layro-cli 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Layro
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,35 @@
-# Temporary Holding Version
+# layro-cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Find and publish React components on [Layro](https://layro.dev) from your terminal.
+
+```bash
+npx layro-cli search pricing toggle
+npx layro-cli login
+npx layro-cli publish components/pricing-card.tsx
+```
+
+Requires Node 20 or newer. No dependencies.
+
+## Commands
+
+| Command                    | Does                                                                                                           |
+| -------------------------- | -------------------------------------------------------------------------------------------------------------- |
+| `layro search <words…>`    | Find components, best match first (typos are fine, no sign-in). `--category`, `--author`, `--limit`, `--json`. |
+| `layro login`              | Sign in with GitHub in your browser (no API keys). `--no-browser` prints the link.                             |
+| `layro whoami`             | Who you're signed in as, and submissions left today.                                                           |
+| `layro publish <files…>`   | Send a new component, or a new version of one you already have (same name). The first file is the entry.       |
+| `layro status [component]` | Where your submissions stand, with reviewers' reasons. `component` is a slug or `author/slug`.                 |
+| `layro add <author/slug>`  | Prints the shadcn command that installs a component.                                                           |
+| `layro logout`             | Revokes the session and forgets it on this computer.                                                           |
+
+### Publish options
+
+`--name`, `--description` (20 to 200 characters), `--category` (a slug from layro.dev/components), `--license` (MIT, Apache-2.0, ISC or BSD-3-Clause; default MIT), `--version` (new versions: defaults to a patch bump), `--notes` (what changed), `--dark-only`, `--preview <plan.json>` (how to film the preview), `-y, --yes` (don't ask; for CI).
+
+Everything goes through review on Layro before it's live. The CLI and coding agents (MCP) share one daily allowance of submissions per account.
+
+## Where tokens live
+
+`~/.config/layro/credentials.json` (or `$XDG_CONFIG_HOME/layro`), readable only by you. Access tokens last an hour and renew themselves. `LAYRO_TOKEN` uses an access token instead; `LAYRO_URL` points at another Layro server.
+
+Docs: https://layro.dev/docs/cli

package/dist/layro.mjs

@@ -0,0 +1,755 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { parseArgs } from "node:util";
+
+// src/auth.ts
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+
+// src/credentials.ts
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+var credentialsPath = () => join(
+  process.env.XDG_CONFIG_HOME || join(homedir(), ".config"),
+  "layro",
+  "credentials.json"
+);
+async function load() {
+  try {
+    const parsed = JSON.parse(await readFile(credentialsPath(), "utf8"));
+    return parsed && typeof parsed.servers === "object" ? parsed : { servers: {} };
+  } catch {
+    return { servers: {} };
+  }
+}
+async function save(file) {
+  const path = credentialsPath();
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  if (Object.keys(file.servers).length === 0) {
+    await rm(path, { force: true });
+    return;
+  }
+  await writeFile(path, `${JSON.stringify(file, null, 2)}
+`, {
+    mode: 384
+  });
+  await chmod(path, 384);
+}
+async function getSession(server2) {
+  return (await load()).servers[server2] ?? null;
+}
+async function setSession(server2, session) {
+  const file = await load();
+  file.servers[server2] = session;
+  await save(file);
+}
+async function clearTokens(server2) {
+  const file = await load();
+  const session = file.servers[server2];
+  if (!session) return;
+  file.servers[server2] = { clientId: session.clientId };
+  await save(file);
+}
+async function forgetClient(server2) {
+  const file = await load();
+  delete file.servers[server2];
+  await save(file);
+}
+
+// src/ui.ts
+import { createInterface } from "node:readline/promises";
+var color = process.stdout.isTTY && !process.env.NO_COLOR;
+var paint = (code) => (text) => color ? `\x1B[${code}m${text}\x1B[0m` : text;
+var bold = paint(1);
+var dim = paint(2);
+var green = paint(32);
+var red = paint(31);
+var yellow = paint(33);
+var say = (text = "") => process.stdout.write(`${text}
+`);
+var warn = (text) => process.stderr.write(`${text}
+`);
+var CliError = class extends Error {
+};
+var canAsk = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
+async function ask(question, fallback = "") {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const hint = fallback ? dim(` (${fallback})`) : "";
+    const answer = (await rl.question(`${question}${hint}: `)).trim();
+    return answer || fallback;
+  } catch (error) {
+    if (error.name === "AbortError")
+      throw new CliError("Cancelled.");
+    throw error;
+  } finally {
+    rl.close();
+  }
+}
+async function confirm(question) {
+  const answer = (await ask(`${question} ${dim("[Y/n]")}`)).toLowerCase();
+  return answer === "" || answer === "y" || answer === "yes";
+}
+async function choose(question, options, fallback) {
+  options.forEach((option, i) => {
+    say(`  ${dim(String(i + 1).padStart(2))}  ${option.label}`);
+  });
+  const fallbackIndex = options.findIndex((o) => o.value === fallback);
+  for (; ; ) {
+    const answer = await ask(
+      question,
+      fallbackIndex >= 0 ? String(fallbackIndex + 1) : ""
+    );
+    const byNumber = options[Number(answer) - 1];
+    const byValue = options.find((o) => o.value === answer);
+    const picked = byNumber ?? byValue;
+    if (picked) return picked.value;
+    say(red(`Pick a number from 1 to ${options.length}.`));
+  }
+}
+
+// src/auth.ts
+var SCOPE = "layro offline_access";
+var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
+var EARLY_MS = 60 * 1e3;
+var apiResource = (server2) => `${server2}/api/v1`;
+async function metadata(server2) {
+  const url = `${server2}/.well-known/oauth-authorization-server/api/auth`;
+  let response;
+  try {
+    response = await fetch(url);
+  } catch (error) {
+    throw new CliError(
+      `Can't reach ${server2} (${error.message}). Check your connection, or LAYRO_URL.`
+    );
+  }
+  if (!response.ok)
+    throw new CliError(`${server2} answered ${response.status} for ${url}.`);
+  return await response.json();
+}
+var base64url = (bytes) => bytes.toString("base64url");
+async function register(meta, server2, redirect) {
+  const response = await fetch(meta.registration_endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      client_name: "Layro CLI",
+      client_uri: "https://layro.dev/docs/cli",
+      redirect_uris: [redirect],
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      scope: SCOPE,
+      resources: [apiResource(server2)]
+    })
+  });
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok || !body.client_id) {
+    throw new CliError(
+      response.status === 429 ? "Too many sign-ins from this network in the last hour. Try again later." : `Couldn't register the CLI with ${server2}: ${body.error_description ?? body.message ?? response.status}.`
+    );
+  }
+  return body.client_id;
+}
+function openBrowser(url) {
+  const custom = process.env.LAYRO_OPEN_BROWSER;
+  const [command, ...args] = custom ? [...custom.split(" ").filter(Boolean), url] : process.platform === "darwin" ? ["open", url] : process.platform === "win32" ? ["cmd", "/c", "start", '""', url.replaceAll("&", "^&")] : ["xdg-open", url];
+  const child = spawn(command, args, {
+    stdio: custom ? "inherit" : "ignore",
+    detached: !custom
+  });
+  child.on("error", () => {
+  });
+  if (!custom) child.unref();
+}
+var page = (title, text) => `<!doctype html><meta charset="utf-8"><title>${title}</title><body style="font:16px/1.5 system-ui,sans-serif;max-width:32rem;margin:20vh auto;padding:0 1rem;color:#111"><h1 style="font-size:1.4rem">${title}</h1><p>${text}</p></body>`;
+async function callbackServer(state) {
+  let settle = () => {
+  };
+  const result = new Promise((resolve2) => {
+    settle = resolve2;
+  });
+  const server2 = createServer((request, response) => {
+    const url = new URL(request.url ?? "/", "http://127.0.0.1");
+    if (url.pathname !== "/callback") {
+      response.writeHead(404).end();
+      return;
+    }
+    const error = url.searchParams.get("error");
+    const code = url.searchParams.get("code");
+    const ok = !error && code && url.searchParams.get("state") === state;
+    response.writeHead(ok ? 200 : 400, { "Content-Type": "text/html; charset=utf-8" }).end(
+      ok ? page(
+        "Signed in to Layro",
+        "You can close this tab and go back to your terminal."
+      ) : page(
+        "Not signed in",
+        error === "access_denied" ? "You denied access. Run layro login again if that was a mistake." : "Something went wrong. Run layro login again."
+      )
+    );
+    settle(
+      ok ? { code } : {
+        error: error ?? (code ? "state mismatch" : "no code in the callback")
+      }
+    );
+  });
+  await new Promise((resolve2, reject) => {
+    server2.once("error", reject);
+    server2.listen(0, "127.0.0.1", resolve2);
+  });
+  const { port } = server2.address();
+  return { port, result, close: () => server2.close() };
+}
+async function tokenRequest(meta, params) {
+  const response = await fetch(meta.token_endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams(params)
+  });
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok || !body.access_token) {
+    return {
+      ok: false,
+      error: body.error_description ?? body.error ?? String(response.status)
+    };
+  }
+  return { ok: true, tokens: body };
+}
+var toSession = (clientId, tokens) => ({
+  clientId,
+  accessToken: tokens.access_token,
+  refreshToken: tokens.refresh_token,
+  expiresAt: Date.now() + (tokens.expires_in ?? 3600) * 1e3
+});
+async function login(server2, options) {
+  const meta = await metadata(server2);
+  const state = base64url(randomBytes(16));
+  const callback = await callbackServer(state);
+  try {
+    const redirect = `http://127.0.0.1:${callback.port}/callback`;
+    const known = await getSession(server2);
+    const clientId = known?.clientId ?? await register(meta, server2, redirect);
+    await setSession(server2, { ...known ?? {}, clientId });
+    const verifier = base64url(randomBytes(32));
+    const challenge = base64url(createHash("sha256").update(verifier).digest());
+    const authorize = new URL(meta.authorization_endpoint);
+    authorize.search = new URLSearchParams({
+      response_type: "code",
+      client_id: clientId,
+      redirect_uri: redirect,
+      scope: SCOPE,
+      state,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      resource: apiResource(server2)
+    }).toString();
+    say("Opening your browser to sign in to Layro with GitHub.");
+    say(dim(`If it doesn't open, visit:
+${authorize}`));
+    if (options.browser) openBrowser(authorize.toString());
+    const outcome = await Promise.race([
+      callback.result,
+      new Promise(
+        (resolve2) => setTimeout(
+          () => resolve2({ error: "timed out waiting for the browser" }),
+          LOGIN_TIMEOUT_MS
+        ).unref()
+      )
+    ]);
+    if (!outcome.code) {
+      if (outcome.error === "invalid_client") await forgetClient(server2);
+      throw new CliError(
+        outcome.error === "access_denied" ? "Sign-in denied on Layro." : `Sign-in didn't finish: ${outcome.error}. Run layro login again.`
+      );
+    }
+    const exchanged = await tokenRequest(meta, {
+      grant_type: "authorization_code",
+      code: outcome.code,
+      redirect_uri: redirect,
+      client_id: clientId,
+      code_verifier: verifier,
+      resource: apiResource(server2)
+    });
+    if (!exchanged.ok)
+      throw new CliError(`Sign-in failed: ${exchanged.error}.`);
+    const session = toSession(clientId, exchanged.tokens);
+    await setSession(server2, session);
+    return session;
+  } finally {
+    callback.close();
+  }
+}
+async function refresh(server2, session) {
+  if (!session.refreshToken) return null;
+  const meta = await metadata(server2);
+  const renewed = await tokenRequest(meta, {
+    grant_type: "refresh_token",
+    refresh_token: session.refreshToken,
+    client_id: session.clientId,
+    resource: apiResource(server2)
+  });
+  if (!renewed.ok) {
+    await clearTokens(server2);
+    return null;
+  }
+  const next = {
+    ...toSession(session.clientId, renewed.tokens),
+    refreshToken: renewed.tokens.refresh_token ?? session.refreshToken,
+    handle: session.handle
+  };
+  await setSession(server2, next);
+  return next;
+}
+var notSignedIn = () => new CliError("Not signed in. Run `npx layro-cli login` first.");
+async function accessToken(server2, force = false) {
+  if (process.env.LAYRO_TOKEN) return process.env.LAYRO_TOKEN;
+  const session = await getSession(server2);
+  if (!session?.accessToken) throw notSignedIn();
+  if (!force && (session.expiresAt ?? 0) - EARLY_MS > Date.now())
+    return session.accessToken;
+  const renewed = await refresh(server2, session);
+  if (!renewed?.accessToken)
+    throw new CliError(
+      "Your Layro session expired. Run `npx layro-cli login` again."
+    );
+  return renewed.accessToken;
+}
+async function logout(server2) {
+  const session = await getSession(server2);
+  if (!session?.accessToken && !session?.refreshToken) return false;
+  try {
+    const meta = await metadata(server2);
+    if (meta.revocation_endpoint && session.refreshToken) {
+      await fetch(meta.revocation_endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          token: session.refreshToken,
+          token_type_hint: "refresh_token",
+          client_id: session.clientId
+        })
+      });
+    }
+  } catch {
+  }
+  await clearTokens(server2);
+  return true;
+}
+
+// src/api.ts
+var VERSION = true ? "0.2.0" : "dev";
+var ApiFailure = class extends CliError {
+  constructor(detail) {
+    super(detail.error);
+    this.detail = detail;
+  }
+  detail;
+};
+async function api(server2, path, init = {}) {
+  const call = async (token) => {
+    try {
+      return await fetch(`${server2}/api/v1${path}`, {
+        method: init.method ?? "GET",
+        headers: {
+          Accept: "application/json",
+          "User-Agent": `layro-cli/${VERSION}`,
+          ...init.body !== void 0 ? { "Content-Type": "application/json" } : {},
+          ...token ? { Authorization: `Bearer ${token}` } : {}
+        },
+        body: init.body !== void 0 ? JSON.stringify(init.body) : void 0
+      });
+    } catch (error) {
+      throw new CliError(
+        `Can't reach ${server2} (${error.message}). Check your connection, or LAYRO_URL.`
+      );
+    }
+  };
+  const authed = init.auth !== false;
+  let response = await call(authed ? await accessToken(server2) : void 0);
+  if (response.status === 401 && authed && !process.env.LAYRO_TOKEN) {
+    response = await call(await accessToken(server2, true));
+  }
+  const body = await response.json().catch(() => null);
+  if (response.ok && body) return body;
+  if (response.status === 401) {
+    if (process.env.LAYRO_TOKEN)
+      throw new CliError("LAYRO_TOKEN was refused: it's invalid or expired.");
+    throw notSignedIn();
+  }
+  throw new ApiFailure({
+    status: response.status,
+    error: body?.error ?? `${server2} answered ${response.status} for ${path}.`,
+    errors: body?.errors
+  });
+}
+
+// src/publish.ts
+import { readFile as readFile2 } from "node:fs/promises";
+import { basename, dirname as dirname2, relative, resolve, sep } from "node:path";
+function nameFromFile(path) {
+  const stem = basename(path).replace(/\.[^.]+$/, "");
+  return stem.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[-_\s.]+/).filter(Boolean).map((word) => word[0].toUpperCase() + word.slice(1)).join(" ");
+}
+async function readFiles(paths) {
+  const absolute = paths.map((p) => resolve(p));
+  let root = dirname2(absolute[0]);
+  for (const path of absolute) {
+    while (!`${dirname2(path)}${sep}`.startsWith(`${root}${sep}`)) {
+      root = dirname2(root);
+    }
+  }
+  return Promise.all(
+    absolute.map(async (path, i) => {
+      let content;
+      try {
+        content = await readFile2(path, "utf8");
+      } catch {
+        throw new CliError(`Can't read ${paths[i]}.`);
+      }
+      return { path: relative(root, path).split(sep).join("/"), content };
+    })
+  );
+}
+async function readPreview(path) {
+  if (!path) return void 0;
+  try {
+    return JSON.parse(await readFile2(path, "utf8"));
+  } catch {
+    throw new CliError(`--preview: ${path} isn't a readable JSON file.`);
+  }
+}
+function explain(error) {
+  if (error instanceof ApiFailure && error.detail.errors) {
+    say(red("Not sent. Fix these and try again:"));
+    for (const [field, message] of Object.entries(error.detail.errors)) {
+      say(`  ${bold(field)}: ${message}`);
+    }
+    process.exit(1);
+  }
+  throw error;
+}
+async function publish(server2, paths, flags) {
+  if (paths.length === 0)
+    throw new CliError(
+      "Name the files to publish, entry first: layro publish components/pricing-card.tsx"
+    );
+  const interactive = canAsk() && !flags.yes;
+  const files = await readFiles(paths);
+  const preview = await readPreview(flags.preview);
+  const me = await api(server2, "/me");
+  say(dim(`Publishing as @${me.handle} to ${server2}`));
+  const name = flags.name ?? (interactive ? await ask("Name", nameFromFile(paths[0])) : nameFromFile(paths[0]));
+  let existing = null;
+  try {
+    existing = await api(
+      server2,
+      `/status?name=${encodeURIComponent(name)}`
+    );
+  } catch (error) {
+    if (!(error instanceof ApiFailure) || error.detail.status !== 404)
+      throw error;
+  }
+  let result;
+  if (existing) {
+    say(
+      `${bold(existing.name)} is already yours (${existing.liveVersion ? `${existing.liveVersion} live` : existing.status}): sending a new version.`
+    );
+    const version = flags.version ?? (interactive ? await ask("Version", existing.nextVersion) : existing.nextVersion);
+    const notes = flags.notes ?? (interactive ? await ask("What changed", "") : "");
+    if (interactive && !await confirm(`Send ${existing.id} ${version} for review?`))
+      return say("Nothing sent.");
+    result = await api(
+      server2,
+      `/components/${existing.id}/versions`,
+      {
+        method: "POST",
+        body: { version, notes, files, preview }
+      }
+    ).catch(explain);
+  } else {
+    if (flags.version && flags.version !== "1.0.0")
+      warn(
+        yellow(
+          `New components start at 1.0.0; ignoring --version ${flags.version}.`
+        )
+      );
+    const index = interactive || !flags.category ? await api(server2, "", { auth: false }) : null;
+    const description = flags.description ?? (interactive ? await ask("Description (20 to 200 characters)") : "");
+    let category = flags.category ?? "";
+    if (!category && interactive && index) {
+      say("Category:");
+      category = await choose(
+        "Category",
+        index.categories.map((c) => ({
+          value: c.slug,
+          label: `${c.name} ${dim(`(${c.slug}): ${c.description}`)}`
+        }))
+      );
+    }
+    let license = flags.license ?? "";
+    if (!license && interactive && index) {
+      say("Licence:");
+      license = await choose(
+        "Licence",
+        index.licenses.map((l) => ({ value: l, label: l })),
+        "MIT"
+      );
+    }
+    license ||= "MIT";
+    if (interactive && !await confirm(`Send ${name} 1.0.0 for review as @${me.handle}?`))
+      return say("Nothing sent.");
+    result = await api(server2, "/components", {
+      method: "POST",
+      body: {
+        name,
+        description,
+        category,
+        license,
+        files,
+        darkOnly: flags.darkOnly ?? false,
+        preview
+      }
+    }).catch(explain);
+  }
+  say(green(`\u2713 ${result.component} ${result.version} is in review.`));
+  say(`  ${result.message}`);
+  say(`  Studio: ${result.studio}`);
+  say(dim(`  Submissions left today: ${result.submissionsLeftToday}`));
+}
+
+// src/search.ts
+async function search(server2, words, flags) {
+  const q = words.join(" ").trim();
+  if (!q) throw new CliError("Give some words: layro search <words\u2026>");
+  const params = new URLSearchParams({ q });
+  if (flags.category) params.set("category", flags.category);
+  if (flags.author) params.set("author", flags.author);
+  if (flags.limit) params.set("limit", flags.limit);
+  const found = await api(server2, `/search?${params}`, { auth: false });
+  if (flags.json) return say(JSON.stringify(found, null, 2));
+  if (found.results.length === 0) {
+    say(`Nothing matches "${q}".`);
+    if (found.suggestion)
+      say(
+        `The closest category is ${bold(found.suggestion.name)}: ${found.suggestion.url}`
+      );
+    return;
+  }
+  for (const c of found.results) {
+    say(`${bold(c.name)} ${dim(c.id)}`);
+    say(`  ${c.description}`);
+    say(dim(`  ${c.install}`));
+  }
+  say(
+    dim(
+      `${found.results.length} ${found.results.length === 1 ? "result" : "results"}. Install one with the command under it.`
+    )
+  );
+}
+
+// src/status.ts
+var LABEL = {
+  live: "live",
+  review: "in review",
+  rejected: "changes requested",
+  processing: "processing",
+  approved: "approved"
+};
+async function status(server2, target) {
+  if (target) {
+    const me = target.includes("/") ? null : await api(server2, "/me");
+    const id = me ? `${me.handle}/${target}` : target;
+    const one = await api(
+      server2,
+      `/status?component=${encodeURIComponent(id)}`
+    );
+    say(`${bold(one.name)} ${dim(one.id)}: ${LABEL[one.status] ?? one.status}`);
+    if (one.url) say(`  ${one.url}`);
+    say(`  Studio: ${one.studio}`);
+    say();
+    for (const v of one.versions) {
+      const state = v.status === "approved" ? v.current ? "live" : "released" : LABEL[v.status];
+      say(
+        `  ${v.version.padEnd(9)} ${state.padEnd(18)} ${dim(v.decidedAt ?? v.submittedAt)}`
+      );
+      if (v.notes) say(dim(`            ${v.notes}`));
+      if (v.decisionNote)
+        say(
+          `            ${v.status === "rejected" ? red("Reason:") : "Reviewer:"} ${v.decisionNote}`
+        );
+    }
+    return;
+  }
+  const all = await api(server2, "/status");
+  say(`@${all.author}`);
+  if (all.components.length === 0) {
+    say(dim("No components yet. Send one with layro publish <files>."));
+  }
+  for (const c of all.components) {
+    const open = c.latestSubmission;
+    say(
+      `  ${c.id.padEnd(36)} ${(LABEL[c.status] ?? c.status).padEnd(18)} ${c.version}${open && c.status === "live" ? dim(` \xB7 ${open.version} ${LABEL[open.status] ?? open.status}`) : ""}`
+    );
+    if (open?.status === "rejected" && open.decisionNote)
+      say(`    ${red("Reason:")} ${open.decisionNote}`);
+  }
+  say(
+    dim(
+      `Submissions left today: ${all.submissions.left} of ${all.submissions.limit}`
+    )
+  );
+}
+
+// src/index.ts
+var HELP = `${bold("layro")} ${dim(VERSION)}: find and publish React components on Layro
+
+Usage
+  layro search <words\u2026>       Find components (typos are fine; no sign-in needed)
+  layro login                 Sign in with GitHub in your browser
+  layro whoami                Who you're signed in as
+  layro publish <files\u2026>      Send a new component, or a new version of yours
+  layro status [component]    Where your submissions stand (component: slug or author/slug)
+  layro add <author/slug>     How to install a component (shadcn does it)
+  layro logout                Sign out on this computer
+
+Publish options
+  --name <name>               Defaults to the first file's name
+  --description <text>        20 to 200 characters (new components)
+  --category <slug>           See https://layro.dev/components (new components)
+  --license <id>              MIT, Apache-2.0, ISC or BSD-3-Clause (default MIT)
+  --version <x.y.z>           New versions: defaults to a patch bump
+  --notes <text>              New versions: what changed
+  --dark-only                 It only works on a dark page
+  --preview <plan.json>       How to film its preview (see the docs)
+  -y, --yes                   Don't ask; send what's given (for CI)
+
+Search options
+  --category <slug>           Only this category
+  --author <handle>           Only this author's components
+  --limit <n>                 1 to 50 (default 20)
+  --json                      Print the API's JSON
+
+Login options
+  --no-browser                Print the sign-in link instead of opening it
+
+Environment
+  LAYRO_TOKEN                 An access token to use instead of signing in
+  LAYRO_URL                   Another Layro server (default https://layro.dev)
+
+Docs: https://layro.dev/docs/cli`;
+var server = (process.env.LAYRO_URL || "https://layro.dev").replace(
+  /\/+$/,
+  ""
+);
+async function whoami() {
+  const me = await api(server, "/me");
+  say(`@${me.handle} ${dim(`on ${server}`)}`);
+  say(
+    dim(
+      `Submissions left today: ${me.submissions.left} of ${me.submissions.limit}`
+    )
+  );
+  return me;
+}
+async function main(argv) {
+  const [command, ...rest] = argv;
+  if (!command || command === "help" || command === "--help" || command === "-h")
+    return say(HELP);
+  if (command === "--version" || command === "-v") return say(VERSION);
+  switch (command) {
+    case "login": {
+      const { values } = parseArgs({
+        args: rest,
+        options: { "no-browser": { type: "boolean" } }
+      });
+      const session = await login(server, { browser: !values["no-browser"] });
+      const me = await api(server, "/me");
+      await setSession(server, { ...session, handle: me.handle });
+      say(green(`\u2713 Signed in as @${me.handle}.`));
+      say(dim(`Tokens saved in ${credentialsPath()}`));
+      return;
+    }
+    case "logout": {
+      const out = await logout(server);
+      say(out ? "Signed out." : "You weren't signed in.");
+      if (process.env.LAYRO_TOKEN)
+        say(dim("LAYRO_TOKEN is still set in this shell."));
+      return;
+    }
+    case "whoami": {
+      if (!process.env.LAYRO_TOKEN && !(await getSession(server))?.accessToken)
+        throw new CliError("Not signed in. Run `npx layro-cli login`.");
+      await whoami();
+      return;
+    }
+    case "publish": {
+      const { values, positionals } = parseArgs({
+        args: rest,
+        allowPositionals: true,
+        options: {
+          name: { type: "string" },
+          description: { type: "string" },
+          category: { type: "string" },
+          license: { type: "string" },
+          version: { type: "string" },
+          notes: { type: "string" },
+          preview: { type: "string" },
+          "dark-only": { type: "boolean" },
+          yes: { type: "boolean", short: "y" }
+        }
+      });
+      const { "dark-only": darkOnly, ...flags } = values;
+      await publish(server, positionals, {
+        ...flags,
+        darkOnly
+      });
+      return;
+    }
+    case "search": {
+      const { values, positionals } = parseArgs({
+        args: rest,
+        allowPositionals: true,
+        options: {
+          category: { type: "string" },
+          author: { type: "string" },
+          limit: { type: "string" },
+          json: { type: "boolean" }
+        }
+      });
+      await search(server, positionals, values);
+      return;
+    }
+    case "status": {
+      const { positionals } = parseArgs({ args: rest, allowPositionals: true });
+      await status(server, positionals[0]);
+      return;
+    }
+    case "add": {
+      const id = rest[0] ?? "<author>/<slug>";
+      say("Layro components install with the shadcn CLI:");
+      say(`  npx shadcn@latest add ${server}/r/${id}.json`);
+      say(dim("Or add Layro as a registry in components.json, then:"));
+      say(dim(`  npx shadcn@latest add @layro/${id}`));
+      return;
+    }
+    default:
+      throw new CliError(`Unknown command "${command}". Run layro --help.`);
+  }
+}
+process.stdout.on("error", (error) => {
+  if (error.code === "EPIPE") process.exit(0);
+  throw error;
+});
+main(process.argv.slice(2)).catch((error) => {
+  if (error instanceof CliError) {
+    warn(red(error.message));
+  } else if (error?.code?.startsWith("ERR_PARSE_ARGS")) {
+    warn(red(error.message));
+  } else {
+    warn(red(`Unexpected error: ${error?.stack ?? error}`));
+  }
+  process.exit(1);
+});

package/package.json

@@ -1,6 +1,37 @@
 {
   "name": "layro-cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Find and publish React components on Layro (layro.dev) from your terminal.",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "layro": "dist/layro.mjs"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "homepage": "https://layro.dev/docs/cli",
+  "keywords": [
+    "layro",
+    "shadcn",
+    "react",
+    "components",
+    "registry",
+    "cli"
+  ],
+  "scripts": {
+    "build": "esbuild src/index.ts --bundle --platform=node --target=node20 --format=esm --outfile=dist/layro.mjs --banner:js=\"#!/usr/bin/env node\" --define:LAYRO_CLI_VERSION=\\\"$npm_package_version\\\"",
+    "typecheck": "tsc -p .",
+    "prepack": "pnpm run build"
+  },
+  "devDependencies": {
+    "@types/node": "22.20.5",
+    "esbuild": "0.28.2",
+    "typescript": "5.9.3"
+  }
+}