droppage 0.1.0

package/dist/cli.js

@@ -0,0 +1,1292 @@
+#!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// package.json
+var package_default;
+var init_package = __esm({
+  "package.json"() {
+    package_default = {
+      name: "droppage",
+      version: "0.1.0",
+      description: "Publish HTML files as shareable, access-controlled live pages",
+      type: "module",
+      license: "Apache-2.0",
+      author: "Vilancer",
+      repository: {
+        type: "git",
+        url: "git+https://github.com/Vilancer/droppage-cli.git"
+      },
+      homepage: "https://droppage.dev",
+      bugs: {
+        url: "https://github.com/Vilancer/droppage-cli/issues"
+      },
+      keywords: [
+        "html",
+        "publish",
+        "share",
+        "report",
+        "cli",
+        "link",
+        "access-control",
+        "agents"
+      ],
+      engines: {
+        node: ">=22"
+      },
+      bin: {
+        droppage: "dist/cli.js"
+      },
+      files: [
+        "dist",
+        "NOTICE"
+      ],
+      publishConfig: {
+        access: "public"
+      },
+      scripts: {
+        dev: "tsx src/cli.ts",
+        build: "tsup",
+        test: "vitest run",
+        "test:watch": "vitest",
+        prepublishOnly: `node -e "require('fs').accessSync('.publish-ok')" && npm run test && npm run build`
+      },
+      dependencies: {
+        "@inquirer/prompts": "8.5.2",
+        "@supabase/supabase-js": "2.110.8",
+        bcryptjs: "3.0.3",
+        commander: "15.0.0",
+        conf: "15.1.0",
+        dotenv: "17.4.2",
+        nanoid: "5.1.16",
+        open: "11.0.0",
+        zod: "4.4.3"
+      },
+      devDependencies: {
+        "@types/node": "^22.15.0",
+        tsup: "8.5.1",
+        tsx: "4.23.1",
+        typescript: "5.9.3",
+        vitest: "4.1.10"
+      }
+    };
+  }
+});
+
+// src/lib/callback-server.ts
+import { createServer } from "http";
+function closeServer(server) {
+  return new Promise((resolve) => {
+    server.close(() => resolve());
+  });
+}
+function tryListen(port) {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    const onError = (err) => {
+      server.off("listening", onListening);
+      reject(err);
+    };
+    const onListening = () => {
+      server.off("error", onError);
+      resolve(server);
+    };
+    server.once("error", onError);
+    server.once("listening", onListening);
+    server.listen(port, LOOPBACK);
+  });
+}
+async function pickCallbackPort() {
+  const candidates = [PREFERRED_PORT, ...FALLBACK_PORTS];
+  for (const port of candidates) {
+    try {
+      const server = await tryListen(port);
+      await closeServer(server);
+      return port;
+    } catch (err) {
+      const code = err && typeof err === "object" && "code" in err ? err.code : void 0;
+      if (code !== "EADDRINUSE") {
+        throw err;
+      }
+    }
+  }
+  throw new Error(
+    `No free localhost callback port in range ${PREFERRED_PORT}\u2013${FALLBACK_PORTS[FALLBACK_PORTS.length - 1]}`
+  );
+}
+function normalizeArgs(portOrOptions, pathArg) {
+  if (typeof portOrOptions === "number") {
+    return {
+      port: portOrOptions,
+      path: pathArg ?? DEFAULT_PATH,
+      timeoutMs: DEFAULT_TIMEOUT_MS
+    };
+  }
+  return {
+    port: portOrOptions.port,
+    path: portOrOptions.path ?? DEFAULT_PATH,
+    timeoutMs: portOrOptions.timeoutMs ?? DEFAULT_TIMEOUT_MS
+  };
+}
+function waitForAuthCode(portOrOptions, pathArg) {
+  const { port, path, timeoutMs } = normalizeArgs(portOrOptions, pathArg);
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let timeout;
+    const settle = (fn) => {
+      if (settled) return;
+      settled = true;
+      if (timeout) clearTimeout(timeout);
+      fn();
+    };
+    const server = createServer((req, res) => {
+      const url = new URL(req.url ?? "/", `http://${LOOPBACK}:${port}`);
+      if (url.pathname !== path) {
+        res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+        res.end("Not found");
+        return;
+      }
+      const code = url.searchParams.get("code");
+      const error = url.searchParams.get("error");
+      const errorDescription = url.searchParams.get("error_description");
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(SUCCESS_BODY);
+      void closeServer(server).then(() => {
+        if (code) {
+          settle(() => resolve(code));
+          return;
+        }
+        const message = errorDescription || error || "No auth code in callback";
+        settle(() => reject(new Error(message)));
+      });
+    });
+    server.on("error", (err) => {
+      settle(() => reject(err));
+    });
+    timeout = setTimeout(() => {
+      void closeServer(server).then(() => {
+        settle(
+          () => reject(new Error(`Timed out waiting for auth callback on port ${port}`))
+        );
+      });
+    }, timeoutMs);
+    server.listen(port, LOOPBACK);
+  });
+}
+var LOOPBACK, PREFERRED_PORT, FALLBACK_PORTS, DEFAULT_PATH, DEFAULT_TIMEOUT_MS, SUCCESS_BODY;
+var init_callback_server = __esm({
+  "src/lib/callback-server.ts"() {
+    "use strict";
+    LOOPBACK = "127.0.0.1";
+    PREFERRED_PORT = 19876;
+    FALLBACK_PORTS = [19877, 19878, 19879, 19880, 19881, 19882, 19883, 19884, 19885];
+    DEFAULT_PATH = "/callback";
+    DEFAULT_TIMEOUT_MS = 3e5;
+    SUCCESS_BODY = "You can close this window and return to the terminal.";
+  }
+});
+
+// src/lib/supabase-defaults.ts
+var DEFAULT_SUPABASE_URL, DEFAULT_SUPABASE_ANON_KEY;
+var init_supabase_defaults = __esm({
+  "src/lib/supabase-defaults.ts"() {
+    "use strict";
+    DEFAULT_SUPABASE_URL = "https://kqumkzpwufiepbbtmsbv.supabase.co";
+    DEFAULT_SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImtxdW1renB3dWZpZXBiYnRtc2J2Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODQ2NjE4OTUsImV4cCI6MjEwMDIzNzg5NX0.Od7YN0Rks8BfrEmcpiijBfdogg6x2jUbsYf_QeyC1lU";
+  }
+});
+
+// src/lib/env.ts
+import { config as loadDotenv } from "dotenv";
+import { join } from "path";
+import { z } from "zod";
+function rejectSecrets(label, value) {
+  if (SECRET_PATTERN.test(value)) {
+    throw new Error(
+      `${label} must not contain service_role or sb_secret (ARCH-02)`
+    );
+  }
+}
+function resolveSupabaseEnv() {
+  loadDotenv({ path: join(process.cwd(), ".env") });
+  const url = process.env.DROPPAGE_SUPABASE_URL || process.env.SUPABASE_URL || DEFAULT_SUPABASE_URL;
+  const anonKey = process.env.DROPPAGE_SUPABASE_ANON_KEY || process.env.SUPABASE_ANON_KEY || DEFAULT_SUPABASE_ANON_KEY;
+  if (!url.trim() || !anonKey.trim()) {
+    throw new Error(
+      "Missing Supabase configuration. Set DROPPAGE_SUPABASE_URL and DROPPAGE_SUPABASE_ANON_KEY (or SUPABASE_URL / SUPABASE_ANON_KEY)."
+    );
+  }
+  rejectSecrets("DROPPAGE_SUPABASE_URL / URL", url);
+  rejectSecrets("DROPPAGE_SUPABASE_ANON_KEY / anon key", anonKey);
+  return {
+    url: urlSchema.parse(url),
+    anonKey: anonKeySchema.parse(anonKey)
+  };
+}
+var SECRET_PATTERN, urlSchema, anonKeySchema;
+var init_env = __esm({
+  "src/lib/env.ts"() {
+    "use strict";
+    init_supabase_defaults();
+    SECRET_PATTERN = /service_role|sb_secret/i;
+    urlSchema = z.string().url();
+    anonKeySchema = z.string().min(1);
+  }
+});
+
+// src/lib/config.ts
+import Conf from "conf";
+import { homedir } from "os";
+import { join as join2 } from "path";
+function validateConfig(data) {
+  for (const [key, value] of Object.entries(data)) {
+    if (FORBIDDEN.test(key)) {
+      throw new Error(
+        `Config key rejected: must not contain service_role or sb_secret (${key})`
+      );
+    }
+    if (typeof value === "string" && FORBIDDEN.test(value)) {
+      throw new Error(
+        "Config value rejected: must not contain service_role or sb_secret"
+      );
+    }
+  }
+}
+function getConf() {
+  const home = homedir();
+  if (!confInstance || confHome !== home) {
+    confHome = home;
+    confInstance = new Conf({
+      cwd: join2(home, ".droppage"),
+      configName: "config",
+      configFileMode: 384
+    });
+  }
+  return confInstance;
+}
+function createConfStorage() {
+  const conf = getConf();
+  return {
+    getItem: (key) => {
+      const value = conf.get(key);
+      return typeof value === "string" ? value : null;
+    },
+    setItem: (key, value) => {
+      validateConfig({ [key]: value });
+      conf.set(key, value);
+    },
+    removeItem: (key) => {
+      conf.delete(key);
+    }
+  };
+}
+var FORBIDDEN, confInstance, confHome;
+var init_config = __esm({
+  "src/lib/config.ts"() {
+    "use strict";
+    FORBIDDEN = /service_role|sb_secret/i;
+  }
+});
+
+// src/lib/supabase.ts
+import { createClient } from "@supabase/supabase-js";
+function createSupabaseClient() {
+  if (client) {
+    return client;
+  }
+  const { url, anonKey } = resolveSupabaseEnv();
+  client = createClient(url, anonKey, {
+    auth: {
+      flowType: "pkce",
+      persistSession: true,
+      autoRefreshToken: true,
+      detectSessionInUrl: false,
+      storage: createConfStorage()
+    }
+  });
+  return client;
+}
+var client;
+var init_supabase = __esm({
+  "src/lib/supabase.ts"() {
+    "use strict";
+    init_config();
+    init_env();
+  }
+});
+
+// src/services/auth.ts
+import { input } from "@inquirer/prompts";
+import open from "open";
+import { z as z2 } from "zod";
+function isLocalSupabaseUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const localHost = parsed.hostname === "127.0.0.1" || parsed.hostname === "localhost";
+    if (!localHost) return false;
+    return parsed.port === "54321" || parsed.port === "";
+  } catch {
+    return false;
+  }
+}
+async function login() {
+  const supabase = createSupabaseClient();
+  const { data, error } = await supabase.auth.getUser();
+  if (!error && data.user?.email) {
+    console.log(`Logged in as ${data.user.email}`);
+    process.exitCode = 0;
+    return;
+  }
+  if (error) {
+    await supabase.auth.signOut({ scope: "local" });
+  }
+  const emailRaw = await input({
+    message: "Email:",
+    validate: (value) => {
+      const result = emailSchema.safeParse(value.trim());
+      return result.success ? true : "Enter a valid email address";
+    }
+  });
+  const email = emailRaw.trim();
+  const port = await pickCallbackPort();
+  const emailRedirectTo = `http://127.0.0.1:${port}/callback`;
+  const { error: otpError } = await supabase.auth.signInWithOtp({
+    email,
+    options: {
+      shouldCreateUser: true,
+      emailRedirectTo
+    }
+  });
+  if (otpError) {
+    console.error(`Failed to send magic link: ${otpError.message}`);
+    process.exitCode = 1;
+    throw otpError;
+  }
+  const codePromise = waitForAuthCode({ port, path: "/callback" });
+  console.log("Check your email for a magic link to sign in.");
+  console.log(
+    `(debug) After you click the link, Auth redirects to: ${emailRedirectTo}`
+  );
+  const { url } = resolveSupabaseEnv();
+  if (isLocalSupabaseUrl(url)) {
+    try {
+      await open(INBUCKET_URL);
+    } catch {
+    }
+  }
+  try {
+    const code = await codePromise;
+    const { data: sessionData, error: exchangeError } = await supabase.auth.exchangeCodeForSession(code);
+    if (exchangeError || !sessionData.user?.email) {
+      const message = exchangeError?.message ?? "No user after code exchange";
+      console.error(`Login failed: ${message}`);
+      process.exitCode = 1;
+      throw exchangeError ?? new Error(message);
+    }
+    console.log(`Logged in as ${sessionData.user.email}`);
+    process.exitCode = 0;
+  } catch (err) {
+    if (process.exitCode !== 1) {
+      console.error(
+        `Login failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+      process.exitCode = 1;
+    }
+    throw err;
+  }
+}
+async function logout() {
+  const supabase = createSupabaseClient();
+  const { data } = await supabase.auth.getSession();
+  if (!data.session) {
+    console.log("Already logged out");
+    process.exitCode = 0;
+    return;
+  }
+  await supabase.auth.signOut();
+  console.log("Logged out");
+  process.exitCode = 0;
+}
+async function requireAuth() {
+  const supabase = createSupabaseClient();
+  const { data, error } = await supabase.auth.getUser();
+  if (error || !data.user) {
+    await supabase.auth.signOut({ scope: "local" });
+    console.error(AUTH_REQUIRED_MESSAGE);
+    process.exitCode = 1;
+    throw new AuthRequiredError();
+  }
+  return data.user;
+}
+var emailSchema, INBUCKET_URL, AUTH_REQUIRED_MESSAGE, AuthRequiredError;
+var init_auth = __esm({
+  "src/services/auth.ts"() {
+    "use strict";
+    init_callback_server();
+    init_env();
+    init_supabase();
+    emailSchema = z2.email();
+    INBUCKET_URL = "http://127.0.0.1:54324";
+    AUTH_REQUIRED_MESSAGE = "Not logged in. Run `droppage login` and try again.";
+    AuthRequiredError = class extends Error {
+      constructor(message = AUTH_REQUIRED_MESSAGE) {
+        super(message);
+        this.name = "AuthRequiredError";
+      }
+    };
+  }
+});
+
+// src/commands/login.ts
+function registerLogin(program2) {
+  program2.command("login").description("Authenticate with Supabase").action(async () => {
+    await login();
+  });
+}
+var init_login = __esm({
+  "src/commands/login.ts"() {
+    "use strict";
+    init_auth();
+  }
+});
+
+// src/commands/logout.ts
+function registerLogout(program2) {
+  program2.command("logout").description("Sign out and clear local credentials").action(async () => {
+    await logout();
+  });
+}
+var init_logout = __esm({
+  "src/commands/logout.ts"() {
+    "use strict";
+    init_auth();
+  }
+});
+
+// src/lib/password.ts
+import bcrypt from "bcryptjs";
+async function hashPassword(plain) {
+  return bcrypt.hash(plain, BCRYPT_ROUNDS);
+}
+var BCRYPT_ROUNDS;
+var init_password = __esm({
+  "src/lib/password.ts"() {
+    "use strict";
+    BCRYPT_ROUNDS = 10;
+  }
+});
+
+// src/lib/share-url.ts
+function resolveShareBaseUrl() {
+  const raw = process.env.DROPPAGE_SHARE_BASE_URL?.trim();
+  return (raw || DEFAULT_SHARE_BASE_URL).replace(/\/+$/, "");
+}
+function buildShareUrl(slug) {
+  return `${resolveShareBaseUrl()}/p/${slug}`;
+}
+var DEFAULT_SHARE_BASE_URL;
+var init_share_url = __esm({
+  "src/lib/share-url.ts"() {
+    "use strict";
+    DEFAULT_SHARE_BASE_URL = "https://droppage.dev";
+  }
+});
+
+// src/lib/slug.ts
+import { customAlphabet } from "nanoid";
+function createSlug() {
+  return generate();
+}
+var SLUG_LENGTH, alphabet, generate;
+var init_slug = __esm({
+  "src/lib/slug.ts"() {
+    "use strict";
+    SLUG_LENGTH = 10;
+    alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-";
+    generate = customAlphabet(alphabet, SLUG_LENGTH);
+  }
+});
+
+// src/lib/validate-html.ts
+import { extname } from "path";
+function formatBytes(bytes) {
+  const mb = bytes / (1024 * 1024);
+  return `${mb.toFixed(1)} MB`;
+}
+function validateHtmlUpload(path, bytes) {
+  const ext = extname(path).toLowerCase();
+  if (!ALLOWED_EXTENSIONS.has(ext)) {
+    throw new Error(
+      `Unsupported file type: ${path} (expected .html or .htm)`
+    );
+  }
+  if (bytes.length === 0) {
+    throw new Error(`File is empty: ${path}`);
+  }
+  if (bytes.length > MAX_UPLOAD_BYTES) {
+    throw new Error(
+      `File too large: ${formatBytes(bytes.length)} (max ${formatBytes(
+        MAX_UPLOAD_BYTES
+      )})`
+    );
+  }
+  const head = Buffer.from(
+    bytes.subarray(0, Math.min(bytes.length, SNIFF_BYTES))
+  ).toString("utf8");
+  const looksLikeHtml = HTML_MARKERS.some((re) => re.test(head));
+  if (!looksLikeHtml) {
+    throw new Error(
+      `Content does not look like HTML: ${path} (no <!doctype html>, <html>, or <body> found)`
+    );
+  }
+  const warnings = [];
+  const body = bytes.length <= SNIFF_BYTES ? head : Buffer.from(bytes).toString("utf8");
+  if (RELATIVE_ASSET_RE.test(body)) {
+    warnings.push(
+      "HTML references relative assets (src/href beginning with ./ or /); they will not resolve in a single-file share. Inline them for a self-contained page."
+    );
+  }
+  if (EXTERNAL_ASSET_RE.test(body)) {
+    warnings.push(
+      "HTML references external assets (//host or http(s)://); they must be publicly reachable to render in the shared page."
+    );
+  }
+  return { ok: true, warnings };
+}
+var MAX_UPLOAD_BYTES, ALLOWED_EXTENSIONS, SNIFF_BYTES, HTML_MARKERS, RELATIVE_ASSET_RE, EXTERNAL_ASSET_RE;
+var init_validate_html = __esm({
+  "src/lib/validate-html.ts"() {
+    "use strict";
+    MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
+    ALLOWED_EXTENSIONS = /* @__PURE__ */ new Set([".html", ".htm"]);
+    SNIFF_BYTES = 4096;
+    HTML_MARKERS = [
+      /<!doctype\s+html/i,
+      /<html[\s>]/i,
+      /<head[\s>]/i,
+      /<body[\s>]/i,
+      /<div[\s>]/i
+    ];
+    RELATIVE_ASSET_RE = /(?:src|href)\s*=\s*["'](?:\.\.?\/|\/(?!\/))/i;
+    EXTERNAL_ASSET_RE = /(?:src|href)\s*=\s*["'](\/\/|https?:\/\/)/i;
+  }
+});
+
+// src/services/upload.ts
+import { readFile } from "fs/promises";
+async function upload({
+  file,
+  user,
+  passwordHash,
+  allowedEmails,
+  accessMode
+}) {
+  const bytes = await readFile(file);
+  const { warnings } = validateHtmlUpload(file, bytes);
+  for (const w of warnings) console.error(`droppage: warning: ${w}`);
+  const supabase = createSupabaseClient();
+  for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+    const slug = createSlug();
+    const storagePath = `${user.id}/${slug}.html`;
+    const up = await supabase.storage.from(BUCKET).upload(storagePath, bytes, {
+      contentType: "text/html; charset=utf-8",
+      upsert: false
+    });
+    if (up.error) throw up.error;
+    const resolvedMode = accessMode ?? (allowedEmails ? "email" : passwordHash ? "password" : "public");
+    const ins = await supabase.rpc("create_page_with_entitlements", {
+      p_slug: slug,
+      p_storage_path: storagePath,
+      p_access_mode: resolvedMode,
+      p_password_hash: resolvedMode === "password" ? passwordHash : null,
+      p_allowed_emails: allowedEmails ?? null
+    });
+    if (!ins.error) return buildShareUrl(slug);
+    const rm = await supabase.storage.from(BUCKET).remove([storagePath]);
+    if (rm.error) {
+      console.error(
+        `droppage: warning: could not remove orphan ${storagePath}: ${rm.error.message}`
+      );
+    }
+    if (ins.error.code === "23505") continue;
+    throw ins.error;
+  }
+  throw new Error(
+    `Could not allocate a unique slug after ${MAX_RETRIES} attempts`
+  );
+}
+var BUCKET, MAX_RETRIES;
+var init_upload = __esm({
+  "src/services/upload.ts"() {
+    "use strict";
+    init_share_url();
+    init_slug();
+    init_supabase();
+    init_validate_html();
+    BUCKET = "pages";
+    MAX_RETRIES = 5;
+  }
+});
+
+// src/commands/upload.ts
+import { password as passwordPrompt } from "@inquirer/prompts";
+function registerUpload(program2) {
+  program2.command("upload").description("Upload an HTML file and get a shareable URL").argument("<file>", "path to .html file").option("--password", "protect the page with a password (prompts securely)").option(
+    "--email <address>",
+    "restrict access to an email allowlist (repeatable; comma-separated)",
+    (val, prev = []) => prev.concat(val.split(","))
+  ).option("--private", "restrict access to only you (owner-only draft)").action(
+    async (file, options) => {
+      let user;
+      try {
+        user = await requireAuth();
+      } catch (err) {
+        if (err instanceof AuthRequiredError) return;
+        throw err;
+      }
+      const modeFlags = [
+        options.password,
+        options.email?.length,
+        options.private
+      ].filter(Boolean).length;
+      if (modeFlags > 1) {
+        process.exitCode = 1;
+        console.error(
+          "droppage: --password, --email, and --private are mutually exclusive \u2014 a page is exactly one access mode."
+        );
+        return;
+      }
+      try {
+        let passwordHash;
+        let allowedEmails;
+        let accessMode = "public";
+        if (options.password) {
+          const pw = await passwordPrompt({ message: "Password:", mask: "*" });
+          const confirm = await passwordPrompt({
+            message: "Confirm password:",
+            mask: "*"
+          });
+          if (pw !== confirm) throw new Error("Passwords do not match");
+          passwordHash = await hashPassword(pw);
+          accessMode = "password";
+        } else if (options.email?.length) {
+          const cleaned = [
+            ...new Set(
+              options.email.map((e) => e.trim().toLowerCase()).filter(Boolean)
+            )
+          ];
+          if (!cleaned.length) {
+            throw new Error(
+              "--email was given but contained no email addresses"
+            );
+          }
+          const invalid = cleaned.filter(
+            (e) => !emailSchema.safeParse(e).success
+          );
+          if (invalid.length) {
+            throw new Error(
+              `invalid email address(es): ${invalid.join(", ")}`
+            );
+          }
+          allowedEmails = cleaned;
+          accessMode = "email";
+        } else if (options.private) {
+          const ownerEmail = user.email?.trim().toLowerCase();
+          if (!ownerEmail) {
+            throw new Error(
+              "--private requires an email on your account, but none was found"
+            );
+          }
+          allowedEmails = [ownerEmail];
+          accessMode = "private";
+        }
+        console.error(`droppage: uploading ${file}...`);
+        const url = await upload({
+          file,
+          user,
+          passwordHash,
+          allowedEmails,
+          accessMode
+        });
+        console.error("droppage: done");
+        process.stdout.write(url + "\n");
+      } catch (err) {
+        process.exitCode = 1;
+        console.error(
+          `droppage: upload failed: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+  );
+}
+var init_upload2 = __esm({
+  "src/commands/upload.ts"() {
+    "use strict";
+    init_password();
+    init_auth();
+    init_upload();
+  }
+});
+
+// src/services/pages.ts
+import { readFile as readFile2 } from "fs/promises";
+async function listPages(user) {
+  const supabase = createSupabaseClient();
+  const { data, error } = await supabase.from("pages").select(
+    "slug, access_mode, allowed_emails, view_count, created_at, last_viewed_at"
+  ).eq("owner_id", user.id).order("created_at", { ascending: false });
+  if (error) throw error;
+  return data ?? [];
+}
+async function deletePage(slug, user) {
+  const supabase = createSupabaseClient();
+  const { data: row, error: selectError } = await supabase.from("pages").select("slug, storage_path").eq("slug", slug).eq("owner_id", user.id).maybeSingle();
+  if (selectError) throw selectError;
+  if (!row) return { ok: false, partial: false, message: NOT_FOUND_MESSAGE };
+  const storagePath = row.storage_path;
+  const removed = await supabase.storage.from(BUCKET2).remove([storagePath]);
+  if (removed.error) {
+    return {
+      ok: false,
+      partial: false,
+      message: `could not remove ${slug}: ${removed.error.message}. Nothing was deleted and the link still works.`
+    };
+  }
+  const blobWasAbsent = (removed.data ?? []).length === 0;
+  const deleted = await supabase.from("pages").delete().eq("slug", slug).eq("owner_id", user.id).select("slug");
+  const deletedCount = deleted.data?.length ?? 0;
+  if (deleted.error || deletedCount === 0) {
+    if (blobWasAbsent && deletedCount === 0 && !deleted.error) {
+      return { ok: false, partial: false, message: NOT_FOUND_MESSAGE };
+    }
+    return {
+      ok: false,
+      partial: true,
+      message: `stored HTML for ${slug} was removed, so the link is dead, but the metadata row could not be deleted (${deleted.error?.message ?? "zero rows affected"}). Re-run droppage delete ${slug}.`
+    };
+  }
+  if (blobWasAbsent) {
+    console.error(
+      `droppage: warning: no stored HTML was found at ${storagePath}; deleted metadata row for ${slug}.`
+    );
+  }
+  return { ok: true, blobWasAbsent };
+}
+async function updatePageHtml({
+  slug,
+  file,
+  user
+}) {
+  const bytes = await readFile2(file);
+  const { warnings } = validateHtmlUpload(file, bytes);
+  for (const warning of warnings) {
+    console.error(`droppage: warning: ${warning}`);
+  }
+  const supabase = createSupabaseClient();
+  const preflight = await supabase.rpc("assert_page_update_allowed", {
+    p_slug: slug
+  });
+  if (preflight.error) throw preflight.error;
+  const { data: row, error: selectError } = await supabase.from("pages").select("slug, storage_path").eq("slug", slug).eq("owner_id", user.id).maybeSingle();
+  if (selectError) throw selectError;
+  if (!row) throw new Error("page not found or not owned");
+  const storagePath = row.storage_path;
+  if (!storagePath.startsWith(`${user.id}/`)) {
+    throw new Error("page storage path is not owner-scoped");
+  }
+  const replaced = await supabase.storage.from(BUCKET2).update(storagePath, bytes, {
+    contentType: "text/html; charset=utf-8"
+  });
+  if (replaced.error) {
+    throw new Error(
+      `could not replace stored HTML: ${replaced.error.message}. The existing link may still serve the previous content.`
+    );
+  }
+  return {
+    slug,
+    storagePath,
+    url: buildShareUrl(slug)
+  };
+}
+var BUCKET2, NOT_FOUND_MESSAGE;
+var init_pages = __esm({
+  "src/services/pages.ts"() {
+    "use strict";
+    init_share_url();
+    init_supabase();
+    init_validate_html();
+    BUCKET2 = "pages";
+    NOT_FOUND_MESSAGE = "page not found or already deleted";
+  }
+});
+
+// src/commands/update.ts
+function registerUpdate(program2) {
+  program2.command("update").description("Replace the HTML behind an existing page URL").argument("<slug>", "slug of the page to update").argument("<file>", "path to replacement .html file").action(async (slug, file) => {
+    let user;
+    try {
+      user = await requireAuth();
+    } catch (err) {
+      if (err instanceof AuthRequiredError) return;
+      throw err;
+    }
+    try {
+      console.error(`droppage: updating ${slug} from ${file}...`);
+      const result = await updatePageHtml({ slug, file, user });
+      console.error(`droppage: updated ${slug}`);
+      process.stdout.write(result.url + "\n");
+    } catch (err) {
+      process.exitCode = 1;
+      console.error(
+        `droppage: update failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  });
+}
+var init_update = __esm({
+  "src/commands/update.ts"() {
+    "use strict";
+    init_auth();
+    init_pages();
+  }
+});
+
+// src/lib/table.ts
+function renderTable(headers, rows, align = headers.map(() => "left")) {
+  const widths = headers.map(
+    (header, i) => Math.max(header.length, ...rows.map((row) => row[i]?.length ?? 0))
+  );
+  const formatRow = (row) => row.map(
+    (cell, i) => align[i] === "right" ? cell.padStart(widths[i]) : cell.padEnd(widths[i])
+  ).join("  ").trimEnd();
+  return [formatRow(headers), ...rows.map(formatRow)].join("\n");
+}
+function formatModeCell(accessMode, allowedEmails) {
+  if (accessMode === "email" || accessMode === "private") {
+    return `${accessMode}(${allowedEmails?.length ?? 0})`;
+  }
+  return accessMode;
+}
+function formatDateCell(iso) {
+  return iso === null ? "\u2014" : iso.slice(0, 10);
+}
+function pageTableCells(row) {
+  return [
+    row.slug,
+    formatModeCell(row.access_mode, row.allowed_emails),
+    formatDateCell(row.created_at),
+    String(row.view_count),
+    formatDateCell(row.last_viewed_at)
+  ];
+}
+var PAGE_TABLE_HEADERS, PAGE_TABLE_ALIGN;
+var init_table = __esm({
+  "src/lib/table.ts"() {
+    "use strict";
+    PAGE_TABLE_HEADERS = [
+      "SLUG",
+      "MODE",
+      "CREATED",
+      "VIEWS",
+      "LAST VIEWED"
+    ];
+    PAGE_TABLE_ALIGN = [
+      "left",
+      "left",
+      "left",
+      "right",
+      "left"
+    ];
+  }
+});
+
+// src/commands/list.ts
+async function fetchPreviewUrls(pages) {
+  if (pages.length === 0) return /* @__PURE__ */ new Map();
+  const supabase = createSupabaseClient();
+  const { data } = await supabase.auth.getSession();
+  const token = data.session?.access_token;
+  if (!token) return null;
+  const response = await fetch(`${resolveShareBaseUrl()}/api/preview`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({ slugs: pages.map((page) => page.slug) })
+  });
+  if (!response.ok) return null;
+  const body = await response.json();
+  return new Map(
+    (body.previews ?? []).filter(
+      (preview) => typeof preview.slug === "string" && typeof preview.url === "string"
+    ).map((preview) => [preview.slug, preview.url])
+  );
+}
+function registerList(program2) {
+  program2.command("list").description(
+    "List your published pages. VIEWS is a raw hit count, including refreshes and crawlers, not unique visitors."
+  ).option("--json", "print a machine-readable JSON array").option("--preview", "include temporary preview URLs that do not increment views").action(async (options) => {
+    let user;
+    try {
+      user = await requireAuth();
+    } catch (err) {
+      if (err instanceof AuthRequiredError) return;
+      throw err;
+    }
+    try {
+      const pages = await listPages(user);
+      let previews = null;
+      if (options.preview) {
+        try {
+          previews = await fetchPreviewUrls(pages);
+        } catch {
+          previews = null;
+        }
+        if (!previews) {
+          console.error(
+            "droppage: warning: could not fetch preview URLs; showing pages without previews."
+          );
+        }
+      }
+      if (pages.length === 0) {
+        console.error(
+          "droppage: no pages yet. Publish one with `droppage upload <file.html>`."
+        );
+      }
+      if (options.json) {
+        process.stdout.write(
+          JSON.stringify(
+            pages.map((page) => ({
+              slug: page.slug,
+              url: buildShareUrl(page.slug),
+              access_mode: page.access_mode,
+              allowed_emails: page.allowed_emails ?? [],
+              view_count: page.view_count,
+              created_at: page.created_at,
+              last_viewed_at: page.last_viewed_at,
+              ...options.preview ? { preview_url: previews?.get(page.slug) ?? null } : {}
+            })),
+            null,
+            2
+          ) + "\n"
+        );
+        return;
+      }
+      if (pages.length > 0) {
+        const headers = options.preview ? [...PAGE_TABLE_HEADERS, "PREVIEW"] : PAGE_TABLE_HEADERS;
+        const align = options.preview ? [...PAGE_TABLE_ALIGN, "left"] : PAGE_TABLE_ALIGN;
+        process.stdout.write(
+          renderTable(
+            headers,
+            pages.map(
+              (page) => options.preview ? [...pageTableCells(page), previews?.get(page.slug) ?? "\u2014"] : pageTableCells(page)
+            ),
+            align
+          ) + "\n"
+        );
+      }
+    } catch (err) {
+      console.error(
+        `droppage: list failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+      process.exitCode = 1;
+    }
+  });
+}
+var init_list = __esm({
+  "src/commands/list.ts"() {
+    "use strict";
+    init_share_url();
+    init_table();
+    init_supabase();
+    init_auth();
+    init_pages();
+  }
+});
+
+// src/commands/delete.ts
+import { confirm as confirmPrompt } from "@inquirer/prompts";
+function registerDelete(program2) {
+  program2.command("delete").description("Delete a published page").argument("<slug>", "slug of the page to delete").option("-y, --yes", "skip the confirmation prompt").action(async (slug, options) => {
+    let user;
+    try {
+      user = await requireAuth();
+    } catch (err) {
+      if (err instanceof AuthRequiredError) return;
+      throw err;
+    }
+    if (!options.yes) {
+      const ok = await confirmPrompt({
+        message: `Delete ${slug} (${buildShareUrl(slug)})? This cannot be undone.`,
+        default: false
+      });
+      if (!ok) {
+        console.error("droppage: delete aborted.");
+        return;
+      }
+    }
+    try {
+      const result = await deletePage(slug, user);
+      if (result.ok) {
+        console.error(`droppage: deleted ${slug}; the link no longer works.`);
+        return;
+      }
+      console.error(`droppage: ${result.message}`);
+      process.exitCode = 1;
+    } catch (err) {
+      console.error(
+        `droppage: delete failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+      process.exitCode = 1;
+    }
+  });
+}
+var init_delete = __esm({
+  "src/commands/delete.ts"() {
+    "use strict";
+    init_share_url();
+    init_auth();
+    init_pages();
+  }
+});
+
+// src/services/recipients.ts
+async function authedFetch(path, init) {
+  const supabase = createSupabaseClient();
+  const { data } = await supabase.auth.getSession();
+  const token = data.session?.access_token;
+  if (!token) throw new RecipientRequestError("not signed in; run `droppage login`", 401);
+  let response;
+  try {
+    response = await fetch(`${resolveShareBaseUrl()}${path}`, {
+      ...init,
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+        ...init.headers ?? {}
+      }
+    });
+  } catch (err) {
+    throw new RecipientRequestError(
+      `could not reach ${resolveShareBaseUrl()}: ${err instanceof Error ? err.message : String(err)}`,
+      0
+    );
+  }
+  const text = await response.text();
+  let body = null;
+  try {
+    body = text ? JSON.parse(text) : null;
+  } catch {
+  }
+  if (!response.ok) {
+    const message = body?.error ?? `request failed (HTTP ${response.status})`;
+    throw new RecipientRequestError(message, response.status);
+  }
+  return body;
+}
+function recipientsPath(slug) {
+  return `/api/pages/${encodeURIComponent(slug)}/recipients`;
+}
+async function listRecipients(slug, _user, page = 1) {
+  return await authedFetch(`${recipientsPath(slug)}?page=${page}`, {
+    method: "GET"
+  });
+}
+async function addRecipients(slug, emails, _user) {
+  return await authedFetch(recipientsPath(slug), {
+    method: "POST",
+    body: JSON.stringify({ emails })
+  });
+}
+async function removeRecipient(slug, email, _user) {
+  await authedFetch(`${recipientsPath(slug)}?email=${encodeURIComponent(email)}`, {
+    method: "DELETE"
+  });
+}
+async function resendRecipient(slug, email, _user) {
+  await authedFetch(recipientsPath(slug), {
+    method: "POST",
+    body: JSON.stringify({ action: "resend", email })
+  });
+}
+var RecipientRequestError;
+var init_recipients = __esm({
+  "src/services/recipients.ts"() {
+    "use strict";
+    init_share_url();
+    init_supabase();
+    RecipientRequestError = class extends Error {
+      constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "RecipientRequestError";
+      }
+    };
+  }
+});
+
+// src/commands/recipients.ts
+import { confirm as confirmPrompt2 } from "@inquirer/prompts";
+import { z as z3 } from "zod";
+function formatDateCell2(iso) {
+  return iso === null ? "\u2014" : iso.slice(0, 10);
+}
+function recipientCells(row) {
+  return [row.email, row.status, row.invitation_status, formatDateCell2(row.last_sent_at)];
+}
+function cleanEmails(values) {
+  const cleaned = [...new Set(values.map((e) => e.trim().toLowerCase()).filter(Boolean))];
+  if (!cleaned.length) throw new Error("no email addresses given");
+  const invalid = cleaned.filter((e) => !emailSchema2.safeParse(e).success);
+  if (invalid.length) throw new Error(`invalid email address(es): ${invalid.join(", ")}`);
+  return cleaned;
+}
+async function run(action) {
+  let user;
+  try {
+    user = await requireAuth();
+  } catch (err) {
+    if (err instanceof AuthRequiredError) return;
+    throw err;
+  }
+  try {
+    await action(user);
+  } catch (err) {
+    const message = err instanceof RecipientRequestError || err instanceof Error ? err.message : String(err);
+    console.error(`droppage: ${message}`);
+    process.exitCode = 1;
+  }
+}
+function registerRecipients(program2) {
+  const recipients = program2.command("recipients").description("Manage who can open an email-gated page");
+  recipients.command("list").description("List recipients on a page").argument("<slug>", "slug of the page").option("--json", "print a machine-readable JSON object").option("--page <n>", "page number for paginated results", "1").action(async (slug, options) => {
+    await run(async (user) => {
+      const page = Number(options.page);
+      const result = await listRecipients(
+        slug,
+        user,
+        Number.isSafeInteger(page) && page > 0 ? page : 1
+      );
+      if (options.json) {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return;
+      }
+      if (result.recipients.length === 0) {
+        console.error(`droppage: no recipients on ${slug} yet.`);
+        return;
+      }
+      process.stdout.write(
+        renderTable(
+          RECIPIENT_HEADERS,
+          result.recipients.map(recipientCells),
+          RECIPIENT_ALIGN
+        ) + "\n"
+      );
+      const shown = result.recipients.length;
+      console.error(
+        `droppage: ${shown} of ${result.total} recipient(s), page ${result.page}.`
+      );
+    });
+  });
+  recipients.command("add").description("Add recipients and queue their invitations").argument("<slug>", "slug of the page").argument("<emails...>", "one or more email addresses").action(async (slug, emails) => {
+    await run(async (user) => {
+      const cleaned = cleanEmails(emails);
+      const result = await addRecipients(slug, cleaned, user);
+      console.error(
+        `droppage: ${result.queued} invitation(s) queued, ${result.unchanged} already had access.`
+      );
+    });
+  });
+  recipients.command("remove").description("Revoke a recipient; their invitation link stops working").argument("<slug>", "slug of the page").argument("<email>", "email address to revoke").option("-y, --yes", "skip the confirmation prompt").action(async (slug, email, options) => {
+    await run(async (user) => {
+      const [cleaned] = cleanEmails([email]);
+      if (!options.yes) {
+        const ok = await confirmPrompt2({
+          message: `Revoke ${cleaned} from ${slug}? Their link will stop working.`,
+          default: false
+        });
+        if (!ok) {
+          console.error("droppage: remove aborted.");
+          return;
+        }
+      }
+      await removeRecipient(slug, cleaned, user);
+      console.error(`droppage: revoked ${cleaned}; their link no longer works.`);
+    });
+  });
+  recipients.command("resend").description("Queue a fresh invitation for one existing recipient").argument("<slug>", "slug of the page").argument("<email>", "email address to resend to").action(async (slug, email) => {
+    await run(async (user) => {
+      const [cleaned] = cleanEmails([email]);
+      await resendRecipient(slug, cleaned, user);
+      console.error(`droppage: invitation for ${cleaned} queued.`);
+    });
+  });
+}
+var emailSchema2, RECIPIENT_HEADERS, RECIPIENT_ALIGN;
+var init_recipients2 = __esm({
+  "src/commands/recipients.ts"() {
+    "use strict";
+    init_table();
+    init_auth();
+    init_recipients();
+    emailSchema2 = z3.email();
+    RECIPIENT_HEADERS = ["EMAIL", "STATUS", "INVITATION", "LAST SENT"];
+    RECIPIENT_ALIGN = ["left", "left", "left", "left"];
+  }
+});
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  createProgram: () => createProgram
+});
+import { Command } from "commander";
+function createProgram() {
+  const program2 = new Command().name("droppage").description(
+    "Publish HTML files as shareable, access-controlled live pages"
+  ).version(package_default.version);
+  registerLogin(program2);
+  registerLogout(program2);
+  registerUpload(program2);
+  registerUpdate(program2);
+  registerList(program2);
+  registerDelete(program2);
+  registerRecipients(program2);
+  return program2;
+}
+var init_index = __esm({
+  "src/index.ts"() {
+    "use strict";
+    init_package();
+    init_login();
+    init_logout();
+    init_upload2();
+    init_update();
+    init_list();
+    init_delete();
+    init_recipients2();
+  }
+});
+
+// src/cli.ts
+var MIN_NODE_MAJOR = 22;
+var nodeMajor = Number(process.versions.node.split(".")[0]);
+if (nodeMajor < MIN_NODE_MAJOR) {
+  process.stderr.write(
+    `droppage requires Node.js ${MIN_NODE_MAJOR} or newer (found ${process.versions.node}).
+Upgrade Node.js: https://nodejs.org/
+`
+  );
+  process.exit(1);
+}
+var { createProgram: createProgram2 } = await Promise.resolve().then(() => (init_index(), index_exports));
+var program = createProgram2();
+await program.parseAsync(process.argv);