gamit 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 gamit
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,132 @@
+# gamit CLI
+
+Publish vibe-coded web games to [gamit.ai](https://gamit.ai) in one command.
+The CLI is a thin client over the public REST API (`/api/v1`) — everything it
+does, an agent with the same API key can do with plain `fetch`.
+
+## Install
+
+```bash
+npx gamit <command>      # no install, always the latest published version
+npm i -g gamit           # global install
+```
+
+Requires Node.js >= 18.17. Every release after v0.1.0 is published from CI with
+[npm provenance](https://docs.npmjs.com/generating-provenance-statements) —
+npmjs.com shows a `✓ Built and signed` badge linking the package to the exact
+source commit and workflow run that built it.
+
+## Quickstart
+
+```bash
+# 1. authenticate (key from gamit.ai dashboard → API keys)
+gamit login
+
+# 2. scaffold a manifest in your game directory
+cd my-game
+gamit init
+
+# 3. ship it
+gamit publish
+# ✔ Published → https://gamit.ai/p/my-space/my-game
+#   Play: https://gamit.app/play/<projectId>/<buildId>/index.html
+```
+
+Re-running `gamit publish` is an idempotent republish: the first publish
+writes `projectId` back into `gamit.json`, so subsequent runs upload a new
+build to the same project and republish it.
+
+## Sign out
+
+```bash
+gamit logout             # removes the stored API key from ~/.gamit/config.json
+```
+
+The API key is stored at `~/.gamit/config.json` (file mode `0600`). `gamit login`
+prompts for the key by default; the `--key <key>` flag is available for
+non-interactive/CI use but lands in your shell history, so prefer the prompt.
+
+## Commands
+
+### `gamit login [--key <key>] [--api-base <url>]`
+
+Validates the key against `GET /api/v1/me` and stores it in
+`~/.gamit/config.json` (mode `0600`). Without `--key` it prompts on stdin.
+
+### `gamit init [dir] [--force]`
+
+Interactive prompts (title, slug, spaceSlug, kind, entry, engine) that write
+`gamit.json` into `dir` (default `.`). Refuses to overwrite an existing
+manifest unless `--force` is given.
+
+### `gamit publish [dir] [--api-base <url>]`
+
+End-to-end publish of `dir` (default `.`):
+
+1. Reads and validates `gamit.json`.
+2. Packs the directory into a zip (excludes `node_modules/`, `.git/`,
+   dot-directories like `.next/`, all dotfiles including `.env*`,
+   `gamit.json` itself, and `*.zip`; 4MB limit, entry file must be present).
+3. Resolves the project: reuses `projectId` if present; otherwise ensures the
+   space exists (creates it if you don't own it yet) and creates — or reuses —
+   the project by slug.
+4. Uploads the zip as a new build (`POST /api/v1/projects/{id}/builds`,
+   multipart `file`; the server detects the entry HTML).
+5. Publishes the project (`PATCH {"status":"published"}`).
+6. Writes `projectId` back into `gamit.json` and prints the page + play URLs.
+
+## gamit.json
+
+The manifest is the unit of config; it also becomes the project's
+`ai_manifest` on the platform.
+
+```json
+{
+  "title": "Click The Dot",
+  "slug": "click-the-dot",
+  "spaceSlug": "my-arcade",
+  "kind": "game",
+  "entry": "index.html",
+  "engine": "vanilla-js",
+  "summary": "A tiny reflex game.",
+  "tags": ["arcade", "casual"]
+}
+```
+
+| Field | Required | Type | Notes |
+| --- | --- | --- | --- |
+| `title` | yes | string | 1–200 chars |
+| `slug` | yes | string | `[a-z0-9-]`, 1–60 chars; unique within the space |
+| `spaceSlug` | yes | string | `[a-z0-9-]`, 3–40 chars; globally unique — created on first publish if you don't own it |
+| `kind` | yes | enum | `game` \| `asset` \| `tool` |
+| `entry` | yes | string | path of the entry HTML file inside the directory (must end in `.html` and exist) |
+| `engine` | no | string | e.g. `vanilla-js`, `phaser`, `godot-web` |
+| `summary` | no | string | short description shown on the project page |
+| `tags` | no | string[] | max 5 tags, each ≤ 40 chars |
+| `projectId` | auto | uuid | written by the CLI after the first publish; makes republish idempotent. Remove it to publish as a new project. |
+
+## Authentication and key scopes
+
+Keys are issued in the gamit.ai dashboard (`gmt_live_…`, scoped Bearer keys).
+`gamit publish` needs **write** (create spaces/projects, upload builds) and
+**publish** (set status to published). `gamit login` works with any scope.
+
+Key resolution order: `GAMIT_API_KEY` env var > `~/.gamit/config.json`
+(override the directory with `GAMIT_CONFIG_DIR`).
+
+## Self-hosted / dev servers
+
+Every command accepts `--api-base <url>` (or set `GAMIT_API_BASE`):
+
+```bash
+gamit publish --api-base http://localhost:3000
+```
+
+## Security notes
+
+- `gamit login --key gmt_live_…` puts the key in your shell history — prefer
+  the interactive prompt or `GAMIT_API_KEY`.
+- The interactive prompt does **not** hide input in v1 (no tty masking).
+- The config file is written with mode `0600`, but the key is stored in
+  plaintext — treat `~/.gamit/config.json` like a credential.
+- Dotfiles (notably `.env*`) are never packed into builds.

package/dist/api.js

@@ -0,0 +1,118 @@
+export class CliApiError extends Error {
+    code;
+    status;
+    constructor(code, status) {
+        super(`${code} (HTTP ${status})`);
+        this.code = code;
+        this.status = status;
+        this.name = "CliApiError";
+    }
+}
+export async function apiFetch(path, { method = "GET", key, apiBase, json, form }) {
+    const headers = {};
+    if (key)
+        headers["Authorization"] = `Bearer ${key}`;
+    // The Bearer key is attached to every request — never send it over plaintext
+    // to a non-local origin (a hijacked --api-base / GAMIT_API_BASE could exfil it).
+    let base;
+    try {
+        base = new URL(apiBase);
+    }
+    catch {
+        throw new Error(`Invalid API base: ${apiBase}`);
+    }
+    const isLocal = base.hostname === "localhost" || base.hostname === "127.0.0.1";
+    if (base.protocol !== "https:" && !isLocal) {
+        throw new Error(`Refusing to send API key over insecure ${base.protocol}// to ${base.host} — use https://`);
+    }
+    let body;
+    if (json !== undefined) {
+        headers["Content-Type"] = "application/json";
+        body = JSON.stringify(json);
+    }
+    else if (form !== undefined) {
+        // Let fetch set the multipart boundary automatically
+        body = form;
+    }
+    let response;
+    try {
+        response = await fetch(`${apiBase}${path}`, {
+            method,
+            headers,
+            body,
+        });
+    }
+    catch (cause) {
+        const err = new Error(`Could not reach ${apiBase}`);
+        err.cause = cause;
+        throw err;
+    }
+    if (response.status === 204)
+        return null;
+    let parsed;
+    try {
+        parsed = await response.json();
+    }
+    catch {
+        parsed = {};
+    }
+    if (!response.ok) {
+        const code = parsed?.error ??
+            `http_${response.status}`;
+        throw new CliApiError(code, response.status);
+    }
+    return parsed;
+}
+export function friendly(err) {
+    if (err instanceof CliApiError) {
+        switch (err.code) {
+            case "unauthorized":
+                return "Invalid or missing API key — run `gamit login`";
+            case "missing_scope":
+                return "This key lacks the required scope (need write + publish)";
+            case "rate_limited":
+                return "Rate limited — try again later";
+            case "invalid_body":
+                return "The server rejected the request body (invalid_body) — check gamit.json field values";
+            case "slug_taken":
+                return "That slug is already taken (slug_taken)";
+            case "invalid_slug":
+                return "Invalid slug — lowercase letters, digits, hyphens only";
+            case "space_not_found":
+                return "Space not found (or not owned by this key)";
+            case "project_not_found":
+                return "Project not found — it may have been deleted or belongs to another account";
+            case "forbidden":
+                return "You don't own that resource";
+            case "payload_too_large":
+                return "Build zip exceeds the upload limit (max 4MB zipped)";
+            case "zip_too_large":
+                return "Build zip exceeds the server's 4MB zip limit";
+            case "build_too_large":
+                return "Build is too large when unzipped (server limit exceeded)";
+            case "too_many_files":
+                return "Build has too many files (server limit 500)";
+            case "zip_invalid":
+                return "The uploaded zip could not be read — re-run `gamit publish`";
+            case "no_entry_html":
+                return "The server found no entry HTML in the build — make sure index.html sits at the directory root";
+            case "missing_file":
+                return "Upload reached the server without a file part — re-run `gamit publish` (and report this if it persists)";
+            case "paid_project_needs_price":
+                return "Paid projects need a price before publishing — set priceCents via the API or dashboard";
+            default:
+                return `Server said: ${err.code} (HTTP ${err.status})`;
+        }
+    }
+    if (err instanceof Error && err.message.startsWith("Could not reach ")) {
+        return err.message;
+    }
+    if (err instanceof Error) {
+        return err.message;
+    }
+    return String(err);
+}
+export function fail(err) {
+    process.stderr.write(`✖ ${friendly(err)}\n`);
+    process.exit(1);
+}

package/dist/commands/init.js

@@ -0,0 +1,167 @@
+import { createInterface } from "node:readline";
+import { basename, resolve } from "node:path";
+import { existsSync } from "node:fs";
+import { readManifest, writeManifest, slugify } from "../manifest.js";
+/**
+ * Node 26 readline behavior: when stdin hits EOF, the readline interface fires
+ * 'close' immediately — even if there are buffered lines not yet consumed by
+ * rl.question() callbacks (which only fire after the prompt is written).
+ *
+ * Fix: listen for 'line' events eagerly and queue them; drain the queue when
+ * ask() is called. Falls back to waiting for the next 'line' if the queue is
+ * empty and stdin is still open.
+ */
+const MAX_RETRIES = 10;
+function makePrompter(input, output) {
+    const queue = [];
+    let waitingResolve = null;
+    let waitingReject = null;
+    let closed = false;
+    const rl = createInterface({ input, output, terminal: false });
+    rl.on("line", (line) => {
+        if (waitingResolve) {
+            const resolve = waitingResolve;
+            waitingResolve = null;
+            waitingReject = null;
+            resolve(line.trim());
+        }
+        else {
+            queue.push(line.trim());
+        }
+    });
+    rl.on("close", () => {
+        closed = true;
+        if (waitingReject) {
+            const reject = waitingReject;
+            waitingResolve = null;
+            waitingReject = null;
+            reject(new Error("stdin closed before prompts completed"));
+        }
+    });
+    function ask(prompt) {
+        output.write(prompt);
+        if (queue.length > 0) {
+            return Promise.resolve(queue.shift());
+        }
+        if (closed) {
+            return Promise.reject(new Error("stdin closed before prompts completed"));
+        }
+        return new Promise((resolve, reject) => {
+            waitingResolve = resolve;
+            waitingReject = reject;
+        });
+    }
+    function close() {
+        rl.close();
+    }
+    return { ask, close };
+}
+const VALID_KINDS = ["game", "asset", "tool"];
+export async function initAction(dir, options) {
+    const absDir = resolve(dir);
+    // Check for existing gamit.json
+    if (!options.force) {
+        try {
+            readManifest(absDir);
+            // If we reach here, the file exists and is valid
+            process.stderr.write("✖ gamit.json already exists (use --force to overwrite)\n");
+            process.exit(1);
+        }
+        catch (err) {
+            // "No gamit.json found" means we can proceed; any other error means it
+            // exists but is malformed — still block unless --force
+            if (err instanceof Error &&
+                !err.message.startsWith("No gamit.json found")) {
+                const jsonPath = `${absDir}/gamit.json`;
+                if (existsSync(jsonPath)) {
+                    process.stderr.write("✖ gamit.json already exists (use --force to overwrite)\n");
+                    process.exit(1);
+                }
+            }
+        }
+    }
+    const prompter = makePrompter(process.stdin, process.stderr);
+    try {
+        // title
+        const dirName = basename(absDir);
+        let title;
+        for (let i = 0; i < MAX_RETRIES; i++) {
+            const titleInput = await prompter.ask(`title [${dirName}]: `);
+            const candidate = titleInput || dirName;
+            if (candidate.length <= 200) {
+                title = candidate;
+                break;
+            }
+            process.stderr.write("  title must be 200 characters or fewer\n");
+            if (i === MAX_RETRIES - 1) {
+                throw new Error("Too many invalid title attempts");
+            }
+        }
+        title = title;
+        // slug
+        const defaultSlug = slugify(title);
+        let slug;
+        for (let i = 0; i < MAX_RETRIES; i++) {
+            const slugInput = await prompter.ask(`slug [${defaultSlug}]: `);
+            const candidate = slugInput || defaultSlug;
+            if (/^[a-z0-9-]{1,60}$/.test(candidate)) {
+                slug = candidate;
+                break;
+            }
+            process.stderr.write("  slug must match /^[a-z0-9-]{1,60}$/ (lowercase letters, digits, hyphens)\n");
+            if (i === MAX_RETRIES - 1) {
+                throw new Error("Too many invalid slug attempts");
+            }
+        }
+        slug = slug;
+        // spaceSlug
+        let spaceSlug;
+        for (let i = 0; i < MAX_RETRIES; i++) {
+            const input = await prompter.ask("spaceSlug (your space slug on gamit.ai — create one at gamit.ai/dashboard): ");
+            if (/^[a-z0-9-]{3,40}$/.test(input)) {
+                spaceSlug = input;
+                break;
+            }
+            process.stderr.write("  spaceSlug must match /^[a-z0-9-]{3,40}$/ (lowercase letters, digits, hyphens; 3–40 chars)\n");
+            if (i === MAX_RETRIES - 1) {
+                throw new Error("Too many invalid spaceSlug attempts");
+            }
+        }
+        spaceSlug = spaceSlug;
+        // kind
+        const kindInput = await prompter.ask("kind [game]: ");
+        const kindRaw = kindInput || "game";
+        const kind = VALID_KINDS.includes(kindRaw)
+            ? kindRaw
+            : "game";
+        if (kindInput && !VALID_KINDS.includes(kindInput)) {
+            process.stderr.write(`  Unknown kind "${kindInput}", using "game"\n`);
+        }
+        // entry
+        const entryInput = await prompter.ask("entry [index.html]: ");
+        const entry = entryInput || "index.html";
+        if (!existsSync(`${absDir}/${entry}`)) {
+            process.stderr.write(`⚠ ${entry} not found in ${absDir} — create it before publishing\n`);
+        }
+        // engine (optional)
+        const engineInput = await prompter.ask("engine []: ");
+        const engine = engineInput || undefined;
+        prompter.close();
+        const manifest = {
+            title,
+            slug,
+            spaceSlug,
+            kind,
+            entry,
+            ...(engine !== undefined && { engine }),
+        };
+        writeManifest(absDir, manifest);
+        process.stdout.write("✔ Wrote gamit.json\n");
+        const publishArg = dir === "." ? "" : ` ${dir}`;
+        process.stdout.write(`Next: gamit publish${publishArg}\n`);
+    }
+    catch (err) {
+        prompter.close();
+        throw err;
+    }
+}

package/dist/commands/login.js

@@ -0,0 +1,43 @@
+import { createInterface } from "node:readline";
+import { loadConfig, saveConfig } from "../config.js";
+import { apiFetch, fail } from "../api.js";
+async function promptApiKey() {
+    return new Promise((resolve) => {
+        const rl = createInterface({
+            input: process.stdin,
+            output: process.stderr,
+        });
+        rl.on("close", () => {
+            resolve("");
+        });
+        rl.question("Paste your gamit API key (gmt_live_…): ", (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}
+export async function loginAction(options) {
+    const config = loadConfig();
+    const apiBase = options.apiBase ?? config.apiBase;
+    const apiKey = options.key ?? (await promptApiKey());
+    if (!apiKey) {
+        fail(new Error("No API key provided"));
+    }
+    // Validate by calling GET /api/v1/me
+    let result;
+    try {
+        result = await apiFetch("/api/v1/me", { apiBase, key: apiKey });
+    }
+    catch (err) {
+        fail(err);
+    }
+    // Save config
+    const toSave = { apiKey };
+    if (options.apiBase)
+        toSave.apiBase = options.apiBase;
+    saveConfig(toSave);
+    const profile = result
+        ?.data;
+    const identity = profile?.display_name ?? profile?.username ?? "(unknown)";
+    process.stdout.write(`✔ Logged in as ${identity}\n`);
+}

package/dist/commands/logout.js

@@ -0,0 +1,5 @@
+import { clearApiKey } from "../config.js";
+export async function logoutAction() {
+    const removed = clearApiKey();
+    process.stdout.write(removed ? "✔ Logged out (API key removed)\n" : "✔ Not logged in — nothing to do\n");
+}

package/dist/commands/publish.js

@@ -0,0 +1,174 @@
+import { resolve } from "node:path";
+import { loadConfig } from "../config.js";
+import { apiFetch, fail, CliApiError } from "../api.js";
+import { readManifest, writeManifest } from "../manifest.js";
+import { packDir } from "../zip.js";
+function progress(msg) {
+    process.stderr.write(`${msg}\n`);
+}
+/**
+ * Resolve the manifest's spaceSlug to an owned space id: reuse it when the
+ * key's owner already has it (GET /api/v1/spaces lists own spaces only),
+ * otherwise create it. A slug_taken on create therefore means the slug
+ * belongs to ANOTHER user — space slugs are globally unique.
+ */
+async function ensureSpaceId(manifest, auth) {
+    let owned;
+    try {
+        const res = (await apiFetch("/api/v1/spaces", auth));
+        owned = res.data;
+    }
+    catch (err) {
+        fail(err);
+    }
+    const existing = owned.find((s) => s.slug === manifest.spaceSlug);
+    if (existing)
+        return existing.id;
+    try {
+        const res = (await apiFetch("/api/v1/spaces", {
+            ...auth,
+            method: "POST",
+            json: { slug: manifest.spaceSlug, name: manifest.spaceSlug },
+        }));
+        progress(`• created space "${manifest.spaceSlug}"`);
+        return res.data.id;
+    }
+    catch (err) {
+        if (err instanceof CliApiError && err.code === "slug_taken") {
+            fail(new Error(`Space slug "${manifest.spaceSlug}" belongs to another user — pick a different spaceSlug in gamit.json`));
+        }
+        fail(err);
+    }
+}
+/**
+ * Create the project, or — when its slug is already taken inside our own
+ * space (slugs are unique per space, and we just verified the space is
+ * ours) — look the existing project up via GET /api/v1/projects?spaceId=…
+ * and reuse its id.
+ */
+async function ensureProjectId(manifest, spaceId, auth) {
+    // gamit.json (minus projectId) doubles as the project's ai_manifest
+    const aiManifest = { ...manifest };
+    delete aiManifest.projectId;
+    try {
+        const res = (await apiFetch("/api/v1/projects", {
+            ...auth,
+            method: "POST",
+            json: {
+                spaceId,
+                slug: manifest.slug,
+                title: manifest.title,
+                kind: manifest.kind,
+                ...(manifest.summary !== undefined && { summary: manifest.summary }),
+                ...(manifest.tags !== undefined && { tags: manifest.tags }),
+                aiManifest,
+            },
+        }));
+        progress(`• created project ${manifest.spaceSlug}/${manifest.slug}`);
+        return res.data.id;
+    }
+    catch (err) {
+        if (!(err instanceof CliApiError) || err.code !== "slug_taken")
+            fail(err);
+    }
+    let owned;
+    try {
+        const res = (await apiFetch(`/api/v1/projects?spaceId=${spaceId}`, auth));
+        owned = res.data;
+    }
+    catch (err) {
+        fail(err);
+    }
+    const existing = owned.find((p) => p.slug === manifest.slug);
+    if (!existing) {
+        fail(new Error(`Slug "${manifest.slug}" is taken in space "${manifest.spaceSlug}" but the project could not be listed — add its projectId to gamit.json manually`));
+    }
+    progress(`• reusing existing project ${manifest.spaceSlug}/${manifest.slug}`);
+    return existing.id;
+}
+export async function publishAction(dir, options) {
+    const absDir = resolve(dir);
+    // 1. manifest + config
+    let manifest;
+    try {
+        manifest = readManifest(absDir);
+    }
+    catch (err) {
+        fail(err);
+    }
+    const config = loadConfig();
+    const apiBase = options.apiBase ?? config.apiBase;
+    if (!config.apiKey) {
+        fail(new Error("No API key found — run `gamit login` first (or set GAMIT_API_KEY)"));
+    }
+    const auth = { apiBase, key: config.apiKey };
+    // 2. pack before touching the network
+    let zip;
+    try {
+        zip = packDir(absDir, manifest.entry);
+    }
+    catch (err) {
+        fail(err);
+    }
+    progress(`• packed ${zip.fileCount} file(s) (${(zip.data.byteLength / 1024).toFixed(1)}KB zipped)`);
+    // 3. resolve the project id
+    let projectId;
+    let spaceSlug = manifest.spaceSlug;
+    let projectSlug = manifest.slug;
+    if (manifest.projectId) {
+        projectId = manifest.projectId;
+        try {
+            const res = (await apiFetch(`/api/v1/projects/${projectId}`, auth));
+            // Server truth for the final URL (handles renames since first publish)
+            projectSlug = res.data.slug ?? projectSlug;
+            spaceSlug = res.data.spaces?.slug ?? spaceSlug;
+        }
+        catch (err) {
+            if (err instanceof CliApiError && err.code === "project_not_found") {
+                fail(new Error("projectId in gamit.json no longer exists — remove it and re-run `gamit publish`"));
+            }
+            fail(err);
+        }
+    }
+    else {
+        const spaceId = await ensureSpaceId(manifest, auth);
+        projectId = await ensureProjectId(manifest, spaceId, auth);
+    }
+    // 4. upload the build (multipart: file=<zip>)
+    const form = new FormData();
+    // fflate types its output as Uint8Array<ArrayBufferLike>; Blob wants ArrayBuffer-backed
+    const zipBytes = zip.data;
+    form.append("file", new Blob([zipBytes], { type: "application/zip" }), "build.zip");
+    if (options.notes)
+        form.append("notes", options.notes);
+    let build;
+    try {
+        const res = (await apiFetch(`/api/v1/projects/${projectId}/builds`, {
+            ...auth,
+            method: "POST",
+            form,
+        }));
+        build = res.data;
+    }
+    catch (err) {
+        fail(err);
+    }
+    progress(`• uploaded build ${build.version} (entry ${build.entryHtml})`);
+    // 5. go live
+    try {
+        await apiFetch(`/api/v1/projects/${projectId}`, {
+            ...auth,
+            method: "PATCH",
+            json: { status: "published" },
+        });
+    }
+    catch (err) {
+        fail(err);
+    }
+    // 6. persist projectId so the next publish is an idempotent republish
+    writeManifest(absDir, { ...manifest, projectId });
+    process.stdout.write(`✔ Published → ${apiBase}/p/${spaceSlug}/${projectSlug}\n`);
+    if (manifest.kind === "game") {
+        process.stdout.write(`  Play: ${build.playUrl}\n`);
+    }
+}

package/dist/config.js

@@ -0,0 +1,57 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+const DEFAULT_BASE = "https://gamit.ai";
+function configDir() {
+    return process.env.GAMIT_CONFIG_DIR ?? join(homedir(), ".gamit");
+}
+function configPath() {
+    return join(configDir(), "config.json");
+}
+function readFileJson() {
+    try {
+        const raw = readFileSync(configPath(), "utf-8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+}
+export function loadConfig() {
+    const file = readFileJson();
+    const apiKey = process.env.GAMIT_API_KEY ?? file.apiKey;
+    const apiBase = process.env.GAMIT_API_BASE ?? file.apiBase ?? DEFAULT_BASE;
+    return { apiKey, apiBase };
+}
+export function saveConfig(partial) {
+    const existing = readFileJson();
+    const merged = { ...existing, ...partial };
+    const dir = configDir();
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const path = configPath();
+    writeFileSync(path, JSON.stringify(merged, null, 2) + "\n", { mode: 0o600 });
+    // ensure mode is 0600 even if file already existed
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // best-effort on platforms that don't support chmod
+    }
+}
+export function clearApiKey() {
+    const existing = readFileJson();
+    if (existing.apiKey === undefined)
+        return false; // idempotent
+    delete existing.apiKey;
+    const dir = configDir();
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const path = configPath();
+    writeFileSync(path, JSON.stringify(existing, null, 2) + "\n", { mode: 0o600 });
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // best-effort on platforms that don't support chmod
+    }
+    return true;
+}

package/dist/index.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+import { program } from "commander";
+import { loginAction } from "./commands/login.js";
+import { logoutAction } from "./commands/logout.js";
+import { initAction } from "./commands/init.js";
+import { publishAction } from "./commands/publish.js";
+program
+    .name("gamit")
+    .description("Publish vibe-coded games to gamit.ai")
+    .version("0.1.0");
+program
+    .command("login")
+    .description("Authenticate with your gamit.ai API key")
+    .option("--key <key>", "API key (gmt_live_…)")
+    .option("--api-base <url>", "Override API base URL")
+    .action(async (options) => {
+    await loginAction(options).catch((err) => {
+        process.stderr.write(`✖ ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(1);
+    });
+});
+program
+    .command("logout")
+    .description("Remove the stored API key from ~/.gamit/config.json")
+    .action(async () => {
+    await logoutAction().catch((err) => {
+        process.stderr.write(`✖ ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(1);
+    });
+});
+program
+    .command("init [dir]")
+    .description("Scaffold a gamit.json manifest in the given directory (default .)")
+    .option("--force", "Overwrite existing gamit.json")
+    .action(async (dir, options) => {
+    await initAction(dir ?? ".", options).catch((err) => {
+        process.stderr.write(`✖ ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(1);
+    });
+});
+program
+    .command("publish [dir]")
+    .description("Package and publish a game build to gamit.ai (default dir .)")
+    .option("--api-base <url>", "Override API base URL")
+    .option("--notes <text>", "Release/patch notes posted to the game's timeline thread")
+    .action(async (dir, options) => {
+    await publishAction(dir ?? ".", options).catch((err) => {
+        process.stderr.write(`✖ ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(1);
+    });
+});
+program.parse();

package/dist/manifest.js

@@ -0,0 +1,149 @@
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+const SLUG_RE = /^[a-z0-9-]{1,60}$/;
+const SPACE_SLUG_RE = /^[a-z0-9-]{3,40}$/;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const VALID_KINDS = ["game", "asset", "tool"];
+function assertString(value, field) {
+    if (typeof value !== "string") {
+        throw new Error(`${field}: must be a string`);
+    }
+    return value;
+}
+function validateManifest(raw) {
+    if (typeof raw !== "object" || raw === null) {
+        throw new Error("gamit.json must be a JSON object");
+    }
+    const obj = raw;
+    // title: 1..200 string
+    const title = assertString(obj.title, "title");
+    if (title.length < 1 || title.length > 200) {
+        throw new Error("title: must be 1–200 characters");
+    }
+    // slug: /^[a-z0-9-]{1,60}$/
+    const slug = assertString(obj.slug, "slug");
+    if (!SLUG_RE.test(slug)) {
+        throw new Error("slug: must match /^[a-z0-9-]{1,60}$/ (lowercase letters, digits, hyphens; 1–60 chars)");
+    }
+    // spaceSlug: /^[a-z0-9-]{3,40}$/
+    const spaceSlug = assertString(obj.spaceSlug, "spaceSlug");
+    if (!SPACE_SLUG_RE.test(spaceSlug)) {
+        throw new Error("spaceSlug: must match /^[a-z0-9-]{3,40}$/ (lowercase letters, digits, hyphens; 3–40 chars)");
+    }
+    // kind: enum
+    const kind = assertString(obj.kind, "kind");
+    if (!VALID_KINDS.includes(kind)) {
+        throw new Error(`kind: must be one of ${VALID_KINDS.join(", ")}`);
+    }
+    // entry: non-empty string ending .html
+    const entry = assertString(obj.entry, "entry");
+    if (!entry.endsWith(".html")) {
+        throw new Error("entry: must be a non-empty string ending in .html");
+    }
+    if (entry.length === 0) {
+        throw new Error("entry: must not be empty");
+    }
+    // tags: optional string[] <=5 items each <=40 chars
+    let tags;
+    if (obj.tags !== undefined) {
+        if (!Array.isArray(obj.tags)) {
+            throw new Error("tags: must be an array of strings");
+        }
+        if (obj.tags.length > 5) {
+            throw new Error("tags: must have at most 5 items");
+        }
+        for (const tag of obj.tags) {
+            if (typeof tag !== "string") {
+                throw new Error("tags: each item must be a string");
+            }
+            if (tag.length > 40) {
+                throw new Error(`tags: each tag must be at most 40 characters (got "${tag}")`);
+            }
+        }
+        tags = obj.tags;
+    }
+    // projectId: optional uuid-shaped
+    let projectId;
+    if (obj.projectId !== undefined) {
+        const pid = assertString(obj.projectId, "projectId");
+        if (!UUID_RE.test(pid)) {
+            throw new Error("projectId: must be a UUID (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)");
+        }
+        projectId = pid;
+    }
+    // optional string fields
+    const engine = obj.engine !== undefined ? assertString(obj.engine, "engine") : undefined;
+    const summary = obj.summary !== undefined
+        ? assertString(obj.summary, "summary")
+        : undefined;
+    return {
+        title,
+        slug,
+        spaceSlug,
+        kind: kind,
+        entry,
+        ...(engine !== undefined && { engine }),
+        ...(summary !== undefined && { summary }),
+        ...(tags !== undefined && { tags }),
+        ...(projectId !== undefined && { projectId }),
+    };
+}
+export function readManifest(dir) {
+    const path = join(dir, "gamit.json");
+    let raw;
+    try {
+        raw = readFileSync(path, "utf-8");
+    }
+    catch {
+        throw new Error("No gamit.json found — run `gamit init` first.");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`gamit.json is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return validateManifest(parsed);
+}
+/** Stable key order for deterministic output. */
+const KEY_ORDER = [
+    "title",
+    "slug",
+    "spaceSlug",
+    "kind",
+    "entry",
+    "engine",
+    "summary",
+    "tags",
+    "projectId",
+];
+export function writeManifest(dir, m) {
+    const ordered = {};
+    for (const key of KEY_ORDER) {
+        if (m[key] !== undefined) {
+            ordered[key] = m[key];
+        }
+    }
+    const path = join(dir, "gamit.json");
+    writeFileSync(path, JSON.stringify(ordered, null, 2) + "\n", "utf-8");
+}
+/**
+ * Convert an arbitrary string to a valid slug.
+ * - Lowercased
+ * - Spaces and underscores → "-"
+ * - Non [a-z0-9-] characters stripped (this means non-latin script such as
+ *   Hangul/CJK/Arabic/etc. is removed entirely — document this behavior)
+ * - Consecutive hyphens collapsed to one
+ * - Leading/trailing hyphens trimmed
+ * - Truncated to 60 characters
+ */
+export function slugify(s) {
+    return s
+        .toLowerCase()
+        .replace(/[\s_]+/g, "-")
+        .replace(/[^a-z0-9-]/g, "")
+        .replace(/-{2,}/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 60);
+}

package/dist/zip.js

@@ -0,0 +1,76 @@
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { zipSync } from "fflate";
+/**
+ * The server caps build uploads at 4MB zipped (Vercel body-limit headroom).
+ * We enforce 4MB on the UNCOMPRESSED total before zipping — stricter, so a
+ * passing pack always uploads — plus a belt-and-braces check on the zip itself.
+ */
+export const MAX_BYTES = 4 * 1024 * 1024;
+const EXCLUDED_DIRS = new Set(["node_modules", ".git"]);
+function formatBytes(n) {
+    if (n >= 1024 * 1024)
+        return `${(n / (1024 * 1024)).toFixed(1)}MB`;
+    if (n >= 1024)
+        return `${(n / 1024).toFixed(1)}KB`;
+    return `${n}B`;
+}
+/** Files we never ship: the manifest itself, dot-anything, nested zips. */
+function isExcludedFile(name) {
+    return name === "gamit.json" || name.startsWith(".") || name.endsWith(".zip");
+}
+/**
+ * Recursively collect relative forward-slash file paths under `absDir`.
+ * Skips node_modules/.git and any dot-prefixed directory (.next, .vercel, …);
+ * dotfiles (.env*, .DS_Store, …) are excluded at every level.
+ */
+function walk(absDir, rel, out) {
+    for (const ent of readdirSync(absDir, { withFileTypes: true })) {
+        const childRel = rel === "" ? ent.name : `${rel}/${ent.name}`;
+        if (ent.isDirectory()) {
+            if (EXCLUDED_DIRS.has(ent.name) || ent.name.startsWith("."))
+                continue;
+            walk(join(absDir, ent.name), childRel, out);
+        }
+        else if (ent.isFile()) {
+            if (isExcludedFile(ent.name))
+                continue;
+            out.push(childRel);
+        }
+        // symlinks/sockets/etc. are silently skipped
+    }
+}
+/**
+ * Zip a game directory for upload.
+ * Throws (with a friendly message) when the entry file is missing from the
+ * packed set, the dir is empty after exclusions, or the build exceeds 4MB.
+ */
+export function packDir(dir, entry) {
+    const paths = [];
+    walk(dir, "", paths);
+    paths.sort();
+    if (paths.length === 0) {
+        throw new Error(`Nothing to pack in ${dir} — no files left after exclusions (dotfiles, node_modules, gamit.json, *.zip)`);
+    }
+    const normalizedEntry = entry.replaceAll("\\", "/");
+    if (!paths.includes(normalizedEntry)) {
+        throw new Error(`Entry file "${entry}" not found in ${dir}`);
+    }
+    // Sum actual sizes first so the error reports the real total.
+    let totalBytes = 0;
+    for (const rel of paths) {
+        totalBytes += statSync(join(dir, ...rel.split("/"))).size;
+    }
+    if (totalBytes > MAX_BYTES) {
+        throw new Error(`Build is ${formatBytes(totalBytes)} uncompressed (${paths.length} files) — exceeds the 4MB upload limit. Trim assets or remove files.`);
+    }
+    const tree = {};
+    for (const rel of paths) {
+        tree[rel] = new Uint8Array(readFileSync(join(dir, ...rel.split("/"))));
+    }
+    const data = zipSync(tree);
+    if (data.byteLength > MAX_BYTES) {
+        throw new Error(`Zipped build is ${formatBytes(data.byteLength)} — exceeds the 4MB upload limit`);
+    }
+    return { data, fileCount: paths.length };
+}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "gamit",
+  "version": "0.1.0",
+  "description": "Publish vibe-coded games to gamit.ai",
+  "keywords": ["gamit", "games", "publish", "cli", "vibe-coding", "webgames", "itch"],
+  "homepage": "https://gamit.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sonan0721/gamit.git",
+    "directory": "cli"
+  },
+  "bugs": { "url": "https://github.com/sonan0721/gamit/issues" },
+  "type": "module",
+  "bin": { "gamit": "./dist/index.js" },
+  "files": ["dist"],
+  "engines": { "node": ">=18.17" },
+  "license": "MIT",
+  "publishConfig": { "access": "public" },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "publint": "publint",
+    "verify": "pnpm run build && pnpm run test && pnpm run publint && node scripts/check-pack.mjs && node scripts/audit-deps.mjs && node scripts/smoke-tarball.mjs",
+    "prepublishOnly": "pnpm run verify"
+  },
+  "dependencies": {
+    "commander": "^12.1.0",
+    "fflate": "^0.8.3"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "publint": "^0.3.21",
+    "typescript": "^5",
+    "vitest": "^4.1.8"
+  }
+}