_${status}`;
+  const sentence = typeof b.message === "string" ? b.message : errorText && errorText !== code ? errorText : undefined;
+  const fields = Array.isArray(b.fields) ? b.fields.map((f) => typeof f === "string" ? f : JSON.stringify(f)) : undefined;
+  if (code === "sign_in_required") {
+    return new CliError(sentence ?? "Sign in to do that: run velven login.", EXIT.auth, code);
+  }
+  if (status === 401 || code === "unauthorized") {
+    if (!creds)
+      return new CliError(sentence ?? "Sign in for that: run velven login.", EXIT.auth, "unauthorized");
+    const which = creds.source === "env" ? "VELVEN_TOKEN" : "your saved sign-in";
+    return new CliError(`Velven did not accept ${which}. Run velven login again.`, EXIT.auth, "unauthorized");
+  }
+  if (status === 429 || code === "rate_limited") {
+    const wait = retryAfter && /^\d+$/.test(retryAfter) ? ` Try again in ${Math.ceil(Number(retryAfter) / 60)} minutes.` : "";
+    return new CliError(`${sentence ?? "Too many requests for now."}${wait}`, EXIT.rateLimited, "rate_limited");
+  }
+  if (code === "missing_fields") {
+    return new CliError(sentence ?? "Some listing fields are missing.", EXIT.usage, code, fields);
+  }
+  if (status >= 500) {
+    return new CliError(sentence ?? `Velven had a problem on its side (HTTP ${status}). Try again in a moment.`, EXIT.failed, code);
+  }
+  if (!body && status === 404) {
+    return new CliError(`This Velven does not answer ${path}. Check VELVEN_API.`, EXIT.failed, "not_found");
+  }
+  if (REFUSED_CODES.has(code) || status >= 400) {
+    return new CliError(sentence ?? `Velven refused the request (HTTP ${status}).`, EXIT.refused, code, fields);
+  }
+  return new CliError(sentence ?? `Unexpected answer from Velven (HTTP ${status}).`, EXIT.failed, code);
+}
+async function call(api, method, path, body) {
+  const headers = { accept: "application/json", "user-agent": USER_AGENT };
+  if (body !== undefined)
+    headers["content-type"] = "application/json";
+  if (api.creds)
+    headers.authorization = `Bearer ${api.creds.token}`;
+  if (api.claim)
+    headers["x-velven-claim"] = api.claim;
+  let response;
+  try {
+    response = await fetch(`${api.base}${path}`, {
+      method,
+      headers,
+      body: body === undefined ? undefined : JSON.stringify(body)
+    });
+  } catch (e) {
+    const cause = e instanceof Error && e.cause instanceof Error ? e.cause.message : e instanceof Error ? e.message : String(e);
+    throw new CliError(`Could not reach Velven at ${api.base} (${cause}).`, EXIT.failed, "network");
+  }
+  const text = await response.text();
+  let parsed = null;
+  if (text) {
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      parsed = null;
+    }
+  }
+  if (!response.ok)
+    throw errorFromResponse(response.status, parsed, path, api.creds, response.headers.get("retry-after"));
+  if (parsed === null)
+    throw new CliError(`Velven answered ${path} with something other than JSON.`, EXIT.failed, "bad_response");
+  return parsed;
+}
+function seg(value) {
+  return encodeURIComponent(String(value));
+}
+
+// src/auth.ts
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+var DEFAULT_API = "https://velven.ai";
+function apiBase(ctx) {
+  const raw = ctx.env.VELVEN_API?.trim() || DEFAULT_API;
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new CliError(`VELVEN_API is not a web address: ${raw}`, EXIT.usage, "usage");
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new CliError(`VELVEN_API must start with https:// or http://, not ${url.protocol}`, EXIT.usage, "usage");
+  }
+  return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
+}
+function authPath(ctx) {
+  return join(ctx.home, ".config", "velven", "auth.json");
+}
+async function readAuthFile(ctx) {
+  let text;
+  try {
+    text = await readFile(authPath(ctx), "utf8");
+  } catch {
+    return { accounts: {} };
+  }
+  try {
+    const parsed = JSON.parse(text);
+    return { accounts: parsed.accounts && typeof parsed.accounts === "object" ? parsed.accounts : {} };
+  } catch {
+    return { accounts: {} };
+  }
+}
+async function writeAuthFile(ctx, file) {
+  const path = authPath(ctx);
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  await writeFile(path, `${JSON.stringify(file, null, 2)}
+`, { mode: 384 });
+  await chmod(path, 384);
+}
+async function saveToken(ctx, api, saved) {
+  const file = await readAuthFile(ctx);
+  file.accounts[api] = saved;
+  await writeAuthFile(ctx, file);
+}
+async function forgetToken(ctx, api) {
+  const file = await readAuthFile(ctx);
+  if (!file.accounts[api])
+    return false;
+  delete file.accounts[api];
+  if (Object.keys(file.accounts).length === 0)
+    await rm(authPath(ctx), { force: true });
+  else
+    await writeAuthFile(ctx, file);
+  return true;
+}
+async function findToken(ctx, api) {
+  const env = ctx.env.VELVEN_TOKEN?.trim();
+  if (env)
+    return { token: env, source: "env" };
+  const saved = (await readAuthFile(ctx)).accounts[api];
+  return saved?.token ? { token: saved.token, source: "file" } : null;
+}
+async function requireToken(ctx, api) {
+  const found = await findToken(ctx, api);
+  if (!found) {
+    throw new CliError("You are not signed in. Run velven login, or set VELVEN_TOKEN.", EXIT.auth, "not_signed_in");
+  }
+  return found;
+}
+
+// src/account.ts
+async function login(ctx) {
+  const base = apiBase(ctx);
+  const api = { base };
+  const started = await call(api, "POST", "/api/agent/login", { agent_name: "Velven CLI" });
+  ctx.out(`Your code: ${started.user_code}`);
+  ctx.out(`Approve it at ${started.verification_url}`);
+  if (ctx.openBrowser(started.verification_url))
+    ctx.out("Opened it in your browser. Waiting for you to approve...");
+  else
+    ctx.out("Open that link in a browser. Waiting for you to approve...");
+  let interval = Math.max(1, started.interval || 5);
+  const deadline = Date.now() + (started.expires_in || 900) * 1000;
+  while (Date.now() < deadline) {
+    await ctx.sleep(interval * 1000);
+    try {
+      const token = await call(api, "POST", "/api/agent/token", { device_code: started.device_code });
+      await saveToken(ctx, base, { token: token.access_token, handle: token.handle });
+      ctx.out(`Signed in as @${token.handle}.`);
+      if (ctx.env.VELVEN_TOKEN)
+        ctx.out("VELVEN_TOKEN is set, so it is used instead of this sign-in until you unset it.");
+      return EXIT.ok;
+    } catch (e) {
+      if (!(e instanceof CliError))
+        throw e;
+      if (e.code === "authorization_pending")
+        continue;
+      if (e.code === "slow_down") {
+        interval += 5;
+        continue;
+      }
+      if (e.code === "access_denied")
+        throw new CliError("The sign-in was denied. Nothing was saved.", EXIT.auth, "access_denied");
+      if (e.code === "expired_token" || e.code === "invalid_grant")
+        break;
+      if (e.exitCode === EXIT.failed)
+        continue;
+      throw e;
+    }
+  }
+  throw new CliError("The code expired before it was approved. Run velven login again.", EXIT.auth, "expired_token");
+}
+async function logout(ctx) {
+  const base = apiBase(ctx);
+  const had = await forgetToken(ctx, base);
+  ctx.out(had ? `Signed out of ${base} on this computer.` : `You were not signed in to ${base} on this computer.`);
+  if (had)
+    ctx.out(`The token stays valid until you revoke it at ${base}/settings.`);
+  if (ctx.env.VELVEN_TOKEN)
+    ctx.out("VELVEN_TOKEN is still set in this shell.");
+  return EXIT.ok;
+}
+async function whoami(ctx, json) {
+  const base = apiBase(ctx);
+  const creds = await requireToken(ctx, base);
+  const me = await call({ base, creds }, "GET", "/api/agent/me");
+  if (json)
+    ctx.out(JSON.stringify({ ok: true, api: base, handle: me.handle, profileUrl: me.profile_url, tokenFrom: creds.source }));
+  else
+    ctx.out(`@${me.handle} on ${base}${creds.source === "env" ? " (from VELVEN_TOKEN)" : ""}`);
+  return EXIT.ok;
+}
+
+// src/args.ts
+var SHORT = { y: "yes", h: "help" };
+function parseArgs(argv, spec) {
+  const positionals = [];
+  const flags = {};
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--") {
+      positionals.push(...argv.slice(i + 1));
+      break;
+    }
+    if (!arg.startsWith("-") || arg === "-") {
+      positionals.push(arg);
+      continue;
+    }
+    const long = arg.startsWith("--");
+    const body = long ? arg.slice(2) : arg.slice(1);
+    const eq = body.indexOf("=");
+    const rawName = eq === -1 ? body : body.slice(0, eq);
+    const name = long ? rawName : SHORT[rawName];
+    const kind = name === "help" ? "boolean" : name ? spec[name] : undefined;
+    if (!name || !kind)
+      throw new CliError(`Unknown option ${arg}. Run velven help to see the options.`, EXIT.usage, "usage");
+    if (kind === "boolean") {
+      if (eq !== -1)
+        throw new CliError(`--${name} takes no value.`, EXIT.usage, "usage");
+      flags[name] = true;
+      continue;
+    }
+    const value = eq !== -1 ? body.slice(eq + 1) : argv[++i];
+    if (value === undefined || eq === -1 && value.startsWith("--")) {
+      throw new CliError(`--${name} needs a value.`, EXIT.usage, "usage");
+    }
+    flags[name] = value;
+  }
+  return { positionals, flags };
+}
+function stringFlag(parsed, name) {
+  const value = parsed.flags[name];
+  return typeof value === "string" ? value : undefined;
+}
+
+// src/context.ts
+import { spawn } from "node:child_process";
+import { homedir } from "node:os";
+import { createInterface } from "node:readline/promises";
+
+class Cancelled extends Error {
+  constructor() {
+    super("Cancelled.");
+  }
+}
+function nodeContext() {
+  return {
+    cwd: process.cwd(),
+    env: process.env,
+    home: homedir(),
+    interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+    out: (line) => process.stdout.write(`${line}
+`),
+    err: (line) => process.stderr.write(`${line}
+`),
+    ask: async (question) => {
+      const rl = createInterface({ input: process.stdin, output: process.stdout });
+      try {
+        return await new Promise((resolve, reject) => {
+          rl.once("SIGINT", () => reject(new Cancelled));
+          rl.question(question).then(resolve, reject);
+        });
+      } finally {
+        rl.close();
+      }
+    },
+    openBrowser: (url) => {
+      const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+      try {
+        const child = spawn(command, args, { stdio: "ignore", detached: true });
+        child.on("error", () => {});
+        child.unref();
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    untilStopped: () => new Promise((resolve) => {
+      process.once("SIGINT", () => resolve());
+      process.once("SIGTERM", () => resolve());
+    })
+  };
+}
+
+// src/dev.ts
+import { readdir as readdir2, readFile as readFile3, realpath, stat } from "node:fs/promises";
+import { createServer } from "node:http";
+import { extname, join as join3, relative, resolve, sep } from "node:path";
+
+// src/ignore.ts
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0;i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*" && glob[i + 1] === "*") {
+      if (glob[i + 2] === "/") {
+        re += "(?:.*/)?";
+        i += 2;
+      } else {
+        re += ".*";
+        i += 1;
+      }
+    } else if (c === "*")
+      re += "[^/]*";
+    else if (c === "?")
+      re += "[^/]";
+    else
+      re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${re}$`);
+}
+function parseIgnore(text) {
+  const rules = [];
+  for (const raw of text.split(/\r?\n/)) {
+    let line = raw.trim();
+    if (!line || line.startsWith("#") || line.startsWith("!"))
+      continue;
+    const dirOnly = line.endsWith("/");
+    if (dirOnly)
+      line = line.replace(/\/+$/, "");
+    const anchored = line.startsWith("/") || line.includes("/");
+    line = line.replace(/^\/+/, "");
+    const re = globToRegExp(line);
+    rules.push((path, isDir) => {
+      if (dirOnly && !isDir)
+        return false;
+      if (anchored)
+        return re.test(path);
+      return re.test(path.slice(path.lastIndexOf("/") + 1));
+    });
+  }
+  return rules;
+}
+function isIgnored(rules, path) {
+  const parts = path.split("/");
+  return rules.some((rule) => rule(path, false) || parts.slice(0, -1).some((_, i) => rule(parts.slice(0, i + 1).join("/"), true)));
+}
+
+// src/project.ts
+import { readdir, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join2, win32 } from "node:path";
+var SPACE_TYPES = ["game", "world", "tool", "wonder"];
+var DEVICES = ["desktop", "mobile", "vr"];
+var PROJECT_FILE = "velven.json";
+var isProjectName = (name) => name.toLowerCase() === PROJECT_FILE;
+function servableSegment(segment) {
+  return !alwaysLeftOut(segment) && !/[. ]$/.test(segment) && !/[:~]/.test(segment);
+}
+function alwaysLeftOut(segment) {
+  return segment.startsWith(".") || segment.toLowerCase() === "node_modules" || isProjectName(segment);
+}
+function servableRelative(rel) {
+  return rel !== "" && !win32.isAbsolute(rel) && rel.split(/[\\/]/).every(servableSegment);
+}
+async function readProject(dir) {
+  const names = await readdir(dir).catch(() => []);
+  const path = join2(dir, names.includes(PROJECT_FILE) ? PROJECT_FILE : names.find(isProjectName) ?? PROJECT_FILE);
+  let text;
+  try {
+    text = await readFile2(path, "utf8");
+  } catch {
+    return { path, exists: false, data: {} };
+  }
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch (e) {
+    throw new CliError(`${PROJECT_FILE} is not valid JSON (${e instanceof Error ? e.message : String(e)}).`, EXIT.usage, "invalid_config");
+  }
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    throw new CliError(`${PROJECT_FILE} must hold one JSON object, like {"title": "My game"}.`, EXIT.usage, "invalid_config");
+  }
+  return { path, exists: true, data };
+}
+async function updateProject(project, values) {
+  for (const [key, value] of Object.entries(values)) {
+    if (value === undefined)
+      delete project.data[key];
+    else
+      project.data[key] = value;
+  }
+  await writeFile2(project.path, `${JSON.stringify(project.data, null, 2)}
+`);
+  project.exists = true;
+}
+function list(value) {
+  return value.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+}
+function withFlags(data, flags) {
+  const out = { ...data };
+  if (flags.title !== undefined)
+    out.title = flags.title;
+  if (flags.type !== undefined)
+    out.type = flags.type.trim().toLowerCase();
+  if (flags.devices !== undefined)
+    out.devices = list(flags.devices);
+  if (flags.description !== undefined)
+    out.description = flags.description;
+  if (flags.engine !== undefined)
+    out.engine = flags.engine;
+  return out;
+}
+var REQUIRED = ["title", "type", "devices"];
+function requiredProblem(field, value) {
+  if (value === undefined || value === null || value === "" || Array.isArray(value) && value.length === 0)
+    return "missing";
+  if (field === "title") {
+    if (typeof value !== "string" || !value.trim())
+      return "must be text";
+    if (value.trim().length > 80)
+      return "must be under 80 characters";
+    return null;
+  }
+  if (field === "type") {
+    return typeof value === "string" && SPACE_TYPES.includes(value) ? null : `must be one of ${SPACE_TYPES.join(", ")}`;
+  }
+  if (!Array.isArray(value) || !value.every((d) => typeof d === "string" && DEVICES.includes(d))) {
+    return `must be a list from ${DEVICES.join(", ")}, like ["desktop", "mobile"]`;
+  }
+  return null;
+}
+var isString = (v) => typeof v === "string";
+var isStringList = (v) => Array.isArray(v) && v.every(isString);
+var isBoolean = (v) => typeof v === "boolean";
+function isStart(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v))
+    return false;
+  const s = v;
+  const keys = Object.keys(s);
+  if (keys.length !== 1)
+    return false;
+  if ("key" in s)
+    return typeof s.key === "string" && s.key.length > 0;
+  if ("click" in s) {
+    if (typeof s.click === "string")
+      return s.click.length > 0;
+    return Array.isArray(s.click) && s.click.length === 2 && s.click.every((n) => typeof n === "number" && Number.isFinite(n));
+  }
+  return false;
+}
+var OPTIONAL = {
+  description: [(v) => isString(v) && v.length <= 160, "must be one line of text, under 160 characters"],
+  engine: [isString, 'must be text, like "three.js"'],
+  ai_tools: [isStringList, "must be a list of text"],
+  models: [isStringList, "must be a list of text"],
+  how_made: [(v) => isString(v) && v.length <= 2000, "must be text, under 2000 characters"],
+  source_url: [isString, "must be a web address"],
+  entry: [(v) => isString(v) && !!v && !v.startsWith("/") && !v.split("/").includes(".."), 'must be a path inside the folder, like "index.html"'],
+  spa: [isBoolean, "must be true or false"],
+  sdk: [isBoolean, "must be true or false"],
+  toasts: [isBoolean, "must be true or false"],
+  start: [isStart, 'must be {"click": "Play"}, {"click": [x, y]} or {"key": "Space"}'],
+  space: [(v) => isString(v) && /^[a-z0-9][a-z0-9-]*$/.test(v), `must be a space's slug, like "my-game"`],
+  claim: [(v) => isString(v) && !!v, "must be the claim token a publish without an account saved"]
+};
+function optionalProblems(data) {
+  const problems = [];
+  for (const [field, [ok, rule]] of Object.entries(OPTIONAL)) {
+    if (data[field] === undefined)
+      continue;
+    if (!ok(data[field]))
+      problems.push(`"${field}" ${rule}`);
+  }
+  return problems;
+}
+function requiredProblems(data) {
+  return REQUIRED.flatMap((field) => {
+    const problem = requiredProblem(field, data[field]);
+    return problem ? [{ field, problem }] : [];
+  });
+}
+var QUESTIONS = {
+  title: "Title, the name people see on Velven: ",
+  type: `Type (${SPACE_TYPES.join(", ")}): `,
+  devices: `Devices it works on, comma separated (${DEVICES.join(", ")}): `
+};
+function parseAnswer(field, answer) {
+  if (field === "title")
+    return answer.trim();
+  if (field === "type")
+    return answer.trim().toLowerCase();
+  return list(answer);
+}
+async function completeRequired(ctx, project, merged, canAsk) {
+  const problems = requiredProblems(merged);
+  if (problems.length === 0)
+    return merged;
+  if (!canAsk) {
+    const lines = problems.map(({ field, problem }) => `"${field}" ${problem === "missing" ? "is missing" : problem}`);
+    throw new CliError(`velven.json needs ${problems.map((p) => p.field).join(", ")}: ${lines.join("; ")}. Add them to velven.json or pass --${problems[0].field}.`, EXIT.usage, "missing_fields", problems.map((p) => p.field));
+  }
+  ctx.out(`velven.json needs ${problems.map((p) => p.field).join(", ")}. Your answers are saved into it.`);
+  const answers = {};
+  for (const { field, problem } of problems) {
+    if (problem !== "missing")
+      ctx.out(`"${field}" ${problem}.`);
+    for (;; ) {
+      const value = parseAnswer(field, await ctx.ask(QUESTIONS[field]));
+      const again = requiredProblem(field, value);
+      if (!again) {
+        answers[field] = value;
+        break;
+      }
+      ctx.out(again === "missing" ? `Please answer: ${field} is required.` : `That ${field} ${again}.`);
+    }
+  }
+  await updateProject(project, answers);
+  return { ...merged, ...answers };
+}
+
+// src/dev.ts
+var TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".htm": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".cjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".map": "application/json; charset=utf-8",
+  ".txt": "text/plain; charset=utf-8",
+  ".csv": "text/csv; charset=utf-8",
+  ".xml": "application/xml; charset=utf-8",
+  ".wasm": "application/wasm",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+  ".bmp": "image/bmp",
+  ".mp3": "audio/mpeg",
+  ".ogg": "audio/ogg",
+  ".oga": "audio/ogg",
+  ".opus": "audio/ogg",
+  ".wav": "audio/wav",
+  ".m4a": "audio/mp4",
+  ".aac": "audio/aac",
+  ".flac": "audio/flac",
+  ".mp4": "video/mp4",
+  ".m4v": "video/mp4",
+  ".webm": "video/webm",
+  ".mov": "video/quicktime",
+  ".ttf": "font/ttf",
+  ".otf": "font/otf",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".glb": "model/gltf-binary",
+  ".gltf": "model/gltf+json",
+  ".pdf": "application/pdf"
+};
+var ENCODINGS = { ".br": "br", ".gz": "gzip" };
+function contentType(path) {
+  const ext = extname(path).toLowerCase();
+  const encoding = ENCODINGS[ext];
+  if (encoding)
+    return { type: TYPES[extname(path.slice(0, -ext.length)).toLowerCase()] ?? "application/octet-stream", encoding };
+  return { type: TYPES[ext] ?? "application/octet-stream" };
+}
+function injectSdk(html, src) {
+  if (/<script[^>]+src=["'][^"']*\/sdk\/v1\.js/i.test(html))
+    return html;
+  const tag = `<script src="${src}" async></script>`;
+  const head = html.search(/<\/head>/i);
+  if (head !== -1)
+    return html.slice(0, head) + tag + html.slice(head);
+  const body = html.search(/<body[\s>]/i);
+  if (body !== -1)
+    return html.slice(0, body) + tag + html.slice(body);
+  return tag + html;
+}
+async function ignoreRules(root) {
+  return parseIgnore(await readFile3(join3(root, ".velvenignore"), "utf8").catch(() => ""));
+}
+async function namedAsOnDisk(base, rel) {
+  const parts = rel.split("/").filter(Boolean);
+  for (let i = 0;i < parts.length; i++) {
+    const names = await readdir2(join3(base, ...parts.slice(0, i))).catch(() => []);
+    if (!names.includes(parts[i]))
+      return false;
+  }
+  return true;
+}
+async function statExact(base, rel) {
+  const info = await stat(join3(base, rel)).catch(() => null);
+  return info && await namedAsOnDisk(base, rel) ? info : null;
+}
+async function startDevServer(root, options) {
+  const base = resolve(root);
+  const realBase = await realpath(base);
+  const server = createServer(async (req, res) => {
+    const send = (status, body2, headers2 = {}) => {
+      res.writeHead(status, { "cache-control": "no-store", ...headers2 });
+      res.end(req.method === "HEAD" ? undefined : body2);
+    };
+    if (req.method !== "GET" && req.method !== "HEAD")
+      return send(405, "Method not allowed", { allow: "GET, HEAD" });
+    let path;
+    try {
+      path = decodeURIComponent(new URL(req.url ?? "/", "http://localhost").pathname);
+    } catch {
+      return send(400, "Bad path");
+    }
+    const parts = path.split("/").filter(Boolean);
+    if (!parts.every(servableSegment))
+      return send(404, "Not found", { "content-type": "text/plain; charset=utf-8" });
+    let rel = parts.join("/");
+    let file = resolve(base, rel);
+    if (file !== base && !file.startsWith(base + sep))
+      return send(404, "Not found");
+    let info = await statExact(base, rel);
+    if (info?.isDirectory()) {
+      if (!path.endsWith("/"))
+        return send(301, "", { location: `${path}/` });
+      rel = rel ? `${rel}/index.html` : options.entry;
+      file = join3(base, rel);
+      info = await statExact(base, rel);
+    }
+    const rules = await ignoreRules(base);
+    if (info?.isFile() && isIgnored(rules, rel))
+      info = null;
+    if (!info?.isFile() && options.spa && !extname(path)) {
+      rel = options.entry;
+      file = join3(base, rel);
+      info = await statExact(base, rel);
+    }
+    if (info?.isFile() && isIgnored(rules, rel))
+      info = null;
+    if (!info?.isFile()) {
+      options.onMissing?.(path);
+      return send(404, "Not found", { "content-type": "text/plain; charset=utf-8" });
+    }
+    const real = await realpath(file).catch(() => null);
+    if (!real || !servableRelative(relative(realBase, real))) {
+      return send(404, "Not found", { "content-type": "text/plain; charset=utf-8" });
+    }
+    const { type, encoding } = contentType(file);
+    let body = await readFile3(file);
+    if (rel === options.entry && options.sdkSrc && !encoding)
+      body = injectSdk(body.toString("utf8"), options.sdkSrc);
+    const headers = { "content-type": type, "content-length": String(Buffer.byteLength(body)) };
+    if (encoding)
+      headers["content-encoding"] = encoding;
+    send(200, body, headers);
+  });
+  await new Promise((resolveListen, reject) => {
+    server.once("error", reject);
+    server.listen(options.port, "127.0.0.1", () => resolveListen());
+  });
+  const { port } = server.address();
+  return {
+    url: `http://localhost:${port}`,
+    close: () => new Promise((done) => {
+      server.closeAllConnections();
+      server.close(() => done());
+    })
+  };
+}
+async function dev(ctx, dirArg, portFlag) {
+  const dir = resolve(ctx.cwd, dirArg ?? ".");
+  const info = await stat(dir).catch(() => null);
+  if (!info?.isDirectory())
+    throw new CliError(`There is no folder at ${dir}.`, EXIT.usage, "usage");
+  const port = portFlag === undefined ? 0 : Number(portFlag);
+  if (!Number.isInteger(port) || port < 0 || port > 65535)
+    throw new CliError("--port must be a number from 1 to 65535.", EXIT.usage, "usage");
+  const { data } = await readProject(dir);
+  const shape = optionalProblems(data);
+  if (shape.length)
+    throw new CliError(`velven.json has problems: ${shape.join("; ")}.`, EXIT.usage, "invalid_config");
+  const base = apiBase(ctx);
+  const entry = typeof data.entry === "string" ? data.entry : "index.html";
+  if (!(await stat(join3(dir, entry)).catch(() => null))?.isFile()) {
+    throw new CliError(`The folder has no ${entry}. Add one, or name the page to open with "entry" in velven.json.`, EXIT.usage, "no_entry");
+  }
+  let server;
+  try {
+    server = await startDevServer(dir, {
+      port,
+      entry,
+      spa: data.spa === true,
+      sdkSrc: data.sdk === false ? null : `${base}/sdk/v1.js`,
+      onMissing: (path) => ctx.err(`Not found: ${path}`)
+    });
+  } catch (e) {
+    const busy = e instanceof Error && "code" in e && e.code === "EADDRINUSE";
+    throw new CliError(busy ? `Port ${port} is taken. Pick another with --port, or leave it out.` : `Could not start the server (${String(e)}).`, EXIT.failed, "server");
+  }
+  const slug = typeof data.space === "string" ? data.space : undefined;
+  const page = `${base}/dev?url=${encodeURIComponent(server.url)}${slug ? `&space=${encodeURIComponent(slug)}` : ""}`;
+  ctx.out(`Serving ${dir} at ${server.url}`);
+  ctx.out(`Play it on Velven: ${page}`);
+  if (!slug)
+    ctx.out("Scores and saves need a space: publish once so velven.json names it.");
+  ctx.out("Scores, saves and achievements made here go to the sandbox. Press Ctrl+C to stop.");
+  ctx.openBrowser(page);
+  await ctx.untilStopped();
+  await server.close();
+  return EXIT.ok;
+}
+
+// src/publish.ts
+import { stat as stat3 } from "node:fs/promises";
+import { resolve as resolve2 } from "node:path";
+
+// src/files.ts
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { readdir as readdir3, readFile as readFile4, realpath as realpath2, stat as stat2 } from "node:fs/promises";
+import { join as join4, relative as relative2 } from "node:path";
+var ACCOUNT_LIMITS = { maxBytes: 100 * 1024 * 1024, maxFiles: 2000 };
+var GUEST_LIMITS = { maxBytes: 50 * 1024 * 1024, maxFiles: 1000 };
+async function walk(root, skipped = () => {}) {
+  const realRoot = await realpath2(root);
+  let rules = [];
+  try {
+    rules = parseIgnore(await readFile4(join4(root, ".velvenignore"), "utf8"));
+  } catch {
+    rules = [];
+  }
+  const out = [];
+  async function visit(rel, chain) {
+    const entries = await readdir3(join4(root, rel), { withFileTypes: true });
+    entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    for (const entry of entries) {
+      if (alwaysLeftOut(entry.name))
+        continue;
+      const path = rel ? `${rel}/${entry.name}` : entry.name;
+      if (!servableSegment(entry.name)) {
+        skipped(path);
+        continue;
+      }
+      const abs = join4(root, path);
+      let isDir = entry.isDirectory();
+      let isFile = entry.isFile();
+      let real = join4(chain[chain.length - 1], entry.name);
+      if (entry.isSymbolicLink()) {
+        const target = await stat2(abs).catch(() => null);
+        const resolved = await realpath2(abs).catch(() => null);
+        if (!target || !resolved || !servableRelative(relative2(realRoot, resolved)) || chain.includes(resolved)) {
+          skipped(path);
+          continue;
+        }
+        real = resolved;
+        isDir = target.isDirectory();
+        isFile = target.isFile();
+      }
+      if (rules.some((rule) => rule(path, isDir)))
+        continue;
+      if (isDir)
+        await visit(path, [...chain, real]);
+      else if (isFile)
+        out.push({ path, abs, size: (await stat2(abs)).size });
+    }
+  }
+  await visit("", [realRoot]);
+  return out;
+}
+function formatSize(bytes) {
+  if (bytes >= 1024 * 1024)
+    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+  if (bytes >= 1024)
+    return `${Math.round(bytes / 1024)} KB`;
+  return `${bytes} bytes`;
+}
+function checkLimits(files, { maxBytes, maxFiles } = ACCOUNT_LIMITS) {
+  if (files.length === 0) {
+    throw new CliError("The folder has no files to publish.", EXIT.usage, "empty");
+  }
+  if (files.length > maxFiles) {
+    throw new CliError(`The folder has ${files.length} files; a version holds at most ${maxFiles}. Leave build leftovers out with a .velvenignore file.`, EXIT.refused, "too_many_files");
+  }
+  const total = files.reduce((sum, f) => sum + f.size, 0);
+  if (total > maxBytes) {
+    const largest = [...files].sort((a, b) => b.size - a.size).slice(0, 5).map((f) => `${f.path} (${formatSize(f.size)})`).join(", ");
+    throw new CliError(`The folder is ${formatSize(total)}; a version holds at most ${formatSize(maxBytes)}. The largest files: ${largest}.`, EXIT.refused, "too_large");
+  }
+}
+function hashFile(abs) {
+  return new Promise((resolve2, reject) => {
+    const hash = createHash("sha256");
+    createReadStream(abs).on("data", (chunk) => hash.update(chunk)).on("error", reject).on("end", () => resolve2(hash.digest("hex")));
+  });
+}
+async function eachLimit(items, limit, task) {
+  let next = 0;
+  async function worker() {
+    while (next < items.length) {
+      const item = items[next++];
+      await task(item);
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+}
+async function hashAll(files) {
+  await eachLimit(files, 8, async (file) => {
+    file.sha256 = await hashFile(file.abs);
+  });
+}
+
+// src/upload.ts
+import { readFile as readFile5 } from "node:fs/promises";
+var PARALLEL = 6;
+var ATTEMPTS = 4;
+function retryable(status) {
+  return status === null || status === 408 || status === 429 || status >= 500;
+}
+async function uploadMissing(ctx, base, targets, files, onDone) {
+  const byHash = new Map(files.map((f) => [f.sha256, f]));
+  await eachLimit(targets, PARALLEL, async (target) => {
+    const file = byHash.get(target.sha256);
+    if (!file)
+      throw new CliError(`Velven asked for a file this folder does not have (${target.sha256.slice(0, 12)}).`, EXIT.failed, "bad_response");
+    const body = await readFile5(file.abs);
+    const url = new URL(target.url, base).toString();
+    for (let attempt = 1;; attempt++) {
+      let status = null;
+      let detail = "";
+      try {
+        const response = await fetch(url, {
+          method: "PUT",
+          headers: { "content-type": "application/octet-stream", "user-agent": USER_AGENT },
+          body
+        });
+        status = response.status;
+        detail = (await response.text()).slice(0, 200);
+        if (response.ok) {
+          onDone(file);
+          return;
+        }
+      } catch (e) {
+        detail = e instanceof Error ? e.message : String(e);
+      }
+      if (!retryable(status) || attempt >= ATTEMPTS) {
+        const why = status === null ? `could not connect: ${detail}` : `HTTP ${status}`;
+        throw new CliError(`Uploading ${file.path} failed (${why}). Run velven publish again; files already sent are kept.`, EXIT.failed, "upload_failed");
+      }
+      await ctx.sleep(500 * 2 ** (attempt - 1));
+    }
+  });
+}
+
+// src/publish.ts
+var plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+var DONE = ["live", "refused", "unjudged", "replaced", "preview"];
+var POLL_MS = 3000;
+var WAIT_LIMIT_MS = 20 * 60 * 1000;
+function listingFields(config) {
+  const fields = { title: config.title, space_type: config.type, devices: config.devices };
+  for (const key of ["description", "engine", "ai_tools", "models", "how_made", "source_url"]) {
+    if (config[key] !== undefined)
+      fields[key] = config[key];
+  }
+  return fields;
+}
+var PASSED = ["entry", "spa", "sdk", "start", "toasts", "boards", "achievements", "stats"];
+async function folderOf(ctx, arg) {
+  const dir = resolve2(ctx.cwd, arg ?? ".");
+  const info = await stat3(dir).catch(() => null);
+  if (!info)
+    throw new CliError(`There is no folder at ${dir}.`, EXIT.usage, "usage");
+  if (!info.isDirectory()) {
+    const hint = /\.zip$/i.test(dir) ? " Unzip it and publish the folder, or upload the zip on velven.ai/add." : " Put it in a folder with an index.html and publish the folder.";
+    throw new CliError(`velven publish takes a folder, and ${dir} is a file.${hint}`, EXIT.usage, "usage");
+  }
+  return dir;
+}
+function spentClaim(error) {
+  return error instanceof CliError && error.code === "claim_spent" ? new CliError(error.message, EXIT.auth, error.code) : null;
+}
+function claimedMeanwhile(base, slug, versionId, when) {
+  return (error) => {
+    if (error instanceof CliError && error.code === "claim_spent") {
+      if (when === "finish")
+        throw new CliError("The page was claimed before this version was finished. Run velven login and publish again.", EXIT.auth, error.code);
+      const files = `${base}/s/${seg(slug)}/edit/files?version=${encodeURIComponent(versionId)}`;
+      throw new CliError(`The page was claimed. Follow the check on its Files tab: ${files}`, EXIT.auth, error.code);
+    }
+    throw error;
+  };
+}
+async function saveProject(ctx, project, values) {
+  try {
+    await updateProject(project, values);
+    return null;
+  } catch (e) {
+    const why = e instanceof Error && "code" in e && typeof e.code === "string" ? e.code : e instanceof Error ? e.message : String(e);
+    const set = Object.entries(values).filter(([, value]) => value !== undefined).map(([key, value]) => `"${key}": ${JSON.stringify(value)}`).join(", ");
+    const drop = Object.entries(values).filter(([, value]) => value === undefined).map(([key]) => ` in place of "${key}"`).join("");
+    const line = `Could not write ${project.path} (${why}). Put ${set} in velven.json${drop}, or the next publish from this folder makes another page.`;
+    ctx.err(line);
+    return line;
+  }
+}
+function claimLink(base, token) {
+  return `${base}/claim/${encodeURIComponent(token)}`;
+}
+async function publish(ctx, options) {
+  const say = options.json ? () => {} : (line) => ctx.out(line);
+  const dir = await folderOf(ctx, options.dir);
+  const base = apiBase(ctx);
+  const creds = await findToken(ctx, base);
+  const guest = !creds;
+  const project = await readProject(dir);
+  const merged = withFlags(project.data, options);
+  const shape = optionalProblems(merged);
+  if (shape.length)
+    throw new CliError(`velven.json has problems: ${shape.join("; ")}.`, EXIT.usage, "invalid_config");
+  let claim = typeof merged.claim === "string" ? merged.claim : undefined;
+  if (guest && options.prod) {
+    const page = claim ? await call({ base, claim }, "GET", "/api/v1/hosting/claim").catch((error) => {
+      const spent = spentClaim(error);
+      if (spent)
+        throw spent;
+      return null;
+    }) : null;
+    throw new CliError(claim ? `Sign in to publish to production: run velven login or open your claim link, ${claimLink(base, claim)}.${page ? ` Your unlisted page is ${page.pageUrl}.` : ""}` : "Sign in to publish to production: run velven login. Without an account, velven publish makes an unlisted page.", EXIT.auth, "sign_in_required");
+  }
+  const config = await completeRequired(ctx, project, merged, ctx.interactive && !options.json && !options.yes);
+  const api = { base, creds: creds ?? undefined, claim: guest ? claim : undefined };
+  const files = await walk(dir, (path) => ctx.err(`Left out ${path}: it is a link to a file or folder outside the folder or to one never published, or a name Velven never serves (ending in a dot or space, or holding ":" or "~").`));
+  checkLimits(files, guest ? GUEST_LIMITS : ACCOUNT_LIMITS);
+  const entry = typeof config.entry === "string" ? config.entry : "index.html";
+  if (!files.some((f) => f.path === entry)) {
+    throw new CliError(`The folder has no ${entry}. Add one, or name the page to open with "entry" in velven.json.`, EXIT.usage, "no_entry");
+  }
+  const terms = `${base.replace(/^https?:\/\//, "")}/terms`;
+  if (guest)
+    say(`By publishing you agree to Velven's Terms: ${terms}`);
+  const total = files.reduce((sum, f) => sum + f.size, 0);
+  say(`Publishing ${plural(files.length, "file")} (${formatSize(total)}) from ${dir}`);
+  await hashAll(files);
+  const body = {
+    fields: listingFields(config),
+    files: files.map((f) => ({ path: f.path, size: f.size, sha256: f.sha256 }))
+  };
+  if (typeof config.space === "string")
+    body.space = config.space;
+  if (claim)
+    body.claim = claim;
+  for (const key of PASSED)
+    if (config[key] !== undefined)
+      body[key] = config[key];
+  const created = await call(api, "POST", "/api/v1/hosting/versions", body).catch((error) => {
+    throw spentClaim(error) ?? error;
+  });
+  const slug = created.space.slug;
+  let notSaved = null;
+  if (guest) {
+    claim = created.claimToken ?? claim;
+    api.claim = claim;
+    if (claim && project.data.claim !== claim)
+      notSaved = await saveProject(ctx, project, { claim });
+  } else if (claim) {
+    notSaved = await saveProject(ctx, project, { claim: undefined, space: slug });
+    say(`Claimed ${slug}: it is yours and on Velven now.`);
+  } else if (project.data.space !== slug) {
+    notSaved = await saveProject(ctx, project, { space: slug });
+    if (!notSaved)
+      say(`Saved "space": "${slug}" in velven.json; later publishes update this space.`);
+  }
+  const unique = new Set(files.map((f) => f.sha256)).size;
+  const sending = files.filter((f) => created.uploads.some((u) => u.sha256 === f.sha256));
+  const bytes = [...new Map(sending.map((f) => [f.sha256, f.size])).values()].reduce((a, b) => a + b, 0);
+  if (created.uploads.length) {
+    say(`Uploading ${created.uploads.length} of ${plural(unique, "file")} (${formatSize(bytes)}); the rest are already on Velven.`);
+  } else
+    say("Every file is already on Velven; nothing to upload.");
+  await uploadMissing(ctx, base, created.uploads, files, () => {});
+  const versionPath = `/api/v1/hosting/versions/${seg(created.version.id)}`;
+  const finished = await call(api, "POST", `${versionPath}/finish`, {
+    preview: !options.prod,
+    ...guest && claim ? { claim } : {}
+  }).catch(claimedMeanwhile(base, slug, created.version.id, "finish"));
+  const result = {
+    ok: true,
+    space: created.space,
+    version: created.version,
+    status: finished.status,
+    watchUrl: finished.watchUrl,
+    previewUrl: finished.previewUrl,
+    uploaded: created.uploads.length,
+    reused: unique - created.uploads.length,
+    ...notSaved ? { notSaved } : {}
+  };
+  const number = created.version.number;
+  if (guest) {
+    const pageUrl = created.pageUrl ?? created.space.url;
+    const claimUrl = claim ? claimLink(base, claim) : undefined;
+    Object.assign(result, { pageUrl, claimToken: claim, claimUrl, expiresAt: created.expiresAt, terms });
+    say(`Published version ${number} of an unlisted page: ${pageUrl}`);
+    say("It goes live once it passes Velven's check, and stays unlisted until you claim it.");
+    if (claim) {
+      say(notSaved ? `Claim token: ${claim} (velven.json could not be written: put it there as "claim", so publishing again from this folder updates the same page)` : `Claim token: ${claim} (saved in velven.json as "claim"; publishing again from this folder updates the same page)`);
+      say(`Claim it: ${claimUrl}, or run velven login and publish again.`);
+    }
+    const expires = created.expiresAt ? ` (${created.expiresAt.slice(0, 10)})` : "";
+    say(`Unclaimed pages are deleted 7 days after the first publish${expires}.`);
+  }
+  let status = { status: finished.status, previewUrl: finished.previewUrl };
+  if (!DONE.includes(finished.status)) {
+    if (guest)
+      say(`Follow the check: ${finished.watchUrl}`);
+    else if (options.prod) {
+      say(`Publishing version ${number} of ${slug} to production. Velven checks it before it goes live.`);
+      say(`Follow the check: ${finished.watchUrl}`);
+    } else
+      say(`Preparing a preview of ${slug} (version ${number}). Follow it: ${finished.watchUrl}`);
+    if (!options.wait) {
+      say(`Run with --wait to wait here for ${options.prod || guest ? "the verdict" : "the preview link"}.`);
+      if (options.json)
+        ctx.out(JSON.stringify(result));
+      return EXIT.ok;
+    }
+    say("Waiting...");
+    status = await waitForVerdict(ctx, api, versionPath).catch(claimedMeanwhile(base, slug, created.version.id, "check"));
+  }
+  Object.assign(result, {
+    status: status.status,
+    reason: status.reason,
+    shownOnTake: status.shownOnTake,
+    pageUrl: status.pageUrl ?? result.pageUrl,
+    previewUrl: status.previewUrl ?? finished.previewUrl
+  });
+  const code = report(say, slug, number, { ...status, previewUrl: status.previewUrl ?? finished.previewUrl }, finished.watchUrl);
+  if (code !== EXIT.ok)
+    result.ok = false;
+  if (options.json)
+    ctx.out(JSON.stringify(result));
+  return code;
+}
+async function waitForVerdict(ctx, api, versionPath) {
+  const deadline = Date.now() + WAIT_LIMIT_MS;
+  let failures = 0;
+  while (Date.now() < deadline) {
+    await ctx.sleep(POLL_MS);
+    let status;
+    try {
+      status = await call(api, "GET", versionPath);
+      failures = 0;
+    } catch (e) {
+      if (e instanceof CliError && e.exitCode === EXIT.failed && ++failures < 5)
+        continue;
+      throw e;
+    }
+    if (DONE.includes(status.status))
+      return status;
+    if (status.stopped)
+      throw new CliError("The check ended before it finished, because the space was hidden, held or moved, or its checks are over the hourly limit. Publish again to check it.", EXIT.failed, "check_stopped");
+  }
+  throw new CliError("The check is still running after 20 minutes. Follow it on the watch link.", EXIT.failed, "wait_timeout");
+}
+function sentence(text) {
+  const clean = text.trim().replace(/^the (recording|take|video) (showed|shows)[:,]?\s*/i, "").replace(/[\s.]+$/, "");
+  const closed = /[!?]$/.test(clean) ? clean : `${clean}.`;
+  return closed.charAt(0).toUpperCase() + closed.slice(1);
+}
+function report(say, slug, number, status, watchUrl) {
+  const label = `Version ${number} of ${slug}`;
+  switch (status.status) {
+    case "preview":
+      say(`Published a preview of ${slug} (version ${number}): ${status.previewUrl ?? watchUrl}. Run velven publish --prod to make it live.`);
+      say("The preview link works for 24 hours. Scores and saves made there go to the sandbox.");
+      return EXIT.ok;
+    case "live":
+      say(`${label} is live: ${status.pageUrl ?? watchUrl}`);
+      return EXIT.ok;
+    case "replaced":
+      say(`${label} was replaced before its check finished: a newer version was published, or the space moved to another address.`);
+      return EXIT.ok;
+    case "refused":
+      say(`${label} was refused. ${sentence(status.reason ?? "It did not pass the safety check")}`);
+      if (status.shownOnTake)
+        say(`The take showed: ${sentence(status.shownOnTake)}`);
+      say(`If you think that is wrong, open ${watchUrl} and press Ask for review.`);
+      return EXIT.notLive;
+    default:
+      say(`Velven could not judge version ${number} of ${slug}. The take showed: ${sentence(status.shownOnTake ?? status.reason ?? "Nothing it could judge")}`);
+      say('If it needs a click or a key to start, add a start hint to velven.json, like "start": { "click": "Play" } or "start": { "key": "Space" }, and publish again.');
+      say(`Or open ${watchUrl} and press Ask for review.`);
+      return EXIT.notLive;
+  }
+}
+
+// src/space.ts
+async function spaceSlug(ctx, flag) {
+  if (flag)
+    return flag;
+  const { data } = await readProject(ctx.cwd);
+  if (typeof data.space === "string" && data.space)
+    return data.space;
+  throw new CliError("No space named here. Run this in a folder you have published (its velven.json names the space), or pass --space <slug>.", EXIT.usage, "no_space");
+}
+async function signedIn(ctx) {
+  const base = apiBase(ctx);
+  return { base, creds: await requireToken(ctx, base) };
+}
+async function listVersions(api, slug) {
+  const answer = await call(api, "GET", `/api/v1/hosting/spaces/${seg(slug)}/versions`);
+  return Array.isArray(answer) ? answer : answer.versions;
+}
+function when(iso) {
+  if (!iso)
+    return "";
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime()) ? iso : d.toISOString().slice(0, 16).replace("T", " ") + " UTC";
+}
+function printVersions(ctx, rows) {
+  for (const v of rows) {
+    const live = v.live || v.status === "live" ? "*" : " ";
+    const size = v.files !== undefined ? `${v.files} files${v.size !== undefined ? `, ${formatSize(v.size)}` : ""}` : "";
+    const cols = [`${live} ${String(v.number).padStart(3)}`, v.status.padEnd(9), when(v.createdAt).padEnd(20), size];
+    ctx.out(cols.join("  ").trimEnd());
+    if (v.reason && v.status !== "live")
+      ctx.out(`        ${v.reason}`);
+  }
+}
+async function versions(ctx, spaceFlag, json) {
+  const api = await signedIn(ctx);
+  const slug = await spaceSlug(ctx, spaceFlag);
+  const rows = await listVersions(api, slug);
+  if (json) {
+    ctx.out(JSON.stringify({ ok: true, space: slug, versions: rows }));
+    return EXIT.ok;
+  }
+  if (rows.length === 0) {
+    ctx.out(`${slug} has no versions yet. Publish one with velven publish.`);
+    return EXIT.ok;
+  }
+  ctx.out(`Versions of ${slug} (* is live):`);
+  printVersions(ctx, rows);
+  return EXIT.ok;
+}
+function versionNumber(raw) {
+  const m = raw.trim().match(/^v?(\d+)$/i);
+  if (!m)
+    throw new CliError(`"${raw}" is not a version number, like 3.`, EXIT.usage, "usage");
+  return Number(m[1]);
+}
+async function rollback(ctx, arg, spaceFlag) {
+  const api = await signedIn(ctx);
+  const slug = await spaceSlug(ctx, spaceFlag);
+  let number;
+  if (arg)
+    number = versionNumber(arg);
+  else {
+    if (!ctx.interactive)
+      throw new CliError("Name the version to go back to, like velven rollback 3.", EXIT.usage, "usage");
+    const rows = await listVersions(api, slug);
+    if (rows.length < 2) {
+      ctx.out(`${slug} has no earlier version to go back to.`);
+      return EXIT.ok;
+    }
+    ctx.out(`Versions of ${slug} (* is live):`);
+    printVersions(ctx, rows);
+    number = versionNumber(await ctx.ask("Which version should go live? "));
+  }
+  const answer = await call(api, "POST", `/api/v1/hosting/spaces/${seg(slug)}/rollback`, { version: number });
+  ctx.out(`Version ${answer.version?.number ?? number} of ${slug} is live again${answer.pageUrl ? `: ${answer.pageUrl}` : "."}`);
+  return EXIT.ok;
+}
+var RESET_CATEGORIES = ["scores", "saves", "achievements", "content", "rooms"];
+async function reset(ctx, options) {
+  const api = await signedIn(ctx);
+  const slug = await spaceSlug(ctx, options.space);
+  const categories = options.categories.length ? options.categories : [...RESET_CATEGORIES];
+  const player = options.player?.replace(/^@/, "");
+  const what = `the sandbox ${categories.join(", ")} of ${slug}${player ? ` for @${player}` : ""}`;
+  if (!options.yes) {
+    if (!ctx.interactive)
+      throw new CliError(`This deletes ${what}. Add --yes to confirm.`, EXIT.usage, "confirm");
+    ctx.out(`This deletes ${what}: the test data from previews and velven dev. Live players' data is not touched.`);
+    const answer2 = (await ctx.ask("Delete it? (y/N) ")).trim().toLowerCase();
+    if (answer2 !== "y" && answer2 !== "yes") {
+      ctx.out("Nothing was deleted.");
+      return EXIT.failed;
+    }
+  }
+  const body = { categories };
+  if (player)
+    body.player = player;
+  const answer = await call(api, "POST", `/api/v1/hosting/spaces/${seg(slug)}/reset`, body);
+  const counts = answer.deleted ? Object.entries(answer.deleted).map(([k, n]) => `${n} ${k}`) : [];
+  ctx.out(`Deleted ${what}${counts.length ? ` (${counts.join(", ")})` : ""}.`);
+  return EXIT.ok;
+}
+
+// src/cli.ts
+var HELP = `velven ${VERSION}: publish a folder to Velven.
+
+Usage:
+  velven login                Sign in (opens the browser to approve a code)
+  velven logout               Forget this computer's sign-in
+  velven whoami [--json]      Show who you are signed in as
+  velven publish [dir]        Upload a folder as a private preview (the link is printed)
+      --prod                  Go live on its Velven page once Velven's safety check passes
+                              (not signed in: an unlisted page with a claim token, no --prod)
+      --wait                  Wait for the preview link, or with --prod for the check's verdict
+      --title <text>          Override velven.json for this run
+      --type <type>           game, world, tool or wonder
+      --devices <list>        desktop, mobile, vr (comma separated)
+      --description <text>
+      --engine <engine>
+      --yes, -y               Never ask; fail when a field is missing
+      --json                  Print one JSON object (for scripts and agents)
+  velven versions [--json]    List the space's versions (* is live)
+  velven rollback [version]   Put an earlier version live again
+  velven reset                Delete the space's sandbox data (from previews and velven dev)
+      --scores --saves --achievements --content --rooms   Only these (default: all)
+      --player <handle>       Only this player's
+      --yes, -y               Do not ask to confirm
+  velven dev [dir]            Serve a folder locally and play it on Velven, in the sandbox
+      --port <n>              Port to serve on (default: a free one)
+
+  versions, rollback and reset act on the space velven.json names; --space <slug> picks another.
+
+Environment:
+  VELVEN_TOKEN   A token to use instead of the saved sign-in (for CI)
+  VELVEN_API     The Velven to talk to (default https://velven.ai)
+
+Exit codes:
+  0 done   1 failed (network, server, cancelled)   2 bad command or velven.json
+  3 needs sign-in (or the token was refused)   4 refused by Velven (not the owner, too large, not found)
+  5 rate limited, try later   6 with --wait: refused or not judged by the safety check`;
+var COMMANDS = {
+  login: { flags: {}, run: (ctx) => login(ctx) },
+  logout: { flags: {}, run: (ctx) => logout(ctx) },
+  whoami: { flags: { json: "boolean" }, run: (ctx, p) => whoami(ctx, p.flags.json === true) },
+  publish: {
+    flags: {
+      prod: "boolean",
+      wait: "boolean",
+      yes: "boolean",
+      json: "boolean",
+      title: "string",
+      type: "string",
+      devices: "string",
+      description: "string",
+      engine: "string"
+    },
+    run: (ctx, p) => publish(ctx, {
+      dir: p.positionals[0],
+      prod: p.flags.prod === true,
+      wait: p.flags.wait === true,
+      yes: p.flags.yes === true,
+      json: p.flags.json === true,
+      title: stringFlag(p, "title"),
+      type: stringFlag(p, "type"),
+      devices: stringFlag(p, "devices"),
+      description: stringFlag(p, "description"),
+      engine: stringFlag(p, "engine")
+    })
+  },
+  versions: {
+    flags: { json: "boolean", space: "string" },
+    run: (ctx, p) => versions(ctx, stringFlag(p, "space"), p.flags.json === true)
+  },
+  rollback: { flags: { space: "string" }, run: (ctx, p) => rollback(ctx, p.positionals[0], stringFlag(p, "space")) },
+  reset: {
+    flags: { space: "string", player: "string", yes: "boolean", ...Object.fromEntries(RESET_CATEGORIES.map((c) => [c, "boolean"])) },
+    run: (ctx, p) => reset(ctx, {
+      categories: RESET_CATEGORIES.filter((c) => p.flags[c] === true),
+      player: stringFlag(p, "player"),
+      space: stringFlag(p, "space"),
+      yes: p.flags.yes === true
+    })
+  },
+  dev: { flags: { port: "string" }, run: (ctx, p) => dev(ctx, p.positionals[0], stringFlag(p, "port")) }
+};
+async function run(argv, ctx) {
+  const [name, ...rest] = argv;
+  if (!name || name === "help" || name === "--help" || name === "-h") {
+    ctx.out(HELP);
+    return EXIT.ok;
+  }
+  if (name === "--version" || name === "-v" || name === "version") {
+    ctx.out(VERSION);
+    return EXIT.ok;
+  }
+  const command = COMMANDS[name];
+  if (!command) {
+    ctx.err(`Unknown command "${name}". Run velven help to see the commands.`);
+    return EXIT.usage;
+  }
+  const json = rest.includes("--json");
+  try {
+    const parsed = parseArgs(rest, command.flags);
+    if (parsed.flags.help) {
+      ctx.out(HELP);
+      return EXIT.ok;
+    }
+    return await command.run(ctx, parsed);
+  } catch (e) {
+    const error = e instanceof CliError ? e : e instanceof Cancelled ? new CliError("Cancelled.", EXIT.failed, "cancelled") : new CliError(`Something went wrong: ${e instanceof Error ? e.message : String(e)}`, EXIT.failed, "internal");
+    if (json)
+      ctx.out(JSON.stringify({ ok: false, error: error.message, code: error.code, ...error.fields ? { fields: error.fields } : {} }));
+    else
+      ctx.err(error.message);
+    return error.exitCode;
+  }
+}
+
+// src/bin.ts
+process.exitCode = await run(process.argv.slice(2), nodeContext());