@velven/cli 0.2.1 → 0.3.0

package/dist/velven.js

@@ -23,7 +23,7 @@ class CliError extends Error {
   }
 }
 // package.json
-var version = "0.2.1";
+var version = "0.3.0";
 
 // src/version.ts
 var VERSION = version;
@@ -64,14 +64,21 @@ function errorFromResponse(status, body, path, creds, retryAfter) {
   }
   return new CliError(sentence ?? `Unexpected answer from Velven (HTTP ${status}).`, EXIT.failed, code);
 }
-async function call(api, method, path, body) {
-  const headers = { accept: "application/json", "user-agent": USER_AGENT };
-  if (body !== undefined)
-    headers["content-type"] = "application/json";
+function requestHeaders(api, accept) {
+  const headers = { ...api.headers, accept, "user-agent": USER_AGENT };
   if (api.creds)
     headers.authorization = `Bearer ${api.creds.token}`;
   if (api.claim)
     headers["x-velven-claim"] = api.claim;
+  return headers;
+}
+function causeOf(e) {
+  return e instanceof Error && e.cause instanceof Error ? e.cause.message : e instanceof Error ? e.message : String(e);
+}
+async function call(api, method, path, body) {
+  const headers = requestHeaders(api, "application/json");
+  if (body !== undefined)
+    headers["content-type"] = "application/json";
   let response;
   try {
     response = await fetch(`${api.base}${path}`, {
@@ -80,8 +87,7 @@ async function call(api, method, path, body) {
       body: body === undefined ? undefined : JSON.stringify(body)
     });
   } catch (e) {
-    const cause = e instanceof Error && e.cause instanceof Error ? e.cause.message : e instanceof Error ? e.message : String(e);
-    throw new CliError(`Could not reach Velven at ${api.base} (${cause}).`, EXIT.failed, "network");
+    throw new CliError(`Could not reach Velven at ${api.base} (${causeOf(e)}).`, EXIT.failed, "network");
   }
   const text = await response.text();
   let parsed = null;
@@ -101,6 +107,138 @@ async function call(api, method, path, body) {
 function seg(value) {
   return encodeURIComponent(String(value));
 }
+var STREAM_FAILURES = 5;
+var BACKOFF_MS = [1000, 2000, 4000, 8000];
+var BRIEF_MS = 5000;
+var ENDED_PAUSE_MS = 1500;
+async function stream(api, path, options, onEvent) {
+  const seen = new Set;
+  const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const stopped = new Promise((resolve) => options.signal?.addEventListener("abort", () => resolve(), { once: true }));
+  let lastId = null;
+  let failures = 0;
+  async function connect() {
+    let got = false;
+    const connectionKeys = new Set;
+    const url = options.from !== undefined && lastId === null ? `${path}${path.includes("?") ? "&" : "?"}from=${options.from}` : path;
+    const headers = requestHeaders(api, "text/event-stream");
+    if (lastId !== null)
+      headers["last-event-id"] = lastId;
+    let response;
+    try {
+      response = await fetch(`${api.base}${url}`, { headers, signal: options.signal });
+    } catch (e) {
+      if (options.signal?.aborted)
+        return { aborted: true };
+      return { failed: `Could not reach Velven at ${api.base} (${causeOf(e)}).` };
+    }
+    if (!response.ok) {
+      const text = await response.text().catch(() => "");
+      let parsed = null;
+      try {
+        parsed = text ? JSON.parse(text) : null;
+      } catch {
+        parsed = null;
+      }
+      const error = errorFromResponse(response.status, parsed, path, api.creds, response.headers.get("retry-after"));
+      if (response.status >= 500)
+        return { failed: error.message };
+      throw error;
+    }
+    if (!response.body || !(response.headers.get("content-type") ?? "").includes("text/event-stream")) {
+      await response.body?.cancel().catch(() => {});
+      throw new CliError(`Velven answered ${path} with something other than a stream.`, EXIT.failed, "bad_response");
+    }
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder;
+    let pending = "";
+    let id = null;
+    let data = [];
+    try {
+      for (;; ) {
+        const { done, value } = await reader.read();
+        if (done)
+          break;
+        const text = pending + decoder.decode(value, { stream: true });
+        const cut = text.endsWith("\r") ? text.length - 1 : text.length;
+        const lines = text.slice(0, cut).split(/\r\n|\r|\n/);
+        pending = (lines.pop() ?? "") + text.slice(cut);
+        for (const line of lines) {
+          if (line.startsWith(":")) {
+            got = true;
+            failures = 0;
+            continue;
+          }
+          if (line !== "") {
+            const colon = line.indexOf(":");
+            const field = colon === -1 ? line : line.slice(0, colon);
+            const value2 = colon === -1 ? "" : line.slice(colon + 1).replace(/^ /, "");
+            if (field === "id")
+              id = value2;
+            else if (field === "data")
+              data.push(value2);
+            continue;
+          }
+          const frameId = id;
+          const frame = data.join(`
+`);
+          id = null;
+          data = [];
+          if (!frame)
+            continue;
+          got = true;
+          failures = 0;
+          if (frameId !== null)
+            lastId = frameId;
+          let event;
+          try {
+            event = JSON.parse(frame);
+          } catch {
+            continue;
+          }
+          if (!event || typeof event !== "object" || typeof event.type !== "string")
+            continue;
+          if (typeof event.key === "string") {
+            const keys = frameId !== null ? seen : connectionKeys;
+            if (keys.has(event.key))
+              continue;
+            keys.add(event.key);
+          }
+          if (onEvent(event))
+            return { final: event };
+        }
+      }
+    } catch (e) {
+      if (options.signal?.aborted)
+        return { aborted: true };
+      if (!got)
+        return { failed: `The connection to Velven dropped (${causeOf(e)}).` };
+    } finally {
+      reader.cancel().catch(() => {});
+    }
+    return got ? { ended: true } : { failed: "Velven ended the connection without sending anything." };
+  }
+  for (;; ) {
+    if (options.signal?.aborted)
+      return null;
+    const began = Date.now();
+    const outcome = await connect();
+    if ("final" in outcome)
+      return outcome.final;
+    if ("aborted" in outcome)
+      return null;
+    if ("ended" in outcome) {
+      if (Date.now() - began < BRIEF_MS)
+        await Promise.race([sleep(ENDED_PAUSE_MS), stopped]);
+      continue;
+    }
+    failures += 1;
+    if (failures >= STREAM_FAILURES) {
+      throw new CliError(`Lost the connection to Velven ${failures} times in a row. ${outcome.failed}`, EXIT.failed, "stream_lost");
+    }
+    await Promise.race([sleep(BACKOFF_MS[failures - 1] ?? BACKOFF_MS[BACKOFF_MS.length - 1]), stopped]);
+  }
+}
 
 // src/auth.ts
 import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
@@ -329,439 +467,971 @@ function nodeContext() {
   };
 }
 
-// src/dev.ts
-import { readdir as readdir2, readFile as readFile3, realpath, stat } from "node:fs/promises";
-import { createServer } from "node:http";
-import { extname, join as join3, relative, resolve, sep } from "node:path";
+// src/create-state.ts
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname2, join as join2 } from "node:path";
+function createStatePath(ctx) {
+  return join2(ctx.home, ".config", "velven", "create.json");
+}
+async function readCreateFile(ctx) {
+  let text;
+  try {
+    text = await readFile2(createStatePath(ctx), "utf8");
+  } catch {
+    return { apis: {} };
+  }
+  try {
+    const parsed = JSON.parse(text);
+    return { apis: parsed.apis && typeof parsed.apis === "object" ? parsed.apis : {} };
+  } catch {
+    return { apis: {} };
+  }
+}
+async function readCreateState(ctx, api) {
+  const state = (await readCreateFile(ctx)).apis[api] ?? {};
+  return {
+    ...typeof state.project === "string" && state.project ? { project: state.project } : {},
+    ...Number.isInteger(state.turn) ? { turn: state.turn } : {}
+  };
+}
+async function saveCreateState(ctx, api, patch) {
+  const file = await readCreateFile(ctx);
+  const next = { ...file.apis[api], ...patch };
+  if (next.turn === undefined)
+    delete next.turn;
+  file.apis[api] = next;
+  const path = createStatePath(ctx);
+  await mkdir2(dirname2(path), { recursive: true, mode: 448 });
+  await writeFile2(path, `${JSON.stringify(file, null, 2)}
+`, { mode: 384 });
+  await chmod2(path, 384);
+}
 
-// src/ignore.ts
-function globToRegExp(glob) {
-  let re = "";
-  for (let i = 0;i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "*" && glob[i + 1] === "*") {
-      if (glob[i + 2] === "/") {
-        re += "(?:.*/)?";
-        i += 2;
-      } else {
-        re += ".*";
-        i += 1;
-      }
-    } else if (c === "*")
-      re += "[^/]*";
-    else if (c === "?")
-      re += "[^/]";
-    else
-      re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+// src/create-timeline.ts
+var BAR_WIDTH = 60;
+var FOLD_OVER = 20;
+var LABEL_MAX = 44;
+var CHAIN_SLACK_MS = 50;
+var PHASE_ORDER = ["workspace", "planning", "coding", "building", "playtesting", "reviewing", "fixing", "saving", "previewing", "replying", "settle"];
+var plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+function seconds(ms) {
+  return `${(ms / 1000).toFixed(1)} s`;
+}
+function duration(ms) {
+  if (ms < 1000)
+    return `${Math.round(ms)} ms`;
+  if (ms < 60000)
+    return seconds(ms);
+  const total = Math.round(ms / 1000);
+  return `${Math.floor(total / 60)} min ${total % 60} s`;
+}
+function size(bytes) {
+  if (bytes < 1024)
+    return `${bytes} B`;
+  if (bytes < 1024 * 1024)
+    return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+var count = (n) => n.toLocaleString("en-US");
+var usd = (micros) => `$${(micros / 1e6).toFixed(micros < 1e7 ? 4 : 2)}`;
+var num = (v) => typeof v === "number" && Number.isFinite(v) ? v : null;
+var QUIET_ATTRS = new Set(["response_id", "finish", "source", "kind", "label", "tool"]);
+var MODEL_QUIET = ["job", "model", "generation_id"];
+var MODEL_FIGURES = ["ttft_ms", "generation_ms", "cost_micros", "reasoning", "tool_calls"];
+function spanFacts(span) {
+  const a = span.attrs ?? {};
+  const out = [];
+  const done = new Set(QUIET_ATTRS);
+  const words = {
+    from: (v) => `from ${v}`,
+    files: (v) => plural(Number(v), "file"),
+    bytes: (v) => size(Number(v)),
+    held: (v) => `${v} held`,
+    bundle_bytes: (v) => `bundle ${size(Number(v))}`,
+    clip_bytes: (v) => `clip ${size(Number(v))}`,
+    blobs: (v) => plural(Number(v), "blob"),
+    commits: (v) => plural(Number(v), "commit"),
+    steps: (v) => plural(Number(v), "model step"),
+    tools: (v) => plural(Number(v), "tool call"),
+    tool_calls: (v) => plural(Number(v), "tool call"),
+    images: (v) => plural(Number(v), "image"),
+    shots: (v) => plural(Number(v), "screenshot"),
+    polls: (v) => plural(Number(v), "poll"),
+    calls: (v) => plural(Number(v), "call"),
+    cut: (v) => v === true ? "cut short" : null,
+    cached_hit: (v) => v === true ? "from the cache" : null,
+    first_build: (v) => v === true ? "first build" : null,
+    ttft_ms: (v) => `ttft ${duration(Number(v))}`,
+    generation_ms: (v) => `generation ${duration(Number(v))}`,
+    model_ms: (v) => `model ${duration(Number(v))}`,
+    cost_micros: (v) => usd(Number(v)),
+    wait_s: (v) => `waited ${v} s`,
+    fps_median: (v) => `${v} fps`,
+    memory_mb: (v) => `${v} MB memory`,
+    clocks: (v) => Number(v) > 1 ? "across two clocks" : null,
+    reasoning: (v) => Number(v) > 0 ? `reasoning ${count(Number(v))}` : null
+  };
+  if (span.kind === "model") {
+    const input = (num(a.input) ?? 0) + (num(a.cached) ?? 0);
+    if (num(a.input) !== null || num(a.cached) !== null) {
+      const parts = [num(a.cached) ? `${count(num(a.cached) ?? 0)} cached` : "", num(a.cache_write) ? `${count(num(a.cache_write) ?? 0)} written` : ""].filter(Boolean);
+      out.push(`in ${count(input)}${parts.length ? ` (${parts.join(", ")})` : ""}`);
+    }
+    if (num(a.output) !== null)
+      out.push(`out ${count(num(a.output) ?? 0)}`);
+    for (const key of ["input", "cached", "cache_write", "output", ...MODEL_QUIET])
+      done.add(key);
+    for (const key of MODEL_FIGURES) {
+      const value = a[key];
+      done.add(key);
+      const text = value === null || value === undefined ? null : words[key](value);
+      if (text)
+        out.push(text);
+    }
   }
-  return new RegExp(`^${re}$`);
+  if (span.attempt !== undefined && span.attempt > 1)
+    out.push(`attempt ${span.attempt}`);
+  for (const [key, value] of Object.entries(a)) {
+    if (done.has(key) || value === null)
+      continue;
+    const say = words[key];
+    const text = say ? say(value) : typeof value === "number" && key.endsWith("_ms") ? `${key.slice(0, -3).replace(/_/g, " ")} ${duration(value)}` : `${key.replace(/_/g, " ")} ${value}`;
+    if (text)
+      out.push(text);
+  }
+  const line = out.join(", ");
+  return line.length > 120 ? `${line.slice(0, 117)}...` : line;
+}
+function treeOf(spans) {
+  const ids = new Set(spans.map((s) => s.id));
+  const roots = [];
+  const children = new Map;
+  for (const span of spans) {
+    if (span.parent !== null && span.parent !== span.id && ids.has(span.parent)) {
+      const list = children.get(span.parent) ?? [];
+      list.push(span);
+      children.set(span.parent, list);
+    } else {
+      roots.push(span);
+    }
+  }
+  const byStart = (list) => list.sort((a, b) => a.start - b.start);
+  byStart(roots);
+  for (const list of children.values())
+    byStart(list);
+  return { roots, children };
+}
+var endOf = (s) => s.start + s.ms;
+function chainTree(spans) {
+  const tree = treeOf(spans);
+  const phases = tree.roots.filter((s) => s.kind === "phase");
+  const children = new Map(tree.children);
+  const begins = new Map;
+  const roots = [];
+  for (const span of tree.roots) {
+    const end = endOf(span);
+    const into = span.kind === "phase" ? undefined : phases.find((p) => p.start > span.start && p.start < end && end <= endOf(p) + CHAIN_SLACK_MS);
+    if (!into) {
+      roots.push(span);
+      continue;
+    }
+    children.set(into.id, [...children.get(into.id) ?? [], span].sort((a, b) => a.start - b.start));
+    begins.set(into.id, Math.min(begins.get(into.id) ?? into.start, span.start));
+  }
+  const byId = new Map(spans.map((s) => [s.id, s]));
+  const parentOf = new Map;
+  for (const [id, kids] of children) {
+    const parent = byId.get(id);
+    if (parent)
+      for (const kid of kids)
+        parentOf.set(kid.id, parent);
+  }
+  return { roots, children, parentOf, startOf: (s) => begins.get(s.id) ?? s.start };
+}
+function chainOf(siblings, startOf) {
+  const chain = [];
+  const left = new Set(siblings);
+  let bound = Number.POSITIVE_INFINITY;
+  const extent = (s) => endOf(s) - startOf(s);
+  for (;; ) {
+    let pick = null;
+    for (const s of left) {
+      if (startOf(s) >= bound || endOf(s) > bound + CHAIN_SLACK_MS)
+        continue;
+      if (!pick || endOf(s) > endOf(pick) || endOf(s) === endOf(pick) && extent(s) > extent(pick))
+        pick = s;
+    }
+    if (!pick)
+      return chain;
+    chain.push(pick);
+    left.delete(pick);
+    bound = startOf(pick);
+  }
+}
+function criticalPath(spans) {
+  const { roots, children, startOf } = chainTree(spans);
+  const marked = new Set;
+  const walk = (siblings) => {
+    for (const span of chainOf(siblings, startOf)) {
+      if (marked.has(span.id))
+        continue;
+      marked.add(span.id);
+      walk(children.get(span.id) ?? []);
+    }
+  };
+  walk(roots);
+  return marked;
+}
+var isShot = (s) => s.name === "shot" || s.name.startsWith("shot ") || s.name.startsWith("shot.");
+function foldRow(spans, what, depth, critical) {
+  const names = new Map;
+  for (const s of spans)
+    names.set(s.name, (names.get(s.name) ?? 0) + 1);
+  const top = [...names.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]));
+  const shown = top.slice(0, 4).map(([name, n]) => `${name} ${n}`);
+  const more = top.length > 4 ? `, ${plural(top.length - 4, "other")}` : "";
+  const start = Math.min(...spans.map((s) => s.start));
+  return {
+    label: `${"  ".repeat(depth)}${plural(spans.length, what)}`,
+    start,
+    end: Math.max(...spans.map(endOf)),
+    ms: spans.reduce((sum, s) => sum + s.ms, 0),
+    critical: spans.some((s) => critical.has(s.id)),
+    facts: `${shown.join(", ")}${more}; --all lists each`
+  };
 }
-function parseIgnore(text) {
-  const rules = [];
-  for (const raw of text.split(/\r?\n/)) {
-    let line = raw.trim();
-    if (!line || line.startsWith("#") || line.startsWith("!"))
+function bar(row, total) {
+  const scale = total > 0 ? BAR_WIDTH / total : 0;
+  const a = Math.min(BAR_WIDTH - 1, Math.max(0, Math.floor(row.start * scale)));
+  const b = Math.min(BAR_WIDTH, Math.max(a + 1, Math.ceil(row.end * scale)));
+  return `|${" ".repeat(a)}${"#".repeat(b - a)}${" ".repeat(BAR_WIDTH - b)}|`;
+}
+function renderTimeline(turn, spans, options = {}) {
+  const kind = `${turn.effort} ${turn.plan ? "plan turn" : isFirstBuild(spans) ? "first build" : "build turn"}`;
+  if (spans.length === 0) {
+    const why = turn.status === "queued" || turn.status === "running" ? " A turn's timeline is written when it ends." : "";
+    return [`Turn ${turn.id}, a ${kind}, ${turn.status}: no timeline.${why}`];
+  }
+  const spanEnd = Math.max(...spans.map(endOf));
+  const total = Math.max(spanEnd, turn.timing?.total_ms ?? 0);
+  const critical = criticalPath(spans);
+  const { roots, children } = treeOf(spans);
+  const rows = [];
+  const seen = new Set;
+  const visit = (span, depth) => {
+    if (seen.has(span.id))
+      return;
+    seen.add(span.id);
+    const flags = `${span.ok ? "" : " (failed)"}`;
+    rows.push({ label: `${"  ".repeat(depth)}${span.name}${flags}`, start: span.start, end: endOf(span), ms: span.ms, critical: critical.has(span.id), facts: spanFacts(span) });
+    const kids = children.get(span.id) ?? [];
+    const tools = kids.filter((k) => k.kind === "tool");
+    const shots = kids.filter(isShot);
+    const foldTools = !options.all && tools.length > FOLD_OVER;
+    const foldShots = !options.all && shots.length > FOLD_OVER;
+    let toolsDone = false;
+    let shotsDone = false;
+    for (const kid of kids) {
+      if (foldTools && kid.kind === "tool") {
+        if (!toolsDone)
+          rows.push(foldRow(tools, "tool call", depth + 1, critical));
+        toolsDone = true;
+        seen.add(kid.id);
+        continue;
+      }
+      if (foldShots && isShot(kid)) {
+        if (!shotsDone)
+          rows.push(foldRow(shots, "screenshot", depth + 1, critical));
+        shotsDone = true;
+        seen.add(kid.id);
+        continue;
+      }
+      visit(kid, depth + 1);
+    }
+  };
+  for (const root of roots)
+    visit(root, 0);
+  for (const span of spans)
+    if (!seen.has(span.id))
+      visit(span, 0);
+  const cut = (label) => label.length > LABEL_MAX ? `${label.slice(0, LABEL_MAX - 3)}...` : label;
+  const width = Math.max(...rows.map((r) => cut(r.label).length), 4);
+  const turnTotal = turn.timing?.total_ms ?? spanEnd;
+  const lines = [
+    `Turn ${turn.id}, a ${kind}, ${turn.status}: ${duration(turnTotal)}, ${plural(spans.length, "span")}${firsts(turn.timing)}. * marks the critical path.`,
+    `${"span".padEnd(width)}  ${"0 s".padEnd(BAR_WIDTH / 2 + 1)}${seconds(total).padStart(BAR_WIDTH / 2 + 1)}  ${"start".padStart(8)}  ${"time".padStart(8)}`
+  ];
+  for (const r of rows) {
+    const head = `${cut(r.label).padEnd(width)}  ${bar(r, total)}  ${seconds(r.start).padStart(8)}  ${seconds(r.ms).padStart(8)} ${r.critical ? "*" : " "}`;
+    lines.push(`${head}${r.facts ? `  ${r.facts}` : ""}`.trimEnd());
+  }
+  return lines;
+}
+function isFirstBuild(spans) {
+  return spans.some((s) => s.name === "beginTurn" && s.attrs?.first_build === true);
+}
+function firsts(timing) {
+  if (!timing || timing.first_dev_ms === undefined && timing.first_write_ms === undefined && timing.first_preview_ms === undefined)
+    return "";
+  const say = (ms) => typeof ms === "number" ? duration(ms) : "-";
+  return `; live link ${say(timing.first_dev_ms)}, first change ${say(timing.first_write_ms)}, first playable ${say(timing.first_preview_ms)}`;
+}
+var isEngineRun = (s) => s.kind === "step" && s.name === "engine_programmer";
+function stepFigures(spans) {
+  const { children } = treeOf(spans);
+  const lines = [];
+  for (const step of spans) {
+    if (step.kind !== "step" || isEngineRun(step) || step.ms < 1000)
       continue;
-    const dirOnly = line.endsWith("/");
-    if (dirOnly)
-      line = line.replace(/\/+$/, "");
-    const anchored = line.startsWith("/") || line.includes("/");
-    line = line.replace(/^\/+/, "");
-    const re = globToRegExp(line);
-    rules.push((path, isDir) => {
-      if (dirOnly && !isDir)
-        return false;
-      if (anchored)
-        return re.test(path);
-      return re.test(path.slice(path.lastIndexOf("/") + 1));
-    });
+    const leaves = [];
+    const collect = (id, depth) => {
+      for (const kid of children.get(id) ?? []) {
+        const below = children.get(kid.id) ?? [];
+        if (below.length && depth < 8)
+          collect(kid.id, depth + 1);
+        else if (kid.ms >= 50)
+          leaves.push(kid);
+      }
+    };
+    collect(step.id, 0);
+    leaves.sort((a, b) => a.start - b.start);
+    const parts = leaves.slice(0, 8).map((s) => `${s.name}${s.ok ? "" : " (failed)"} ${seconds(s.ms)}`);
+    const more = leaves.length > 8 ? `, and ${leaves.length - 8} more` : "";
+    lines.push(`  ${step.name}${step.ok ? "" : " (failed)"} ${seconds(step.ms)}${parts.length ? `: ${parts.join(", ")}${more}` : ""}`);
   }
-  return rules;
+  return lines;
 }
-function isIgnored(rules, path) {
-  const parts = path.split("/");
-  return rules.some((rule) => rule(path, false) || parts.slice(0, -1).some((_, i) => rule(parts.slice(0, i + 1).join("/"), true)));
+function engineSummary(spans) {
+  const run = spans.find(isEngineRun);
+  if (!run)
+    return null;
+  const a = run.attrs ?? {};
+  const kids = spans.filter((s) => s.parent === run.id);
+  const steps = num(a.steps) ?? kids.filter((s) => s.kind === "model").length;
+  const tools = num(a.tools) ?? kids.filter((s) => s.kind === "tool").length;
+  const images = num(a.images) ?? kids.filter((s) => s.kind === "tool" && s.name === "make_image").length;
+  const figures = [plural(steps, "model step"), plural(tools, "tool call"), plural(images, "image")];
+  if (a.cut === true)
+    figures.push("cut short");
+  return `in ${duration(run.ms)}: ${figures.join(", ")}`;
+}
+function table(rows, indent) {
+  const widths = [];
+  for (const row of rows)
+    row.forEach((cell, i) => widths[i] = Math.max(widths[i] ?? 0, cell.length));
+  return rows.map((row) => `${indent}${row.map((cell, i) => i === 0 ? cell.padEnd(widths[i]) : cell.padStart(widths[i])).join("  ")}`.trimEnd());
+}
+var sec = (ms) => ms === null ? "-" : seconds(ms);
+var pair = (p, f) => `${f(p.p50)} / ${f(p.p90)}`;
+function groupTitle(g) {
+  const what = g.plan ? "plan turns" : g.first_build === true ? "first builds" : g.first_build === false ? "later builds" : "build turns";
+  return `${g.effort} ${what}, ${g.engine}`;
+}
+function renderStats(groups, options) {
+  const over = `the last ${plural(options.days, "day")}${options.origin ? `, from ${options.origin}` : ""}`;
+  if (groups.length === 0)
+    return [`No turns finished in ${over}.`];
+  const per = options.microsPerCredit ?? null;
+  const credits = (micros) => micros === null || !per ? "-" : String(Math.ceil(micros / per));
+  const cents = (micros) => micros === null ? "-" : (micros / 1e4).toFixed(1);
+  const lines = [`Turns created in ${over}: p50 and p90 over the done turns.`];
+  for (const g of groups) {
+    lines.push("", `${groupTitle(g)}: ${plural(g.turns, "done turn")}, ${g.failed} failed`);
+    const figures = [
+      ["figure", "p50", "p90", "turns"],
+      ["first live link", sec(g.first_dev_ms.p50), sec(g.first_dev_ms.p90), ""],
+      ["first change", sec(g.first_write_ms?.p50 ?? null), sec(g.first_write_ms?.p90 ?? null), ""],
+      ["first playable", sec(g.first_preview_ms.p50), sec(g.first_preview_ms.p90), ""],
+      ["whole turn", sec(g.total_ms.p50), sec(g.total_ms.p90), ""]
+    ];
+    const phases = Object.keys(g.phases).sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
+    for (const p of phases)
+      figures.push([`phase ${p}`, sec(g.phases[p].p50), sec(g.phases[p].p90), String(g.phases[p].n)]);
+    lines.push(...table(figures, "  "));
+    const jobs = Object.keys(g.jobs).sort();
+    if (jobs.length) {
+      const rows = [["job", "credits p50 / p90", "USD cents p50 / p90", "model time p50 / p90"]];
+      for (const j of jobs)
+        rows.push([j, pair(g.jobs[j].cost_micros, credits), pair(g.jobs[j].cost_micros, cents), pair(g.jobs[j].ms, sec)]);
+      lines.push(...table(rows, "  "));
+    }
+    const spans = Object.keys(g.spans).sort((a, b) => (g.spans[b].ms.p50 ?? -1) - (g.spans[a].ms.p50 ?? -1) || a.localeCompare(b));
+    if (spans.length) {
+      const rows = [["span", "p50", "p90", "calls"]];
+      for (const s of spans)
+        rows.push([s, sec(g.spans[s].ms.p50), sec(g.spans[s].ms.p90), String(g.spans[s].n)]);
+      lines.push(...table(rows, "  "));
+    }
+  }
+  return lines;
 }
-
-// src/project.ts
-import { readdir, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join2, win32 } from "node:path";
-var SPACE_TYPES = ["game", "world", "tool", "wonder"];
-var DEVICES = ["desktop", "mobile", "vr"];
-var PROJECT_FILE = "velven.json";
-var isProjectName = (name) => name.toLowerCase() === PROJECT_FILE;
-function servableSegment(segment) {
-  return !alwaysLeftOut(segment) && !/[. ]$/.test(segment) && !/[:~]/.test(segment);
+function rank(phase) {
+  const i = PHASE_ORDER.indexOf(phase);
+  return i === -1 ? PHASE_ORDER.length : i;
 }
-function alwaysLeftOut(segment) {
-  return segment.startsWith(".") || segment.toLowerCase() === "node_modules" || isProjectName(segment);
+
+// src/create.ts
+var CREATE_HELP = `velven create: describe a game, and Velven's agents build it.
+
+Usage:
+  velven create new [title...]       Start a project; it becomes the current one
+      --engine <id>                  The engine pack (default phaser)
+      --genre <id>                   The genre pack (default arcade)
+  velven create send <text...>       Send the project a message: prints the estimate, asks, then follows the turn
+      --project <id>                 A project other than the current one
+      --effort quick|standard|deep   How much the turn may do; kept for later messages until you change it
+      --plan, --no-plan              Plan mode: the turn updates the design document and changes no game files;
+                                     kept until you change it (on by default for standard, off for quick)
+      --yes, -y                      Do not ask before sending
+      --detach                       Send it and return at once; follow it later with watch
+  velven create watch [turn]         Follow a turn to its end (default: the last one)
+      --from <n>                     Start from this event
+  velven create cancel [turn]        Stop a turn: what it finished is saved, unused credits come back
+  velven create list                 Your projects (* is the current one)
+  velven create show [project]       A project, its newest turn and its preview link (a fresh 24-hour link)
+      --timeline                     The newest turn's timeline instead: a waterfall of every step, model and
+                                     tool call, the critical path marked (* at the line's end)
+      --turn <id>                    With --timeline: this turn instead of the project's newest
+      --all                          With --timeline: list every tool call and screenshot (past 20 under one
+                                     step they fold into one line)
+  velven create credits              Your credits and the latest entries
+  velven create stats                Admins: p50 and p90 over recent turns, by effort, plan mode and engine
+      --days <n>                     Turns created in the last n days, 1 to 90 (default 7)
+      --origin <origin>              Only turns sent from web, api, cli, mcp or benchmark
+
+  --json: new, send, list, show, credits and stats print one JSON object (send prints the finished turn,
+  show --timeline the timeline); watch prints one event per line.
+  Ctrl+C stops following a turn; the turn goes on.
+
+Exit codes:
+  0 done (also a turn that stopped at its credit cap or time limit)   1 failed, cancelled or no longer followed
+  2 bad command   3 needs sign-in   4 refused (no credits, closed, busy, too many turns, effort unavailable,
+  not found)   5 rate limited, try later`;
+var CREATE_FLAGS = {
+  engine: "string",
+  genre: "string",
+  project: "string",
+  effort: "string",
+  plan: "boolean",
+  "no-plan": "boolean",
+  yes: "boolean",
+  detach: "boolean",
+  from: "string",
+  json: "boolean",
+  timeline: "boolean",
+  turn: "string",
+  all: "boolean",
+  days: "string",
+  origin: "string"
+};
+var SUBCOMMANDS = {
+  new: ["engine", "genre", "json"],
+  send: ["project", "effort", "plan", "no-plan", "yes", "detach", "json"],
+  watch: ["from", "json"],
+  cancel: [],
+  list: ["json"],
+  show: ["json", "timeline", "turn", "all"],
+  credits: ["json"],
+  stats: ["days", "origin", "json"]
+};
+var EFFORTS = ["quick", "standard", "deep"];
+var ORIGINS = ["web", "api", "cli", "mcp", "benchmark"];
+var ROOT = "/api/v1/create";
+async function create(ctx, parsed) {
+  const [sub, ...args] = parsed.positionals;
+  if (!sub) {
+    ctx.out(CREATE_HELP);
+    return EXIT.ok;
+  }
+  const allowed = SUBCOMMANDS[sub];
+  if (!allowed)
+    throw new CliError(`Unknown command "create ${sub}". Run velven create --help to see the commands.`, EXIT.usage, "usage");
+  for (const [name, value] of Object.entries(parsed.flags)) {
+    if (value !== undefined && name !== "help" && !allowed.includes(name)) {
+      throw new CliError(`--${name} is not an option of velven create ${sub}.`, EXIT.usage, "usage");
+    }
+  }
+  const json = parsed.flags.json === true;
+  const base = apiBase(ctx);
+  const api = { base, creds: await requireToken(ctx, base) };
+  switch (sub) {
+    case "new":
+      return newProject(ctx, api, args.join(" ").trim(), stringFlag(parsed, "engine"), stringFlag(parsed, "genre"), json);
+    case "send":
+      return send(ctx, api, args, parsed, json);
+    case "watch":
+      return watch(ctx, api, args[0], stringFlag(parsed, "from"), json);
+    case "cancel":
+      return cancel(ctx, api, args[0]);
+    case "list":
+      return list(ctx, api, json);
+    case "show":
+      if (parsed.flags.timeline === true)
+        return showTimeline(ctx, api, args[0], stringFlag(parsed, "turn"), parsed.flags.all === true, json);
+      if (parsed.flags.turn !== undefined || parsed.flags.all !== undefined) {
+        throw new CliError("--turn and --all go with --timeline, like velven create show --timeline --turn 12.", EXIT.usage, "usage");
+      }
+      return show(ctx, api, args[0], json);
+    case "stats":
+      return stats(ctx, api, stringFlag(parsed, "days"), stringFlag(parsed, "origin"), json);
+    default:
+      return credits(ctx, api, json);
+  }
+}
+async function newProject(ctx, api, title, engine, genre, json) {
+  const body = {};
+  if (title)
+    body.title = title;
+  if (engine)
+    body.engine = engine;
+  if (genre)
+    body.genre = genre;
+  const { project } = await call(api, "POST", `${ROOT}/projects`, body);
+  await saveCreateState(ctx, api.base, { project: project.id, turn: undefined });
+  if (json) {
+    ctx.out(JSON.stringify({ ok: true, project }));
+    return EXIT.ok;
+  }
+  ctx.out(`Started ${project.title ?? "a project"} (${project.id}): ${packs(project)}. It is now the current project.`);
+  ctx.out('Tell it what to build: velven create send "a one-button game where a fox jumps over logs"');
+  return EXIT.ok;
 }
-function servableRelative(rel) {
-  return rel !== "" && !win32.isAbsolute(rel) && rel.split(/[\\/]/).every(servableSegment);
+async function send(ctx, api, words, parsed, json) {
+  const text = words.join(" ").trim();
+  if (!text)
+    throw new CliError('Say what to build or change, like velven create send "make the fox jump higher".', EXIT.usage, "usage");
+  const effort = stringFlag(parsed, "effort");
+  if (effort !== undefined && !EFFORTS.includes(effort)) {
+    throw new CliError(`--effort is quick, standard or deep, not "${effort}".`, EXIT.usage, "usage");
+  }
+  if (parsed.flags.plan === true && parsed.flags["no-plan"] === true) {
+    throw new CliError("Pass --plan or --no-plan, not both.", EXIT.usage, "usage");
+  }
+  const plan = parsed.flags.plan === true ? true : parsed.flags["no-plan"] === true ? false : undefined;
+  const project = await currentProject(ctx, api.base, stringFlag(parsed, "project"));
+  const say = json ? () => {} : (line) => ctx.out(line);
+  const query = new URLSearchParams;
+  if (effort !== undefined)
+    query.set("effort", effort);
+  if (plan !== undefined)
+    query.set("plan", String(plan));
+  const search = query.toString();
+  const { estimate } = await call(api, "GET", `${ROOT}/projects/${seg(project)}/estimate${search ? `?${search}` : ""}`);
+  const kind = estimate.plan ? `${estimate.effort} plan turn` : estimate.first_build === true ? `${estimate.effort} first build (its pictures are made before the first preview)` : `${estimate.effort} build turn`;
+  say(`A ${kind}: about ${estimate.credits.typical} credits, at most ${estimate.credits.cap}. You have ${estimate.available} available.`);
+  if (!estimate.enough) {
+    throw new CliError(estimate.reason ?? "Velven cannot start this turn now.", EXIT.refused, "not_enough");
+  }
+  if (ctx.interactive && !json && parsed.flags.yes !== true) {
+    const answer = (await ctx.ask("Send it? (Y/n) ")).trim().toLowerCase();
+    if (answer === "n" || answer === "no") {
+      ctx.out("Nothing was sent.");
+      return EXIT.failed;
+    }
+  }
+  const body = { text };
+  if (effort !== undefined)
+    body.effort = effort;
+  if (plan !== undefined)
+    body.plan = plan;
+  const sent = await call(api, "POST", `${ROOT}/projects/${seg(project)}/messages`, body);
+  const turn = sent.turn;
+  await saveCreateState(ctx, api.base, { project, turn: turn.id });
+  if (turn.queued)
+    say(`Turn ${turn.id} waits for room on Velven and starts on its own.`);
+  else
+    say(`Turn ${turn.id} is on its way.`);
+  if (parsed.flags.detach === true) {
+    if (json)
+      ctx.out(JSON.stringify({ ok: true, turn }));
+    else
+      say(`Follow it: velven create watch ${turn.id}; stop it: velven create cancel ${turn.id}`);
+    return EXIT.ok;
+  }
+  const path = sent.stream?.startsWith("/") ? sent.stream : `${ROOT}/turns/${seg(turn.id)}/stream`;
+  return follow(ctx, api, turn.id, path, undefined, json ? "final" : "text");
 }
-async function readProject(dir) {
-  const names = await readdir(dir).catch(() => []);
-  const path = join2(dir, names.includes(PROJECT_FILE) ? PROJECT_FILE : names.find(isProjectName) ?? PROJECT_FILE);
-  let text;
-  try {
-    text = await readFile2(path, "utf8");
-  } catch {
-    return { path, exists: false, data: {} };
+async function watch(ctx, api, arg, fromFlag, json) {
+  let from;
+  if (fromFlag !== undefined) {
+    if (!/^\d+$/.test(fromFlag))
+      throw new CliError(`--from is an event number, like 12, not "${fromFlag}".`, EXIT.usage, "usage");
+    from = Number(fromFlag);
   }
-  let data;
+  const turn = await turnId(ctx, api.base, arg, "watch");
+  let code;
   try {
-    data = JSON.parse(text);
+    code = await follow(ctx, api, turn, `${ROOT}/turns/${seg(turn)}/stream`, from, json ? "events" : "text");
   } catch (e) {
-    throw new CliError(`${PROJECT_FILE} is not valid JSON (${e instanceof Error ? e.message : String(e)}).`, EXIT.usage, "invalid_config");
-  }
-  if (!data || typeof data !== "object" || Array.isArray(data)) {
-    throw new CliError(`${PROJECT_FILE} must hold one JSON object, like {"title": "My game"}.`, EXIT.usage, "invalid_config");
+    if (e instanceof CliError && e.code === "stream_lost")
+      await saveCreateState(ctx, api.base, { turn });
+    throw e;
   }
-  return { path, exists: true, data };
+  await saveCreateState(ctx, api.base, { turn });
+  return code;
 }
-async function updateProject(project, values) {
-  for (const [key, value] of Object.entries(values)) {
-    if (value === undefined)
-      delete project.data[key];
+async function follow(ctx, api, turn, path, from, mode) {
+  const controller = new AbortController;
+  ctx.untilStopped().then(() => controller.abort());
+  const said = { held: null, engine: null };
+  let final;
+  try {
+    final = await stream(api, path, { from, signal: controller.signal, sleep: ctx.sleep }, (event2) => {
+      if (mode === "events")
+        ctx.out(JSON.stringify(event2));
+      else if (mode === "text")
+        render(ctx, event2, said);
+      return event2.type === "turn.done" || event2.type === "error";
+    });
+  } catch (e) {
+    const error = e instanceof CliError && e.code === "stream_lost" ? new CliError(`${e.message} The turn goes on: velven create watch ${turn}`, e.exitCode, e.code) : e;
+    if (mode === "final" && error instanceof CliError) {
+      ctx.out(JSON.stringify({ ok: false, error: error.message, code: error.code, turn: { id: turn } }));
+      return error.exitCode;
+    }
+    throw error;
+  } finally {
+    controller.abort();
+    release(ctx, said);
+  }
+  if (final === null) {
+    const message = `The turn goes on. Watch it: velven create watch ${turn}; stop it: velven create cancel ${turn}`;
+    if (mode === "final")
+      ctx.out(JSON.stringify({ ok: false, error: message, code: "detached", turn: { id: turn } }));
     else
-      project.data[key] = value;
+      ctx.err(message);
+    return EXIT.failed;
+  }
+  const event = final;
+  const code = event.type === "error" || event.status !== "done" ? EXIT.failed : EXIT.ok;
+  if (mode === "final") {
+    const error = event.type === "error" ? { error: event.message, code: event.code } : {};
+    let view;
+    try {
+      ({ turn: view } = await call(api, "GET", `${ROOT}/turns/${seg(turn)}`));
+    } catch (e) {
+      if (!(e instanceof CliError))
+        throw e;
+      const ended = event.type === "turn.done" ? { status: event.status } : {};
+      ctx.out(JSON.stringify({ ok: false, error: e.message, code: e.code, ...error, turn: { id: turn, ...ended } }));
+      return code;
+    }
+    ctx.out(JSON.stringify({ ok: code === EXIT.ok, ...error, turn: view }));
+  } else if (mode === "text") {
+    finish(ctx, turn, event);
   }
-  await writeFile2(project.path, `${JSON.stringify(project.data, null, 2)}
-`);
-  project.exists = true;
+  return code;
 }
-function list(value) {
-  return value.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+var plural2 = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+function capital(text) {
+  return text.charAt(0).toUpperCase() + text.slice(1);
 }
-function withFlags(data, flags) {
-  const out = { ...data };
-  if (flags.title !== undefined)
-    out.title = flags.title;
-  if (flags.type !== undefined)
-    out.type = flags.type.trim().toLowerCase();
-  if (flags.devices !== undefined)
-    out.devices = list(flags.devices);
-  if (flags.description !== undefined)
-    out.description = flags.description;
-  if (flags.engine !== undefined)
-    out.engine = flags.engine;
-  return out;
+function jobLabel(job) {
+  return capital(job.replace(/_/g, " "));
 }
-var REQUIRED = ["title", "type", "devices"];
-function requiredProblem(field, value) {
-  if (value === undefined || value === null || value === "" || Array.isArray(value) && value.length === 0)
-    return "missing";
-  if (field === "title") {
-    if (typeof value !== "string" || !value.trim())
-      return "must be text";
-    if (value.trim().length > 80)
-      return "must be under 80 characters";
-    return null;
-  }
-  if (field === "type") {
-    return typeof value === "string" && SPACE_TYPES.includes(value) ? null : `must be one of ${SPACE_TYPES.join(", ")}`;
-  }
-  if (!Array.isArray(value) || !value.every((d) => typeof d === "string" && DEVICES.includes(d))) {
-    return `must be a list from ${DEVICES.join(", ")}, like ["desktop", "mobile"]`;
+function lasting(at, expires) {
+  const minutes = Math.round((Date.parse(expires) - Date.parse(at)) / 60000);
+  if (!Number.isFinite(minutes) || minutes <= 0)
+    return "";
+  if (minutes < 90)
+    return plural2(minutes, "minute");
+  return plural2(Math.round(minutes / 60), "hour");
+}
+function jobDone(ctx, label, figures, summary) {
+  if (figures)
+    ctx.err(`${label} done ${figures}${summary ? `. ${summary}` : ""}`);
+  else
+    ctx.err(`${label} done${summary ? `: ${summary}` : "."}`);
+}
+function release(ctx, said) {
+  if (!said.held)
+    return;
+  jobDone(ctx, said.held.label, null, said.held.summary);
+  said.held = null;
+}
+function render(ctx, event, said) {
+  if (event.type === "spans") {
+    const figures = engineSummary(event.spans);
+    if (said.held) {
+      jobDone(ctx, said.held.label, figures, said.held.summary);
+      said.held = null;
+    } else if (figures) {
+      said.engine = figures;
+    }
+    for (const line of stepFigures(event.spans))
+      ctx.err(line);
+    return;
+  }
+  release(ctx, said);
+  switch (event.type) {
+    case "turn.started":
+      ctx.err(`Started: ${event.effort}${event.plan ? ", plan mode" : ""}, ${plural2(event.credits_held, "credit")} held.`);
+      return;
+    case "turn.queued":
+      ctx.err("Still waiting for room on Velven.");
+      return;
+    case "phase":
+      ctx.err(`${capital(event.phase)}${event.detail ? `: ${event.detail}` : ""}`);
+      return;
+    case "job": {
+      if (event.job === "engine_programmer" && event.state !== "failed") {
+        if (event.state === "started")
+          said.engine = null;
+        else {
+          if (said.engine)
+            jobDone(ctx, jobLabel(event.job), said.engine, event.summary);
+          else
+            said.held = { label: jobLabel(event.job), ...event.summary ? { summary: event.summary } : {} };
+          said.engine = null;
+          return;
+        }
+      }
+      const what = event.state === "started" ? `started${event.model ? ` (${event.model})` : ""}` : event.state;
+      ctx.err(`${jobLabel(event.job)} ${what}${event.summary ? `: ${event.summary}` : "."}`);
+      return;
+    }
+    case "tool":
+      ctx.err(`  ${event.name}: ${event.summary}${typeof event.ms === "number" ? ` (${duration(event.ms)})` : ""}`);
+      return;
+    case "text":
+      ctx.out(event.text);
+      return;
+    case "files": {
+      if (!event.changed.length)
+        return;
+      const changed = event.changed.map((c) => `${c.path} +${c.added} -${c.removed}`).join(", ");
+      ctx.err(`  changed: ${changed}${event.more > 0 ? `, and ${event.more} more` : ""}`);
+      return;
+    }
+    case "dev":
+      if (event.url)
+        ctx.out(`Live while it builds: ${event.url}`);
+      else
+        ctx.err("The live link is gone.");
+      return;
+    case "shot":
+      ctx.err(`  screenshot ${event.label}: ${event.url}`);
+      return;
+    case "clip":
+      ctx.out(`Clip: ${event.url}`);
+      return;
+    case "build":
+      if (event.ok)
+        ctx.err(`The build passed in ${(event.ms / 1000).toFixed(1)} s.`);
+      else {
+        ctx.err("The build failed:");
+        for (const line of event.errors)
+          ctx.err(`  ${line}`);
+      }
+      return;
+    case "playtest":
+      ctx.err(`Playtest round ${event.round}: ${event.ok ? "every check passed" : plural2(event.problems, "check problem")}.`);
+      return;
+    case "review":
+      ctx.err(`Review: ${event.ok ? "no problems" : plural2(event.problems, "problem")}.`);
+      return;
+    case "commit":
+      ctx.out(`Committed ${event.sha.slice(0, 7)}: ${event.message}`);
+      return;
+    case "preview": {
+      if (event.purpose !== "playtest") {
+        ctx.out(`Preview: ${event.url}`);
+        return;
+      }
+      const lasts = lasting(event.at, event.expires_at);
+      ctx.out(`Preview (playtest${lasts ? `, ${lasts}` : ""}): ${event.url}`);
+      return;
+    }
+    case "cost":
+      ctx.err(`${event.credits_used} of ${plural2(event.credits_held, "credit")} used so far.`);
+      return;
+    default:
+      return;
   }
-  return null;
 }
-var isString = (v) => typeof v === "string";
-var isStringList = (v) => Array.isArray(v) && v.every(isString);
-var isBoolean = (v) => typeof v === "boolean";
-function isInsidePath(v) {
-  return isString(v) && !!v && !/^[\\/]/.test(v) && !v.split(/[\\/]/).includes("..");
+function finish(ctx, turn, event) {
+  if (event.type === "error") {
+    const tail = event.code === "turn_stopped" || event.code === "not_found" ? " Check it again later: velven create show" : ` The turn may go on. Watch it: velven create watch ${turn}; check it: velven create show`;
+    ctx.err(`${event.message || "The turn's stream answered with an error."}${tail}`);
+    return;
+  }
+  if (event.reply)
+    ctx.out(event.reply);
+  if (event.preview)
+    ctx.out(`Play it: ${event.preview.url}`);
+  const back = event.refunded > 0 ? `; ${plural2(event.refunded, "credit")} came back` : "";
+  if (event.status === "done") {
+    ctx.out(`Turn ${turn} is done: ${plural2(event.credits_charged, "credit")} used${back}.`);
+    if (event.stop_reason === "cap")
+      ctx.out("It stopped at its credit cap. What it finished is saved: send another message to go on.");
+    if (event.stop_reason === "time")
+      ctx.out("It stopped at its time limit. What it finished is saved: send another message to go on.");
+    return;
+  }
+  if (event.status === "cancelled") {
+    ctx.err(`Turn ${turn} was cancelled: ${plural2(event.credits_charged, "credit")} used${back}. What it finished is saved.`);
+    return;
+  }
+  ctx.err(`Turn ${turn} failed: ${event.error ?? "Velven could not finish it."} A failed turn costs nothing.`);
+}
+async function cancel(ctx, api, arg) {
+  const turn = await turnId(ctx, api.base, arg, "cancel");
+  const answer = await call(api, "POST", `${ROOT}/turns/${seg(turn)}/cancel`, {});
+  if (answer.status === "cancelled")
+    ctx.out(`Turn ${turn} is cancelled before it started. Its credits are back.`);
+  else
+    ctx.out(`Turn ${turn} is stopping. What it finished is saved and unused credits come back. Follow it: velven create watch ${turn}`);
+  return EXIT.ok;
 }
-function isStart(v) {
-  if (!v || typeof v !== "object" || Array.isArray(v))
-    return false;
-  const s = v;
-  const keys = Object.keys(s);
-  if (keys.length !== 1)
-    return false;
-  if ("key" in s)
-    return typeof s.key === "string" && s.key.length > 0;
-  if ("click" in s) {
-    if (typeof s.click === "string")
-      return s.click.length > 0;
-    return Array.isArray(s.click) && s.click.length === 2 && s.click.every((n) => typeof n === "number" && Number.isFinite(n));
+async function list(ctx, api, json) {
+  const { projects } = await call(api, "GET", `${ROOT}/projects`);
+  if (json) {
+    ctx.out(JSON.stringify({ ok: true, projects }));
+    return EXIT.ok;
   }
-  return false;
-}
-var OPTIONAL = {
-  description: [(v) => isString(v) && v.length <= 160, "must be one line of text, under 160 characters"],
-  engine: [isString, 'must be text, like "three.js"'],
-  ai_tools: [isStringList, "must be a list of text"],
-  models: [isStringList, "must be a list of text"],
-  how_made: [(v) => isString(v) && v.length <= 2000, "must be text, under 2000 characters"],
-  source_url: [isString, "must be a web address"],
-  entry: [isInsidePath, 'must be a path inside the folder, like "index.html"'],
-  thumbnail: [isInsidePath, 'must be a path inside the folder, like "media/thumbnail.jpg"'],
-  clip: [isInsidePath, 'must be a path inside the folder, like "media/clip.mp4"'],
-  spa: [isBoolean, "must be true or false"],
-  sdk: [isBoolean, "must be true or false"],
-  toasts: [isBoolean, "must be true or false"],
-  start: [isStart, 'must be {"click": "Play"}, {"click": [x, y]} or {"key": "Space"}'],
-  space: [(v) => isString(v) && /^[a-z0-9][a-z0-9-]*$/.test(v), `must be a space's slug, like "my-game"`],
-  claim: [(v) => isString(v) && !!v, "must be the claim token a publish without an account saved"]
-};
-function optionalProblems(data) {
-  const problems = [];
-  for (const [field, [ok, rule]] of Object.entries(OPTIONAL)) {
-    if (data[field] === undefined)
-      continue;
-    if (!ok(data[field]))
-      problems.push(`"${field}" ${rule}`);
+  if (projects.length === 0) {
+    ctx.out("No projects yet. Start one with velven create new.");
+    return EXIT.ok;
   }
-  return problems;
-}
-function requiredProblems(data) {
-  return REQUIRED.flatMap((field) => {
-    const problem = requiredProblem(field, data[field]);
-    return problem ? [{ field, problem }] : [];
-  });
-}
-var QUESTIONS = {
-  title: "Title, the name people see on Velven: ",
-  type: `Type (${SPACE_TYPES.join(", ")}): `,
-  devices: `Devices it works on, comma separated (${DEVICES.join(", ")}): `
-};
-function parseAnswer(field, answer) {
-  if (field === "title")
-    return answer.trim();
-  if (field === "type")
-    return answer.trim().toLowerCase();
-  return list(answer);
+  const current = (await readCreateState(ctx, api.base)).project;
+  for (const p of projects) {
+    const mark = p.id === current ? "*" : " ";
+    const turn = p.turn ? `turn ${p.turn.id} ${p.turn.status}` : "no turns yet";
+    ctx.out(`${mark} ${p.id}  ${(p.title ?? "Untitled").padEnd(24)}  ${turn.padEnd(18)}  ${when(p.updated_at)}`.trimEnd());
+  }
+  return EXIT.ok;
 }
-async function completeRequired(ctx, project, merged, canAsk) {
-  const problems = requiredProblems(merged);
-  if (problems.length === 0)
-    return merged;
-  if (!canAsk) {
-    const lines = problems.map(({ field, problem }) => `"${field}" ${problem === "missing" ? "is missing" : problem}`);
-    throw new CliError(`velven.json needs ${problems.map((p) => p.field).join(", ")}: ${lines.join("; ")}. Add them to velven.json or pass --${problems[0].field}.`, EXIT.usage, "missing_fields", problems.map((p) => p.field));
+async function show(ctx, api, arg, json) {
+  const id = await currentProject(ctx, api.base, arg);
+  const { project } = await call(api, "GET", `${ROOT}/projects/${seg(id)}`);
+  if (arg)
+    await saveCreateState(ctx, api.base, { project: project.id, turn: project.turn?.id });
+  if (json) {
+    ctx.out(JSON.stringify({ ok: true, project }));
+    return EXIT.ok;
   }
-  ctx.out(`velven.json needs ${problems.map((p) => p.field).join(", ")}. Your answers are saved into it.`);
-  const answers = {};
-  for (const { field, problem } of problems) {
-    if (problem !== "missing")
-      ctx.out(`"${field}" ${problem}.`);
-    for (;; ) {
-      const value = parseAnswer(field, await ctx.ask(QUESTIONS[field]));
-      const again = requiredProblem(field, value);
-      if (!again) {
-        answers[field] = value;
-        break;
-      }
-      ctx.out(again === "missing" ? `Please answer: ${field} is required.` : `That ${field} ${again}.`);
-    }
+  ctx.out(`${project.title ?? "Untitled"} (${project.id})`);
+  ctx.out(`Packs: ${packs(project)}`);
+  ctx.out(`Next turn: ${project.effort}, plan mode ${project.plan ? "on" : "off"}`);
+  ctx.out(`Latest commit: ${project.head ? project.head.slice(0, 7) : "none yet"}`);
+  const t = project.turn;
+  if (t) {
+    const charged = t.credits.charged !== null ? `, ${plural2(t.credits.charged, "credit")} used` : `, ${plural2(t.credits.held, "credit")} held`;
+    const stop = t.stop_reason === "cap" ? ", stopped at its credit cap" : t.stop_reason === "time" ? ", stopped at its time limit" : "";
+    ctx.out(`Newest turn: ${t.id}, ${t.status}${t.phase && t.status === "running" ? ` (${t.phase})` : ""}${charged}${stop}`);
+    if (t.error)
+      ctx.out(`  ${t.error}`);
+  } else {
+    ctx.out("Newest turn: none yet");
   }
-  await updateProject(project, answers);
-  return { ...merged, ...answers };
-}
-
-// src/dev.ts
-var TYPES = {
-  ".html": "text/html; charset=utf-8",
-  ".htm": "text/html; charset=utf-8",
-  ".js": "text/javascript; charset=utf-8",
-  ".mjs": "text/javascript; charset=utf-8",
-  ".cjs": "text/javascript; charset=utf-8",
-  ".css": "text/css; charset=utf-8",
-  ".json": "application/json; charset=utf-8",
-  ".map": "application/json; charset=utf-8",
-  ".txt": "text/plain; charset=utf-8",
-  ".csv": "text/csv; charset=utf-8",
-  ".xml": "application/xml; charset=utf-8",
-  ".wasm": "application/wasm",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".avif": "image/avif",
-  ".svg": "image/svg+xml",
-  ".ico": "image/x-icon",
-  ".bmp": "image/bmp",
-  ".mp3": "audio/mpeg",
-  ".ogg": "audio/ogg",
-  ".oga": "audio/ogg",
-  ".opus": "audio/ogg",
-  ".wav": "audio/wav",
-  ".m4a": "audio/mp4",
-  ".aac": "audio/aac",
-  ".flac": "audio/flac",
-  ".mp4": "video/mp4",
-  ".m4v": "video/mp4",
-  ".webm": "video/webm",
-  ".mov": "video/quicktime",
-  ".ttf": "font/ttf",
-  ".otf": "font/otf",
-  ".woff": "font/woff",
-  ".woff2": "font/woff2",
-  ".glb": "model/gltf-binary",
-  ".gltf": "model/gltf+json",
-  ".pdf": "application/pdf"
-};
-var ENCODINGS = { ".br": "br", ".gz": "gzip" };
-function contentType(path) {
-  const ext = extname(path).toLowerCase();
-  const encoding = ENCODINGS[ext];
-  if (encoding)
-    return { type: TYPES[extname(path.slice(0, -ext.length)).toLowerCase()] ?? "application/octet-stream", encoding };
-  return { type: TYPES[ext] ?? "application/octet-stream" };
-}
-function injectSdk(html, src) {
-  if (/<script[^>]+src=["'][^"']*\/sdk\/v1\.js/i.test(html))
-    return html;
-  const tag = `<script src="${src}" async></script>`;
-  const head = html.search(/<\/head>/i);
-  if (head !== -1)
-    return html.slice(0, head) + tag + html.slice(head);
-  const body = html.search(/<body[\s>]/i);
-  if (body !== -1)
-    return html.slice(0, body) + tag + html.slice(body);
-  return tag + html;
-}
-async function ignoreRules(root) {
-  return parseIgnore(await readFile3(join3(root, ".velvenignore"), "utf8").catch(() => ""));
+  if (project.preview?.url)
+    ctx.out(`Play it: ${project.preview.url}${project.preview.expires_at ? ` (the preview lasts until ${when(project.preview.expires_at)})` : ""}`);
+  else
+    ctx.out("Preview: none yet");
+  return EXIT.ok;
 }
-async function namedAsOnDisk(base, rel) {
-  const parts = rel.split("/").filter(Boolean);
-  for (let i = 0;i < parts.length; i++) {
-    const names = await readdir2(join3(base, ...parts.slice(0, i))).catch(() => []);
-    if (!names.includes(parts[i]))
-      return false;
+async function showTimeline(ctx, api, arg, turnFlag, all, json) {
+  let id;
+  if (turnFlag !== undefined) {
+    if (arg)
+      throw new CliError("Name a project or a turn with --turn, not both.", EXIT.usage, "usage");
+    if (!/^\d+$/.test(turnFlag) || Number(turnFlag) === 0)
+      throw new CliError(`--turn is a turn number, like 12, not "${turnFlag}".`, EXIT.usage, "usage");
+    id = Number(turnFlag);
+  } else {
+    const project = await currentProject(ctx, api.base, arg);
+    const { project: view } = await call(api, "GET", `${ROOT}/projects/${seg(project)}`);
+    if (!view.turn)
+      throw new CliError("This project has no turns yet, so there is no timeline to show.", EXIT.usage, "no_turn");
+    id = view.turn.id;
+  }
+  const { turn } = await call(api, "GET", `${ROOT}/turns/${seg(id)}?timeline=1`);
+  const timeline = turn.timeline ?? { started_at: turn.started_at, spans: [] };
+  if (json) {
+    ctx.out(JSON.stringify({ ok: true, turn: turn.id, timeline }));
+    return EXIT.ok;
   }
-  return true;
-}
-async function statExact(base, rel) {
-  const info = await stat(join3(base, rel)).catch(() => null);
-  return info && await namedAsOnDisk(base, rel) ? info : null;
-}
-async function startDevServer(root, options) {
-  const base = resolve(root);
-  const realBase = await realpath(base);
-  const server = createServer(async (req, res) => {
-    const send = (status, body2, headers2 = {}) => {
-      res.writeHead(status, { "cache-control": "no-store", ...headers2 });
-      res.end(req.method === "HEAD" ? undefined : body2);
-    };
-    if (req.method !== "GET" && req.method !== "HEAD")
-      return send(405, "Method not allowed", { allow: "GET, HEAD" });
-    let path;
-    try {
-      path = decodeURIComponent(new URL(req.url ?? "/", "http://localhost").pathname);
-    } catch {
-      return send(400, "Bad path");
-    }
-    const parts = path.split("/").filter(Boolean);
-    if (!parts.every(servableSegment))
-      return send(404, "Not found", { "content-type": "text/plain; charset=utf-8" });
-    let rel = parts.join("/");
-    let file = resolve(base, rel);
-    if (file !== base && !file.startsWith(base + sep))
-      return send(404, "Not found");
-    let info = await statExact(base, rel);
-    if (info?.isDirectory()) {
-      if (!path.endsWith("/"))
-        return send(301, "", { location: `${path}/` });
-      rel = rel ? `${rel}/index.html` : options.entry;
-      file = join3(base, rel);
-      info = await statExact(base, rel);
-    }
-    const rules = await ignoreRules(base);
-    if (info?.isFile() && isIgnored(rules, rel))
-      info = null;
-    if (!info?.isFile() && options.spa && !extname(path)) {
-      rel = options.entry;
-      file = join3(base, rel);
-      info = await statExact(base, rel);
-    }
-    if (info?.isFile() && isIgnored(rules, rel))
-      info = null;
-    if (!info?.isFile()) {
-      options.onMissing?.(path);
-      return send(404, "Not found", { "content-type": "text/plain; charset=utf-8" });
-    }
-    const real = await realpath(file).catch(() => null);
-    if (!real || !servableRelative(relative(realBase, real))) {
-      return send(404, "Not found", { "content-type": "text/plain; charset=utf-8" });
-    }
-    const { type, encoding } = contentType(file);
-    let body = await readFile3(file);
-    if (rel === options.entry && options.sdkSrc && !encoding)
-      body = injectSdk(body.toString("utf8"), options.sdkSrc);
-    const headers = { "content-type": type, "content-length": String(Buffer.byteLength(body)) };
-    if (encoding)
-      headers["content-encoding"] = encoding;
-    send(200, body, headers);
-  });
-  await new Promise((resolveListen, reject) => {
-    server.once("error", reject);
-    server.listen(options.port, "127.0.0.1", () => resolveListen());
-  });
-  const { port } = server.address();
-  return {
-    url: `http://localhost:${port}`,
-    close: () => new Promise((done) => {
-      server.closeAllConnections();
-      server.close(() => done());
-    })
-  };
+  for (const line of renderTimeline(turn, timeline.spans, { all }))
+    ctx.out(line);
+  return EXIT.ok;
 }
-async function dev(ctx, dirArg, portFlag) {
-  const dir = resolve(ctx.cwd, dirArg ?? ".");
-  const info = await stat(dir).catch(() => null);
-  if (!info?.isDirectory())
-    throw new CliError(`There is no folder at ${dir}.`, EXIT.usage, "usage");
-  const port = portFlag === undefined ? 0 : Number(portFlag);
-  if (!Number.isInteger(port) || port < 0 || port > 65535)
-    throw new CliError("--port must be a number from 1 to 65535.", EXIT.usage, "usage");
-  const { data } = await readProject(dir);
-  const shape = optionalProblems(data);
-  if (shape.length)
-    throw new CliError(`velven.json has problems: ${shape.join("; ")}.`, EXIT.usage, "invalid_config");
-  const base = apiBase(ctx);
-  const entry = typeof data.entry === "string" ? data.entry : "index.html";
-  if (!(await stat(join3(dir, entry)).catch(() => null))?.isFile()) {
-    throw new CliError(`The folder has no ${entry}. Add one, or name the page to open with "entry" in velven.json.`, EXIT.usage, "no_entry");
+async function stats(ctx, api, daysFlag, origin, json) {
+  const days = daysFlag === undefined ? 7 : Number(daysFlag);
+  if (daysFlag !== undefined && (!/^\d+$/.test(daysFlag) || days < 1 || days > 90)) {
+    throw new CliError(`--days is a number of days from 1 to 90, not "${daysFlag}".`, EXIT.usage, "usage");
   }
-  let server;
+  if (origin !== undefined && !ORIGINS.includes(origin)) {
+    throw new CliError(`--origin is one of ${ORIGINS.join(", ")}, not "${origin}".`, EXIT.usage, "usage");
+  }
+  const query = new URLSearchParams({ days: String(days) });
+  if (origin)
+    query.set("origin", origin);
+  let answer;
   try {
-    server = await startDevServer(dir, {
-      port,
-      entry,
-      spa: data.spa === true,
-      sdkSrc: data.sdk === false ? null : `${base}/sdk/v1.js`,
-      onMissing: (path) => ctx.err(`Not found: ${path}`)
-    });
+    answer = await call(api, "GET", `${ROOT}/stats?${query}`);
   } catch (e) {
-    const busy = e instanceof Error && "code" in e && e.code === "EADDRINUSE";
-    throw new CliError(busy ? `Port ${port} is taken. Pick another with --port, or leave it out.` : `Could not start the server (${String(e)}).`, EXIT.failed, "server");
+    if (e instanceof CliError && e.code === "not_found") {
+      throw new CliError("velven create stats reads the figures over everyone's turns, which only Velven's admins may read.", EXIT.refused, "not_found");
+    }
+    throw e;
+  }
+  if (json) {
+    ctx.out(JSON.stringify({ ok: true, ...answer }));
+    return EXIT.ok;
+  }
+  for (const line of renderStats(answer.stats, { days, origin, microsPerCredit: answer.micros_per_credit ?? null }))
+    ctx.out(line);
+  return EXIT.ok;
+}
+async function credits(ctx, api, json) {
+  const view = await call(api, "GET", `${ROOT}/credits`);
+  if (json) {
+    ctx.out(JSON.stringify({ ok: true, credits: view }));
+    return EXIT.ok;
+  }
+  ctx.out(`${plural2(view.available, "credit")} available: ${view.daily_left} left of today's allowance, ${view.balance} in your balance, ${view.held} held by open turns.`);
+  for (const row of view.ledger.slice(0, 10)) {
+    const amount = row.amount > 0 ? `+${row.amount}` : String(row.amount);
+    ctx.out(`  ${when(row.created_at).padEnd(20)}  ${amount.padStart(6)}  ${row.kind}${row.turn_id !== null ? ` (turn ${row.turn_id})` : ""}`);
   }
-  const slug = typeof data.space === "string" ? data.space : undefined;
-  const page = `${base}/dev?url=${encodeURIComponent(server.url)}${slug ? `&space=${encodeURIComponent(slug)}` : ""}`;
-  ctx.out(`Serving ${dir} at ${server.url}`);
-  ctx.out(`Play it on Velven: ${page}`);
-  if (!slug)
-    ctx.out("Scores and saves need a space: publish once so velven.json names it.");
-  ctx.out("Scores, saves and achievements made here go to the sandbox. Press Ctrl+C to stop.");
-  ctx.openBrowser(page);
-  await ctx.untilStopped();
-  await server.close();
   return EXIT.ok;
 }
+function packs(project) {
+  const engine = `${project.engine.id} ${project.engine.version}`;
+  return project.genre ? `${engine}, ${project.genre.id} ${project.genre.version}` : engine;
+}
+function when(iso) {
+  if (!iso)
+    return "";
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime()) ? iso : d.toISOString().slice(0, 16).replace("T", " ") + " UTC";
+}
+async function currentProject(ctx, base, given) {
+  if (given)
+    return given;
+  const { project } = await readCreateState(ctx, base);
+  if (project)
+    return project;
+  throw new CliError("No current project. Start one with velven create new, or name one with --project <id>.", EXIT.usage, "no_project");
+}
+async function turnId(ctx, base, arg, verb) {
+  if (arg !== undefined) {
+    if (!/^\d+$/.test(arg) || Number(arg) === 0)
+      throw new CliError(`"${arg}" is not a turn number, like 12.`, EXIT.usage, "usage");
+    return Number(arg);
+  }
+  const { turn } = await readCreateState(ctx, base);
+  if (turn !== undefined)
+    return turn;
+  throw new CliError(`No turn to ${verb}. Name one, like velven create ${verb} 12.`, EXIT.usage, "no_turn");
+}
 
-// src/publish.ts
-import { stat as stat3 } from "node:fs/promises";
-import { resolve as resolve2 } from "node:path";
-
-// src/files.ts
-import { createHash } from "node:crypto";
-import { createReadStream } from "node:fs";
-import { open, readdir as readdir3, readFile as readFile4, realpath as realpath2, stat as stat2 } from "node:fs/promises";
-import { join as join4, relative as relative2 } from "node:path";
+// src/dev.ts
+import { createReadStream as createReadStream2 } from "node:fs";
+import { open as open2, readdir as readdir3, readFile as readFile5, realpath as realpath2, stat as stat2 } from "node:fs/promises";
+import { createServer } from "node:http";
+import { extname, join as join5, relative as relative2, resolve, sep } from "node:path";
+import { createBrotliDecompress, createGunzip } from "node:zlib";
 
 // ../scan-rules/src/each-limit.ts
 async function eachLimit(items, limit, task) {
@@ -772,6 +1442,138 @@ async function eachLimit(items, limit, task) {
   };
   await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
 }
+// ../scan-rules/src/pieces.ts
+var PIECE_BYTES = 32 * 1024 * 1024;
+// ../scan-rules/src/wasm.ts
+var HEADER = [0, 97, 115, 109, 1, 0, 0, 0];
+var CUSTOM_SECTION = 0;
+var IMPORT_SECTION = 2;
+var MEMORY_SECTION = 5;
+var LAST_SECTION = 13;
+var IMPORT_FUNC = 0;
+var IMPORT_TABLE = 1;
+var IMPORT_MEMORY = 2;
+var IMPORT_GLOBAL = 3;
+var IMPORT_TAG = 4;
+var HAS_MAX = 1;
+var SHARED = 2;
+var PAGE_SIZE = 8;
+
+class Unreadable extends Error {
+}
+
+class Reader {
+  bytes;
+  pos;
+  end;
+  constructor(bytes, pos, end) {
+    this.bytes = bytes;
+    this.pos = pos;
+    this.end = end;
+  }
+  byte() {
+    if (this.pos >= this.end)
+      throw new Unreadable;
+    return this.bytes[this.pos++];
+  }
+  leb() {
+    let value = 0;
+    for (let i = 0;i < 10; i++) {
+      const b = this.byte();
+      value += (b & 127) * 2 ** (7 * i);
+      if ((b & 128) === 0)
+        return value;
+    }
+    throw new Unreadable;
+  }
+  skip(n) {
+    if (this.pos + n > this.end)
+      throw new Unreadable;
+    this.pos += n;
+  }
+  limits() {
+    const flags = this.byte();
+    if (flags > 15)
+      throw new Unreadable;
+    this.leb();
+    if (flags & HAS_MAX)
+      this.leb();
+    if (flags & PAGE_SIZE)
+      this.leb();
+    return flags;
+  }
+  valueType() {
+    const t = this.byte();
+    if (t === 99 || t === 100)
+      this.leb();
+  }
+}
+function importsShared(r) {
+  const count2 = r.leb();
+  for (let i = 0;i < count2; i++) {
+    r.skip(r.leb());
+    r.skip(r.leb());
+    switch (r.byte()) {
+      case IMPORT_FUNC:
+        r.leb();
+        break;
+      case IMPORT_TABLE:
+        r.valueType();
+        r.limits();
+        break;
+      case IMPORT_MEMORY:
+        if (r.limits() & SHARED)
+          return true;
+        break;
+      case IMPORT_GLOBAL:
+        r.valueType();
+        r.byte();
+        break;
+      case IMPORT_TAG:
+        r.byte();
+        r.leb();
+        break;
+      default:
+        throw new Unreadable;
+    }
+  }
+  return false;
+}
+function declaresShared(r) {
+  const count2 = r.leb();
+  let shared = false;
+  for (let i = 0;i < count2; i++)
+    if (r.limits() & SHARED)
+      shared = true;
+  return shared;
+}
+function sharedMemory(bytes) {
+  if (bytes.length < HEADER.length || HEADER.some((b, i) => bytes[i] !== b))
+    return null;
+  const top = new Reader(bytes, HEADER.length, bytes.length);
+  try {
+    while (top.pos < bytes.length) {
+      const id = top.byte();
+      const size2 = top.leb();
+      if (id > LAST_SECTION)
+        return null;
+      if (id !== CUSTOM_SECTION && id > MEMORY_SECTION)
+        return false;
+      const start = top.pos;
+      top.skip(size2);
+      const section = new Reader(bytes, start, start + size2);
+      if (id === IMPORT_SECTION && importsShared(section))
+        return true;
+      if (id === MEMORY_SECTION)
+        return declaresShared(section);
+    }
+    return null;
+  } catch (error) {
+    if (error instanceof Unreadable)
+      return null;
+    throw error;
+  }
+}
 // ../scan-rules/src/index.ts
 var HEAD_BYTES = 16;
 var TEXT_EXTENSIONS = new Set(["html", "htm", "xhtml", "js", "mjs", "cjs", "css", "json", "svg", "txt", "xml"]);
@@ -948,6 +1750,61 @@ function refusalSentence(findings) {
   return `${first.message} Also refused: ${shown}${more}.`;
 }
 
+// src/files.ts
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { open, readdir as readdir2, readFile as readFile4, realpath, stat } from "node:fs/promises";
+import { join as join4, relative } from "node:path";
+
+// src/ignore.ts
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0;i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*" && glob[i + 1] === "*") {
+      if (glob[i + 2] === "/") {
+        re += "(?:.*/)?";
+        i += 2;
+      } else {
+        re += ".*";
+        i += 1;
+      }
+    } else if (c === "*")
+      re += "[^/]*";
+    else if (c === "?")
+      re += "[^/]";
+    else
+      re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${re}$`);
+}
+function parseIgnore(text) {
+  const rules = [];
+  for (const raw of text.split(/\r?\n/)) {
+    let line = raw.trim();
+    if (!line || line.startsWith("#") || line.startsWith("!"))
+      continue;
+    const dirOnly = line.endsWith("/");
+    if (dirOnly)
+      line = line.replace(/\/+$/, "");
+    const anchored = line.startsWith("/") || line.includes("/");
+    line = line.replace(/^\/+/, "");
+    const re = globToRegExp(line);
+    rules.push((path, isDir) => {
+      if (dirOnly && !isDir)
+        return false;
+      if (anchored)
+        return re.test(path);
+      return re.test(path.slice(path.lastIndexOf("/") + 1));
+    });
+  }
+  return rules;
+}
+function isIgnored(rules, path) {
+  const parts = path.split("/");
+  return rules.some((rule) => rule(path, false) || parts.slice(0, -1).some((_, i) => rule(parts.slice(0, i + 1).join("/"), true)));
+}
+
 // ../../src/lib/file-magic.ts
 function isJpeg(bytes) {
   return bytes.length >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255;
@@ -981,22 +1838,22 @@ var ascii = (b, i, n) => String.fromCharCode(...b.subarray(i, i + n));
 function mp4Seconds(b) {
   const boxes = (start, end, visit) => {
     for (let at = start;at + 8 <= end; ) {
-      let size = u32(b, at);
+      let size2 = u32(b, at);
       const type = ascii(b, at + 4, 4);
       let body = at + 8;
-      if (size === 1) {
+      if (size2 === 1) {
         if (at + 16 > end)
           return null;
-        size = u64(b, at + 8);
+        size2 = u64(b, at + 8);
         body = at + 16;
-      } else if (size === 0)
-        size = end - at;
-      if (size < body - at || at + size > end)
+      } else if (size2 === 0)
+        size2 = end - at;
+      if (size2 < body - at || at + size2 > end)
         return null;
-      const found = visit(type, body, at + size);
+      const found = visit(type, body, at + size2);
       if (found !== undefined)
         return found;
-      at += size;
+      at += size2;
     }
     return null;
   };
@@ -1008,10 +1865,10 @@ function mp4Seconds(b) {
     if (scaleAt + (version2 === 1 ? 12 : 8) > innerEnd)
       return null;
     const scale = u32(b, scaleAt);
-    const duration = version2 === 1 ? u64(b, scaleAt + 4) : u32(b, scaleAt + 4);
-    if (!scale || !duration || duration === 4294967295)
+    const duration2 = version2 === 1 ? u64(b, scaleAt + 4) : u32(b, scaleAt + 4);
+    if (!scale || !duration2 || duration2 === 4294967295)
       return null;
-    return duration / scale;
+    return duration2 / scale;
   }));
 }
 function ebmlId(b, at) {
@@ -1031,13 +1888,13 @@ function ebmlSize(b, at) {
     length++;
   if (length > 8 || at + length > b.length)
     return null;
-  let size = first & 255 >> length;
-  let allOnes = size === 255 >> length;
+  let size2 = first & 255 >> length;
+  let allOnes = size2 === 255 >> length;
   for (let i = 1;i < length; i++) {
-    size = size * 256 + b[at + i];
+    size2 = size2 * 256 + b[at + i];
     allOnes &&= b[at + i] === 255;
   }
-  return { size: allOnes ? null : size, next: at + length };
+  return { size: allOnes ? null : size2, next: at + length };
 }
 var SEGMENT = 408125543;
 var INFO = 357149030;
@@ -1047,18 +1904,18 @@ function webmSeconds(b) {
   const view = new DataView(b.buffer, b.byteOffset, b.byteLength);
   for (let at = 0;at < b.length; ) {
     const id = ebmlId(b, at);
-    const size = id && ebmlSize(b, id.next);
-    if (!id || !size)
+    const size2 = id && ebmlSize(b, id.next);
+    if (!id || !size2)
       return null;
     if (id.id === SEGMENT) {
-      at = size.next;
+      at = size2.next;
       continue;
     }
-    if (id.id === INFO && size.size !== null) {
+    if (id.id === INFO && size2.size !== null) {
       let scale = 1e6;
-      let duration = null;
-      const end = Math.min(size.next + size.size, b.length);
-      for (let i = size.next;i < end; ) {
+      let duration2 = null;
+      const end = Math.min(size2.next + size2.size, b.length);
+      for (let i = size2.next;i < end; ) {
         const child = ebmlId(b, i);
         const childSize = child && ebmlSize(b, child.next);
         if (!child || !childSize || childSize.size === null)
@@ -1071,16 +1928,16 @@ function webmSeconds(b) {
           for (let j = 0;j < childSize.size; j++)
             scale = scale * 256 + b[body + j];
         } else if (child.id === DURATION && (childSize.size === 4 || childSize.size === 8)) {
-          duration = childSize.size === 4 ? view.getFloat32(body) : view.getFloat64(body);
+          duration2 = childSize.size === 4 ? view.getFloat32(body) : view.getFloat64(body);
         }
         i = body + childSize.size;
       }
-      const seconds = duration !== null ? duration * scale / 1e9 : null;
-      return seconds && Number.isFinite(seconds) && seconds > 0 ? seconds : null;
+      const seconds2 = duration2 !== null ? duration2 * scale / 1e9 : null;
+      return seconds2 && Number.isFinite(seconds2) && seconds2 > 0 ? seconds2 : null;
     }
-    if (size.size === null)
+    if (size2.size === null)
       return null;
-    at = size.next + size.size;
+    at = size2.next + size2.size;
   }
   return null;
 }
@@ -1160,10 +2017,10 @@ var MEDIA_RULES = {
 var CLIP_MIN_SECONDS = 5;
 var CLIP_MAX_SECONDS = 10;
 var CLIP_SLACK_SECONDS = 0.25;
-function clipLengthProblem(seconds) {
-  if (seconds < CLIP_MIN_SECONDS - CLIP_SLACK_SECONDS)
+function clipLengthProblem(seconds2) {
+  if (seconds2 < CLIP_MIN_SECONDS - CLIP_SLACK_SECONDS)
     return "short";
-  if (seconds > CLIP_MAX_SECONDS + CLIP_SLACK_SECONDS)
+  if (seconds2 > CLIP_MAX_SECONDS + CLIP_SLACK_SECONDS)
     return "long";
   return null;
 }
@@ -1171,40 +2028,219 @@ var MAX_PICTURE_SIDE = 4096;
 function mediaPath(raw) {
   return raw.replace(/\\/g, "/").replace(/^(\.\/)+/, "");
 }
-var megabytes = (bytes) => `${String(Math.ceil(bytes / (1024 * 1024) * 10) / 10)} MB`;
-function mediaProblem(kind, path, size, bytes, missing = "is not among the files published") {
-  const rule = MEDIA_RULES[kind];
-  const extension = /\.([^./]+)$/.exec(path)?.[1]?.toLowerCase() ?? "";
-  if (!rule.extensions.includes(extension))
-    return `"${kind}" must be ${rule.what} (${rule.extensions.map((e) => `.${e}`).join(", ")}), and ${path} is not.`;
-  if (size === undefined)
-    return `"${kind}" names ${path}, which ${missing}.`;
-  if (size > rule.maxBytes) {
-    return `"${kind}" must be ${megabytes(rule.maxBytes)} at most, and ${path} is ${megabytes(size)}.${kind === "clip" ? ` A 480p clip of ${CLIP_MIN_SECONDS} to ${CLIP_MAX_SECONDS} seconds fits.` : ""}`;
+var megabytes = (bytes) => `${String(Math.ceil(bytes / (1024 * 1024) * 10) / 10)} MB`;
+function mediaProblem(kind, path, size2, bytes, missing = "is not among the files published") {
+  const rule = MEDIA_RULES[kind];
+  const extension = /\.([^./]+)$/.exec(path)?.[1]?.toLowerCase() ?? "";
+  if (!rule.extensions.includes(extension))
+    return `"${kind}" must be ${rule.what} (${rule.extensions.map((e) => `.${e}`).join(", ")}), and ${path} is not.`;
+  if (size2 === undefined)
+    return `"${kind}" names ${path}, which ${missing}.`;
+  if (size2 > rule.maxBytes) {
+    return `"${kind}" must be ${megabytes(rule.maxBytes)} at most, and ${path} is ${megabytes(size2)}.${kind === "clip" ? ` A 480p clip of ${CLIP_MIN_SECONDS} to ${CLIP_MAX_SECONDS} seconds fits.` : ""}`;
+  }
+  if (!bytes)
+    return null;
+  if (!rule.bytes(bytes))
+    return `${path} is not ${rule.what} by its contents, so it cannot be the "${kind}".`;
+  if (kind === "clip") {
+    const seconds2 = clipHeaderSeconds(bytes);
+    if (seconds2 !== null && clipLengthProblem(seconds2)) {
+      return `${path} is ${seconds2.toFixed(1)} seconds long. Keep your clip between ${CLIP_MIN_SECONDS} and ${CLIP_MAX_SECONDS} seconds.`;
+    }
+  } else {
+    const picture = pictureSize(bytes);
+    if (picture && (picture.width > MAX_PICTURE_SIDE || picture.height > MAX_PICTURE_SIDE)) {
+      return `${path} is ${picture.width} by ${picture.height} pixels. Keep your thumbnail to ${MAX_PICTURE_SIDE} pixels or less on each side.`;
+    }
+  }
+  return null;
+}
+
+// src/project.ts
+import { readdir, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join3, win32 } from "node:path";
+var SPACE_TYPES = ["game", "world", "tool", "wonder"];
+var DEVICES = ["desktop", "mobile", "vr"];
+var PROJECT_FILE = "velven.json";
+var isProjectName = (name) => name.toLowerCase() === PROJECT_FILE;
+function servableSegment(segment) {
+  return !alwaysLeftOut(segment) && !/[. ]$/.test(segment) && !/[:~]/.test(segment);
+}
+function alwaysLeftOut(segment) {
+  return segment.startsWith(".") || segment.toLowerCase() === "node_modules" || isProjectName(segment);
+}
+function servableRelative(rel) {
+  return rel !== "" && !win32.isAbsolute(rel) && rel.split(/[\\/]/).every(servableSegment);
+}
+async function readProject(dir) {
+  const names = await readdir(dir).catch(() => []);
+  const path = join3(dir, names.includes(PROJECT_FILE) ? PROJECT_FILE : names.find(isProjectName) ?? PROJECT_FILE);
+  let text;
+  try {
+    text = await readFile3(path, "utf8");
+  } catch {
+    return { path, exists: false, data: {} };
+  }
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch (e) {
+    throw new CliError(`${PROJECT_FILE} is not valid JSON (${e instanceof Error ? e.message : String(e)}).`, EXIT.usage, "invalid_config");
+  }
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    throw new CliError(`${PROJECT_FILE} must hold one JSON object, like {"title": "My game"}.`, EXIT.usage, "invalid_config");
+  }
+  return { path, exists: true, data };
+}
+async function updateProject(project, values) {
+  for (const [key, value] of Object.entries(values)) {
+    if (value === undefined)
+      delete project.data[key];
+    else
+      project.data[key] = value;
+  }
+  await writeFile3(project.path, `${JSON.stringify(project.data, null, 2)}
+`);
+  project.exists = true;
+}
+function list2(value) {
+  return value.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+}
+function withFlags(data, flags) {
+  const out = { ...data };
+  if (flags.title !== undefined)
+    out.title = flags.title;
+  if (flags.type !== undefined)
+    out.type = flags.type.trim().toLowerCase();
+  if (flags.devices !== undefined)
+    out.devices = list2(flags.devices);
+  if (flags.description !== undefined)
+    out.description = flags.description;
+  if (flags.engine !== undefined)
+    out.engine = flags.engine;
+  return out;
+}
+var REQUIRED = ["title", "type", "devices"];
+function requiredProblem(field, value) {
+  if (value === undefined || value === null || value === "" || Array.isArray(value) && value.length === 0)
+    return "missing";
+  if (field === "title") {
+    if (typeof value !== "string" || !value.trim())
+      return "must be text";
+    if (value.trim().length > 80)
+      return "must be under 80 characters";
+    return null;
+  }
+  if (field === "type") {
+    return typeof value === "string" && SPACE_TYPES.includes(value) ? null : `must be one of ${SPACE_TYPES.join(", ")}`;
+  }
+  if (!Array.isArray(value) || !value.every((d) => typeof d === "string" && DEVICES.includes(d))) {
+    return `must be a list from ${DEVICES.join(", ")}, like ["desktop", "mobile"]`;
+  }
+  return null;
+}
+var isString = (v) => typeof v === "string";
+var isStringList = (v) => Array.isArray(v) && v.every(isString);
+var isBoolean = (v) => typeof v === "boolean";
+function isInsidePath(v) {
+  return isString(v) && !!v && !/^[\\/]/.test(v) && !v.split(/[\\/]/).includes("..");
+}
+function isStart(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v))
+    return false;
+  const s = v;
+  const keys = Object.keys(s);
+  if (keys.length !== 1)
+    return false;
+  if ("key" in s)
+    return typeof s.key === "string" && s.key.length > 0;
+  if ("click" in s) {
+    if (typeof s.click === "string")
+      return s.click.length > 0;
+    return Array.isArray(s.click) && s.click.length === 2 && s.click.every((n) => typeof n === "number" && Number.isFinite(n));
+  }
+  return false;
+}
+var OPTIONAL = {
+  description: [(v) => isString(v) && v.length <= 160, "must be one line of text, under 160 characters"],
+  engine: [isString, 'must be text, like "three.js"'],
+  ai_tools: [isStringList, "must be a list of text"],
+  models: [isStringList, "must be a list of text"],
+  how_made: [(v) => isString(v) && v.length <= 2000, "must be text, under 2000 characters"],
+  source_url: [isString, "must be a web address"],
+  entry: [isInsidePath, 'must be a path inside the folder, like "index.html"'],
+  thumbnail: [isInsidePath, 'must be a path inside the folder, like "media/thumbnail.jpg"'],
+  clip: [isInsidePath, 'must be a path inside the folder, like "media/clip.mp4"'],
+  spa: [isBoolean, "must be true or false"],
+  sdk: [isBoolean, "must be true or false"],
+  toasts: [isBoolean, "must be true or false"],
+  crossOriginIsolated: [isBoolean, "must be true or false"],
+  start: [isStart, 'must be {"click": "Play"}, {"click": [x, y]} or {"key": "Space"}'],
+  space: [(v) => isString(v) && /^[a-z0-9][a-z0-9-]*$/.test(v), `must be a space's slug, like "my-game"`],
+  claim: [(v) => isString(v) && !!v, "must be the claim token a publish without an account saved"]
+};
+function optionalProblems(data) {
+  const problems = [];
+  for (const [field, [ok, rule]] of Object.entries(OPTIONAL)) {
+    if (data[field] === undefined)
+      continue;
+    if (!ok(data[field]))
+      problems.push(`"${field}" ${rule}`);
+  }
+  return problems;
+}
+function requiredProblems(data) {
+  return REQUIRED.flatMap((field) => {
+    const problem = requiredProblem(field, data[field]);
+    return problem ? [{ field, problem }] : [];
+  });
+}
+var QUESTIONS = {
+  title: "Title, the name people see on Velven: ",
+  type: `Type (${SPACE_TYPES.join(", ")}): `,
+  devices: `Devices it works on, comma separated (${DEVICES.join(", ")}): `
+};
+function parseAnswer(field, answer) {
+  if (field === "title")
+    return answer.trim();
+  if (field === "type")
+    return answer.trim().toLowerCase();
+  return list2(answer);
+}
+async function completeRequired(ctx, project, merged, canAsk) {
+  const problems = requiredProblems(merged);
+  if (problems.length === 0)
+    return merged;
+  if (!canAsk) {
+    const lines = problems.map(({ field, problem }) => `"${field}" ${problem === "missing" ? "is missing" : problem}`);
+    throw new CliError(`velven.json needs ${problems.map((p) => p.field).join(", ")}: ${lines.join("; ")}. Add them to velven.json or pass --${problems[0].field}.`, EXIT.usage, "missing_fields", problems.map((p) => p.field));
   }
-  if (!bytes)
-    return null;
-  if (!rule.bytes(bytes))
-    return `${path} is not ${rule.what} by its contents, so it cannot be the "${kind}".`;
-  if (kind === "clip") {
-    const seconds = clipHeaderSeconds(bytes);
-    if (seconds !== null && clipLengthProblem(seconds)) {
-      return `${path} is ${seconds.toFixed(1)} seconds long. Keep your clip between ${CLIP_MIN_SECONDS} and ${CLIP_MAX_SECONDS} seconds.`;
-    }
-  } else {
-    const picture = pictureSize(bytes);
-    if (picture && (picture.width > MAX_PICTURE_SIDE || picture.height > MAX_PICTURE_SIDE)) {
-      return `${path} is ${picture.width} by ${picture.height} pixels. Keep your thumbnail to ${MAX_PICTURE_SIDE} pixels or less on each side.`;
+  ctx.out(`velven.json needs ${problems.map((p) => p.field).join(", ")}. Your answers are saved into it.`);
+  const answers = {};
+  for (const { field, problem } of problems) {
+    if (problem !== "missing")
+      ctx.out(`"${field}" ${problem}.`);
+    for (;; ) {
+      const value = parseAnswer(field, await ctx.ask(QUESTIONS[field]));
+      const again = requiredProblem(field, value);
+      if (!again) {
+        answers[field] = value;
+        break;
+      }
+      ctx.out(again === "missing" ? `Please answer: ${field} is required.` : `That ${field} ${again}.`);
     }
   }
-  return null;
+  await updateProject(project, answers);
+  return { ...merged, ...answers };
 }
 
 // src/files.ts
-var ACCOUNT_LIMITS = { maxBytes: 100 * 1024 * 1024, maxFiles: 2000 };
-var GUEST_LIMITS = { maxBytes: 50 * 1024 * 1024, maxFiles: 1000 };
+var MB = 1024 * 1024;
+var ACCOUNT_LIMITS = { maxBytes: 512 * MB, maxFiles: 5000 };
+var GUEST_LIMITS = { maxBytes: 50 * MB, maxFiles: 1000 };
 async function walk(root, skipped = () => {}) {
-  const realRoot = await realpath2(root);
+  const realRoot = await realpath(root);
   let rules = [];
   try {
     rules = parseIgnore(await readFile4(join4(root, ".velvenignore"), "utf8"));
@@ -1213,7 +2249,7 @@ async function walk(root, skipped = () => {}) {
   }
   const out = [];
   async function visit(rel, chain) {
-    const entries = await readdir3(join4(root, rel), { withFileTypes: true });
+    const entries = await readdir2(join4(root, rel), { withFileTypes: true });
     entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     for (const entry of entries) {
       if (alwaysLeftOut(entry.name))
@@ -1228,9 +2264,9 @@ async function walk(root, skipped = () => {}) {
       let isFile = entry.isFile();
       let real = join4(chain[chain.length - 1], entry.name);
       if (entry.isSymbolicLink()) {
-        const target = await stat2(abs).catch(() => null);
-        const resolved = await realpath2(abs).catch(() => null);
-        if (!target || !resolved || !servableRelative(relative2(realRoot, resolved)) || chain.includes(resolved)) {
+        const target = await stat(abs).catch(() => null);
+        const resolved = await realpath(abs).catch(() => null);
+        if (!target || !resolved || !servableRelative(relative(realRoot, resolved)) || chain.includes(resolved)) {
           skipped(path);
           continue;
         }
@@ -1243,7 +2279,7 @@ async function walk(root, skipped = () => {}) {
       if (isDir)
         await visit(path, [...chain, real]);
       else if (isFile)
-        out.push({ path, abs, size: (await stat2(abs)).size });
+        out.push({ path, abs, size: (await stat(abs)).size });
     }
   }
   await visit("", [realRoot]);
@@ -1279,18 +2315,39 @@ async function readHead(abs) {
     await handle.close();
   }
 }
+var SCAN_WINDOW = 8 * MB;
+var SCAN_OVERLAP = 64 * 1024;
+async function fileFindings(file) {
+  if (!scansContent(file.path) || isCompressed(file.path))
+    return refuseFindings(file.path, await readHead(file.abs));
+  const encoding = extensionOf(file.path) === "wasm" ? "latin1" : "utf8";
+  const handle = await open(file.abs, "r");
+  try {
+    const window = Buffer.alloc(Math.min(SCAN_WINDOW, file.size));
+    let findings;
+    let lineOffset = 0;
+    for (let start = 0;; ) {
+      const { bytesRead } = await handle.read(window, 0, window.length, start);
+      const bytes = window.subarray(0, bytesRead);
+      findings ??= refuseFindings(file.path, bytes.subarray(0, HEAD_BYTES));
+      const hit = textHits(bytes.toString(encoding))[0];
+      if (hit)
+        return [...findings, refuseFinding(hit.line ? { ...hit, line: hit.line + lineOffset } : hit, file.path)];
+      if (bytesRead < window.length || start + bytesRead >= file.size)
+        return findings;
+      const carry = bytesRead - SCAN_OVERLAP;
+      for (let at = bytes.indexOf(10);at !== -1 && at < carry; at = bytes.indexOf(10, at + 1))
+        lineOffset++;
+      start += carry;
+    }
+  } finally {
+    await handle.close();
+  }
+}
 async function refusePrograms(files) {
   const found = new Map;
   await eachLimit(files, 8, async (file) => {
-    let head;
-    let text;
-    if (scansContent(file.path) && !isCompressed(file.path)) {
-      const bytes = await readFile4(file.abs);
-      head = bytes.subarray(0, HEAD_BYTES);
-      text = bytes.toString(extensionOf(file.path) === "wasm" ? "latin1" : "utf8");
-    } else
-      head = await readHead(file.abs);
-    const findings2 = refuseFindings(file.path, head, text);
+    const findings2 = await fileFindings(file);
     if (findings2.length)
       found.set(file.path, findings2);
   });
@@ -1319,31 +2376,378 @@ async function checkMedia(config, files) {
   return out;
 }
 function hashFile(abs) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     const hash = createHash("sha256");
-    createReadStream(abs).on("data", (chunk) => hash.update(chunk)).on("error", reject).on("end", () => resolve2(hash.digest("hex")));
+    createReadStream(abs).on("data", (chunk) => hash.update(chunk)).on("error", reject).on("end", () => resolve(hash.digest("hex")));
   });
 }
-async function hashAll(files) {
+var HASH_CHUNK = 4 * MB;
+async function hashPieces(file, pieceBytes) {
+  const handle = await open(file.abs, "r");
+  try {
+    const chunk = Buffer.alloc(Math.min(pieceBytes, HASH_CHUNK));
+    const pieces = [];
+    for (let start = 0;start < file.size; start += pieceBytes) {
+      const end = Math.min(start + pieceBytes, file.size);
+      const hash = createHash("sha256");
+      for (let at = start;at < end; ) {
+        const { bytesRead } = await handle.read(chunk, 0, Math.min(chunk.length, end - at), at);
+        if (bytesRead === 0)
+          throw new CliError(`${file.path} changed while it was read. Publish again once it is written.`, EXIT.failed, "file_changed");
+        hash.update(chunk.subarray(0, bytesRead));
+        at += bytesRead;
+      }
+      pieces.push(hash.digest("hex"));
+    }
+    return pieces;
+  } finally {
+    await handle.close();
+  }
+}
+async function hashAll(files, pieceBytes = PIECE_BYTES) {
   await eachLimit(files, 8, async (file) => {
-    file.sha256 = await hashFile(file.abs);
+    if (file.size > pieceBytes) {
+      file.pieces = await hashPieces(file, pieceBytes);
+      file.sha256 = undefined;
+    } else {
+      file.sha256 = await hashFile(file.abs);
+      file.pieces = undefined;
+    }
+  });
+}
+
+// src/dev.ts
+var TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".htm": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".cjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".map": "application/json; charset=utf-8",
+  ".txt": "text/plain; charset=utf-8",
+  ".csv": "text/csv; charset=utf-8",
+  ".xml": "application/xml; charset=utf-8",
+  ".wasm": "application/wasm",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+  ".bmp": "image/bmp",
+  ".mp3": "audio/mpeg",
+  ".ogg": "audio/ogg",
+  ".oga": "audio/ogg",
+  ".opus": "audio/ogg",
+  ".wav": "audio/wav",
+  ".m4a": "audio/mp4",
+  ".aac": "audio/aac",
+  ".flac": "audio/flac",
+  ".mp4": "video/mp4",
+  ".m4v": "video/mp4",
+  ".webm": "video/webm",
+  ".mov": "video/quicktime",
+  ".ttf": "font/ttf",
+  ".otf": "font/otf",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".glb": "model/gltf-binary",
+  ".gltf": "model/gltf+json",
+  ".pdf": "application/pdf",
+  ".mem": "application/octet-stream",
+  ".basis": "application/octet-stream",
+  ".wgsl": "text/plain; charset=utf-8"
+};
+var ENCODINGS = { ".br": "br", ".gz": "gzip" };
+var UNITY_BROTLI = "UnityWeb Compressed Content (brotli)";
+var SNIFF_BYTES = 64;
+function sniffUnityweb(head) {
+  if (head[0] === 31 && head[1] === 139)
+    return "gzip";
+  if (Buffer.from(head.subarray(0, SNIFF_BYTES)).toString("latin1").includes(UNITY_BROTLI))
+    return "br";
+  return;
+}
+var typeOfName = (name) => TYPES[extname(name).toLowerCase()] ?? "application/octet-stream";
+function contentType(path, head) {
+  const ext = extname(path).toLowerCase();
+  const encoding = ext === ".unityweb" ? head && sniffUnityweb(head) : ENCODINGS[ext];
+  if (encoding)
+    return { type: typeOfName(path.slice(0, -ext.length)), encoding };
+  return { type: typeOfName(path) };
+}
+var WASM_HEAD_BYTES = 1024 * 1024;
+var ISOLATION_HEADER = { "Document-Isolation-Policy": "isolate-and-credentialless" };
+async function readStart(abs, length) {
+  const handle = await open2(abs, "r");
+  try {
+    const head = new Uint8Array(length);
+    const { bytesRead } = await handle.read(head, 0, length, 0);
+    return head.subarray(0, bytesRead);
+  } finally {
+    await handle.close();
+  }
+}
+function inflatedStart(abs, encoding) {
+  return new Promise((resolveHead) => {
+    const source = createReadStream2(abs);
+    const inflate = encoding === "gzip" ? createGunzip() : createBrotliDecompress();
+    const chunks = [];
+    let size2 = 0;
+    let done = false;
+    const finish2 = () => {
+      if (done)
+        return;
+      done = true;
+      source.destroy();
+      inflate.destroy();
+      resolveHead(new Uint8Array(Buffer.concat(chunks).subarray(0, WASM_HEAD_BYTES)));
+    };
+    inflate.on("data", (chunk) => {
+      chunks.push(chunk);
+      size2 += chunk.length;
+      if (size2 >= WASM_HEAD_BYTES)
+        finish2();
+    });
+    inflate.on("end", finish2);
+    inflate.on("error", finish2);
+    source.on("error", finish2);
+    source.pipe(inflate);
+  });
+}
+async function threadedModules(root) {
+  const shared = [];
+  await eachLimit(await walk(root), 4, async (file) => {
+    const name = file.path.toLowerCase();
+    let encoding;
+    if (name.endsWith(".wasm.br"))
+      encoding = "br";
+    else if (name.endsWith(".wasm.gz"))
+      encoding = "gzip";
+    else if (name.endsWith(".wasm.unityweb"))
+      encoding = sniffUnityweb(await readStart(file.abs, SNIFF_BYTES));
+    else if (!name.endsWith(".wasm"))
+      return;
+    const head = encoding ? await inflatedStart(file.abs, encoding) : await readStart(file.abs, WASM_HEAD_BYTES);
+    if (sharedMemory(head) === true)
+      shared.push(file.path);
+  });
+  return shared.sort();
+}
+function injectSdk(html, src) {
+  if (/<script[^>]+src=["'][^"']*\/sdk\/v1\.js/i.test(html))
+    return html;
+  const tag = `<script src="${src}" async></script>`;
+  const head = html.search(/<\/head>/i);
+  if (head !== -1)
+    return html.slice(0, head) + tag + html.slice(head);
+  const body = html.search(/<body[\s>]/i);
+  if (body !== -1)
+    return html.slice(0, body) + tag + html.slice(body);
+  return tag + html;
+}
+async function ignoreRules(root) {
+  return parseIgnore(await readFile5(join5(root, ".velvenignore"), "utf8").catch(() => ""));
+}
+async function namedAsOnDisk(base, rel) {
+  const parts = rel.split("/").filter(Boolean);
+  for (let i = 0;i < parts.length; i++) {
+    const names = await readdir3(join5(base, ...parts.slice(0, i))).catch(() => []);
+    if (!names.includes(parts[i]))
+      return false;
+  }
+  return true;
+}
+async function statExact(base, rel) {
+  const info = await stat2(join5(base, rel)).catch(() => null);
+  return info && await namedAsOnDisk(base, rel) ? info : null;
+}
+async function startDevServer(root, options) {
+  const base = resolve(root);
+  const realBase = await realpath2(base);
+  const server = createServer(async (req, res) => {
+    const send2 = (status, body2, headers2 = {}) => {
+      res.writeHead(status, { "cache-control": "no-store", ...options.isolated ? ISOLATION_HEADER : {}, ...headers2 });
+      res.end(req.method === "HEAD" ? undefined : body2);
+    };
+    if (req.method !== "GET" && req.method !== "HEAD")
+      return send2(405, "Method not allowed", { allow: "GET, HEAD" });
+    let path;
+    try {
+      path = decodeURIComponent(new URL(req.url ?? "/", "http://localhost").pathname);
+    } catch {
+      return send2(400, "Bad path");
+    }
+    const parts = path.split("/").filter(Boolean);
+    if (!parts.every(servableSegment))
+      return send2(404, "Not found", { "content-type": "text/plain; charset=utf-8" });
+    let rel = parts.join("/");
+    let file = resolve(base, rel);
+    if (file !== base && !file.startsWith(base + sep))
+      return send2(404, "Not found");
+    let info = await statExact(base, rel);
+    if (info?.isDirectory()) {
+      if (!path.endsWith("/"))
+        return send2(301, "", { location: `${path}/` });
+      rel = rel ? `${rel}/index.html` : options.entry;
+      file = join5(base, rel);
+      info = await statExact(base, rel);
+    }
+    const rules = await ignoreRules(base);
+    if (info?.isFile() && isIgnored(rules, rel))
+      info = null;
+    if (!info?.isFile() && options.spa && !extname(path)) {
+      rel = options.entry;
+      file = join5(base, rel);
+      info = await statExact(base, rel);
+    }
+    if (info?.isFile() && isIgnored(rules, rel))
+      info = null;
+    if (!info?.isFile()) {
+      options.onMissing?.(path);
+      return send2(404, "Not found", { "content-type": "text/plain; charset=utf-8" });
+    }
+    const real = await realpath2(file).catch(() => null);
+    if (!real || !servableRelative(relative2(realBase, real))) {
+      return send2(404, "Not found", { "content-type": "text/plain; charset=utf-8" });
+    }
+    let body = await readFile5(file);
+    const { type, encoding } = contentType(file, body);
+    if (rel === options.entry && options.sdkSrc && !encoding)
+      body = injectSdk(body.toString("utf8"), options.sdkSrc);
+    const headers = { "content-type": type, "content-length": String(Buffer.byteLength(body)) };
+    if (encoding)
+      headers["content-encoding"] = encoding;
+    send2(200, body, headers);
   });
+  await new Promise((resolveListen, reject) => {
+    server.once("error", reject);
+    server.listen(options.port, "127.0.0.1", () => resolveListen());
+  });
+  const { port } = server.address();
+  return {
+    url: `http://localhost:${port}`,
+    close: () => new Promise((done) => {
+      server.closeAllConnections();
+      server.close(() => done());
+    })
+  };
+}
+async function dev(ctx, dirArg, portFlag) {
+  const dir = resolve(ctx.cwd, dirArg ?? ".");
+  const info = await stat2(dir).catch(() => null);
+  if (!info?.isDirectory())
+    throw new CliError(`There is no folder at ${dir}.`, EXIT.usage, "usage");
+  const port = portFlag === undefined ? 0 : Number(portFlag);
+  if (!Number.isInteger(port) || port < 0 || port > 65535)
+    throw new CliError("--port must be a number from 1 to 65535.", EXIT.usage, "usage");
+  const { data } = await readProject(dir);
+  const shape = optionalProblems(data);
+  if (shape.length)
+    throw new CliError(`velven.json has problems: ${shape.join("; ")}.`, EXIT.usage, "invalid_config");
+  const base = apiBase(ctx);
+  const entry = typeof data.entry === "string" ? data.entry : "index.html";
+  if (!(await stat2(join5(dir, entry)).catch(() => null))?.isFile()) {
+    throw new CliError(`The folder has no ${entry}. Add one, or name the page to open with "entry" in velven.json.`, EXIT.usage, "no_entry");
+  }
+  const threaded = await threadedModules(dir);
+  const isolated = threaded.length > 0 || data.crossOriginIsolated === true;
+  let server;
+  try {
+    server = await startDevServer(dir, {
+      port,
+      entry,
+      spa: data.spa === true,
+      isolated,
+      sdkSrc: data.sdk === false ? null : `${base}/sdk/v1.js`,
+      onMissing: (path) => ctx.err(`Not found: ${path}`)
+    });
+  } catch (e) {
+    const busy = e instanceof Error && "code" in e && e.code === "EADDRINUSE";
+    throw new CliError(busy ? `Port ${port} is taken. Pick another with --port, or leave it out.` : `Could not start the server (${String(e)}).`, EXIT.failed, "server");
+  }
+  const slug = typeof data.space === "string" ? data.space : undefined;
+  const page = `${base}/dev?url=${encodeURIComponent(server.url)}${slug ? `&space=${encodeURIComponent(slug)}` : ""}`;
+  ctx.out(`Serving ${dir} at ${server.url}`);
+  if (threaded.length)
+    ctx.out("Cross-origin isolated (a threaded module)");
+  else if (isolated)
+    ctx.out('Cross-origin isolated ("crossOriginIsolated" in velven.json)');
+  ctx.out(`Play it on Velven: ${page}`);
+  if (!slug)
+    ctx.out("Scores and saves need a space: publish once so velven.json names it.");
+  ctx.out("Scores, saves and achievements made here go to the sandbox. Press Ctrl+C to stop.");
+  ctx.openBrowser(page);
+  await ctx.untilStopped();
+  await server.close();
+  return EXIT.ok;
 }
 
+// src/publish.ts
+import { stat as stat3 } from "node:fs/promises";
+import { resolve as resolve2 } from "node:path";
+
 // src/upload.ts
-import { readFile as readFile5 } from "node:fs/promises";
+import { open as open3 } from "node:fs/promises";
 var PARALLEL = 6;
 var ATTEMPTS = 4;
+function slicesOf(files, pieceBytes = PIECE_BYTES) {
+  const slices = new Map;
+  for (const file of files) {
+    const pieces = file.pieces;
+    if (pieces) {
+      pieces.forEach((sha, i) => {
+        const offset = i * pieceBytes;
+        if (!slices.has(sha))
+          slices.set(sha, { file, offset, length: Math.min(pieceBytes, file.size - offset), part: [i + 1, pieces.length] });
+      });
+    } else if (file.sha256 && !slices.has(file.sha256))
+      slices.set(file.sha256, { file, offset: 0, length: file.size });
+  }
+  return slices;
+}
+async function readSlice({ file, offset, length }) {
+  const handle = await open3(file.abs, "r");
+  try {
+    const body = Buffer.alloc(length);
+    let read = 0;
+    while (read < length) {
+      const { bytesRead } = await handle.read(body, read, length - read, offset + read);
+      if (bytesRead === 0)
+        throw new CliError(`${file.path} changed while it was read. Publish again once it is written.`, EXIT.failed, "file_changed");
+      read += bytesRead;
+    }
+    return body;
+  } finally {
+    await handle.close();
+  }
+}
 function retryable(status) {
   return status === null || status === 408 || status === 429 || status >= 500;
 }
-async function uploadMissing(ctx, base, targets, files, onDone) {
-  const byHash = new Map(files.map((f) => [f.sha256, f]));
+async function uploadMissing(ctx, base, targets, files, onProgress, pieceBytes = PIECE_BYTES) {
+  const slices = slicesOf(files, pieceBytes);
+  let failure = null;
   await eachLimit(targets, PARALLEL, async (target) => {
-    const file = byHash.get(target.sha256);
-    if (!file)
+    if (failure)
+      return;
+    try {
+      await send2(target);
+    } catch (e) {
+      failure ??= e;
+    }
+  });
+  if (failure)
+    throw failure;
+  async function send2(target) {
+    const slice = slices.get(target.sha256);
+    if (!slice)
       throw new CliError(`Velven asked for a file this folder does not have (${target.sha256.slice(0, 12)}).`, EXIT.failed, "bad_response");
-    const body = await readFile5(file.abs);
+    const body = await readSlice(slice);
     const url = new URL(target.url, base).toString();
     for (let attempt = 1;; attempt++) {
       let status = null;
@@ -1357,7 +2761,7 @@ async function uploadMissing(ctx, base, targets, files, onDone) {
         status = response.status;
         detail = (await response.text()).slice(0, 200);
         if (response.ok) {
-          onDone(file);
+          onProgress(slice.length);
           return;
         }
       } catch (e) {
@@ -1365,15 +2769,16 @@ async function uploadMissing(ctx, base, targets, files, onDone) {
       }
       if (!retryable(status) || attempt >= ATTEMPTS) {
         const why = status === null ? `could not connect: ${detail}` : `HTTP ${status}`;
-        throw new CliError(`Uploading ${file.path} failed (${why}). Run velven publish again; files already sent are kept.`, EXIT.failed, "upload_failed");
+        const what = slice.part ? `${slice.file.path} (part ${slice.part[0]} of ${slice.part[1]})` : slice.file.path;
+        throw new CliError(`Uploading ${what} failed (${why}). Run velven publish again; files already sent are kept.`, EXIT.failed, "upload_failed");
       }
       await ctx.sleep(500 * 2 ** (attempt - 1));
     }
-  });
+  }
 }
 
 // src/publish.ts
-var plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+var plural3 = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
 var DONE = ["live", "refused", "unjudged", "replaced", "preview"];
 var POLL_MS = 3000;
 var WAIT_LIMIT_MS = 20 * 60 * 1000;
@@ -1385,7 +2790,11 @@ function listingFields(config) {
   }
   return fields;
 }
-var PASSED = ["entry", "spa", "sdk", "start", "toasts", "boards", "achievements", "stats"];
+var PASSED = ["entry", "spa", "sdk", "start", "toasts", "crossOriginIsolated", "boards", "achievements", "stats"];
+function fileEntry(f) {
+  return f.pieces ? { path: f.path, size: f.size, pieces: f.pieces } : { path: f.path, size: f.size, sha256: f.sha256 ?? "" };
+}
+var hashesOf = (f) => f.pieces ?? (f.sha256 ? [f.sha256] : []);
 async function folderOf(ctx, arg) {
   const dir = resolve2(ctx.cwd, arg ?? ".");
   const info = await stat3(dir).catch(() => null);
@@ -1400,10 +2809,10 @@ async function folderOf(ctx, arg) {
 function spentClaim(error) {
   return error instanceof CliError && error.code === "claim_spent" ? new CliError(error.message, EXIT.auth, error.code) : null;
 }
-function claimedMeanwhile(base, slug, versionId, when) {
+function claimedMeanwhile(base, slug, versionId, when2) {
   return (error) => {
     if (error instanceof CliError && error.code === "claim_spent") {
-      if (when === "finish")
+      if (when2 === "finish")
         throw new CliError("The page was claimed before this version was finished. Run velven login and publish again.", EXIT.auth, error.code);
       const files = `${base}/s/${seg(slug)}/edit/files?version=${encodeURIComponent(versionId)}`;
       throw new CliError(`The page was claimed. Follow it on its Files tab: ${files}`, EXIT.auth, error.code);
@@ -1462,11 +2871,11 @@ async function publish(ctx, options) {
   if (guest)
     say(`By publishing you agree to Velven's Terms: ${terms}`);
   const total = files.reduce((sum, f) => sum + f.size, 0);
-  say(`Publishing ${plural(files.length, "file")} (${formatSize(total)}) from ${dir}`);
+  say(`Publishing ${plural3(files.length, "file")} (${formatSize(total)}) from ${dir}`);
   await hashAll(files);
   const body = {
     fields: listingFields(config),
-    files: files.map((f) => ({ path: f.path, size: f.size, sha256: f.sha256 }))
+    files: files.map(fileEntry)
   };
   if (typeof config.space === "string")
     body.space = config.space;
@@ -1494,11 +2903,13 @@ async function publish(ctx, options) {
     if (!notSaved)
       say(`Saved "space": "${slug}" in velven.json; later publishes update this space.`);
   }
-  const unique = new Set(files.map((f) => f.sha256)).size;
-  const sending = files.filter((f) => created.uploads.some((u) => u.sha256 === f.sha256));
-  const bytes = [...new Map(sending.map((f) => [f.sha256, f.size])).values()].reduce((a, b) => a + b, 0);
-  if (created.uploads.length) {
-    say(`Uploading ${created.uploads.length} of ${plural(unique, "file")} (${formatSize(bytes)}); the rest are already on Velven.`);
+  const distinct = [...new Map(files.map((f) => [hashesOf(f).join(","), f])).values()];
+  const wanted = new Set(created.uploads.map((u) => u.sha256));
+  const sending = distinct.filter((f) => hashesOf(f).some((sha) => wanted.has(sha))).length;
+  const slices = slicesOf(files);
+  const bytes = [...wanted].reduce((sum, sha) => sum + (slices.get(sha)?.length ?? 0), 0);
+  if (sending) {
+    say(`Uploading ${sending} of ${plural3(distinct.length, "file")} (${formatSize(bytes)}); the rest are already on Velven.`);
   } else
     say("Every file is already on Velven; nothing to upload.");
   await uploadMissing(ctx, base, created.uploads, files, () => {});
@@ -1514,8 +2925,8 @@ async function publish(ctx, options) {
     status: finished.status,
     watchUrl: finished.watchUrl,
     previewUrl: finished.previewUrl,
-    uploaded: created.uploads.length,
-    reused: unique - created.uploads.length,
+    uploaded: sending,
+    reused: distinct.length - sending,
     ...notSaved ? { notSaved } : {}
   };
   const number = created.version.number;
@@ -1641,7 +3052,7 @@ async function listVersions(api, slug) {
   const answer = await call(api, "GET", `/api/v1/hosting/spaces/${seg(slug)}/versions`);
   return Array.isArray(answer) ? answer : answer.versions;
 }
-function when(iso) {
+function when2(iso) {
   if (!iso)
     return "";
   const d = new Date(iso);
@@ -1650,8 +3061,8 @@ function when(iso) {
 function printVersions(ctx, rows) {
   for (const v of rows) {
     const live = v.live || v.status === "live" ? "*" : " ";
-    const size = v.files !== undefined ? `${v.files} files${v.size !== undefined ? `, ${formatSize(v.size)}` : ""}` : "";
-    const cols = [`${live} ${String(v.number).padStart(3)}`, v.status.padEnd(9), when(v.createdAt).padEnd(20), size];
+    const size2 = v.files !== undefined ? `${v.files} files${v.size !== undefined ? `, ${formatSize(v.size)}` : ""}` : "";
+    const cols = [`${live} ${String(v.number).padStart(3)}`, v.status.padEnd(9), when2(v.createdAt).padEnd(20), size2];
     ctx.out(cols.join("  ").trimEnd());
     if (v.reason && v.status !== "live")
       ctx.out(`        ${v.reason}`);
@@ -1807,7 +3218,8 @@ var COMMANDS = {
       yes: p.flags.yes === true
     })
   },
-  dev: { flags: { port: "string" }, run: (ctx, p) => dev(ctx, p.positionals[0], stringFlag(p, "port")) }
+  dev: { flags: { port: "string" }, run: (ctx, p) => dev(ctx, p.positionals[0], stringFlag(p, "port")) },
+  create: { flags: CREATE_FLAGS, help: CREATE_HELP, run: (ctx, p) => create(ctx, p) }
 };
 async function run(argv, ctx) {
   const [name, ...rest] = argv;
@@ -1828,7 +3240,7 @@ async function run(argv, ctx) {
   try {
     const parsed = parseArgs(rest, command.flags);
     if (parsed.flags.help) {
-      ctx.out(HELP);
+      ctx.out(command.help ?? HELP);
       return EXIT.ok;
     }
     return await command.run(ctx, parsed);