hiraiship 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dilane3
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,34 @@
-# Temporary Holding Version
+# hiraiship
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The command-line interface for [Hiraiship](https://hiraiship.com): deploy a
+Vite, Rasengan.js, Hono or Futon app and other to its own subdomain.
+
+```bash
+npx hiraiship login
+npx hiraiship deploy
+```
+
+Or install it once:
+
+```bash
+npm install -g hiraiship
+```
+
+## Commands
+
+| Command                  | What it does                                             |
+| ------------------------ | -------------------------------------------------------- |
+| `hiraiship login`        | Log in through the dashboard with a one-time device code |
+| `hiraiship logout`       | Revoke and forget the stored login                       |
+| `hiraiship whoami`       | Show the logged-in account and its workspaces            |
+| `hiraiship link [dir]`   | Link a directory to a project without deploying          |
+| `hiraiship deploy [dir]` | Upload a directory, build it and publish it              |
+
+In CI, set `HIRAISHIP_TOKEN` to a workspace API key instead of logging in.
+`hiraiship <command> --help` lists every option.
+
+Requires Node.js 20.12 or later. Documentation: https://docs.hiraiship.com/cli
+
+## License
+
+MIT

package/dist/index.js

@@ -0,0 +1,1106 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command } from "commander";
+
+// src/commands/deploy.ts
+import { resolve as resolve3 } from "path";
+import { setTimeout as sleep } from "timers/promises";
+
+// src/lib/errors.ts
+var CliError = class extends Error {
+  constructor(message, exitCode = 1) {
+    super(message);
+    this.exitCode = exitCode;
+    this.name = "CliError";
+  }
+  exitCode;
+};
+var ApiError = class extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "ApiError";
+  }
+  status;
+  code;
+};
+
+// src/lib/config.ts
+import { chmod, mkdir, readFile, rm, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var DEFAULT_API_URL = "https://api.hiraiship.com";
+function resolveScope(options) {
+  return options.scope?.trim() || process.env.HIRAISHIP_SCOPE?.trim() || null;
+}
+function resolveApiUrl(options) {
+  const raw = options.apiUrl ?? process.env.HIRAISHIP_API_URL ?? DEFAULT_API_URL;
+  return raw.replace(/\/+$/, "");
+}
+function configDir() {
+  if (process.platform === "win32" && process.env.APPDATA) {
+    return join(process.env.APPDATA, "hiraiship");
+  }
+  return join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "hiraiship");
+}
+function credentialsPath() {
+  return join(configDir(), "credentials.json");
+}
+async function readCredentialsFile() {
+  try {
+    const parsed = JSON.parse(await readFile(credentialsPath(), "utf8"));
+    if (parsed?.version === 1 && parsed.credentials && typeof parsed.credentials === "object") {
+      return parsed;
+    }
+  } catch {
+  }
+  return { version: 1, credentials: {} };
+}
+async function writeCredentialsFile(file) {
+  const path = credentialsPath();
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  await writeFile(path, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
+  await chmod(path, 384);
+}
+async function getStoredCredential(apiUrl) {
+  return (await readCredentialsFile()).credentials[apiUrl];
+}
+async function saveCredential(apiUrl, credential) {
+  const file = await readCredentialsFile();
+  file.credentials[apiUrl] = credential;
+  await writeCredentialsFile(file);
+}
+async function removeCredential(apiUrl) {
+  const file = await readCredentialsFile();
+  if (!file.credentials[apiUrl]) return false;
+  delete file.credentials[apiUrl];
+  if (Object.keys(file.credentials).length === 0) {
+    await rm(credentialsPath(), { force: true });
+  } else {
+    await writeCredentialsFile(file);
+  }
+  return true;
+}
+async function resolveToken(apiUrl, options) {
+  if (options.token) return { token: options.token, source: "flag" };
+  if (process.env.HIRAISHIP_TOKEN) return { token: process.env.HIRAISHIP_TOKEN, source: "env" };
+  const credential = await getStoredCredential(apiUrl);
+  return credential ? { token: credential.token, source: "file", credential } : null;
+}
+
+// src/lib/api.ts
+var API_VERSION = "/api/v1";
+async function rejectionReason(res) {
+  try {
+    const body = await res.clone().json();
+    return body.code?.startsWith("api_key_") && body.error ? `: ${body.error.replace(/\.$/, "")}` : "";
+  } catch {
+    return "";
+  }
+}
+var ApiClient = class {
+  constructor(apiUrl, auth) {
+    this.apiUrl = apiUrl;
+    this.auth = auth;
+  }
+  apiUrl;
+  auth;
+  /**
+   * RFC-0041: sent as `X-Hiraiship-Workspace` on every request. Only
+   * collection routes (`/projects`, `/workspace/*`) read it; resource
+   * routes (`/environments/:id/...`) find their workspace themselves.
+   * `null` = the caller's default workspace.
+   */
+  workspaceSlug = null;
+  get token() {
+    return this.auth;
+  }
+  /** RFC-0052: a workspace API key (`hsk_…`) belongs to one workspace, so there's no `X-Hiraiship-Workspace` to send and no login to prompt for. */
+  get isApiKey() {
+    return this.auth?.token.startsWith("hsk_") ?? false;
+  }
+  /** A raw authenticated `fetch` against `/api/v1{path}` — `deploy` uses it for the SSE stream. */
+  async fetch(path, init = {}) {
+    const headers = new Headers(init.headers);
+    if (this.auth) headers.set("Authorization", `Bearer ${this.auth.token}`);
+    if (this.workspaceSlug && !this.isApiKey && !headers.has("X-Hiraiship-Workspace")) headers.set("X-Hiraiship-Workspace", this.workspaceSlug);
+    if (init.body !== void 0 && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
+    let res;
+    try {
+      res = await fetch(`${this.apiUrl}${API_VERSION}${path}`, { ...init, headers });
+    } catch (error) {
+      throw new CliError(`Could not reach the Hiraiship API at ${this.apiUrl} (${error.cause ?? error.message}).`);
+    }
+    if (res.status === 401 && this.auth) {
+      if (this.auth.source === "file") await removeCredential(this.apiUrl);
+      throw new CliError(
+        this.auth.source === "file" ? "Session expired or revoked \u2014 run `hiraiship login`." : `The token from ${this.auth.source === "env" ? "HIRAISHIP_TOKEN" : "--token"} was rejected (401)${await rejectionReason(res)}.`
+      );
+    }
+    return res;
+  }
+  async request(method, path, body) {
+    const res = await this.fetch(path, { method, body: body === void 0 ? void 0 : JSON.stringify(body) });
+    if (!res.ok) {
+      const text2 = await res.text();
+      let parsed = null;
+      try {
+        parsed = JSON.parse(text2);
+      } catch {
+      }
+      throw new ApiError(
+        res.status,
+        parsed?.error ?? parsed?.code,
+        parsed?.error_description ?? parsed?.message ?? parsed?.error ?? (text2 || res.statusText)
+      );
+    }
+    if (res.status === 204) return void 0;
+    return await res.json();
+  }
+  get(path) {
+    return this.request("GET", path);
+  }
+  post(path, body) {
+    return this.request("POST", path, body ?? {});
+  }
+};
+async function createClient(options) {
+  const apiUrl = resolveApiUrl(options);
+  const client = new ApiClient(apiUrl, await resolveToken(apiUrl, options));
+  client.workspaceSlug = resolveScope(options);
+  return client;
+}
+async function createAuthenticatedClient(options) {
+  const client = await createClient(options);
+  if (!client.token) {
+    throw new CliError(`Not logged in to ${client.apiUrl} \u2014 run \`hiraiship login\`.`);
+  }
+  return client;
+}
+
+// src/lib/build-env.ts
+import { readFile as readFile2 } from "fs/promises";
+import { resolve } from "path";
+import { parseEnv } from "util";
+var KEY_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
+var SANDBOX_KEYS = ["PATH", "HOME", "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY"];
+var MAX_BUILD_ENV = 100;
+var MAX_VALUE_LENGTH = 4096;
+function checkKey(key, source) {
+  if (!KEY_PATTERN.test(key))
+    throw new CliError(
+      `Invalid build variable "${key}" (from ${source}): uppercase letters, digits and underscores, not starting with a digit.`
+    );
+  if (key === "HIRAISHIP" || key.startsWith("HIRAISHIP_"))
+    throw new CliError(`${key} (from ${source}) is reserved: HIRAISHIP_* variables are set by Hiraiship itself.`);
+  if (SANDBOX_KEYS.includes(key)) throw new CliError(`${key} (from ${source}) is reserved for the build machine.`);
+}
+function parseBuildEnvFlags(entries) {
+  const env = {};
+  for (const entry of entries) {
+    const separator = entry.indexOf("=");
+    if (separator <= 0) throw new CliError(`--build-env expects KEY=VALUE, got "${entry}".`);
+    env[entry.slice(0, separator)] = entry.slice(separator + 1);
+  }
+  return env;
+}
+async function resolveBuildEnv(dir, options) {
+  const env = {};
+  const sources = /* @__PURE__ */ new Map();
+  if (options.buildEnvFile) {
+    const path = resolve(dir, options.buildEnvFile);
+    let text2;
+    try {
+      text2 = await readFile2(path, "utf8");
+    } catch (error) {
+      throw new CliError(`Couldn't read --build-env-file ${options.buildEnvFile}: ${error.message}`);
+    }
+    for (const [key, value] of Object.entries(parseEnv(text2))) {
+      env[key] = value ?? "";
+      sources.set(key, options.buildEnvFile);
+    }
+  }
+  for (const [key, value] of Object.entries(parseBuildEnvFlags(options.buildEnv ?? []))) {
+    env[key] = value;
+    sources.set(key, "--build-env");
+  }
+  const keys = Object.keys(env);
+  if (keys.length === 0) return void 0;
+  if (keys.length > MAX_BUILD_ENV)
+    throw new CliError(`At most ${MAX_BUILD_ENV} build variables per deployment, got ${keys.length}.`);
+  for (const key of keys) {
+    checkKey(key, sources.get(key));
+    if (env[key].length > MAX_VALUE_LENGTH)
+      throw new CliError(`${key} is longer than ${MAX_VALUE_LENGTH} characters.`);
+  }
+  return env;
+}
+
+// src/lib/git.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var run = promisify(execFile);
+async function git(cwd, args) {
+  try {
+    const { stdout } = await run("git", args, { cwd, timeout: 5e3 });
+    return stdout.trim() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function stripRemoteCredentials(remote) {
+  try {
+    const url = new URL(remote);
+    url.username = "";
+    url.password = "";
+    return url.toString();
+  } catch {
+    return remote;
+  }
+}
+async function readGitMetadata(dir) {
+  const [gitSha, commitMessage, remote] = await Promise.all([
+    git(dir, ["rev-parse", "HEAD"]),
+    git(dir, ["log", "-1", "--pretty=%s"]),
+    git(dir, ["remote", "get-url", "origin"])
+  ]);
+  return { gitSha, commitMessage, repoUrl: remote ? stripRemoteCredentials(remote) : void 0 };
+}
+
+// src/lib/pack.ts
+import { lstat, readFile as readFile3, readdir, realpath } from "fs/promises";
+import { join as join2, relative, sep } from "path";
+import ignore from "ignore";
+import { create as createTar } from "tar";
+var MAX_TARBALL_BYTES = 25 * 1024 * 1024;
+var ALWAYS_EXCLUDED = [".git/", "node_modules/", ".hiraiship/", ".env", ".env.*", "!.env.example"];
+async function readIgnoreFile(path) {
+  try {
+    return await readFile3(path, "utf8");
+  } catch {
+    return "";
+  }
+}
+async function collectFiles(root) {
+  const always = ignore().add(ALWAYS_EXCLUDED);
+  const user = ignore().add(await readIgnoreFile(join2(root, ".gitignore"))).add(await readIgnoreFile(join2(root, ".hiraishipignore")));
+  const isIgnored = (path) => always.ignores(path) || user.ignores(path);
+  const realRoot = await realpath(root);
+  const files = [];
+  const sizes = /* @__PURE__ */ new Map();
+  const walk = async (dir) => {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const abs = join2(dir, entry.name);
+      const rel = relative(root, abs).split(sep).join("/");
+      if (entry.isSymbolicLink()) {
+        let target;
+        try {
+          target = await realpath(abs);
+        } catch {
+          continue;
+        }
+        if (target !== realRoot && !target.startsWith(realRoot + sep)) continue;
+        const stat = await lstat(target);
+        if (isIgnored(stat.isDirectory() ? `${rel}/` : rel)) continue;
+        files.push(rel);
+        continue;
+      }
+      if (entry.isDirectory()) {
+        if (!isIgnored(`${rel}/`)) await walk(abs);
+      } else if (entry.isFile() && !isIgnored(rel)) {
+        files.push(rel);
+        sizes.set(rel, (await lstat(abs)).size);
+      }
+    }
+  };
+  await walk(root);
+  return { files: files.sort(), sizes };
+}
+async function packDirectory(root) {
+  const { files, sizes } = await collectFiles(root);
+  if (files.length === 0) {
+    throw new Error("Nothing to deploy \u2014 every file in this directory is ignored.");
+  }
+  const chunks = [];
+  const stream = createTar({ cwd: root, gzip: true, portable: true, noDirRecurse: true }, files);
+  for await (const chunk of stream) chunks.push(chunk);
+  const largest = [...sizes.entries()].sort((a, b) => b[1] - a[1]).slice(0, 5).map(([path, size]) => ({ path, size }));
+  return { tarball: Buffer.concat(chunks), fileCount: files.length, largest };
+}
+
+// src/lib/sse.ts
+async function* readSse(body) {
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let event = "message";
+  let data = [];
+  let lastEventId = "";
+  for await (const chunk of body) {
+    buffer += decoder.decode(chunk, { stream: true });
+    let newline;
+    while ((newline = buffer.indexOf("\n")) !== -1) {
+      const line = buffer.slice(0, newline).replace(/\r$/, "");
+      buffer = buffer.slice(newline + 1);
+      if (line === "") {
+        if (data.length > 0) yield { event, data: data.join("\n"), lastEventId };
+        event = "message";
+        data = [];
+      } else if (line.startsWith("event:")) {
+        event = line.slice(6).trim();
+      } else if (line.startsWith("data:")) {
+        data.push(line.slice(5).replace(/^ /, ""));
+      } else if (line.startsWith("id:")) {
+        const id = line.slice(3).replace(/^ /, "");
+        if (!id.includes("\0")) lastEventId = id;
+      }
+    }
+  }
+}
+
+// src/lib/ui.ts
+import { styleText } from "util";
+var paint = (style) => (text2) => styleText(style, text2);
+var dim = paint("dim");
+var bold = paint("bold");
+var green = paint("green");
+var red = paint("red");
+var yellow = paint("yellow");
+var cyan = paint("cyan");
+var ok = (message) => console.log(`${green("\u2714")} ${message}`);
+var fail = (message) => console.error(`${red("\u2716")} ${message}`);
+var info = (message) => console.log(`${cyan("\u25C6")} ${message}`);
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / 1024 / 1024).toFixed(1)} MB`;
+}
+function formatDuration(ms) {
+  return ms < 1e3 ? `${ms}ms` : `${(ms / 1e3).toFixed(1)}s`;
+}
+
+// src/commands/link.ts
+import { readFile as readFile5 } from "fs/promises";
+import { basename, join as join4, resolve as resolve2 } from "path";
+import * as p2 from "@clack/prompts";
+
+// src/lib/project-link.ts
+import { appendFile, mkdir as mkdir2, readFile as readFile4, writeFile as writeFile2 } from "fs/promises";
+import { join as join3 } from "path";
+var LINK_DIR = ".hiraiship";
+async function readProjectLink(dir) {
+  try {
+    const link2 = JSON.parse(await readFile4(join3(dir, LINK_DIR, "project.json"), "utf8"));
+    return link2.projectId && link2.environmentId ? link2 : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function writeProjectLink(dir, link2) {
+  await mkdir2(join3(dir, LINK_DIR), { recursive: true });
+  await writeFile2(join3(dir, LINK_DIR, "project.json"), JSON.stringify(link2, null, 2) + "\n");
+  await ensureGitignored(dir);
+}
+async function ensureGitignored(dir) {
+  const path = join3(dir, ".gitignore");
+  let current = "";
+  try {
+    current = await readFile4(path, "utf8");
+  } catch {
+  }
+  const lines = current.split(/\r?\n/).map((line) => line.trim());
+  if (lines.includes(LINK_DIR) || lines.includes(`${LINK_DIR}/`) || lines.includes(`/${LINK_DIR}`)) return;
+  const prefix = current && !current.endsWith("\n") ? "\n" : "";
+  await appendFile(path, `${prefix}${LINK_DIR}
+`);
+}
+
+// src/lib/workspaces.ts
+import * as p from "@clack/prompts";
+async function listWorkspaces(client) {
+  try {
+    return await client.get("/workspaces");
+  } catch (error) {
+    if (!(error instanceof ApiError) || error.status !== 404) throw error;
+    const workspace = await client.get("/workspace/me");
+    return [{ id: workspace.id, slug: workspace.slug, name: workspace.name, planId: workspace.planId, role: "owner", permissions: [] }];
+  }
+}
+async function chooseWorkspace(client, interactive) {
+  const workspaces = await listWorkspaces(client);
+  if (client.workspaceSlug) {
+    const scoped = workspaces.find((w) => w.slug === client.workspaceSlug);
+    if (!scoped) {
+      throw new CliError(`You're not a member of a workspace "${client.workspaceSlug}". Yours: ${workspaces.map((w) => w.slug).join(", ")}.`);
+    }
+    return scoped;
+  }
+  let chosen = workspaces[0];
+  if (workspaces.length > 1 && interactive) {
+    const slug = await p.select({
+      message: "Which workspace?",
+      initialValue: chosen.slug,
+      options: workspaces.map((w) => ({ value: w.slug, label: w.name, hint: `${w.slug} \xB7 ${w.role}` }))
+    });
+    if (p.isCancel(slug)) {
+      p.cancel("Cancelled.");
+      throw new CliError("Cancelled.", 130);
+    }
+    chosen = workspaces.find((w) => w.slug === slug);
+  }
+  client.workspaceSlug = chosen.slug;
+  return chosen;
+}
+
+// src/commands/link.ts
+function slugify(value) {
+  return value.toLowerCase().replace(/^@[^/]+\//, "").replace(/[^a-z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 48);
+}
+async function defaultProjectName(dir) {
+  try {
+    const pkg = JSON.parse(await readFile5(join4(dir, "package.json"), "utf8"));
+    if (pkg.name) return pkg.name.replace(/^@[^/]+\//, "");
+  } catch {
+  }
+  return basename(resolve2(dir));
+}
+async function getBySlug(client, slug) {
+  try {
+    return await client.get(`/projects/by-slug/${encodeURIComponent(slug)}`);
+  } catch (error) {
+    if (error instanceof ApiError && (error.status === 404 || error.status === 400)) {
+      const where = client.workspaceSlug ? `the workspace "${client.workspaceSlug}"` : "your default workspace";
+      throw new CliError(`No project with slug "${slug}" in ${where}. Pass --scope <workspace> if it's in another one.`);
+    }
+    throw error;
+  }
+}
+function cancelled(value) {
+  if (p2.isCancel(value)) {
+    p2.cancel("Cancelled.");
+    return true;
+  }
+  return false;
+}
+async function promptForProject(client, dir) {
+  const { items } = await client.get("/projects?limit=50");
+  let choice = "new";
+  if (items.length > 0) {
+    choice = await p2.select({
+      message: "Link this directory to which project?",
+      options: [
+        { value: "new", label: "Create a new project" },
+        ...items.map((project) => ({ value: project.slug, label: project.name, hint: project.slug }))
+      ]
+    });
+    if (cancelled(choice)) throw new CliError("Cancelled.", 130);
+  }
+  if (choice !== "new") return getBySlug(client, choice);
+  const name = await p2.text({
+    message: "Project name",
+    initialValue: await defaultProjectName(dir),
+    validate: (value) => value?.trim() ? void 0 : "Required"
+  });
+  if (cancelled(name)) throw new CliError("Cancelled.", 130);
+  let slug = slugify(name);
+  for (; ; ) {
+    const input = await p2.text({
+      message: "Project slug (becomes its subdomain)",
+      initialValue: slug,
+      validate: (value) => /^[a-z0-9-]+$/.test(value ?? "") ? void 0 : "Lowercase letters, digits and hyphens only"
+    });
+    if (cancelled(input)) throw new CliError("Cancelled.", 130);
+    slug = input;
+    const { available } = await client.get(`/projects/slug-available?slug=${encodeURIComponent(slug)}`);
+    if (available) break;
+    p2.log.warn(`"${slug}" is already taken \u2014 pick another.`);
+  }
+  try {
+    return await client.post("/projects", { name: name.trim(), slug });
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 429) throw new CliError(`Project not created: ${error.message}`);
+    throw error;
+  }
+}
+async function ensureLinked(client, dir, options) {
+  const existing = await readProjectLink(dir);
+  if (existing && !options.project) {
+    if (existing.apiUrl === client.apiUrl) {
+      if (existing.workspaceSlug) client.workspaceSlug = existing.workspaceSlug;
+      return existing;
+    }
+    p2.log.warn(`This directory is linked to a project on ${existing.apiUrl}, not ${client.apiUrl} \u2014 linking again.`);
+  }
+  const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  if (!options.project && !interactive) {
+    throw new CliError("This directory is not linked to a project. Pass --project <slug> (no terminal to prompt in).");
+  }
+  const workspace = await chooseWorkspace(client, interactive && !options.project);
+  const resolved = options.project ? await getBySlug(client, options.project) : await promptForProject(client, dir);
+  const link2 = {
+    projectId: resolved.project.id,
+    environmentId: resolved.environment.id,
+    projectSlug: resolved.project.slug,
+    apiUrl: client.apiUrl,
+    workspaceSlug: workspace.slug
+  };
+  await writeProjectLink(dir, link2);
+  ok(`Linked to ${resolved.project.name} (${resolved.project.slug}) in ${workspace.name}`);
+  return link2;
+}
+async function link(dir, options) {
+  const client = await createAuthenticatedClient(options);
+  const existing = await readProjectLink(dir);
+  if (existing && existing.apiUrl === client.apiUrl && !options.project) {
+    ok(`Already linked to ${existing.projectSlug}${existing.workspaceSlug ? ` in ${existing.workspaceSlug}` : ""} \u2014 pass --project <slug> to change it.`);
+    return;
+  }
+  await ensureLinked(client, dir, options);
+}
+
+// src/commands/deploy.ts
+var BUILD_MACHINES = ["standard-1", "standard-2", "standard-3", "standard-4"];
+function resolveMachine(options) {
+  const raw = options.machine?.trim() || process.env.HIRAISHIP_MACHINE?.trim();
+  if (!raw) return void 0;
+  if (!BUILD_MACHINES.includes(raw)) {
+    const source = options.machine?.trim() ? "--machine" : "HIRAISHIP_MACHINE";
+    throw new CliError(`Unknown build machine "${raw}" (from ${source}). Valid machines: ${BUILD_MACHINES.join(", ")}.`);
+  }
+  return raw;
+}
+async function checkMachine(client, machine, workspaceSlug) {
+  let quote;
+  try {
+    quote = await client.get(`/workspace/quote?resource=build_machine&machine=${encodeURIComponent(machine)}`);
+  } catch (error) {
+    if (error instanceof ApiError && (error.status === 400 || error.status === 404)) return;
+    throw error;
+  }
+  if (quote.outcome !== "quota_exceeded") return;
+  const allowed = quote.allowedBuildMachines?.length ? `
+Machines your plan allows: ${quote.allowedBuildMachines.join(", ")}.` : "";
+  const where = workspaceSlug ? ` in ${workspaceSlug}` : "";
+  throw new CliError(`Build machine ${machine} refused${where}: ${quote.error ?? "not available on this plan."}${allowed}`);
+}
+var STEP_LABELS = {
+  preparing: "Preparing",
+  installing: "Installing dependencies",
+  building: "Building",
+  packaging: "Packaging"
+};
+var FAILURE_TAIL = 20;
+var MAX_RECONNECTS = 3;
+var BuildRenderer = class _BuildRenderer {
+  constructor(verbose, publishPlanned = false, createdAt = Date.now()) {
+    this.verbose = verbose;
+    this.publishPlanned = publishPlanned;
+    this.createdAt = createdAt;
+  }
+  verbose;
+  publishPlanned;
+  createdAt;
+  steps = /* @__PURE__ */ new Map();
+  logs = /* @__PURE__ */ new Map();
+  seenLogIds = /* @__PURE__ */ new Set();
+  failedStep;
+  /** RFC-0063: the stream's last event id, sent back on a reconnection. */
+  lastEventId = "";
+  /** RFC-0050: waiting for a free build slot. RFC-0057: or a free build machine. RFC-0069: or for its machine to start (`machine`). */
+  queued = null;
+  queueTicker;
+  lastQueueLine;
+  everQueued = false;
+  static QUEUE_NOTE_MIN_MS = 5e3;
+  /** Still in the queue proper: a build waiting for its machine has left it (RFC-0069). */
+  get isQueued() {
+    return this.queued !== null && !this.queued.machine;
+  }
+  /**
+   * RFC-0050: `⏳ Queued · position 2 · 0:42`, redrawn in place once a
+   * second on a terminal, and printed again only when the position
+   * changes when output is piped (no cursor to rewrite a line with).
+   */
+  onStatus(event) {
+    const startingMachine = event.status === "pending" && event.phase === "starting_machine";
+    if (event.status === "queued" || startingMachine) {
+      this.everQueued = true;
+      this.queued = { position: event.queuePosition, reason: event.queueReason ?? null, machine: startingMachine };
+      this.drawQueue();
+      if (process.stdout.isTTY && !this.queueTicker) {
+        this.queueTicker = setInterval(() => this.drawQueue(), 1e3);
+        this.queueTicker.unref();
+      }
+      return;
+    }
+    this.leaveQueue();
+  }
+  queueLine() {
+    const waited = formatDuration(Date.now() - this.createdAt);
+    const position = this.queued?.position ? ` \xB7 position ${this.queued.position}` : "";
+    if (this.queued?.machine) return `${yellow("\u23F3")} Queued \xB7 ${waited} ${dim("\u2014 starting a build machine")}`;
+    const waitingFor = this.queued?.reason === "capacity" ? "a free build machine" : "a free build slot";
+    return `${yellow("\u23F3")} Queued${position} \xB7 ${waited} ${dim(`\u2014 waiting for ${waitingFor}`)}`;
+  }
+  drawQueue() {
+    const line = this.queueLine();
+    if (process.stdout.isTTY) {
+      process.stdout.write(`\r\x1B[K${line}`);
+      this.lastQueueLine = line;
+      return;
+    }
+    const position = this.queued?.position ?? null;
+    const key = `position ${position} ${this.queued?.reason ?? ""} ${this.queued?.machine ? "machine" : ""}`;
+    if (this.lastQueueLine === key) return;
+    this.lastQueueLine = key;
+    console.log(line);
+  }
+  /** The build left the queue (or was cancelled): freeze the line and say how long it waited, when that was worth noting. */
+  leaveQueue() {
+    if (!this.queued && !this.everQueued) return;
+    if (this.queueTicker) clearInterval(this.queueTicker);
+    this.queueTicker = void 0;
+    const waited = Date.now() - this.createdAt;
+    if (this.queued && process.stdout.isTTY) process.stdout.write("\r\x1B[K");
+    if (this.queued && waited >= _BuildRenderer.QUEUE_NOTE_MIN_MS) console.log(dim(`  Waited ${formatDuration(waited)} before the build started`));
+    this.queued = null;
+    this.everQueued = false;
+  }
+  /** RFC-0049: publishing is a step of the flow, so say so up front instead of surprising the user after packaging. */
+  printPlan() {
+    const steps = [...Object.values(STEP_LABELS), ...this.publishPlanned ? ["Publish"] : []];
+    console.log(dim(`  ${steps.join(" \u2192 ")}`));
+  }
+  onStep(event) {
+    if (event.status !== "pending" && this.queued?.machine) this.leaveQueue();
+    const previous = this.steps.get(event.step);
+    if (previous?.status === event.status) return;
+    const startedAt = event.startedAt ? Date.parse(event.startedAt) : previous?.startedAt;
+    this.steps.set(event.step, { status: event.status, startedAt });
+    const label = STEP_LABELS[event.step] ?? event.step;
+    const elapsed = startedAt && event.finishedAt ? dim(` (${formatDuration(Date.parse(event.finishedAt) - startedAt)})`) : "";
+    if (event.status === "running") {
+      console.log(`${yellow("\u25C7")} ${label}\u2026`);
+    } else if (event.status === "success") {
+      console.log(`${green("\u2714")} ${label}${elapsed}`);
+      if (event.step === "packaging") this.notePublishing();
+    } else if (event.status === "failed") {
+      console.log(`${red("\u2716")} ${label}${elapsed}`);
+      this.failedStep = event.step;
+    }
+  }
+  publishingNoted = false;
+  notePublishing() {
+    if (this.publishingNoted) return;
+    this.publishingNoted = true;
+    console.log(`${yellow("\u25C7")} Publishing\u2026`);
+  }
+  /** RFC-0030: the publish outcome, timed server-side when the live `done` event carried a duration. */
+  printPublish(deployment, publishDurationMs) {
+    if (deployment.status !== "success") return;
+    const elapsed = publishDurationMs !== null ? dim(` (${formatDuration(publishDurationMs)})`) : "";
+    if (deployment.dispatchStatus === "live") {
+      this.notePublishing();
+      console.log(`${green("\u2714")} Published${elapsed}`);
+    } else if (deployment.dispatchStatus === "error") {
+      this.notePublishing();
+      console.log(`${red("\u2716")} Publishing failed${elapsed}`);
+    } else if (this.publishingNoted) {
+      console.log(dim("\u2013 Publishing skipped (not configured on this control-plane)"));
+    }
+  }
+  /**
+   * The failed step's last log lines, printed with the final result
+   * rather than at the step's `failed` event — its logs can arrive
+   * after that event. Nothing to add under `--verbose`.
+   */
+  printFailureTail() {
+    if (this.verbose || !this.failedStep) return;
+    const lines = (this.logs.get(this.failedStep) ?? []).filter((line) => line.trim()).slice(-FAILURE_TAIL);
+    if (lines.length === 0) return;
+    console.log(dim(`  Last lines of ${STEP_LABELS[this.failedStep].toLowerCase()}:`));
+    for (const line of lines) console.log(dim(`  \u2502 ${line}`));
+  }
+  onLog(event) {
+    if (event.id !== null) {
+      if (this.seenLogIds.has(event.id)) return;
+      this.seenLogIds.add(event.id);
+    }
+    const lines = this.logs.get(event.step) ?? [];
+    lines.push(...event.message.replace(/\n$/, "").split("\n"));
+    this.logs.set(event.step, lines.slice(-FAILURE_TAIL * 5));
+    if (this.verbose) {
+      for (const line of event.message.replace(/\n$/, "").split("\n")) console.log(dim(`  \u2502 ${line}`));
+    }
+  }
+};
+async function streamOnce(client, deploymentId, renderer) {
+  const headers = { Accept: "text/event-stream" };
+  if (renderer.lastEventId) headers["Last-Event-ID"] = renderer.lastEventId;
+  const res = await client.fetch(`/deployments/${deploymentId}/stream`, { headers });
+  if (!res.ok || !res.body) throw new Error(`stream responded ${res.status}`);
+  for await (const message of readSse(res.body)) {
+    if (message.lastEventId) renderer.lastEventId = message.lastEventId;
+    const data = JSON.parse(message.data);
+    if (message.event === "status") renderer.onStatus(data);
+    else if (message.event === "step") renderer.onStep(data);
+    else if (message.event === "log") renderer.onLog(data);
+    else if (message.event === "done") {
+      renderer.leaveQueue();
+      return data;
+    }
+  }
+  throw new Error("stream closed before the build finished");
+}
+function publishDurationOf(deployment) {
+  if (!deployment.publishStartedAt || !deployment.finishedAt) return null;
+  const ms = Date.parse(deployment.finishedAt) - Date.parse(deployment.publishStartedAt);
+  return Number.isFinite(ms) && ms >= 0 ? ms : null;
+}
+async function waitForTerminal(client, deploymentId) {
+  for (; ; ) {
+    const deployment = await client.get(`/deployments/${deploymentId}`);
+    if (deployment.status !== "queued" && deployment.status !== "pending" && deployment.dispatchStatus !== "pending") return deployment;
+    await sleep(3e3);
+  }
+}
+var SETTLE_TIMEOUT_MS = 3e3;
+async function settleSteps(client, deployment, renderer) {
+  const deadline = Date.now() + SETTLE_TIMEOUT_MS;
+  for (; ; ) {
+    const steps = await client.get(`/deployments/${deployment.id}/steps`);
+    for (const step of steps) renderer.onStep(step);
+    const settled = deployment.status === "success" ? steps.every((step) => step.status === "success") : steps.some((step) => step.status === "failed") && !steps.some((step) => step.status === "running");
+    if (settled || Date.now() >= deadline) return;
+    await sleep(300);
+  }
+}
+async function followDeployment(client, deploymentId, renderer) {
+  for (let attempt = 0; attempt <= MAX_RECONNECTS; attempt++) {
+    try {
+      const done = await streamOnce(client, deploymentId, renderer);
+      const deployment2 = await client.get(`/deployments/${deploymentId}`);
+      await settleSteps(client, deployment2, renderer);
+      renderer.printPublish(deployment2, done.publishDurationMs ?? publishDurationOf(deployment2));
+      return deployment2;
+    } catch (error) {
+      if (error instanceof CliError) throw error;
+      if (attempt < MAX_RECONNECTS) {
+        console.log(dim(`  (lost the log stream: ${error.message} \u2014 reconnecting)`));
+        await sleep(1e3 * (attempt + 1));
+      }
+    }
+  }
+  console.log(dim("  (log stream unavailable \u2014 polling for the result instead)"));
+  const deployment = await waitForTerminal(client, deploymentId);
+  renderer.printPublish(deployment, publishDurationOf(deployment));
+  return deployment;
+}
+async function deploy(dirArg, options) {
+  const dir = resolve3(dirArg ?? ".");
+  const client = await createAuthenticatedClient(options);
+  const machine = resolveMachine(options);
+  const buildEnv = await resolveBuildEnv(dir, options);
+  const link2 = await ensureLinked(client, dir, options);
+  if (machine) await checkMachine(client, machine, link2.workspaceSlug);
+  let packed;
+  try {
+    packed = await packDirectory(dir);
+  } catch (error) {
+    throw new CliError(error.message);
+  }
+  if (packed.tarball.length > MAX_TARBALL_BYTES) {
+    const largest = packed.largest.map((file) => `  ${formatBytes(file.size).padStart(9)}  ${file.path}`).join("\n");
+    throw new CliError(
+      `Upload is ${formatBytes(packed.tarball.length)}, above the ${formatBytes(MAX_TARBALL_BYTES)} limit \u2014 add large files to .hiraishipignore.
+Largest files:
+${largest}`
+    );
+  }
+  info(`Packed ${packed.fileCount} files (${formatBytes(packed.tarball.length)})`);
+  const git2 = await readGitMetadata(dir);
+  let deployment;
+  try {
+    deployment = await client.post(`/environments/${link2.environmentId}/deployments`, {
+      sourceTarballBase64: packed.tarball.toString("base64"),
+      triggerSource: "cli",
+      ...git2,
+      installCommand: options.installCommand,
+      buildCommand: options.buildCommand,
+      outputDir: options.outputDir,
+      machine,
+      buildEnv
+    });
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 404) {
+      throw new CliError(
+        `The linked project (${link2.projectSlug}) no longer exists, or you're no longer a member of its workspace \u2014 run \`hiraiship link --project <slug>\`.`
+      );
+    }
+    if (error instanceof ApiError && error.status === 403) {
+      throw new CliError(`Your role in ${link2.workspaceSlug ?? "this workspace"} can't deploy. Ask an owner or admin to make you a developer.`);
+    }
+    if (error instanceof ApiError && error.status === 402) throw new CliError(`Deployment refused: ${error.message}`);
+    if (error instanceof ApiError) throw new CliError(`Deployment rejected (${error.status}): ${error.message}`);
+    throw error;
+  }
+  const credential = client.token?.credential;
+  const dashboardLink = credential ? `${credential.dashboardUrl}/${link2.workspaceSlug ?? credential.workspaceSlug}/${link2.projectSlug}/${deployment.id}` : void 0;
+  const builtOn = deployment.buildMachine ?? machine;
+  console.log(
+    dim(`  Deployment ${deployment.id}${git2.gitSha ? ` \xB7 ${git2.gitSha.slice(0, 7)}` : ""}${builtOn ? ` \xB7 ${builtOn}` : ""}`)
+  );
+  if (options.wait === false) {
+    ok(`${deployment.status === "queued" ? `Build queued, waiting for a free ${deployment.queueReason === "capacity" ? "build machine" : "slot"}${deployment.queuePosition ? ` (position ${deployment.queuePosition})` : ""}` : "Build started"}${dashboardLink ? ` \u2192 ${dashboardLink}` : ""}`);
+    return;
+  }
+  const renderer = new BuildRenderer(options.verbose ?? false, deployment.publishPlanned ?? false, Date.parse(deployment.createdAt));
+  const onSigint = () => {
+    const state = renderer.isQueued ? "The build stays queued and starts when it can." : "The build keeps running.";
+    console.log(dim(`
+  Detached \u2014 ${state}${dashboardLink ? ` Follow it at ${dashboardLink}` : ""}`));
+    process.exit(130);
+  };
+  process.once("SIGINT", onSigint);
+  renderer.printPlan();
+  if (deployment.status === "queued") renderer.onStatus({ status: "queued", queuePosition: deployment.queuePosition ?? null, queueReason: deployment.queueReason ?? null });
+  let final;
+  try {
+    final = await followDeployment(client, deployment.id, renderer);
+  } finally {
+    process.off("SIGINT", onSigint);
+  }
+  const inspect = dashboardLink ? dim(`  Inspect: ${dashboardLink}`) : void 0;
+  if (final.status === "failed") {
+    renderer.printFailureTail();
+    fail(final.error === "canceled" ? "Build canceled while it was queued" : `Build failed${final.error ? `: ${final.error}` : ""}`);
+    if (inspect) console.log(inspect);
+    process.exitCode = 1;
+  } else if (final.dispatchStatus === "error") {
+    fail(`Built, but publishing failed${final.dispatchError ? `: ${final.dispatchError}` : ""}`);
+    if (inspect) console.log(inspect);
+    process.exitCode = 1;
+  } else if (final.dispatchStatus === "live") {
+    ok(`Deployed \u2192 ${bold(final.deployedUrl ?? "(no default domain)")}`);
+    if (inspect) console.log(inspect);
+  } else {
+    ok("Built (publishing is not configured on this control-plane)");
+    if (inspect) console.log(inspect);
+  }
+}
+
+// src/commands/login.ts
+import open from "open";
+
+// src/lib/account.ts
+function fetchApiKeyIdentity(client) {
+  return client.get("/api-key/me");
+}
+async function fetchAccount(client) {
+  if (client.isApiKey) {
+    const key = await fetchApiKeyIdentity(client);
+    return { email: `API key "${key.name}"`, workspaceSlug: key.workspace.slug };
+  }
+  const session = await client.get("/auth/get-session");
+  if (!session) {
+    throw new CliError("This token is no longer valid (expired or revoked) \u2014 run `hiraiship login`.");
+  }
+  const workspace = await client.get("/workspace/me");
+  return { email: session.user.email, workspaceSlug: workspace.slug };
+}
+
+// src/lib/device-flow.ts
+import { setTimeout as sleep2 } from "timers/promises";
+var CLIENT_ID = "hiraiship-cli";
+var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+function requestDeviceCode(client) {
+  return client.post("/auth/device/code", { client_id: CLIENT_ID });
+}
+async function pollForToken(client, code, signal) {
+  let intervalMs = Math.max(code.interval, 1) * 1e3;
+  const deadline = Date.now() + code.expires_in * 1e3;
+  while (Date.now() < deadline) {
+    await sleep2(intervalMs, void 0, { signal });
+    try {
+      const token = await client.post("/auth/device/token", {
+        grant_type: DEVICE_CODE_GRANT,
+        device_code: code.device_code,
+        client_id: CLIENT_ID
+      });
+      return token.access_token;
+    } catch (error) {
+      if (!(error instanceof ApiError)) throw error;
+      switch (error.code) {
+        case "authorization_pending":
+          continue;
+        case "slow_down":
+          intervalMs += 5e3;
+          continue;
+        case "access_denied":
+          throw new CliError("Login denied in the browser.");
+        case "expired_token":
+          throw new CliError("Code expired \u2014 run `hiraiship login` again.");
+        default:
+          throw new CliError(`Login failed: ${error.message}`);
+      }
+    }
+  }
+  throw new CliError("Code expired \u2014 run `hiraiship login` again.");
+}
+
+// src/commands/login.ts
+function formatUserCode(code) {
+  return code.length > 4 ? `${code.slice(0, 4)}-${code.slice(4)}` : code;
+}
+async function login(options) {
+  const apiUrl = resolveApiUrl(options);
+  const client = new ApiClient(apiUrl, null);
+  const code = await requestDeviceCode(client);
+  const dashboardUrl = new URL(code.verification_uri).origin;
+  info(`Your one-time code: ${bold(formatUserCode(code.user_code))}`);
+  console.log(`  Approve it at ${code.verification_uri_complete}`);
+  if (options.browser !== false && process.stdout.isTTY) {
+    try {
+      await open(code.verification_uri_complete);
+      console.log(dim("  (opened in your browser \u2014 or visit the URL above)"));
+    } catch {
+      console.log(dim("  (could not open a browser \u2014 visit the URL above)"));
+    }
+  }
+  console.log(dim(`  Waiting for approval\u2026 (expires in ${Math.round(code.expires_in / 60)} min, Ctrl-C to cancel)`));
+  const controller = new AbortController();
+  const onSigint = () => controller.abort();
+  process.once("SIGINT", onSigint);
+  let token;
+  try {
+    token = await pollForToken(client, code, controller.signal);
+  } catch (error) {
+    if (error.name === "AbortError") throw new CliError("Login cancelled.", 130);
+    throw error;
+  } finally {
+    process.off("SIGINT", onSigint);
+  }
+  const account = await fetchAccount(new ApiClient(apiUrl, { token, source: "flag" }));
+  await saveCredential(apiUrl, { token, ...account, dashboardUrl, createdAt: (/* @__PURE__ */ new Date()).toISOString() });
+  ok(`Logged in as ${bold(account.email)} (workspace ${account.workspaceSlug})`);
+}
+
+// src/commands/logout.ts
+async function logout(options) {
+  const apiUrl = resolveApiUrl(options);
+  const credential = await getStoredCredential(apiUrl);
+  if (!credential) {
+    console.log(`Not logged in to ${apiUrl}.`);
+    return;
+  }
+  try {
+    await new ApiClient(apiUrl, { token: credential.token, source: "flag" }).post("/auth/sign-out");
+  } catch (error) {
+    console.log(dim(`  (could not revoke the session server-side: ${error.message})`));
+  }
+  await removeCredential(apiUrl);
+  ok(`Logged out from ${apiUrl}`);
+}
+
+// src/commands/whoami.ts
+async function whoami(options) {
+  const client = await createAuthenticatedClient(options);
+  if (client.isApiKey) {
+    const key = await fetchApiKeyIdentity(client);
+    console.log(`${bold(`API key "${key.name}"`)} ${dim(`\xB7 ${key.role} \xB7 ${key.prefix}\u2026 \xB7 ${client.apiUrl}`)}`);
+    console.log(`  ${cyan("\u25CF")} ${key.workspace.name} ${dim(key.workspace.slug)}`);
+    console.log(dim(key.expiresAt ? `  expires ${new Date(key.expiresAt).toLocaleDateString()}` : "  never expires"));
+    if (options.showToken) console.log(client.token.token);
+    return;
+  }
+  const account = await fetchAccount(client);
+  const workspaces = await listWorkspaces(client);
+  console.log(`${bold(account.email)} ${dim(`\xB7 ${client.apiUrl}`)}`);
+  const current = client.workspaceSlug ?? workspaces[0]?.slug;
+  for (const [index, workspace] of workspaces.entries()) {
+    const marker = workspace.slug === current ? cyan("\u25CF") : dim("\u25CB");
+    const tags = [workspace.role, index === 0 ? "default" : null].filter(Boolean).join(", ");
+    console.log(`  ${marker} ${workspace.name} ${dim(`${workspace.slug} \xB7 ${tags}`)}`);
+  }
+  if (options.showToken) {
+    console.log(client.token.token);
+  }
+}
+
+// src/lib/banner.ts
+import { mkdir as mkdir3, readFile as readFile6, writeFile as writeFile3 } from "fs/promises";
+import { join as join5 } from "path";
+
+// src/lib/version.ts
+var CLI_VERSION = true ? "0.1.0" : "0.0.0-dev";
+
+// src/lib/banner.ts
+var CHECK_EVERY_MS = 24 * 60 * 60 * 1e3;
+var CHECK_TIMEOUT_MS = 800;
+var REGISTRY_URL = "https://registry.npmjs.org/hiraiship/latest";
+async function printBanner() {
+  const latest = await latestVersion();
+  const update = latest && isNewer(latest, CLI_VERSION) ? latest : null;
+  const plain = ` \u26A1 hiraiship ${CLI_VERSION}${update ? ` (update available ${update})` : ""}`;
+  const title = ` \u26A1 ${bold("hiraiship")} ${CLI_VERSION}${update ? ` ${dim("(update available")} ${green(update)}${dim(")")}` : ""}`;
+  process.stderr.write(`
+${title}
+${yellow("\u2500".repeat(plain.length + 1))}
+`);
+}
+async function latestVersion() {
+  if (process.env.HIRAISHIP_NO_UPDATE_CHECK || process.env.CI || CLI_VERSION.includes("-dev")) return null;
+  const file = join5(configDir(), "update-check.json");
+  const cached = await readFile6(file, "utf8").then((raw) => JSON.parse(raw)).catch(() => null);
+  if (cached && Date.now() - cached.checkedAt < CHECK_EVERY_MS) return cached.latest;
+  try {
+    const res = await fetch(REGISTRY_URL, { signal: AbortSignal.timeout(CHECK_TIMEOUT_MS) });
+    if (!res.ok) return cached?.latest ?? null;
+    const { version } = await res.json();
+    await mkdir3(configDir(), { recursive: true });
+    await writeFile3(file, JSON.stringify({ checkedAt: Date.now(), latest: version }));
+    return version;
+  } catch {
+    return cached?.latest ?? null;
+  }
+}
+function isNewer(candidate, current) {
+  if (candidate.includes("-")) return false;
+  const parse = (v) => v.split("-")[0].split(".").map(Number);
+  const [a, b] = [parse(candidate), parse(current)];
+  for (let i = 0; i < 3; i++) {
+    if ((a[i] ?? 0) !== (b[i] ?? 0)) return (a[i] ?? 0) > (b[i] ?? 0);
+  }
+  return false;
+}
+
+// src/index.ts
+var program = new Command().name("hiraiship").description("Deploy apps to Hiraiship.").version(CLI_VERSION).option("--api-url <url>", "control-plane URL (env: HIRAISHIP_API_URL)").option("--token <token>", "auth token, instead of the stored login (env: HIRAISHIP_TOKEN)").option("--scope <workspace>", "workspace slug to act in, instead of your default one (env: HIRAISHIP_SCOPE)").showHelpAfterError().hook("preAction", () => printBanner());
+var withGlobals = (command, options) => ({ ...command.optsWithGlobals(), ...options });
+program.command("login").description("Log in through the dashboard with a one-time device code").option("--no-browser", "print the approval URL without opening a browser").action((options, command) => login(withGlobals(command, options)));
+program.command("logout").description("Revoke and forget the stored login for this control-plane").action((options, command) => logout(withGlobals(command, options)));
+program.command("whoami").description("Show the logged-in account and its workspaces").option("--show-token", "also print the token (for HIRAISHIP_TOKEN in CI)").action((options, command) => whoami(withGlobals(command, options)));
+program.command("link").description("Link a directory to a project without deploying").argument("[dir]", "directory to link", ".").option("--project <slug>", "link to this existing project instead of prompting").action((dir, options, command) => link(dir, withGlobals(command, options)));
+program.command("deploy").description("Upload a directory, build it and publish it").argument("[dir]", "directory to deploy", ".").option("--project <slug>", "deploy to this existing project (links the directory to it)").option("--no-wait", "return once the build is queued instead of following it").option("--verbose", "print every build log line").option("--install-command <command>", "override the install command for this deployment").option("--build-command <command>", "override the build command for this deployment").option("--output-dir <dir>", "override the output directory for this deployment").option(
+  "--machine <machine>",
+  "build machine for this deployment: standard-1, standard-2, standard-3 or standard-4 (env: HIRAISHIP_MACHINE)"
+).option(
+  "--build-env <KEY=VALUE>",
+  "build variable for this deployment only, over the project's own (repeatable)",
+  (entry, previous) => [...previous, entry],
+  []
+).option("--build-env-file <path>", "read build variables for this deployment from a dotenv file (--build-env wins)").action((dir, options, command) => deploy(dir, withGlobals(command, options)));
+program.parseAsync().catch((error) => {
+  if (error instanceof CliError) {
+    fail(error.message);
+    process.exit(error.exitCode);
+  }
+  if (error instanceof ApiError) {
+    fail(`API error (${error.status}): ${error.message}`);
+    process.exit(1);
+  }
+  fail(error?.stack ?? String(error));
+  process.exit(1);
+});

package/package.json

@@ -1,6 +1,57 @@
 {
   "name": "hiraiship",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "The Hiraiship CLI: log in, then deploy a directory to Hiraiship.",
+  "license": "MIT",
+  "keywords": [
+    "hiraiship",
+    "deploy",
+    "cli",
+    "cloudflare",
+    "workers",
+    "vite",
+    "hono"
+  ],
+  "homepage": "https://docs.hiraiship.com/cli",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dilane3/hiraiship.git",
+    "directory": "packages/cli"
+  },
+  "bugs": "https://github.com/dilane3/hiraiship/issues",
+  "type": "module",
+  "bin": {
+    "hiraiship": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20.12"
+  },
+  "dependencies": {
+    "@clack/prompts": "^1.8.1",
+    "commander": "^15.0.0",
+    "ignore": "^7.0.10",
+    "open": "^11.0.4",
+    "tar": "^7.5.22"
+  },
+  "devDependencies": {
+    "@types/node": "^20.8.6",
+    "tsup": "^8.5.1",
+    "tsx": "^4.19.0",
+    "typescript": "^5.9.3",
+    "@hiraiship/types": "0.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "tsx --test 'src/**/*.test.ts'"
+  }
 }