costaff-workspace 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Simon Liu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,91 @@
+# costaff-workspace
+
+Publish documents, decks and workbooks to [CoStaff Workspace](https://workspace.costaffs.app),
+and pull their source back out to keep working on them.
+
+Built for projects made with [open-doc](https://github.com/simonliu-ai-product/open-doc),
+open-slide and open-sheet.
+
+```bash
+npm i -g costaff-workspace
+
+cd my-doc
+costaff-workspace push
+```
+
+That is the whole command. In a project folder it works the rest out: the folder
+name is the slug, `package.json` says whether this is a document, a deck or a
+workbook, `dist/` is the built bundle, and the source travels with it so the file
+can be pulled back and edited. Every guess is printed, and a guess it cannot make
+stops the push rather than inventing something.
+
+The first push shows a device code to authorise in a browser. That machine stays
+signed in afterwards.
+
+## Commands
+
+```bash
+costaff-workspace push                  # push this folder
+costaff-workspace pull <token> [dir]    # fetch a published file's source
+costaff-workspace login                 # sign this machine in
+costaff-workspace logout                # forget this machine's sign-in
+```
+
+Useful flags on `push`:
+
+| Flag | |
+| --- | --- |
+| `--slug`, `--kind`, `--title` | override a guess |
+| `--site-dir <dir>` | the built bundle (default `dist`) |
+| `--no-source` | publish the bundle alone — nothing can be pulled back out of it |
+| `--dry-run` | package and report, without uploading or needing a network |
+| `--endpoint <url>` | a receiver you run yourself |
+
+## A project is a site of many documents
+
+An open-doc project is not one file — it is a site holding several documents
+under `docs/`, and one `open-doc build` puts all of their chunks in a single
+`assets/` directory. So `push` builds each document into a bundle of its own and
+pushes them one at a time.
+
+That is not tidiness. A share can only withhold the rest of a workspace if the
+rest of the workspace is not in the bundle: inside a shared build, anyone holding
+a link to one document can fetch the chunks of the others. The cost is real — N
+builds instead of one, and assets repeated across them.
+
+## The protocol is public
+
+`src/protocol.ts` is a specification, not an implementation detail. Anyone can
+run their own receiver and point `--endpoint` at it; `COSTAFF_WORKSPACE_ENDPOINT`
+does the same thing for a whole shell.
+
+Adding a required field is a breaking change for every third-party receiver, so
+optional is the default. `source` is optional: a push without it is still valid,
+and a receiver that ignores it still serves. `pull` is optional in the discovery
+document — a receiver that cannot hand source back omits the field rather than
+answering 404 to a command the CLI thought it had.
+
+## What travels with the source
+
+`node_modules` and dotfiles are not collected. `.env` is inside that.
+
+Local dependency specs (`link:`, `file:`, `workspace:`, `portal:`) are replaced
+with the version actually installed, because a path on the author's disk exists
+on no other machine. A version that cannot be resolved refuses the push — a
+published path nobody can resolve buys an install failure that talks about a
+missing directory instead of a broken dependency.
+
+## What comes back depends on who you are
+
+The server decides, not the client.
+
+| | You get | Pushing it back |
+| --- | --- | --- |
+| Owner | includes the token | updates the same link |
+| Shared with you | no token | publishes at a new link of your own; the original is untouched |
+
+Two clients each deciding who owns a file would eventually disagree.
+
+## Licence
+
+MIT

package/dist/bundle.js

@@ -0,0 +1,83 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { PUSH_PROTOCOL } from "./protocol.js";
+async function collect(dir, rel = '') {
+    const out = new Map();
+    for (const entry of await fs.readdir(dir, { withFileTypes: true })) {
+        const abs = path.join(dir, entry.name);
+        const key = rel ? `${rel}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) {
+            for (const [k, v] of await collect(abs, key))
+                out.set(k, v);
+        }
+        else if (entry.isFile()) {
+            out.set(key, new Uint8Array(await fs.readFile(abs)));
+        }
+    }
+    return out;
+}
+function nest(files) {
+    const tree = {};
+    for (const [key, bytes] of files) {
+        const parts = key.split('/');
+        let node = tree;
+        for (const part of parts.slice(0, -1)) {
+            const next = node[part];
+            if (next === undefined || next instanceof Uint8Array) {
+                const created = {};
+                node[part] = created;
+                node = created;
+            }
+            else {
+                node = next;
+            }
+        }
+        node[parts[parts.length - 1]] = bytes;
+    }
+    return tree;
+}
+/**
+ * Zips one file's built site plus its manifest.
+ *
+ * The manifest travels inside the zip rather than in a header so a receiver
+ * never has to parse metadata out of a size-capped header, and so the archive
+ * is self-describing once it lands in storage.
+ *
+ * Nothing here inspects the site: what the manifest says is what the caller
+ * stated. A publisher that guessed would sooner or later name something the
+ * recipient was never given.
+ */
+export async function createBundle(input) {
+    const stat = await fs.stat(input.siteDir).catch(() => null);
+    if (stat === null || !stat.isDirectory()) {
+        throw new Error(`No site at ${input.siteDir} — build it first.`);
+    }
+    const files = await collect(input.siteDir);
+    const entry = input.manifest.entry;
+    if (!files.has(entry)) {
+        throw new Error(`${input.siteDir} has no ${entry} — it is not a publishable site.`);
+    }
+    const manifest = {
+        ...input.manifest,
+        protocol: PUSH_PROTOCOL,
+        pushedAt: input.pushedAt,
+        ...(input.source === undefined
+            ? {}
+            : {
+                source: {
+                    dir: input.source.dir,
+                    entry: input.source.entry,
+                    dependencies: input.source.dependencies,
+                    devDependencies: input.source.devDependencies,
+                },
+            }),
+    };
+    const { zipSync } = await import('fflate');
+    const tree = {
+        'manifest.json': new TextEncoder().encode(`${JSON.stringify(manifest, null, 2)}\n`),
+        site: nest(files),
+        ...(input.source === undefined ? {} : { source: nest(input.source.files) }),
+    };
+    return { bytes: zipSync(tree), manifest };
+}
+//# sourceMappingURL=bundle.js.map

package/dist/bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAiBjE,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,GAAG,GAAG,EAAE;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACtD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,IAAI,CAAC,KAA8B;IAC1C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;gBACrD,MAAM,OAAO,GAAa,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;gBACrB,IAAI,GAAG,OAAO,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAkB;IACnD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,OAAO,WAAW,KAAK,kCAAkC,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,QAAQ,GAAiB;QAC7B,GAAG,KAAK,CAAC,QAAQ;QACjB,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;YAC5B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;oBACrB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;oBACzB,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;oBACvC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe;iBAC9C;aACF,CAAC;KACP,CAAC;IAEF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAa;QACrB,eAAe,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACnF,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;QACjB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;KAC5E,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,IAAqC,CAAC,EAAE,QAAQ,EAAE,CAAC;AAC7E,CAAC"}

package/dist/cli-pull.js

@@ -0,0 +1,60 @@
+import { PublishError, discover } from "./client.js";
+import { DEFAULT_ENDPOINT } from "./defaults.js";
+import { pull } from "./pull.js";
+import { login } from "./push.js";
+const USAGE = `costaff-workspace pull — fetch a published file's source back out
+
+  costaff-workspace pull <token> [dir] [options]
+
+  --endpoint <url>     receiver (default ${DEFAULT_ENDPOINT},
+                       or COSTAFF_WORKSPACE_ENDPOINT)
+  --force              write into a directory that is not empty
+  --bearer <token>     auth token instead of a stored login
+
+If you own the file, what comes back can be pushed straight back to the
+same link. If it was shared with you, it comes back as a copy: pushing it
+publishes at a new link under your own workspace.
+`;
+export async function runPull(argv) {
+    if (argv.length === 0 || argv.includes('--help') || argv.includes('-h')) {
+        process.stdout.write(USAGE);
+        return;
+    }
+    const flags = {};
+    const positional = [];
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (!arg.startsWith('--')) {
+            positional.push(arg);
+            continue;
+        }
+        const next = argv[i + 1];
+        if (next !== undefined && !next.startsWith('--')) {
+            flags[arg.slice(2)] = next;
+            i += 1;
+        }
+        else {
+            flags[arg.slice(2)] = true;
+        }
+    }
+    const str = (k) => typeof flags[k] === 'string' ? flags[k] : undefined;
+    const endpoint = str('endpoint') ?? process.env.COSTAFF_WORKSPACE_ENDPOINT ?? DEFAULT_ENDPOINT;
+    if (endpoint === '')
+        throw new PublishError('missing --endpoint');
+    const token = positional[0];
+    if (token === undefined)
+        throw new PublishError('missing <token>');
+    const out = (line) => {
+        process.stdout.write(line);
+    };
+    await pull({
+        endpoint,
+        token,
+        dir: positional[1],
+        force: flags.force === true,
+        bearer: str('bearer'),
+        out,
+        signIn: async () => login({ endpoint, out }, (await discover(endpoint)).name),
+    });
+}
+//# sourceMappingURL=cli-pull.js.map

package/dist/cli-pull.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-pull.js","sourceRoot":"","sources":["../src/cli-pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,MAAM,KAAK,GAAG;;;;2CAI6B,gBAAgB;;;;;;;;CAQ1D,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YAC3B,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAsB,EAAE,CAC5C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAK,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAElE,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,gBAAgB,CAAC;IAC/F,IAAI,QAAQ,KAAK,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAEnE,MAAM,GAAG,GAAG,CAAC,IAAY,EAAQ,EAAE;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC;IACF,MAAM,IAAI,CAAC;QACT,QAAQ;QACR,KAAK;QACL,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,IAAI;QAC3B,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC;QACrB,GAAG;QACH,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;KAC9E,CAAC,CAAC;AACL,CAAC"}

package/dist/cli.js

@@ -0,0 +1,173 @@
+import { PublishError } from "./client.js";
+import { DEFAULT_ENDPOINT, kindFromManifest, readManifest, slugFromDir, titleFromManifest, } from "./defaults.js";
+import { pushProject, realBuildItem, scanProject } from "./project.js";
+import { push } from "./push.js";
+const USAGE = `costaff-workspace push — push one built file into your workspace
+
+  costaff-workspace push [options]
+
+Run it in the project folder with nothing else and it works out the rest:
+the folder name is the slug, package.json says which kind, dist/ is the
+bundle, and the source travels with it so it can be pulled back and edited.
+
+  --endpoint <url>     receiver (default ${DEFAULT_ENDPOINT},
+                       or COSTAFF_WORKSPACE_ENDPOINT)
+  --slug <slug>        the file's identity (default: the folder's name)
+  --kind <kind>        document | workbook | deck (default: read from
+                       package.json, else document)
+  --site-dir <dir>     built bundle to upload (default dist)
+  --title <text>       display name (default: package.json description,
+                       else the slug)
+  --subtitle <text>
+  --folder <name>      folder in the file manager
+  --route <path>       route inside the bundle (default /)
+  --entry <file>       entry file inside the bundle (default index.html)
+  --source-dir <dir>   the item's source, relative to --source-root
+                       (default: the whole project)
+  --source-root <dir>  workspace root the source and its build setup live in
+                       (default: the current directory)
+  --no-source          publish the built bundle alone; nothing can be pulled
+                       back out of it afterwards
+  --source-entry <f>   file a rebuild starts from (default index.tsx)
+  --token <token>      override the remembered public address
+  --bearer <token>     auth token instead of a stored login
+  --login              sign in again even if a token is stored;
+                       on its own (with --endpoint) it just signs in
+  --logout             forget the stored login for this endpoint
+  --dry-run            package and report, do not upload
+`;
+const KINDS = new Set(['document', 'workbook', 'deck']);
+function parse(argv) {
+    const flags = {};
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (!arg.startsWith('--'))
+            continue;
+        const name = arg.slice(2);
+        const next = argv[i + 1];
+        if (next !== undefined && !next.startsWith('--')) {
+            flags[name] = next;
+            i += 1;
+        }
+        else {
+            flags[name] = true;
+        }
+    }
+    const str = (k) => typeof flags[k] === 'string' ? flags[k] : undefined;
+    const kind = (str('kind') ?? 'document');
+    if (!KINDS.has(kind))
+        throw new PublishError(`--kind must be one of ${[...KINDS].join(', ')}`);
+    const slug = str('slug') ?? '';
+    return {
+        help: flags.help === true || flags.h === true,
+        /* 猜測要能被說出來，所以記下哪些是使用者自己給的。 */
+        given: {
+            slug: str('slug') !== undefined,
+            kind: str('kind') !== undefined,
+            title: str('title') !== undefined,
+        },
+        noSource: flags['no-source'] === true,
+        endpoint: str('endpoint') ?? process.env.COSTAFF_WORKSPACE_ENDPOINT ?? DEFAULT_ENDPOINT,
+        slug,
+        kind,
+        title: str('title') ?? slug,
+        subtitle: str('subtitle'),
+        folder: str('folder') ?? null,
+        route: str('route') ?? '/',
+        entry: str('entry'),
+        siteDir: str('site-dir') ?? 'dist',
+        sourceRoot: str('source-root') ?? process.cwd(),
+        sourceDir: str('source-dir'),
+        sourceEntry: str('source-entry'),
+        token: str('token'),
+        bearer: str('bearer'),
+        login: flags.login === true,
+        logout: flags.logout === true,
+        dryRun: flags['dry-run'] === true,
+        out: (line) => process.stdout.write(line),
+    };
+}
+/*
+ * 補上沒給的值，並且把每一個猜測印出來。安靜猜錯比要求人打完整指令更糟 —— 推錯
+ * 位置的人得看得出來是哪一個猜測害的。
+ */
+async function fill(opts) {
+    const root = opts.sourceRoot ?? process.cwd();
+    const guessed = [];
+    if (!opts.given.slug) {
+        const slug = slugFromDir(root);
+        if (slug === null) {
+            throw new PublishError(`cannot make a slug out of the folder name — pass --slug (lowercase letters, digits and dashes)`);
+        }
+        opts.slug = slug;
+        guessed.push(`--slug ${slug}`);
+    }
+    const manifest = await readManifest(root);
+    if (!opts.given.kind) {
+        const kind = kindFromManifest(manifest);
+        if (kind !== null) {
+            opts.kind = kind;
+            guessed.push(`--kind ${kind}`);
+        }
+    }
+    if (!opts.given.title) {
+        opts.title = titleFromManifest(manifest, opts.slug);
+    }
+    /*
+     * 原始碼預設跟著走：沒有它，推上去的東西之後拉不回來改，而那正是這個服務
+     * 存在的理由。--no-source 是明確的退出方式。
+     */
+    if (opts.noSource) {
+        opts.sourceRoot = undefined;
+        opts.sourceDir = undefined;
+    }
+    else if (opts.sourceDir === undefined) {
+        opts.sourceDir = '.';
+        guessed.push('--source-dir .');
+    }
+    if (guessed.length > 0)
+        opts.out?.(`  guessed ${guessed.join('  ')}\n`);
+}
+export async function runPush(argv) {
+    const opts = parse(argv);
+    if (opts.help) {
+        process.stdout.write(USAGE);
+        return;
+    }
+    if (!opts.logout && opts.endpoint === '') {
+        process.stderr.write(`error: missing --endpoint\n\n${USAGE}`);
+        process.exit(1);
+    }
+    if (opts.logout || opts.login) {
+        await push(opts);
+        return;
+    }
+    /*
+     * 一個 open-doc／open-slide／open-sheet 專案是一個站台含多份文件，不是一份
+     * 檔案。每一份各自建置、各自推 —— 共用的 bundle 裡，拿到其中一份連結的人就能
+     * 抓到其餘的 chunk，那樣分享設定擋不住任何東西。
+     *
+     * 明確給了 --slug 的人是在手動推某一份，照他說的做。
+     */
+    const root = opts.sourceRoot ?? process.cwd();
+    const items = opts.given.slug ? [] : await scanProject(root);
+    if (items.length > 0) {
+        const by = new Map();
+        for (const it of items)
+            by.set(it.surface.label, (by.get(it.surface.label) ?? 0) + 1);
+        const shape = [...by].map(([label, n]) => `${n} ${label}`).join('、');
+        process.stdout.write(`  ${shape} —— 各自建置成獨立的 bundle\n`);
+        await pushProject({
+            root,
+            endpoint: opts.endpoint,
+            items,
+            dryRun: opts.dryRun,
+            buildItem: realBuildItem,
+            base: { bearer: opts.bearer, folder: opts.folder },
+        });
+        return;
+    }
+    await fill(opts);
+    await push(opts);
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEvE,OAAO,EAAoB,IAAI,EAAE,MAAM,WAAW,CAAC;AAEnD,MAAM,KAAK,GAAG;;;;;;;;2CAQ6B,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;CAyB1D,CAAC;AAEF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAW,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAQlE,SAAS,KAAK,CAAC,IAAc;IAC3B,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACnB,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAsB,EAAE,CAC5C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAK,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAElE,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,UAAU,CAAa,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,yBAAyB,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE/F,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,KAAK,IAAI;QAC7C,8BAA8B;QAC9B,KAAK,EAAE;YACL,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS;YAC/B,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS;YAC/B,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS;SAClC;QACD,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI;QACrC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,gBAAgB;QACvF,IAAI;QACJ,IAAI;QACJ,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI;QAC3B,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC;QACzB,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI;QAC7B,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG;QAC1B,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC;QACnB,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,MAAM;QAClC,UAAU,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE;QAC/C,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC;QAC5B,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC;QAChC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC;QACnB,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC;QACrB,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,IAAI;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,IAAI;QAC7B,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI;QACjC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,IAAI,CAAC,IAAY;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,YAAY,CACpB,gGAAgG,CACjG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAE1C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAED;;;OAGG;IACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;SAAM,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO;IACT,CAAC;IAED;;;;;;OAMG;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,IAAI,GAAG,EAAkB,CAAC;QACrC,KAAK,MAAM,EAAE,IAAI,KAAK;YAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,uBAAuB,CAAC,CAAC;QACxD,MAAM,WAAW,CAAC;YAChB,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,aAAa;YACxB,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;SACnD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC"}

package/dist/client.js

@@ -0,0 +1,123 @@
+import { DISCOVERY_PATH, isDiscovery, isPushResult, PUSH_PROTOCOL, } from "./protocol.js";
+export class PublishError extends Error {
+    status;
+    code;
+    constructor(message, status, 
+    /** Machine-readable reason from the receiver; a status alone is ambiguous. */
+    code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'PublishError';
+    }
+}
+function resolveAgainst(endpoint, target) {
+    return new URL(target, endpoint.endsWith('/') ? endpoint : `${endpoint}/`).toString();
+}
+async function readJson(res) {
+    const text = await res.text();
+    if (text.trim() === '')
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new PublishError(`${res.url} returned ${res.status} with a non-JSON body.`, res.status);
+    }
+}
+function errorCode(body) {
+    if (typeof body === 'object' && body !== null) {
+        const code = body.code;
+        if (typeof code === 'string' && code !== '')
+            return code;
+    }
+    return undefined;
+}
+function errorMessage(body, fallback) {
+    if (typeof body === 'object' && body !== null) {
+        const message = body.message;
+        if (typeof message === 'string' && message.trim() !== '')
+            return message;
+    }
+    return fallback;
+}
+export async function discover(endpoint) {
+    const url = resolveAgainst(endpoint, `.${DISCOVERY_PATH}`);
+    let res;
+    try {
+        res = await fetch(url, { headers: { accept: 'application/json' } });
+    }
+    catch (err) {
+        throw new PublishError(`Cannot reach ${endpoint} — ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!res.ok) {
+        throw new PublishError(`${endpoint} is not a CoStaff Workspace endpoint (${res.status}).`);
+    }
+    const body = await readJson(res);
+    if (!isDiscovery(body)) {
+        throw new PublishError(`${endpoint} returned a discovery document we cannot read.`);
+    }
+    if (body.protocol > PUSH_PROTOCOL) {
+        throw new PublishError(`${body.name} speaks push protocol ${body.protocol}; this open-doc understands ${PUSH_PROTOCOL}. Upgrade costaff-workspace.`);
+    }
+    return body;
+}
+export async function startDeviceAuth(endpoint, discovery) {
+    const res = await fetch(resolveAgainst(endpoint, discovery.deviceAuthStart), {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', accept: 'application/json' },
+        body: JSON.stringify({ protocol: PUSH_PROTOCOL }),
+    });
+    const body = await readJson(res);
+    if (!res.ok) {
+        throw new PublishError(errorMessage(body, `Login could not start (${res.status}).`), res.status);
+    }
+    return body;
+}
+export async function pollDeviceAuth(endpoint, discovery, deviceCode) {
+    const res = await fetch(resolveAgainst(endpoint, discovery.deviceAuthPoll), {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', accept: 'application/json' },
+        body: JSON.stringify({ deviceCode }),
+    });
+    const body = await readJson(res);
+    if (res.status === 428)
+        return { status: 'pending' };
+    if (!res.ok) {
+        throw new PublishError(errorMessage(body, `Login failed (${res.status}).`), res.status);
+    }
+    return body;
+}
+export async function upload(endpoint, discovery, token, bytes) {
+    if (bytes.byteLength > discovery.maxBytes) {
+        throw new PublishError(`Bundle is ${formatBytes(bytes.byteLength)}; ${discovery.name} accepts at most ${formatBytes(discovery.maxBytes)}.`);
+    }
+    const res = await fetch(resolveAgainst(endpoint, discovery.push), {
+        method: 'POST',
+        headers: {
+            authorization: `Bearer ${token}`,
+            'content-type': 'application/zip',
+            accept: 'application/json',
+        },
+        body: bytes,
+    });
+    const body = await readJson(res);
+    if (res.status === 401 || res.status === 403) {
+        throw new PublishError(errorMessage(body, 'Login expired — run with --login.'), res.status);
+    }
+    if (!res.ok) {
+        throw new PublishError(errorMessage(body, `Publish failed (${res.status}).`), res.status, errorCode(body));
+    }
+    if (!isPushResult(body)) {
+        throw new PublishError(`${discovery.name} accepted the upload but returned no share URL.`);
+    }
+    return body;
+}
+export function formatBytes(n) {
+    if (n < 1024)
+        return `${n} B`;
+    if (n < 1024 * 1024)
+        return `${(n / 1024).toFixed(1)} kB`;
+    return `${(n / (1024 * 1024)).toFixed(1)} MB`;
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,EAEd,WAAW,EACX,YAAY,EACZ,aAAa,GAEd,MAAM,eAAe,CAAC;AAEvB,MAAM,OAAO,YAAa,SAAQ,KAAK;IAG1B;IAEA;IAJX,YACE,OAAe,EACN,MAAe;IACxB,8EAA8E;IACrE,IAAa;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAS;QAEf,SAAI,GAAJ,IAAI,CAAS;QAGtB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,MAAc;IACtD,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;AACxF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,GAAG,GAAG,CAAC,GAAG,aAAa,GAAG,CAAC,MAAM,wBAAwB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAI,IAAgC,CAAC,IAAI,CAAC;QACpD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;IAC3D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,QAAgB;IACnD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAI,IAAgC,CAAC,OAAO,CAAC;QAC1D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,OAAO,CAAC;IAC3E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,cAAc,EAAE,CAAC,CAAC;IAC3D,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CACpB,gBAAgB,QAAQ,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CAAC,GAAG,QAAQ,yCAAyC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CAAC,GAAG,QAAQ,gDAAgD,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,GAAG,aAAa,EAAE,CAAC;QAClC,MAAM,IAAI,YAAY,CACpB,GAAG,IAAI,CAAC,IAAI,yBAAyB,IAAI,CAAC,QAAQ,+BAA+B,aAAa,8BAA8B,CAC7H,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,SAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,eAAe,CAAC,EAAE;QAC3E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;KAClD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CACpB,YAAY,CAAC,IAAI,EAAE,0BAA0B,GAAG,CAAC,MAAM,IAAI,CAAC,EAC5D,GAAG,CAAC,MAAM,CACX,CAAC;IACJ,CAAC;IACD,OAAO,IAAuB,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,SAAoB,EACpB,UAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,cAAc,CAAC,EAAE;QAC1E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC;KACrC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACrD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,IAAsB,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,QAAgB,EAChB,SAAoB,EACpB,KAAa,EACb,KAAiB;IAEjB,IAAI,KAAK,CAAC,UAAU,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,YAAY,CACpB,aAAa,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,IAAI,oBAAoB,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CACpH,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE;QAChE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,iBAAiB;YACjC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,KAA4B;KACnC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,MAAM,IAAI,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,mCAAmC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CACpB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,CAAC,MAAM,IAAI,CAAC,EACrD,GAAG,CAAC,MAAM,EACV,SAAS,CAAC,IAAI,CAAC,CAChB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CAAC,GAAG,SAAS,CAAC,IAAI,iDAAiD,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IAC9B,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAChD,CAAC"}

package/dist/credentials.js

@@ -0,0 +1,56 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+export function credentialsPath(env = process.env) {
+    const base = env.XDG_CONFIG_HOME?.trim() || path.join(os.homedir(), '.config');
+    return path.join(base, 'costaff-workspace', 'credentials.json');
+}
+/**
+ * Tokens are filed per endpoint origin, not per full URL: a receiver that moves
+ * its publish path must not orphan a valid login, and two endpoints on one host
+ * would share a session anyway.
+ */
+export function credentialKey(endpoint) {
+    return new URL(endpoint).origin;
+}
+async function readStore(file) {
+    try {
+        const parsed = JSON.parse(await fs.readFile(file, 'utf8'));
+        if (typeof parsed === 'object' &&
+            parsed !== null &&
+            typeof parsed.endpoints === 'object') {
+            return parsed;
+        }
+    }
+    catch {
+        // A missing or corrupt store is a logged-out state, not a failure.
+    }
+    return { version: 1, endpoints: {} };
+}
+export function isExpired(cred, now = Date.now()) {
+    if (cred.expiresAt === undefined)
+        return false;
+    const at = Date.parse(cred.expiresAt);
+    return Number.isFinite(at) && at <= now;
+}
+export async function loadCredential(endpoint, file = credentialsPath()) {
+    const store = await readStore(file);
+    const cred = store.endpoints[credentialKey(endpoint)];
+    if (cred === undefined || isExpired(cred))
+        return null;
+    return cred;
+}
+export async function saveCredential(endpoint, cred, file = credentialsPath()) {
+    const store = await readStore(file);
+    store.endpoints[credentialKey(endpoint)] = cred;
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    await fs.writeFile(file, `${JSON.stringify(store, null, 2)}\n`, { mode: 0o600 });
+    await fs.chmod(file, 0o600).catch(() => { });
+}
+export async function clearCredential(endpoint, file = credentialsPath()) {
+    const store = await readStore(file);
+    delete store.endpoints[credentialKey(endpoint)];
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    await fs.writeFile(file, `${JSON.stringify(store, null, 2)}\n`, { mode: 0o600 });
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAU7B,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,OAAQ,MAAgB,CAAC,SAAS,KAAK,QAAQ,EAC/C,CAAC;YACD,OAAO,MAAe,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAsB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAChE,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,IAAI,GAAG,eAAe,EAAE;IAExB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,IAAsB,EACtB,IAAI,GAAG,eAAe,EAAE;IAExB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACpC,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,CAAC;IAChD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,IAAI,GAAG,eAAe,EAAE;IAC9E,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACnF,CAAC"}