ai-native-lab 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,90 @@
-# Temporary Holding Version
+# ai-native-lab · `aln`
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[AI Native Lab](https://ai-native-lab.mixdao.world) 的命令行工具，给人和 Agent 用：读、搜、发布内容，管理标签、图片、会员。
+
+- 非交互：所有参数都能用 flag 或环境变量传
+- `--json`：stdout 只输出一个 JSON 对象，提示信息走 stderr
+- 稳定退出码：`0` 成功 · `1` 错误 · `2` 用法 · `3` 认证 · `4` 无权限 / 内容锁定 · `5` 冲突（版本不匹配、已存在）
+
+## 安装
+
+```bash
+npm i -g ai-native-lab     # 命令名是 aln，需要 Node.js 20+
+aln login                  # 打开浏览器确认授权；自建服务：aln login https://your-host
+aln whoami
+```
+
+Agent / CI 里直接用 Token（在网站「我的账户 → API Token」生成）：
+
+```bash
+ALN_TOKEN=aln_xxx ALN_API_URL=https://ai-native-lab.mixdao.world aln ls --json
+```
+
+## 阅读
+
+```bash
+aln tags                           # 标签组和标签
+aln ls --tag agentic-coding        # 组内「或」、组间「且」
+aln search 公司大脑
+aln read <slug>                    # Markdown；HTML 内容输出抽出的文字，--html 输出源码
+aln bookmark <slug>
+aln redeem ALN-XXXX-XXXX-XXXX      # 兑换会员
+```
+
+会员内容权限不够时只输出摘要，退出码 `4`。
+
+## 发布（编辑团队）
+
+Markdown，元数据写在 frontmatter：
+
+```markdown
+---
+slug: my-post
+title: 标题
+summary: 看不了全文的读者只能看到这段
+access: public            # public | registered | member
+tags: [agentic-coding]
+cover: ./img/cover.jpg    # 本地图片会自动上传
+---
+
+正文，![配图](./img/chart.png) 也会自动上传并压缩。
+```
+
+```bash
+aln push post.md --dry-run
+aln push post.md --publish
+aln pull my-post -o post.md        # 改完再 push，--if-match <version> 防止覆盖别人的修改
+```
+
+HTML 页面（单个 `.html`、`.zip`，或一个目录：根目录 `index.html` + 相对路径的资源，元数据放 `aln.json`）：
+
+```bash
+aln push ./site/ --slug my-report --title 报告 --access member --publish
+aln pull my-report -o ./site/      # 解压并写 aln.json，改完：aln push ./site/ --if-match <version>
+```
+
+图片和标签：
+
+```bash
+aln image upload a.png b.jpg       # 输出可直接粘贴的 Markdown
+aln tag create company-brain --name 公司大脑 --group topic
+```
+
+## 管理（管理员）
+
+```bash
+aln users --expiring 7
+aln member grant someone@example.com --days 365
+aln role someone@example.com editor
+aln code create --days 365 --count 10
+aln image purge --dry-run
+aln audit --action membership.
+```
+
+## 给 Claude Code 用
+
+```bash
+aln skill --install                # 写入 ~/.claude/skills/ai-native-lab/SKILL.md
+```
+
+完整命令：`aln --help`、`aln <命令> --help`。

package/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: ai-native-lab
+description: Read, search and publish content on the AI Native Lab platform with the `aln` CLI. Use when the user asks to look up, quote, summarize, write, update or publish AI Native Lab content, manage its tags, or manage members / redeem codes.
+---
+
+# AI Native Lab CLI (`aln`)
+
+Always pass `--json` and parse stdout (one JSON object). Errors are `{"error":{"code","message"}}` on stdout with a non-zero exit code.
+
+Exit codes: 0 ok · 1 error · 2 usage · 3 auth (run `aln login` or set `ALN_TOKEN`) · 4 forbidden / locked · 5 conflict (re-fetch, then retry).
+
+## Auth
+
+- `aln whoami --json` → `role` is one of guest / user / member / editor / admin, plus `permissions` and `membership.expiresAt`.
+- Not logged in: ask the user to run `aln login <url>` (it opens a browser), or use `ALN_TOKEN=aln_… ALN_API_URL=https://…`.
+
+## Read
+
+1. `aln tags --json` to learn the tag slugs.
+2. `aln ls --tag <a,b> --json` (OR within a tag group, AND across groups), or `aln search <text> --json` (full text, best matches first; the body only counts for content the reader can open, so locked items match on title / summary only).
+3. `aln read <slug>` prints Markdown. `locked: true` (exit 4) means the reader's role can't open the full text; only the summary is available. Don't try to work around it.
+
+## Follow tags
+
+- `aln follow <tag>` subscribes the user to a weekly email digest (Mondays) of new content in that tag; `aln follow <tag> --remove` unsubscribes; `aln follow --json` lists current follows. Only do this when the user asks.
+
+## Write (editor or admin)
+
+- Edit existing: `aln pull <slug> -o post.md` → edit the file → `aln push post.md --if-match <version from frontmatter>`.
+- New content: write Markdown with frontmatter (`slug`, `title`, `summary`, `access`, `tags`), then
+  `aln push post.md --dry-run --json` → `aln push post.md --json` (saves a draft) → `aln publish <slug>` when the user approves.
+- Unknown tags fail with `unknown_tag`; create them with `aln tag create <slug> --name <name> --group <key>`, or pass `--auto-tags <group>`.
+- `access`: `public` (everyone), `registered` (signed-in users), `member` (members only). Always write a useful `summary`: it's all that locked readers see.
+- Publishing is visible to everyone and logged; confirm with the user before `--publish` / `aln publish`.
+
+## Admin
+
+- `aln users --expiring 7 --json`, `aln member grant <email> --days 365`, `aln member revoke <email>`, `aln role <email> editor`.
+- `aln code create --days 365 --count 10` prints codes once; store them safely.
+- `aln audit --action membership. --json`.
+
+## Images
+
+- Reference local images in Markdown with relative paths (`![说明](./img/chart.png)`, also `cover: ./img/cover.jpg`); `aln push` uploads them, compresses them to WebP (long edge ≤ 2000px) and rewrites the links. `--dry-run` does not upload.
+- Or upload first: `aln image upload a.png b.jpg --json` → paste the returned `url`.
+- `aln image ls --unused`; admins: `aln image purge --dry-run` then `aln image purge`, `aln image rm <id> [--force]`.
+
+## HTML pages
+
+- Content is either Markdown or an HTML page (`format` in `--json` output). HTML pages open full-page at `pageUrl` (`/p/<slug>/`) in a sandbox: scripts run, but `localStorage`, cookies and the platform API are unavailable to the page.
+- Publish a page: `aln push page.html`, `aln push site.zip`, or `aln push ./site/` (a folder with `index.html` at the top plus relative css / js / images). Metadata comes from flags (`--slug --title --summary --access --tags`) or `aln.json` in the folder (`{"slug","title","summary","access","status","tags","cover"}`). Title falls back to `<title>`.
+- Edit: `aln pull <slug> -o ./site/` (writes the files and `aln.json` with `version`) → edit → `aln push ./site/ --if-match <version>`.
+- `aln read <slug>` prints the page's extracted text; `aln read <slug> --html` prints the entry HTML.
+- Pushing Markdown to an HTML slug fails with `html_content` (exit 5) — that's intentional; don't convert formats unless the user asks.

package/dist/cli.js

@@ -0,0 +1,685 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { spawn } from "child_process";
+import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "fs/promises";
+import { homedir as homedir2, hostname } from "os";
+import path4 from "path";
+import { fileURLToPath } from "url";
+import { Command, Option } from "commander";
+
+// ../shared/src/cli.ts
+var EXIT = {
+  ok: 0,
+  error: 1,
+  usage: 2,
+  auth: 3,
+  forbidden: 4,
+  conflict: 5
+};
+
+// ../shared/src/content.ts
+var SLUG_RE = /^[a-z0-9][a-z0-9-]{0,79}$/;
+var isSlug = (s) => SLUG_RE.test(s);
+function slugify(raw) {
+  return raw.toLowerCase().normalize("NFKD").replace(/[^\w\s-]/g, "").replace(/[\s_]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 80);
+}
+var IMAGE_LIMITS = { maxUploadBytes: 20 * 1024 * 1024, maxEdge: 2e3, targetBytes: 600 * 1024 };
+var PAGE_LIMITS = { maxUploadBytes: 50 * 1024 * 1024, maxTotalBytes: 200 * 1024 * 1024, maxFiles: 2e3 };
+
+// package.json
+var package_default = {
+  name: "ai-native-lab",
+  version: "0.1.0",
+  description: "AI Native Lab CLI for people and agents: read, search and publish content. Non-interactive, --json output, stable exit codes.",
+  keywords: [
+    "ai-native-lab",
+    "cli",
+    "agent",
+    "claude-code",
+    "content",
+    "markdown",
+    "mixlab"
+  ],
+  homepage: "https://github.com/shadowcz007/ai-native-lab/tree/main/packages/cli#readme",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/shadowcz007/ai-native-lab.git",
+    directory: "packages/cli"
+  },
+  bugs: {
+    url: "https://github.com/shadowcz007/ai-native-lab/issues"
+  },
+  type: "module",
+  bin: {
+    aln: "dist/cli.js"
+  },
+  files: [
+    "dist",
+    "SKILL.md",
+    "README.md"
+  ],
+  engines: {
+    node: ">=20"
+  },
+  scripts: {
+    dev: "tsx src/cli.ts",
+    build: "tsup",
+    typecheck: "tsc -p .",
+    prepack: "tsup"
+  },
+  devDependencies: {
+    "@ai-native-lab/shared": "workspace:*"
+  },
+  dependencies: {
+    commander: "^15.0.0",
+    fflate: "^0.8.3",
+    yaml: "^2.8.1"
+  },
+  publishConfig: {
+    access: "public"
+  }
+};
+
+// src/api.ts
+var CliError = class extends Error {
+  constructor(code2, message, exitCode, status) {
+    super(message);
+    this.code = code2;
+    this.exitCode = exitCode;
+    this.status = status;
+  }
+  code;
+  exitCode;
+  status;
+};
+var exitFor = (status, code2) => status === 401 || code2 === "pending_approval" || code2 === "banned" || code2 === "expired_token" || code2 === "access_denied" ? EXIT.auth : status === 403 ? EXIT.forbidden : status === 409 || status === 412 ? EXIT.conflict : status === 400 ? EXIT.usage : EXIT.error;
+function createClient(apiUrl, token) {
+  async function call(method, p, body, headers = {}) {
+    const h = { "user-agent": `aln-cli/${package_default.version}`, ...headers };
+    if (token) h.authorization = `Bearer ${token}`;
+    if (body !== void 0) h["content-type"] = "application/json";
+    let res;
+    try {
+      res = await fetch(`${apiUrl}/api${p}`, { method, headers: h, body: body === void 0 ? void 0 : JSON.stringify(body) });
+    } catch (e) {
+      throw new CliError("network", `Can't reach ${apiUrl}: ${e.message}`, EXIT.error);
+    }
+    const text = await res.text();
+    let json = {};
+    try {
+      json = text ? JSON.parse(text) : {};
+    } catch {
+      if (res.ok) return text;
+    }
+    if (!res.ok) {
+      const code2 = json.error?.code ?? "http_error";
+      throw new CliError(code2, json.error?.message ?? `HTTP ${res.status}`, exitFor(res.status, code2), res.status);
+    }
+    return json;
+  }
+  async function download(p) {
+    const h = { "user-agent": `aln-cli/${package_default.version}` };
+    if (token) h.authorization = `Bearer ${token}`;
+    let res;
+    try {
+      res = await fetch(`${apiUrl}/api${p}`, { headers: h });
+    } catch (e) {
+      throw new CliError("network", `Can't reach ${apiUrl}: ${e.message}`, EXIT.error);
+    }
+    if (!res.ok) {
+      const json = await res.json().catch(() => ({}));
+      const code2 = json.error?.code ?? "http_error";
+      throw new CliError(code2, json.error?.message ?? `HTTP ${res.status}`, exitFor(res.status, code2), res.status);
+    }
+    return new Uint8Array(await res.arrayBuffer());
+  }
+  async function upload(p, form, method = "POST", extraHeaders = {}) {
+    const h = { "user-agent": `aln-cli/${package_default.version}`, ...extraHeaders };
+    if (token) h.authorization = `Bearer ${token}`;
+    let res;
+    try {
+      res = await fetch(`${apiUrl}/api${p}`, { method, headers: h, body: form });
+    } catch (e) {
+      throw new CliError("network", `Can't reach ${apiUrl}: ${e.message}`, EXIT.error);
+    }
+    const json = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      const code2 = json.error?.code ?? "http_error";
+      throw new CliError(code2, json.error?.message ?? `HTTP ${res.status}`, exitFor(res.status, code2), res.status);
+    }
+    return json;
+  }
+  const q = (params) => {
+    const s = new URLSearchParams();
+    for (const [k, v] of Object.entries(params)) if (v !== void 0 && v !== false && v !== "") s.set(k, String(v === true ? 1 : v));
+    const str = s.toString();
+    return str ? `?${str}` : "";
+  };
+  const enc = encodeURIComponent;
+  return {
+    call,
+    upload,
+    download,
+    q,
+    me: () => call("GET", "/me"),
+    deviceStart: (clientName) => call("POST", "/cli/device", { clientName }),
+    deviceToken: (deviceCode) => call("POST", "/cli/device/token", { deviceCode }),
+    list: (params) => call("GET", `/contents${q(params)}`),
+    get: (slug) => call("GET", `/contents/${enc(slug)}`),
+    put: (slug, body, opts) => call("PUT", `/contents/${enc(slug)}${q({ dryRun: opts.dryRun })}`, body, opts.ifMatch ? { "if-match": opts.ifMatch } : {}),
+    action: (slug, action) => call("POST", `/contents/${enc(slug)}/${action}`, {}),
+    tags: () => call("GET", "/tags")
+  };
+}
+
+// src/config.ts
+import { mkdir, readFile, rm, writeFile } from "fs/promises";
+import { homedir } from "os";
+import path from "path";
+var DIR = path.join(process.env.XDG_CONFIG_HOME ?? path.join(homedir(), ".config"), "ai-native-lab");
+var FILE = path.join(DIR, "config.json");
+var configPath = FILE;
+var DEFAULT_API_URL = "https://ai-native-lab.mixdao.world";
+var normalizeUrl = (url) => new URL(/^https?:\/\//.test(url) ? url : `https://${url}`).origin;
+async function loadConfig() {
+  try {
+    return JSON.parse(await readFile(FILE, "utf8"));
+  } catch {
+    return {};
+  }
+}
+async function saveConfig(c) {
+  await mkdir(DIR, { recursive: true, mode: 448 });
+  await writeFile(FILE, JSON.stringify(c, null, 2), { mode: 384 });
+}
+var clearConfig = () => rm(FILE, { force: true });
+async function resolveAuth(flags) {
+  const c = await loadConfig();
+  const explicit = flags.apiUrl ?? process.env.ALN_API_URL;
+  const apiUrl = normalizeUrl(explicit ?? c.url ?? DEFAULT_API_URL);
+  const same = !explicit || c.url && normalizeUrl(c.url) === apiUrl;
+  return { apiUrl, token: flags.token ?? process.env.ALN_TOKEN ?? (same ? c.token : void 0) };
+}
+
+// src/images.ts
+import { readFile as readFile2 } from "fs/promises";
+import path2 from "path";
+var MIME = { ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".png": "image/png", ".webp": "image/webp", ".gif": "image/gif", ".avif": "image/avif" };
+async function uploadFile(c, file) {
+  const buf = await readFile2(file);
+  const form = new FormData();
+  form.append("file", new Blob([buf], { type: MIME[path2.extname(file).toLowerCase()] ?? "application/octet-stream" }), path2.basename(file));
+  return c.upload("/images", form);
+}
+var isLocalRef = (ref) => !/^(?:[a-z][a-z0-9+.-]*:|\/|#)/i.test(ref);
+var MD_IMG = /!\[([^\]]*)\]\(\s*<?([^)\s>]+)>?(\s+"[^"]*")?\s*\)/g;
+var HTML_IMG = /(<img\b[^>]*?\bsrc=["'])([^"']+)(["'])/gi;
+async function uploadLocalImages(body, baseDir, upload) {
+  const refs = /* @__PURE__ */ new Set();
+  for (const m of body.matchAll(MD_IMG)) if (isLocalRef(m[2])) refs.add(m[2]);
+  for (const m of body.matchAll(HTML_IMG)) if (isLocalRef(m[2])) refs.add(m[2]);
+  const urls = /* @__PURE__ */ new Map();
+  const uploaded = [];
+  for (const ref of refs) {
+    const abs = path2.resolve(baseDir, decodeURIComponent(ref));
+    const img = await upload(abs);
+    urls.set(ref, img.url);
+    uploaded.push({ ...img, file: ref });
+  }
+  const out2 = body.replace(MD_IMG, (all, alt, ref, title = "") => urls.has(ref) ? `![${alt}](${urls.get(ref)}${title})` : all).replace(HTML_IMG, (all, a, ref, b) => urls.has(ref) ? `${a}${urls.get(ref)}${b}` : all);
+  return { body: out2, uploaded };
+}
+
+// src/markdown.ts
+import YAML from "yaml";
+var FM = /^?---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
+function parseDoc(src) {
+  const m = FM.exec(src);
+  const meta = m ? YAML.parse(m[1]) : {};
+  let body = m ? src.slice(m[0].length).replace(/^\r?\n/, "") : src;
+  const fm = meta ?? {};
+  const str = (k) => typeof fm[k] === "string" ? fm[k] : fm[k] == null ? void 0 : String(fm[k]);
+  let title = str("title");
+  if (!title) {
+    const h = /^\s*#\s+(.+?)\s*#*\s*$/m.exec(body);
+    if (h && body.slice(0, h.index).trim() === "") {
+      title = h[1];
+      body = body.slice(h.index + h[0].length).replace(/^\r?\n/, "");
+    }
+  }
+  const rawTags = fm.tags;
+  const tags = Array.isArray(rawTags) ? rawTags.map(String) : typeof rawTags === "string" ? rawTags.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+  return { slug: str("slug"), title, summary: str("summary"), access: str("access"), status: str("status"), cover: str("cover"), tags, body };
+}
+function formatDoc(d) {
+  const meta = { slug: d.slug, title: d.title, summary: d.summary || void 0, access: d.access, status: d.status, tags: d.tags };
+  if (d.cover) meta.cover = d.cover;
+  if (d.version != null) meta.version = d.version;
+  for (const k of Object.keys(meta)) if (meta[k] === void 0) delete meta[k];
+  return `---
+${YAML.stringify(meta).trimEnd()}
+---
+
+${d.body.replace(/^\n+/, "")}`;
+}
+
+// src/pages.ts
+import { mkdir as mkdir2, readdir, readFile as readFile3, stat, writeFile as writeFile2 } from "fs/promises";
+import path3 from "path";
+import { unzipSync, zipSync } from "fflate";
+var META_FILE = "aln.json";
+var IGNORE = /* @__PURE__ */ new Set([".git", "node_modules", ".DS_Store", "Thumbs.db", META_FILE]);
+async function zipDir(dir) {
+  const files = {};
+  let count = 0;
+  const walk = async (rel) => {
+    for (const e of await readdir(path3.join(dir, rel), { withFileTypes: true })) {
+      if (IGNORE.has(e.name) || e.name.startsWith(".")) continue;
+      const r = rel ? `${rel}/${e.name}` : e.name;
+      if (e.isDirectory()) await walk(r);
+      else if (e.isFile()) {
+        files[r] = await readFile3(path3.join(dir, r));
+        if (++count > 2e3) throw new Error("A page can have at most 2000 files");
+      }
+    }
+  };
+  await walk("");
+  if (!files["index.html"] && !Object.keys(files).some((f) => !f.includes("/") && /\.html?$/i.test(f))) {
+    throw new Error(`No index.html at the top of ${dir}`);
+  }
+  return zipSync(files, { level: 6 });
+}
+async function readMeta(dir) {
+  try {
+    return JSON.parse(await readFile3(path3.join(dir, META_FILE), "utf8"));
+  } catch (e) {
+    if (e.code === "ENOENT") return {};
+    throw new Error(`Can't read ${META_FILE}: ${e.message}`);
+  }
+}
+var htmlTitle = (html) => /<title[^>]*>([^<]*)<\/title>/i.exec(html)?.[1]?.trim() || void 0;
+var isDir = async (p) => (await stat(p).catch(() => null))?.isDirectory() ?? false;
+async function extractTo(dir, zip, meta) {
+  const files = unzipSync(zip);
+  for (const [name, buf] of Object.entries(files)) {
+    if (name.endsWith("/")) continue;
+    const target = path3.resolve(dir, name);
+    if (!target.startsWith(path3.resolve(dir) + path3.sep)) throw new Error(`Unsafe path in zip: ${name}`);
+    await mkdir2(path3.dirname(target), { recursive: true });
+    await writeFile2(target, buf);
+  }
+  await writeFile2(path3.join(dir, META_FILE), `${JSON.stringify(meta, null, 2)}
+`);
+  return Object.keys(files).length;
+}
+
+// src/cli.ts
+var program = new Command().name("aln").description("AI Native Lab: read, search and publish content from the terminal or an agent").version(package_default.version).addOption(new Option("--json", "print one JSON object to stdout (also ALN_JSON=1)").default(process.env.ALN_JSON === "1")).option("--api-url <url>", "server URL, overrides the saved one (env ALN_API_URL)").option("--token <token>", "API token, overrides the saved one (env ALN_TOKEN)").showHelpAfterError().addHelpText(
+  "after",
+  `
+Recommended workflow:
+  First time       login <url> \u2192 whoami \u2192 tags \u2192 ls
+  Read             ls --tag <slug> \u2192 read <slug>            (read prints Markdown; locked content shows the summary)
+  Search           search "<words>" \u2192 read <slug>
+  Subscribe        tags \u2192 follow <tag>                       (weekly email digest; follow --remove <tag> to stop)
+  Write (editor)   pull <slug> -o post.md \u2192 edit \u2192 push post.md --publish
+  New content      push post.md --slug <slug> --tags a,b [--auto-tags topic] --dry-run, then without --dry-run
+  Images           ![\u8BF4\u660E](./img/a.png) in Markdown is uploaded by push automatically; or: image upload a.png
+  HTML pages       push page.html | push site.zip | push ./site/  (folder: index.html + assets, metadata in aln.json)
+                   pull <slug> -o ./site/ \u2192 edit \u2192 push ./site/ --if-match <version>
+  Members (admin)  users --expiring 7 \u2192 member grant <email> --days 365
+
+Markdown files carry metadata in YAML frontmatter:
+  ---
+  slug: my-post          # lowercase letters, digits, hyphens
+  title: \u6807\u9898             # or the first "# heading"
+  summary: \u4E00\u53E5\u8BDD\u6458\u8981       # shown to readers who can't open the full text
+  access: public | registered | member
+  status: draft | published
+  tags: [agentic-coding, case-study]
+  ---
+
+Exit codes: 0 ok \xB7 1 error \xB7 2 usage \xB7 3 auth \xB7 4 forbidden \xB7 5 conflict (version mismatch / exists)
+
+Examples:
+  $ aln login                                      # default server; or: aln login https://your-host
+  $ aln ls --tag agentic-coding --json
+  $ aln read company-brain > company-brain.md
+  $ cat note.md | aln push - --slug quick-note --publish
+  $ ALN_TOKEN=aln_xxx ALN_API_URL=https://lab.example.com aln ls --json`
+);
+var g = () => program.opts();
+function out(human, data) {
+  if (g().json) process.stdout.write(`${JSON.stringify(data)}
+`);
+  else console.log(human);
+}
+var note = (msg) => {
+  if (!g().json) console.error(msg);
+};
+async function client() {
+  const { apiUrl, token } = await resolveAuth(g());
+  return createClient(apiUrl, token);
+}
+async function needToken() {
+  const { apiUrl, token } = await resolveAuth(g());
+  if (!token) throw new CliError("unauthorized", "Not logged in. Run `aln login <url>` or set ALN_TOKEN", EXIT.auth);
+  return createClient(apiUrl, token);
+}
+var readInput = async (file) => {
+  if (file !== "-") return readFile4(file, "utf8");
+  const chunks = [];
+  for await (const c of process.stdin) chunks.push(c);
+  return Buffer.concat(chunks).toString("utf8");
+};
+var date = (iso) => iso ? iso.slice(0, 10) : "\u2014";
+var pad = (s, n) => s.length >= n ? s : s + " ".repeat(n - s.length);
+var lock = (i) => i.locked ? " \u{1F512}" : "";
+var listLine = (i) => `${pad(i.slug, 28)} ${pad(i.access, 10)} ${pad(i.status, 9)} ${date(i.publishedAt)}  ${i.title}${lock(i)}${i.tags.length ? `  [${i.tags.map((t) => t.slug).join(", ")}]` : ""}`;
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+program.command("login [url]").description("log in through the browser (device code); the token is saved to ~/.config/ai-native-lab").option("--no-browser", "don't open the browser, just print the link").action(async (url, opts) => {
+  const saved = await loadConfig();
+  const apiUrl = normalizeUrl(url ?? g().apiUrl ?? process.env.ALN_API_URL ?? saved.url ?? DEFAULT_API_URL);
+  const c = createClient(apiUrl);
+  const start = await c.deviceStart(`aln on ${hostname()}`.slice(0, 80));
+  note(`Open ${start.verificationUrlComplete}
+and confirm the code ${start.userCode}. Waiting\u2026`);
+  if (opts.browser) openBrowser(start.verificationUrlComplete);
+  const deadline = Date.now() + start.expiresIn * 1e3;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, start.interval * 1e3));
+    try {
+      const res = await c.deviceToken(start.deviceCode);
+      await saveConfig({ url: apiUrl, token: res.token, email: res.user.email });
+      return out(`Logged in to ${apiUrl} as ${res.user.email}`, { ok: true, url: apiUrl, email: res.user.email });
+    } catch (e) {
+      if (e instanceof CliError && e.code === "authorization_pending") continue;
+      throw e;
+    }
+  }
+  throw new CliError("expired_token", "Login request expired. Run login again", EXIT.auth);
+});
+program.command("logout").description("forget the saved token").action(async () => {
+  await clearConfig();
+  out(`Removed ${configPath}`, { ok: true });
+});
+program.command("whoami").description("who you are, your role and membership expiry").action(async () => {
+  const me = await (await client()).me();
+  const m = me.membership ? `, member until ${date(me.membership.expiresAt)}` : "";
+  out(me.user ? `${me.user.email} \xB7 ${me.role}${m}
+permissions: ${me.permissions.join(", ")}` : "guest (not logged in)", me);
+});
+program.command("ls").description("list content (newest first)").option("--tag <slugs>", "comma separated tag slugs; OR within a tag group, AND across groups").option("--access <level>", "public | registered | member").option("--status <status>", "published (default) | draft | archived | all  (editors only for non-published)").option("-q, --query <text>", "full-text search (same as `aln search`)").option("--bookmarked", "only content you bookmarked").option("--limit <n>", "page size, max 100", "20").option("--offset <n>", "skip n items", "0").action(async (o) => {
+  const res = await (await client()).list({ tag: o.tag, access: o.access, status: o.status, q: o.query, bookmarked: o.bookmarked, limit: o.limit, offset: o.offset });
+  const more = res.nextOffset != null ? `
+\u2026 more: --offset ${res.nextOffset}` : "";
+  out(res.items.length ? res.items.map(listLine).join("\n") + more : "No content", res);
+});
+program.command("search <text>").description("full-text search, best matches first; every space-separated word must match; the body is searched only for content you can read").option("--limit <n>", "max results", "20").action(async (text, o) => {
+  const res = await (await client()).list({ q: text, limit: o.limit });
+  out(res.items.length ? res.items.map(listLine).join("\n") : "No matches", res);
+});
+program.command("read <slug>").description("print a piece of content as Markdown; HTML pages print their extracted text (locked content prints the summary and exits 4)").option("--meta", "include YAML frontmatter").option("--html", "HTML pages: print the entry page's HTML source instead of text").action(async (slug, o) => {
+  const c = await client();
+  const item = await c.get(slug);
+  if (g().json) return out("", item);
+  if (item.locked) {
+    console.log(`# ${item.title}
+
+${item.summary}
+`);
+    throw new CliError("locked", `Full text is for ${item.access === "member" ? "members" : "signed-in users"} only`, EXIT.forbidden);
+  }
+  if (o.html) {
+    if (item.format !== "html") throw new CliError("not_html", `${slug} is Markdown; drop --html`, EXIT.usage);
+    return void process.stdout.write(await c.call("GET", `/contents/${encodeURIComponent(slug)}?format=html`));
+  }
+  const doc = { ...item, tags: item.tags.map((t) => t.slug), body: item.body ?? "" };
+  console.log(o.meta ? formatDoc(doc) : `# ${item.title}
+
+${doc.body}`);
+});
+program.command("tags").description("all tag groups and tags with published counts").action(async () => {
+  const res = await (await client()).tags();
+  out(res.groups.map((gr) => `${gr.name} (${gr.key})
+${gr.tags.map((t) => `  ${pad(t.slug, 28)} ${t.name}  ${t.count}`).join("\n") || "  \u2014"}`).join("\n"), res);
+});
+program.command("bookmark <slug>").description("bookmark (or --remove) a piece of content").option("--remove", "remove the bookmark").action(async (slug, o) => {
+  const res = await (await needToken()).call(o.remove ? "DELETE" : "PUT", `/contents/${encodeURIComponent(slug)}/bookmark`);
+  out(o.remove ? `Removed bookmark ${slug}` : `Bookmarked ${slug}`, res);
+});
+program.command("follow [tag]").description("follow a tag (weekly email digest of new content in it), --remove to unfollow; no tag lists what you follow").option("--remove", "unfollow").action(async (slug, o) => {
+  const c = await needToken();
+  if (!slug) {
+    if (o.remove) throw new CliError("bad_request", "Pass the tag to unfollow", EXIT.usage);
+    const res2 = await c.call("GET", "/me/follows");
+    return out(res2.follows.map((t) => `${pad(t.slug, 28)} ${t.name}${t.archived ? " (archived)" : ""}`).join("\n") || "Not following any tags. Try `aln tags`, then `aln follow <tag>`", res2);
+  }
+  const res = await c.call(o.remove ? "DELETE" : "PUT", `/tags/${encodeURIComponent(slug)}/follow`);
+  out(o.remove ? `Unfollowed ${slug}` : `Following ${slug} \xB7 weekly digest every Monday`, res);
+});
+program.command("redeem <code>").description("redeem a membership code").action(async (code2) => {
+  const res = await (await needToken()).call("POST", "/redeem", { code: code2 });
+  out(`+${res.days} days, member until ${date(res.membership?.expiresAt ?? null)}`, res);
+});
+async function pushPage(file, o) {
+  const dir = await isDir(file);
+  const meta = dir ? await readMeta(file) : {};
+  const base = path4.basename(path4.resolve(file)).replace(/\.(zip|html?)$/i, "");
+  const slug = o.slug ?? meta.slug ?? slugify(base);
+  if (!slug || !isSlug(slug)) throw new CliError("invalid_slug", `Pass --slug (lowercase letters, digits, hyphens)${dir ? ` or set "slug" in ${META_FILE}` : ""}`, EXIT.usage);
+  const data = dir ? await zipDir(file) : await readFile4(file);
+  let title = o.title ?? meta.title;
+  if (!title && /\.html?$/i.test(file)) title = htmlTitle(Buffer.from(data).toString("utf8"));
+  if (!title && dir) title = htmlTitle(await readFile4(path4.join(file, "index.html"), "utf8").catch(() => ""));
+  if (/\.html?$/i.test(file) && /<img\b[^>]*\bsrc=["'](?![a-z][a-z0-9+.-]*:|\/|#)/i.test(Buffer.from(data).toString("utf8"))) {
+    note("warning: this HTML references local files; push the folder (or a .zip) so they are uploaded too");
+  }
+  const c = await needToken();
+  let cover = meta.cover ?? void 0;
+  if (cover && isLocalRef(cover)) {
+    if (o.dryRun) {
+      note(`dry run: would upload cover ${cover}`);
+      cover = void 0;
+    } else {
+      const img = await uploadFile(c, path4.resolve(dir ? file : path4.dirname(file), cover));
+      note(`uploaded cover ${cover} \u2192 ${img.url}`);
+      cover = img.url;
+    }
+  }
+  const status = o.publish ? "published" : o.draft ? "draft" : meta.status;
+  const tags = o.tags ? o.tags.split(",").map((s) => s.trim()).filter(Boolean) : meta.tags;
+  const form = new FormData();
+  form.append("file", new Blob([data]), dir ? `${slug}.zip` : path4.basename(file));
+  form.append("meta", JSON.stringify({ title, summary: o.summary ?? meta.summary, cover, access: o.access ?? meta.access, status, tags, autoCreateTagsIn: o.autoTags }));
+  const res = await c.upload(
+    `/contents/${encodeURIComponent(slug)}/page${c.q({ dryRun: o.dryRun })}`,
+    form,
+    "PUT",
+    o.ifMatch ? { "if-match": o.ifMatch } : {}
+  );
+  if (res.dryRun) return out(`dry run: would ${res.action} ${slug} (HTML, entry ${res.entry}, ${res.files} files)`, res);
+  const p = res.content.page;
+  out(`${res.created ? "Created" : "Updated"} ${slug} \xB7 HTML${p ? ` (${p.files} files, ${Math.round(p.bytes / 1024)}KB)` : ""} \xB7 ${res.content.status} \xB7 v${res.content.version}`, res);
+}
+program.command("push <file>").description("create or update content from a Markdown file (or - for stdin), upsert by slug").option("--slug <slug>", "defaults to frontmatter slug, then the file name").option("--title <title>", "override the title").option("--summary <text>", "override the summary (what readers who can't open the full text see)").option("--access <level>", "public | registered | member").option("--tags <slugs>", "comma separated tag slugs (replaces existing tags)").option("--auto-tags <group>", "create unknown tags inside this tag group instead of failing").option("--publish", "publish right away (same as status: published)").option("--draft", "save as draft").option("--if-match <version>", "only write if the server version still matches (optimistic lock)").option("--dry-run", "validate and show what would happen, change nothing (local images are not uploaded)").option("--no-upload-images", "don't upload local images referenced in the Markdown").action(async (file, o) => {
+  if (file !== "-" && (await isDir(file) || /\.(zip|html?)$/i.test(file))) return pushPage(file, o);
+  const doc = parseDoc(await readInput(file));
+  const slug = o.slug ?? doc.slug ?? (file === "-" ? "" : slugify(path4.basename(file, path4.extname(file))));
+  if (!slug || !isSlug(slug)) throw new CliError("invalid_slug", "Pass --slug (lowercase letters, digits, hyphens) or set slug in frontmatter", EXIT.usage);
+  const title = o.title ?? doc.title;
+  if (!title) throw new CliError("bad_request", "No title: add `title:` to frontmatter, a leading `# heading`, or pass --title", EXIT.usage);
+  const status = o.publish ? "published" : o.draft ? "draft" : doc.status;
+  const tags = o.tags ? o.tags.split(",").map((s) => s.trim()).filter(Boolean) : doc.tags;
+  const c = await needToken();
+  let text = doc.body;
+  let cover = doc.cover;
+  const images = [];
+  if (o.uploadImages && !o.dryRun) {
+    const baseDir = file === "-" ? process.cwd() : path4.dirname(path4.resolve(file));
+    const r = await uploadLocalImages(text, baseDir, (abs) => uploadFile(c, abs));
+    text = r.body;
+    images.push(...r.uploaded);
+    if (cover && isLocalRef(cover)) {
+      const img = await uploadFile(c, path4.resolve(baseDir, cover));
+      images.push({ ...img, file: cover });
+      cover = img.url;
+    }
+    for (const i of images) note(`uploaded ${i.file} \u2192 ${i.url} (${Math.round(i.originalBytes / 1024)}KB \u2192 ${Math.round(i.bytes / 1024)}KB)`);
+  } else if (o.dryRun && cover && isLocalRef(cover)) {
+    note(`dry run: would upload cover ${cover}`);
+    cover = void 0;
+  }
+  const body = { title, summary: o.summary ?? doc.summary, body: text, cover, access: o.access ?? doc.access, status, tags, autoCreateTagsIn: o.autoTags };
+  const res = await c.put(slug, body, { ifMatch: o.ifMatch, dryRun: o.dryRun });
+  if (res.dryRun) return out(`dry run: would ${res.action} ${slug}`, res);
+  out(`${res.created ? "Created" : "Updated"} ${slug} \xB7 ${res.content.status} \xB7 v${res.content.version}`, { ...res, images });
+});
+program.command("pull <slug>").description("download content to edit and push back: Markdown with frontmatter, or for HTML pages a folder (with aln.json) / .zip").option("-o, --out <file>", "write to a file instead of stdout; HTML pages: a folder, or a path ending in .zip").action(async (slug, o) => {
+  const c = await needToken();
+  const item = await c.get(slug);
+  if (item.locked || item.body == null) throw new CliError("locked", "You can't read the full text of this content", EXIT.forbidden);
+  if (item.format === "html") {
+    if (!o.out) throw new CliError("bad_request", `${slug} is an HTML page: pass -o <folder> or -o <file.zip>`, EXIT.usage);
+    const zip = await c.download(`/contents/${encodeURIComponent(slug)}/page.zip`);
+    if (/\.zip$/i.test(o.out)) {
+      await writeFile3(o.out, zip);
+      return out(`Wrote ${o.out} (v${item.version})`, { ok: true, file: o.out, version: item.version });
+    }
+    const n = await extractTo(o.out, zip, {
+      slug: item.slug,
+      title: item.title,
+      summary: item.summary,
+      access: item.access,
+      status: item.status,
+      tags: item.tags.map((t) => t.slug),
+      cover: item.cover,
+      version: item.version
+    });
+    return out(`Wrote ${n} files to ${o.out}/ (v${item.version}); edit, then: aln push ${o.out} --if-match ${item.version}`, { ok: true, dir: o.out, files: n, version: item.version });
+  }
+  const md = formatDoc({ ...item, tags: item.tags.map((t) => t.slug), body: item.body });
+  if (!o.out) return void process.stdout.write(md.endsWith("\n") ? md : `${md}
+`);
+  await writeFile3(o.out, md);
+  out(`Wrote ${o.out} (v${item.version})`, { ok: true, file: o.out, version: item.version });
+});
+for (const action of ["publish", "unpublish", "archive"]) {
+  program.command(`${action} <slug>`).description(action === "publish" ? "publish content" : action === "unpublish" ? "move published content back to draft" : "archive content (hide it everywhere)").action(async (slug) => {
+    const res = await (await needToken()).action(slug, action);
+    out(`${slug} \u2192 ${res.content.status}`, res);
+  });
+}
+var tagCmd = program.command("tag").description("manage tags (editors)");
+tagCmd.command("create <slug>").requiredOption("--name <name>", "display name").requiredOption("--group <key>", "tag group key").option("--color <color>", "green | lavender | divider").option("--description <text>").action(async (slug, o) => {
+  const res = await (await needToken()).call("POST", "/tags", { slug, ...o });
+  out(`Created tag ${slug}`, res);
+});
+tagCmd.command("archive <slug>").action(async (slug) => {
+  const res = await (await needToken()).call("DELETE", `/tags/${encodeURIComponent(slug)}`);
+  out(`Archived tag ${slug}`, res);
+});
+tagCmd.command("group <key>").description("create a tag group").requiredOption("--name <name>").option("--position <n>").action(async (key, o) => {
+  const res = await (await needToken()).call("POST", "/tag-groups", { key, name: o.name, position: o.position ? Number(o.position) : void 0 });
+  out(`Created tag group ${key}`, res);
+});
+var imageCmd = program.command("image").description("upload and manage images (editors upload, admins delete)");
+imageCmd.command("upload <files...>").description("upload images (compressed to WebP, long edge \u2264 2000px); prints Markdown you can paste").action(async (files) => {
+  const c = await needToken();
+  const res = [];
+  for (const f of files) res.push({ file: f, ...await uploadFile(c, f) });
+  out(res.map((r) => `![${path4.basename(r.file, path4.extname(r.file))}](${r.url})`).join("\n"), { images: res });
+});
+imageCmd.command("ls").description("list uploaded images and where they are used").option("--unused", "only images no content uses").option("--used", "only images in use").option("--limit <n>", "", "60").action(async (o) => {
+  const c = await needToken();
+  const res = await c.call("GET", `/images${c.q({ filter: o.unused ? "unused" : o.used ? "used" : void 0, limit: o.limit })}`);
+  const lines = res.images.map((i) => `${i.id.slice(0, 8)}  ${pad(`${i.width}x${i.height}`, 10)} ${pad(`${Math.round(i.bytes / 1024)}KB`, 7)} ${pad(i.originalName ?? "", 24)} ${i.usages.length ? i.usages.map((u) => `${u.slug}:${u.where}`).join(", ") : "(unused)"}`);
+  out([`${res.stats.total} images, ${res.stats.unused} unused`, ...lines].join("\n"), res);
+});
+imageCmd.command("rm <id>").description("delete an image (admin); refuses if still used unless --force").option("--force", "delete even if content still uses it").action(async (id, o) => {
+  const c = await needToken();
+  const res = await c.call("DELETE", `/images/${encodeURIComponent(id)}${o.force ? "?force=1" : ""}`);
+  out(`Deleted ${id}`, res);
+});
+imageCmd.command("purge").description("delete images no content body / cover uses (admin); skips uploads from the last hour").option("--dry-run", "only count").option("--include-revisions", "also delete images only referenced by old revisions").option("--min-age <minutes>", "skip images newer than this", "60").action(async (o) => {
+  const res = await (await needToken()).call("POST", "/images/purge", { dryRun: o.dryRun, includeRevisions: o.includeRevisions, minAgeMinutes: Number(o.minAge) });
+  out(`${o.dryRun ? "Would delete" : "Deleted"} ${res.count} images (${Math.round(res.bytes / 1024)}KB)`, res);
+});
+async function findUserByEmail(email) {
+  const c = await needToken();
+  const res = await c.call("GET", `/admin/users${c.q({ q: email })}`);
+  const u = res.users.find((x) => x.email.toLowerCase() === email.toLowerCase());
+  if (!u) throw new CliError("not_found", `No user with email ${email}`, EXIT.error);
+  return { c, u };
+}
+program.command("users").description("list users (admin)").option("-q, --query <text>", "filter by email or name").option("--expiring <days>", "only members whose membership ends within N days").action(async (o) => {
+  const c = await needToken();
+  if (o.expiring) {
+    const res2 = await c.call("GET", `/admin/memberships/expiring${c.q({ days: o.expiring })}`);
+    return out(res2.memberships.map((m) => `${pad(m.email, 32)} ${date(m.expiresAt)}  ${m.name}`).join("\n") || "Nobody", res2);
+  }
+  const res = await c.call("GET", `/admin/users${c.q({ q: o.query })}`);
+  out(res.users.map((u) => `${pad(u.email, 32)} ${pad(u.role, 8)} ${pad(u.status, 8)} ${u.membership ? `member\u2192${date(u.membership.expiresAt)}` : ""}`).join("\n") || "No users", res);
+});
+var member = program.command("member").description("grant or revoke membership (admin)");
+member.command("grant <email>").option("--days <n>", "add N days (after the current expiry if already a member)").option("--until <date>", "set the end date, e.g. 2027-10-20").option("--note <text>").action(async (email, o) => {
+  if (!o.days === !o.until) throw new CliError("bad_request", "Pass exactly one of --days or --until", EXIT.usage);
+  const { c, u } = await findUserByEmail(email);
+  const res = await c.call("POST", `/admin/users/${u.id}/membership`, { days: o.days ? Number(o.days) : void 0, until: o.until, note: o.note });
+  out(`${email} is a member until ${date(res.membership?.expiresAt ?? null)}`, res);
+});
+member.command("revoke <email>").action(async (email) => {
+  const { c, u } = await findUserByEmail(email);
+  const res = await c.call("DELETE", `/admin/users/${u.id}/membership`);
+  out(`${email} is now ${res.role}`, res);
+});
+program.command("role <email> <role>").description("set staff role: admin | editor | user (admin)").action(async (email, role) => {
+  const { c, u } = await findUserByEmail(email);
+  const res = await c.call("POST", `/admin/users/${u.id}/role`, { role });
+  out(`${email} \u2192 ${res.staffRole}`, res);
+});
+var code = program.command("code").description("membership redeem codes (admin)");
+code.command("create").requiredOption("--days <n>", "membership days per redemption").option("--count <n>", "how many codes", "1").option("--max-uses <n>", "redemptions per code", "1").option("--expires <date>", "code stops working after this date").option("--note <text>").action(async (o) => {
+  const res = await (await needToken()).call("POST", "/admin/redeem-codes", {
+    days: Number(o.days),
+    count: Number(o.count),
+    maxUses: Number(o.maxUses),
+    expiresAt: o.expires,
+    note: o.note
+  });
+  out(res.codes.join("\n"), res);
+});
+code.command("ls").action(async () => {
+  const res = await (await needToken()).call("GET", "/admin/redeem-codes");
+  out(res.codes.map((x) => `${x.prefix}\u2026  ${pad(`${x.days}d`, 6)} ${x.usedCount}/${x.maxUses}  ${x.active ? "active" : "inactive"}  ${x.note ?? ""}`).join("\n") || "No codes", res);
+});
+program.command("audit").description("recent audit log (admin)").option("--action <prefix>", "e.g. content. or membership.").option("--limit <n>", "", "50").action(async (o) => {
+  const c = await needToken();
+  const res = await c.call("GET", `/admin/audit${c.q({ action: o.action, limit: o.limit })}`);
+  out(res.entries.map((e) => `${e.createdAt.slice(0, 19).replace("T", " ")}  ${pad(e.actor ?? "system", 28)} ${pad(e.action, 24)} ${e.targetType}:${e.targetId}`).join("\n"), res);
+});
+program.command("skill").description("print the agent usage guide (SKILL.md), or --install it for Claude Code").option("--install", "write it to ~/.claude/skills/ai-native-lab/SKILL.md").action(async (o) => {
+  const src = await readFile4(fileURLToPath(new URL("../SKILL.md", import.meta.url)), "utf8");
+  if (!o.install) return void process.stdout.write(src);
+  const dir = path4.join(homedir2(), ".claude", "skills", "ai-native-lab");
+  await mkdir3(dir, { recursive: true });
+  await writeFile3(path4.join(dir, "SKILL.md"), src);
+  out(`Installed ${path4.join(dir, "SKILL.md")}`, { ok: true, path: path4.join(dir, "SKILL.md") });
+});
+try {
+  await program.parseAsync();
+} catch (e) {
+  const err = e instanceof CliError ? e : new CliError("error", e.message, EXIT.error);
+  if (g().json) process.stdout.write(`${JSON.stringify({ error: { code: err.code, message: err.message } })}
+`);
+  else console.error(`error: ${err.message}`);
+  process.exit(err.exitCode);
+}

package/package.json

@@ -1,6 +1,51 @@
 {
   "name": "ai-native-lab",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "AI Native Lab CLI for people and agents: read, search and publish content. Non-interactive, --json output, stable exit codes.",
+  "keywords": [
+    "ai-native-lab",
+    "cli",
+    "agent",
+    "claude-code",
+    "content",
+    "markdown",
+    "mixlab"
+  ],
+  "homepage": "https://github.com/shadowcz007/ai-native-lab/tree/main/packages/cli#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/shadowcz007/ai-native-lab.git",
+    "directory": "packages/cli"
+  },
+  "bugs": {
+    "url": "https://github.com/shadowcz007/ai-native-lab/issues"
+  },
+  "type": "module",
+  "bin": {
+    "aln": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "SKILL.md",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "devDependencies": {
+    "@ai-native-lab/shared": "0.0.0"
+  },
+  "dependencies": {
+    "commander": "^15.0.0",
+    "fflate": "^0.8.3",
+    "yaml": "^2.8.1"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "dev": "tsx src/cli.ts",
+    "build": "tsup",
+    "typecheck": "tsc -p ."
+  }
 }