carboncanvas-cli 0.1.0

package/CONTRACT.md

@@ -0,0 +1,94 @@
+# Publish contract (`POST /api/publish`)
+
+This file is the **source of truth** for the hosted-publish endpoint, the way
+`src/CommentLayer/networkClient.ts` is for the comments API. The CLI
+(`carboncanvas-cli`) is built to this exact shape; the server half must match it
+byte-for-byte. **Change both sides together.**
+
+Client implementation: `cli/src/upload.ts` (`publishBundle`, `buildPublishForm`).
+Token verification for `login`: `GET /api/entitlements` with
+`Authorization: Bearer <token>` — 200 means the token is a live creator session.
+
+---
+
+## Request
+
+```
+POST {serviceUrl}/api/publish
+Authorization: Bearer <token>
+Content-Type: multipart/form-data
+```
+
+Multipart parts:
+
+| part     | type                | contents |
+|----------|---------------------|----------|
+| `bundle` | file, `application/gzip`, filename `bundle.tar.gz` | a `.tar.gz` of the built **static** dist directory (entries rooted at `.`, so `index.html` is at the archive root) |
+| `meta`   | text (JSON string)  | the `PublishMeta` object below |
+
+### `meta` (JSON string)
+
+```jsonc
+{
+  "canvasId": "cnv_…",   // optional — target an EXISTING canvas (the baked id or --canvas)
+  "slug":     "my-app",  // optional — requested slug for the review link (--name)
+  "label":    "main",    // optional — version label (git branch or --label; default "preview")
+  "branch":   "main",    // optional — git branch (auto-filled)
+  "commit":   "a1b2c3d",  // optional — git short SHA (auto-filled)
+  "fresh":    false        // optional — true = mint a THROWAWAY canvas, ignore canvasId (--fresh)
+}
+```
+
+Notes for the server:
+- When `fresh` is true, the CLI omits `canvasId` — provision a throwaway canvas.
+- When `fresh` is falsy and `canvasId` is present, associate the deploy with that
+  canvas (idempotent re-publish → new deploy, same canvas, comments re-pin).
+- When neither is present, auto-provision (`ensureCanvas`) so the deploy isn't
+  orphaned.
+- The bundle's `index.html` already carries `<meta name="cc-deploy"
+  content="<label>@<shortsha>">` (the CLI stamps it into the packaged copy). The
+  server does not need to inject it.
+- `bundle.tar.gz` unpacks to a static site: `index.html` at the root, no server
+  manifest (the CLI refuses those client-side, but the server re-validates).
+
+---
+
+## Responses
+
+### 200 OK — `PublishResult`
+
+```jsonc
+{
+  "canvasId":     "cnv_…",                       // the canvas the deploy is bound to
+  "deployId":     "dep_…",                        // this immutable deploy
+  "url":          "https://my-app.<host>",        // the review link (slug root alias)
+  "dashboardUrl": "https://<host>/dashboard/…",   // where to manage it
+  "expiresAt":    "2026-08-06T00:00:00.000Z",     // ISO string, or null if it never expires
+  "slug":         "my-app"                          // the resolved slug
+}
+```
+
+### Error responses — `{ error, message }`
+
+| status | meaning | CLI behavior |
+|--------|---------|--------------|
+| `401`  | invalid / expired token | tells the user to run `carboncanvas login` |
+| `402`  | `publish` capability not entitled | surfaces `message` + an upgrade hint |
+| `400`  | validation failed (size cap, bad bundle) | surfaces `message` |
+| `413`  | payload too large | surfaces `message` |
+| `503`  | publish / CDN provider not configured server-side | surfaces `message` |
+
+All error bodies use the foundation's `{ error: string, message: string }` shape.
+The CLI reads `message` for the human-facing line; `error` is a stable machine code.
+
+---
+
+## Client-side pre-checks (server MUST re-validate)
+
+The CLI enforces these before upload; the server treats them as advisory and
+re-checks (a hand-crafted request can skip the CLI):
+
+- **Size caps:** ~50 MB packed / 2,000 files. Over → the CLI refuses locally; the
+  server should still enforce (→ 400 / 413).
+- **Static-ness:** `index.html` at root, no server manifest (`.next/standalone`,
+  `.output/server`, `functions/`, `server.js`/`server.mjs`, `_worker.js`).

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Alex Roitch
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,90 @@
+# carboncanvas-cli
+
+The Carbon Canvas CLI. Build your prototype locally and publish the static output
+to a hosted, commentable **review link** — one verb, no deploy platform to set up.
+
+The bin name is **`carboncanvas`**, so you run `carboncanvas publish`. This is a
+separate package from the `carboncanvas` library (which stays dependency-free);
+the CLI carries the upload/tar/auth deps.
+
+```bash
+# one-off (no install)
+npx carboncanvas-cli login
+npx carboncanvas-cli publish
+
+# or install as a dev dep / globally, then use the `carboncanvas` bin
+npm i -D carboncanvas-cli
+npx carboncanvas publish
+```
+
+## `carboncanvas login`
+
+Verifies a creator API token (from the dashboard → Settings → API tokens) against
+the backend and stores it in `~/.carboncanvas/config.json` (mode `0600`), keyed by
+backend URL.
+
+```bash
+carboncanvas login                 # prompts for a token (hidden input)
+carboncanvas login --token cc_xxx  # non-interactive
+```
+
+- `CARBON_TOKEN` overrides the stored token at use time.
+- `--service-url <url>` / `CARBON_SERVICE_URL` selects the backend
+  (default `https://quilt-production-65f6.up.railway.app`).
+- `carboncanvas logout` removes the stored token; `carboncanvas whoami` checks it.
+
+## `carboncanvas publish`
+
+Runs, in order:
+
+1. **Detect** the project (package manager from lockfile, framework + build script
+   from `package.json`).
+2. **Build** with the detected script — streamed to your terminal. A build failure
+   stops here; we never upload a broken build. (Skip with `--dist`.)
+3. **Validate it's static** — refuses loudly if the output needs a server
+   (`.next/standalone`, `.output/server`, `functions/`, `server.js`, …).
+4. **Canvas-config check** — greps the bundle for a `cnv_` canvasId and warns if
+   it's missing (the canvas would be view-only). It never rewrites your bundle.
+5. **Name-preservation check** — warns if the build minified your component names
+   (the Inspector would show `t`/`Bn` instead of real names). Fix by spreading
+   `carbonPreset()` from `carboncanvas/vite` into your `vite.config` (it sets
+   `esbuild: { keepNames: true }`), then rebuild.
+6. **Stamp** a `<meta name="cc-deploy" content="<label>@<shortsha>">` into the
+   packaged copy of `index.html` (never your file on disk).
+7. **Package** the dist to a `.tar.gz` (≤ ~50 MB / 2,000 files).
+8. **Upload** to `POST /api/publish` and print the review link + dashboard URL.
+
+### Flags
+
+| flag | meaning |
+|------|---------|
+| `--dir <dir>`     | project directory (default: cwd) |
+| `--dist <dir>`    | skip the build; publish this pre-built static dir |
+| `--canvas <id>`   | target an existing canvas instead of the baked one |
+| `--fresh`         | publish to a throwaway canvas (feedback won't touch main) |
+| `--name <slug>`   | request a specific slug for the review link |
+| `--label <label>` | version label (default: git branch, else `preview`) |
+| `--service-url`   | backend URL (env `CARBON_SERVICE_URL`) |
+| `--token`         | token override (env `CARBON_TOKEN`) |
+
+## The static-only limitation (and the alternative)
+
+`publish` hosts **static builds** (Vite / CRA / Astro-static / SvelteKit static
+adapter) and apps that talk to a hosted backend (Supabase/Firebase). It does
+**not** run a server for you.
+
+If your app needs real server routes / SSR / a local DB, that's fine — **deploy it
+yourself** (Vercel, Netlify, Railway, your own host) and point Carbon Canvas at the
+live URL. Bring-your-own-deployment is the default on-ramp; `publish` is the
+opt-in convenience for the local-agent workflow that has code but no URL.
+
+## Published links are public (Phase 1)
+
+Anyone with the URL can view a published prototype — the link is **not** gated by
+the canvas's access policy (an invite-only canvas restricts its *comments*, not
+the hosted pages). Don't publish sensitive prototypes yet; auth-gated private
+links (`--private`) arrive with viewer-auth Phase 2's edge gate.
+
+## Requirements
+
+Node ≥ 18 (uses built-in `fetch` / `FormData` / `Blob`). Only runtime dep: `tar`.

package/dist/build.js

@@ -0,0 +1,32 @@
+// Run the author's build script in their environment, streaming output to our
+// stderr. Build failure rejects with a non-zero exit — the agent fixes it
+// locally; we never upload a broken build.
+import { spawn } from 'node:child_process';
+export class BuildError extends Error {
+    code;
+    constructor(code, command) {
+        super(`Build command failed (exit ${code}): ${command}`);
+        this.name = 'BuildError';
+        this.code = code;
+    }
+}
+export function runBuild(command, cwd) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, {
+            cwd,
+            shell: true,
+            stdio: ['inherit', 'inherit', 'inherit'],
+            // Author's env — build reads their .env, NODE_ENV, etc. as usual.
+            env: process.env,
+        });
+        child.on('error', (err) => reject(err));
+        child.on('close', (code) => {
+            const c = code ?? 1;
+            if (c === 0)
+                resolve({ code: 0 });
+            else
+                reject(new BuildError(c, command));
+        });
+    });
+}
+//# sourceMappingURL=build.js.map

package/dist/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,0EAA0E;AAC1E,2CAA2C;AAE3C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAM3C,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,IAAI,CAAS;IACb,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,8BAA8B,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,GAAW;IACnD,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE;YAC3B,GAAG;YACH,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;YACxC,kEAAkE;YAClE,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;;gBAC7B,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/canvasConfig.js

@@ -0,0 +1,19 @@
+// Canvas-config check (plan amendment B.2 — publish injects NOTHING).
+//
+// The canvasId + serviceUrl are baked into the author's JSX at *their* build
+// time. All we do is grep the built bundle for a `cnv_` id and warn if it's
+// absent (the published canvas would have no comments). We NEVER rewrite or
+// inject config into the bundle.
+import { readBundleText } from './walk.js';
+// canvasIds look like `cnv_` + url-safe chars (see server schema / networkClient).
+const CANVAS_ID_RE = /cnv_[A-Za-z0-9_-]{4,}/;
+export async function findCanvasId(distDir) {
+    const text = await readBundleText(distDir, ['.js', '.mjs', '.cjs', '.html']);
+    const m = text.match(CANVAS_ID_RE);
+    return { canvasId: m ? m[0] : null };
+}
+export const NO_CANVAS_ID_WARNING = 'No canvasId (cnv_…) found in the built bundle — the published canvas will be ' +
+    'view-only (no comments). Register a canvas on the dashboard and add ' +
+    'comments={{ canvasId, serviceUrl }} to your <DesignCanvas>, then rebuild. ' +
+    'Publishing anyway.';
+//# sourceMappingURL=canvasConfig.js.map

package/dist/canvasConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canvasConfig.js","sourceRoot":"","sources":["../src/canvasConfig.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,iCAAiC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,mFAAmF;AACnF,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAM7C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe;IAChD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACnC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAC/B,+EAA+E;IAC/E,sEAAsE;IACtE,4EAA4E;IAC5E,oBAAoB,CAAC"}

package/dist/constants.js

@@ -0,0 +1,16 @@
+// Shared constants for the Carbon Canvas CLI.
+//
+// The prod backend URL is the same Railway service the comments client talks to
+// (server/README.md: "running on Railway at https://quilt-production-65f6.up.railway.app").
+// It can be overridden per-invocation with `--service-url` or `CARBON_SERVICE_URL`.
+export const DEFAULT_SERVICE_URL = 'https://quilt-production-65f6.up.railway.app';
+// The command name a user types (bin name), used in help/error text.
+export const BIN_NAME = 'carboncanvas';
+// Client-side size caps (the server re-validates — these mirror plan §6b/B.3).
+export const MAX_BUNDLE_BYTES = 50 * 1024 * 1024; // ~50 MB packed source dir
+export const MAX_BUNDLE_FILES = 2000;
+// Where the paste-token config lives (mode 0600). Keyed by serviceUrl so an
+// author with multiple backends (prod + self-hosted) keeps distinct tokens.
+export const CONFIG_DIR_NAME = '.carboncanvas';
+export const CONFIG_FILE_NAME = 'config.json';
+//# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,gFAAgF;AAChF,4FAA4F;AAC5F,oFAAoF;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,8CAA8C,CAAC;AAElF,qEAAqE;AACrE,MAAM,CAAC,MAAM,QAAQ,GAAG,cAAc,CAAC;AAEvC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,2BAA2B;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,4EAA4E;AAC5E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC"}

package/dist/detect.js

@@ -0,0 +1,80 @@
+// Project detection: package manager (from lockfile), framework (from deps),
+// and the build script (from package.json). Pure & testable — takes a root dir.
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+const LOCKFILES = [
+    ['bun.lockb', 'bun'],
+    ['bun.lock', 'bun'],
+    ['pnpm-lock.yaml', 'pnpm'],
+    ['yarn.lock', 'yarn'],
+    ['package-lock.json', 'npm'],
+];
+async function exists(p) {
+    try {
+        await fs.access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function inferPackageManager(root) {
+    for (const [file, pm] of LOCKFILES) {
+        if (await exists(path.join(root, file)))
+            return pm;
+    }
+    return 'npm'; // default happy path
+}
+export function detectFramework(pkg) {
+    const all = { ...pkg.dependencies, ...pkg.devDependencies };
+    if ('@sveltejs/kit' in all)
+        return 'sveltekit';
+    if ('astro' in all)
+        return 'astro';
+    if ('react-scripts' in all)
+        return 'cra';
+    if ('vite' in all)
+        return 'vite';
+    return 'unknown';
+}
+// Pick the build script. Prefer "build"; fall back to a script whose command
+// mentions a known bundler. Returns the SCRIPT NAME (to run via the pm), not the
+// command string.
+export function detectBuildScript(pkg) {
+    const scripts = pkg.scripts ?? {};
+    if (scripts.build)
+        return 'build';
+    for (const [name, cmd] of Object.entries(scripts)) {
+        if (/\b(vite build|astro build|react-scripts build|svelte-kit build|tsc && vite)\b/.test(cmd)) {
+            return name;
+        }
+    }
+    return null;
+}
+// Build the shell command that runs a named npm script under the detected pm.
+export function runScriptCommand(pm, script) {
+    switch (pm) {
+        case 'pnpm':
+            return `pnpm run ${script}`;
+        case 'yarn':
+            return `yarn ${script}`;
+        case 'bun':
+            return `bun run ${script}`;
+        case 'npm':
+        default:
+            return `npm run ${script}`;
+    }
+}
+export async function readPackageJson(root) {
+    const p = path.join(root, 'package.json');
+    const raw = await fs.readFile(p, 'utf8');
+    return JSON.parse(raw);
+}
+export async function detectProject(root) {
+    const packageJson = await readPackageJson(root);
+    const packageManager = await inferPackageManager(root);
+    const framework = detectFramework(packageJson);
+    const buildScript = detectBuildScript(packageJson);
+    return { root, packageJson, packageManager, framework, buildScript };
+}
+//# sourceMappingURL=detect.js.map

package/dist/detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.js","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,gFAAgF;AAEhF,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AA2BlC,MAAM,SAAS,GAAoC;IACjD,CAAC,WAAW,EAAE,KAAK,CAAC;IACpB,CAAC,UAAU,EAAE,KAAK,CAAC;IACnB,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAC1B,CAAC,WAAW,EAAE,MAAM,CAAC;IACrB,CAAC,mBAAmB,EAAE,KAAK,CAAC;CAC7B,CAAC;AAEF,KAAK,UAAU,MAAM,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY;IACpD,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;QACnC,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,qBAAqB;AACrC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAgB;IAC9C,MAAM,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,YAAY,EAAE,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC;IAC5D,IAAI,eAAe,IAAI,GAAG;QAAE,OAAO,WAAW,CAAC;IAC/C,IAAI,OAAO,IAAI,GAAG;QAAE,OAAO,OAAO,CAAC;IACnC,IAAI,eAAe,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC;IACjC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,iFAAiF;AACjF,kBAAkB;AAClB,MAAM,UAAU,iBAAiB,CAAC,GAAgB;IAChD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,IAAI,+EAA+E,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,EAAkB,EAAE,MAAc;IACjE,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,MAAM;YACT,OAAO,YAAY,MAAM,EAAE,CAAC;QAC9B,KAAK,MAAM;YACT,OAAO,QAAQ,MAAM,EAAE,CAAC;QAC1B,KAAK,KAAK;YACR,OAAO,WAAW,MAAM,EAAE,CAAC;QAC7B,KAAK,KAAK,CAAC;QACX;YACE,OAAO,WAAW,MAAM,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC9C,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACnD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACvE,CAAC"}

package/dist/errors.js

@@ -0,0 +1,11 @@
+// A user-facing error the CLI shell prints (message only, no stack) before
+// exiting non-zero. Distinct from unexpected errors, which print a stack.
+export class UserError extends Error {
+    hint;
+    constructor(message, hint) {
+        super(message);
+        this.name = 'UserError';
+        this.hint = hint;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,0EAA0E;AAE1E,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,IAAI,CAAU;IACd,YAAY,OAAe,EAAE,IAAa;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/index.js

@@ -0,0 +1,160 @@
+#!/usr/bin/env node
+// Carbon Canvas CLI — thin shell over the command modules. Arg parsing via
+// node:util parseArgs (no commander dep).
+import { parseArgs } from 'node:util';
+import * as log from './logger.js';
+import { UserError } from './errors.js';
+import { PublishError } from './upload.js';
+import { DEFAULT_SERVICE_URL, BIN_NAME } from './constants.js';
+import { loginCommand } from './loginCommand.js';
+import { publishCommand } from './publishCommand.js';
+import { clearToken, storedToken } from './tokenStore.js';
+import { verifyToken } from './verify.js';
+import { resolveToken } from './tokenStore.js';
+const VERSION = '0.0.0';
+function resolveServiceUrl(flag) {
+    return (flag || process.env.CARBON_SERVICE_URL || DEFAULT_SERVICE_URL).replace(/\/+$/, '');
+}
+const HELP = `${BIN_NAME} — publish your prototype to a hosted, commentable review link.
+
+USAGE
+  ${BIN_NAME} <command> [options]
+
+COMMANDS
+  login             Verify and store a creator API token (paste-token).
+  publish           Build locally and upload the static output; prints a review link.
+  logout            Remove the stored token for a backend.
+  whoami            Show whether a stored/env token is valid.
+  help              Show this help.
+
+COMMON OPTIONS
+  --service-url <url>   Backend to target (env CARBON_SERVICE_URL;
+                        default ${DEFAULT_SERVICE_URL}).
+  --token <token>       Use this token instead of the stored one (env CARBON_TOKEN).
+  -h, --help            Show help.
+  -v, --version         Show version.
+
+publish OPTIONS
+  --dir <dir>       Project directory (default: cwd).
+  --dist <dir>      Skip the build; publish this pre-built static directory.
+  --canvas <id>     Target an existing canvas (cnv_…) instead of the baked one.
+  --fresh           Publish to a throwaway canvas (feedback won't touch main).
+  --name <slug>     Request a specific slug for the review link.
+  --label <label>   Version label (default: git branch, else "preview").
+
+EXAMPLES
+  ${BIN_NAME} login
+  ${BIN_NAME} publish
+  npx carboncanvas-cli publish --dist dist --name my-prototype
+  ${BIN_NAME} publish --fresh --label redesign-empty-states
+
+NOTE
+  publish covers STATIC builds only (Vite/CRA/Astro-static/SvelteKit-static).
+  For apps that need a server, deploy them yourself and point Carbon Canvas at the URL.`;
+async function main(argv) {
+    const command = argv[0] && !argv[0].startsWith('-') ? argv[0] : undefined;
+    const rest = command ? argv.slice(1) : argv;
+    // Global flags handled before dispatch.
+    const globalPeek = rest.concat(command ?? []);
+    if (!command && (globalPeek.includes('-v') || globalPeek.includes('--version'))) {
+        log.out(VERSION);
+        return 0;
+    }
+    if (!command || command === 'help' || globalPeek.includes('-h') || globalPeek.includes('--help')) {
+        if (!command || command === 'help') {
+            log.info(HELP);
+            return 0;
+        }
+    }
+    const { values } = parseArgs({
+        args: rest,
+        allowPositionals: true,
+        options: {
+            'service-url': { type: 'string' },
+            token: { type: 'string' },
+            dir: { type: 'string' },
+            dist: { type: 'string' },
+            canvas: { type: 'string' },
+            fresh: { type: 'boolean' },
+            name: { type: 'string' },
+            label: { type: 'string' },
+            help: { type: 'boolean', short: 'h' },
+            version: { type: 'boolean', short: 'v' },
+        },
+    });
+    if (values.help) {
+        log.info(HELP);
+        return 0;
+    }
+    if (values.version) {
+        log.out(VERSION);
+        return 0;
+    }
+    const serviceUrl = resolveServiceUrl(values['service-url']);
+    switch (command) {
+        case 'login':
+            await loginCommand({ serviceUrl, token: values.token });
+            return 0;
+        case 'publish':
+            await publishCommand({
+                serviceUrl,
+                token: values.token,
+                dir: values.dir,
+                dist: values.dist,
+                canvas: values.canvas,
+                fresh: Boolean(values.fresh),
+                name: values.name,
+                label: values.label,
+            });
+            return 0;
+        case 'logout': {
+            const removed = await clearToken(serviceUrl);
+            if (removed)
+                log.success(`Removed stored token for ${serviceUrl}.`);
+            else
+                log.info(`No stored token for ${serviceUrl}.`);
+            return 0;
+        }
+        case 'whoami': {
+            const token = await resolveToken(serviceUrl, values.token);
+            if (!token) {
+                log.info(`Not logged in for ${serviceUrl}.`);
+                return 1;
+            }
+            const stored = await storedToken(serviceUrl);
+            const src = values.token ? '--token' : process.env.CARBON_TOKEN ? 'CARBON_TOKEN' : stored ? 'stored config' : 'unknown';
+            const result = await verifyToken(serviceUrl, token);
+            if (result.ok) {
+                log.success(`Token (${src}) is valid for ${serviceUrl}.`);
+                return 0;
+            }
+            log.error(`Token (${src}) was rejected (HTTP ${result.status}) by ${serviceUrl}.`);
+            return 1;
+        }
+        default:
+            log.error(`Unknown command: ${command}`);
+            log.info(`Run \`${BIN_NAME} help\` for usage.`);
+            return 2;
+    }
+}
+main(process.argv.slice(2))
+    .then((code) => process.exit(code))
+    .catch((err) => {
+    if (err instanceof UserError) {
+        log.error(err.message);
+        if (err.hint)
+            log.info('  ' + err.hint);
+        process.exit(1);
+    }
+    if (err instanceof PublishError) {
+        log.error(err.message);
+        if (err.hint)
+            log.info('  ' + err.hint);
+        process.exit(1);
+    }
+    log.error('Unexpected error:');
+    // eslint-disable-next-line no-console
+    console.error(err);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,2EAA2E;AAC3E,0CAA0C;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB,SAAS,iBAAiB,CAAC,IAAwB;IACjD,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,mBAAmB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,IAAI,GAAG,GAAG,QAAQ;;;IAGpB,QAAQ;;;;;;;;;;;kCAWsB,mBAAmB;;;;;;;;;;;;;;IAcjD,QAAQ;IACR,QAAQ;;IAER,QAAQ;;;;wFAI4E,CAAC;AAEzF,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE5C,wCAAwC;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjG,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACnC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACf,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC3B,IAAI,EAAE,IAAI;QACV,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACzC;KACF,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,aAAa,CAAuB,CAAC,CAAC;IAElF,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,MAAM,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,KAA2B,EAAE,CAAC,CAAC;YAC9E,OAAO,CAAC,CAAC;QAEX,KAAK,SAAS;YACZ,MAAM,cAAc,CAAC;gBACnB,UAAU;gBACV,KAAK,EAAE,MAAM,CAAC,KAA2B;gBACzC,GAAG,EAAE,MAAM,CAAC,GAAyB;gBACrC,IAAI,EAAE,MAAM,CAAC,IAA0B;gBACvC,MAAM,EAAE,MAAM,CAAC,MAA4B;gBAC3C,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC5B,IAAI,EAAE,MAAM,CAAC,IAA0B;gBACvC,KAAK,EAAE,MAAM,CAAC,KAA2B;aAC1C,CAAC,CAAC;YACH,OAAO,CAAC,CAAC;QAEX,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;YAC7C,IAAI,OAAO;gBAAE,GAAG,CAAC,OAAO,CAAC,4BAA4B,UAAU,GAAG,CAAC,CAAC;;gBAC/D,GAAG,CAAC,IAAI,CAAC,uBAAuB,UAAU,GAAG,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,KAA2B,CAAC,CAAC;YACjF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,IAAI,CAAC,qBAAqB,UAAU,GAAG,CAAC,CAAC;gBAC7C,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YACxH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACpD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,kBAAkB,UAAU,GAAG,CAAC,CAAC;gBAC1D,OAAO,CAAC,CAAC;YACX,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,wBAAwB,MAAM,CAAC,MAAM,QAAQ,UAAU,GAAG,CAAC,CAAC;YACnF,OAAO,CAAC,CAAC;QACX,CAAC;QAED;YACE,GAAG,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,SAAS,QAAQ,oBAAoB,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KACxB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KAClC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtB,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;QAChC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC/B,sCAAsC;IACtC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/logger.js

@@ -0,0 +1,25 @@
+// Tiny logging shell. No color deps — just semantic prefixes to stderr so stdout
+// stays clean for the one machine-readable line (the published URL) if we ever
+// want to pipe it. Everything human goes to stderr.
+/* eslint-disable no-console */
+export function info(msg) {
+    process.stderr.write(msg + '\n');
+}
+export function step(msg) {
+    process.stderr.write('→ ' + msg + '\n');
+}
+export function warn(msg) {
+    process.stderr.write('⚠ ' + msg + '\n');
+}
+export function error(msg) {
+    process.stderr.write('✗ ' + msg + '\n');
+}
+export function success(msg) {
+    process.stderr.write('✓ ' + msg + '\n');
+}
+// The one line we intentionally send to stdout (the published URL), so
+// `URL=$(carboncanvas publish ... | tail -1)` works.
+export function out(msg) {
+    process.stdout.write(msg + '\n');
+}
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,+EAA+E;AAC/E,oDAAoD;AAEpD,+BAA+B;AAE/B,MAAM,UAAU,IAAI,CAAC,GAAW;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,GAAW;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,GAAW;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAW;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,uEAAuE;AACvE,qDAAqD;AACrD,MAAM,UAAU,GAAG,CAAC,GAAW;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/loginCommand.js

@@ -0,0 +1,33 @@
+// `carboncanvas login` — paste-token auth (v1; device-code deferred, plan §9).
+//
+// Prompts for (or accepts --token) a creator API token from the dashboard,
+// verifies it against the backend, and stores it in ~/.carboncanvas/config.json
+// (0600) keyed by serviceUrl. CARBON_TOKEN overrides the stored token at use
+// time; --service-url / CARBON_SERVICE_URL selects the backend.
+import * as log from './logger.js';
+import { UserError } from './errors.js';
+import { promptSecret } from './prompt.js';
+import { verifyToken } from './verify.js';
+import { writeToken } from './tokenStore.js';
+export async function loginCommand(opts) {
+    let token = opts.token?.trim();
+    if (!token) {
+        log.info(`Paste a creator API token from the dashboard (${opts.serviceUrl}).`);
+        log.info('Find it under Settings → API tokens. Input is hidden.');
+        token = await promptSecret('Token: ');
+    }
+    if (!token) {
+        throw new UserError('No token provided.');
+    }
+    log.step(`Verifying token against ${opts.serviceUrl} …`);
+    const result = await verifyToken(opts.serviceUrl, token, opts.fetchImpl);
+    if (!result.ok) {
+        if (result.status === 401) {
+            throw new UserError('That token was rejected (401). Double-check you copied it in full.');
+        }
+        throw new UserError(`Could not verify the token (HTTP ${result.status}). Try again or check --service-url.`);
+    }
+    await writeToken(opts.serviceUrl, token);
+    log.success(`Logged in. Token saved for ${opts.serviceUrl}.`);
+}
+//# sourceMappingURL=loginCommand.js.map

package/dist/loginCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginCommand.js","sourceRoot":"","sources":["../src/loginCommand.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,6EAA6E;AAC7E,gEAAgE;AAEhE,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAkB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAQ7C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAkB;IACnD,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,iDAAiD,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAClE,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,2BAA2B,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CAAC,oEAAoE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,oCAAoC,MAAM,CAAC,MAAM,sCAAsC,CACxF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACzC,GAAG,CAAC,OAAO,CAAC,8BAA8B,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;AAChE,CAAC"}