pageship 0.0.1 → 0.1.0

package/dist/cli.mjs

@@ -1,13 +1,1598 @@
 #!/usr/bin/env node
-import { NodeRuntime, NodeServices } from "@effect/platform-node";
-import { Effect } from "effect";
-import { Command } from "effect/unstable/cli";
+import { execFile } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { lstat, mkdir, open, realpath, rename, rm } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { promisify } from "node:util";
+import { constants } from "node:fs";
+import { homedir } from "node:os";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { NodeServices } from "@effect/platform-node";
+import { Cause, Config, Console, Effect, Option, Schema } from "effect";
+import { Argument, CliConfig, CliError, CliOutput, Command, Flag, GlobalFlag } from "effect/unstable/cli";
+//#region ../../packages/api-client/src/generated/core/bodySerializer.gen.ts
+const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
+Object.entries({
+	$body_: "body",
+	$headers_: "headers",
+	$path_: "path",
+	$query_: "query"
+});
+//#endregion
+//#region ../../packages/api-client/src/generated/core/serverSentEvents.gen.ts
+function createSseClient({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url, ...options }) {
+	let lastEventId;
+	const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	const createStream = async function* () {
+		let retryDelay = sseDefaultRetryDelay ?? 3e3;
+		let attempt = 0;
+		const signal = options.signal ?? new AbortController().signal;
+		while (true) {
+			if (signal.aborted) break;
+			attempt++;
+			const headers = options.headers instanceof Headers ? options.headers : new Headers(options.headers);
+			if (lastEventId !== void 0) headers.set("Last-Event-ID", lastEventId);
+			try {
+				const requestInit = {
+					redirect: "follow",
+					...options,
+					body: options.serializedBody,
+					headers,
+					signal
+				};
+				let request = new Request(url, requestInit);
+				if (onRequest) request = await onRequest(url, requestInit);
+				const response = await (options.fetch ?? globalThis.fetch)(request);
+				if (!response.ok) throw new Error(`SSE failed: ${response.status} ${response.statusText}`);
+				if (!response.body) throw new Error("No body in SSE response");
+				const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();
+				let buffer = "";
+				const abortHandler = () => {
+					try {
+						reader.cancel();
+					} catch {}
+				};
+				signal.addEventListener("abort", abortHandler);
+				try {
+					while (true) {
+						const { done, value } = await reader.read();
+						if (done) break;
+						buffer += value;
+						buffer = buffer.replace(/\r\n?/g, "\n");
+						const chunks = buffer.split("\n\n");
+						buffer = chunks.pop() ?? "";
+						for (const chunk of chunks) {
+							const lines = chunk.split("\n");
+							const dataLines = [];
+							let eventName;
+							for (const line of lines) if (line.startsWith("data:")) dataLines.push(line.replace(/^data:\s*/, ""));
+							else if (line.startsWith("event:")) eventName = line.replace(/^event:\s*/, "");
+							else if (line.startsWith("id:")) lastEventId = line.replace(/^id:\s*/, "");
+							else if (line.startsWith("retry:")) {
+								const parsed = Number.parseInt(line.replace(/^retry:\s*/, ""), 10);
+								if (!Number.isNaN(parsed)) retryDelay = parsed;
+							}
+							let data;
+							let parsedJson = false;
+							if (dataLines.length) {
+								const rawData = dataLines.join("\n");
+								try {
+									data = JSON.parse(rawData);
+									parsedJson = true;
+								} catch {
+									data = rawData;
+								}
+							}
+							if (parsedJson) {
+								if (responseValidator) await responseValidator(data);
+								if (responseTransformer) data = await responseTransformer(data);
+							}
+							onSseEvent?.({
+								data,
+								event: eventName,
+								id: lastEventId,
+								retry: retryDelay
+							});
+							if (dataLines.length) yield data;
+						}
+					}
+				} finally {
+					signal.removeEventListener("abort", abortHandler);
+					reader.releaseLock();
+				}
+				break;
+			} catch (error) {
+				onSseError?.(error);
+				if (sseMaxRetryAttempts !== void 0 && attempt >= sseMaxRetryAttempts) break;
+				const backoff = Math.min(retryDelay * 2 ** (attempt - 1), sseMaxRetryDelay ?? 3e4);
+				await sleep(backoff);
+			}
+		}
+	};
+	return { stream: createStream() };
+}
+//#endregion
+//#region ../../packages/api-client/src/generated/core/pathSerializer.gen.ts
+const separatorArrayExplode = (style) => {
+	switch (style) {
+		case "label": return ".";
+		case "matrix": return ";";
+		case "simple": return ",";
+		default: return "&";
+	}
+};
+const separatorArrayNoExplode = (style) => {
+	switch (style) {
+		case "form": return ",";
+		case "pipeDelimited": return "|";
+		case "spaceDelimited": return "%20";
+		default: return ",";
+	}
+};
+const separatorObjectExplode = (style) => {
+	switch (style) {
+		case "label": return ".";
+		case "matrix": return ";";
+		case "simple": return ",";
+		default: return "&";
+	}
+};
+const serializeArrayParam = ({ allowReserved, explode, name, style, value }) => {
+	if (!explode) {
+		const joinedValues = (allowReserved ? value : value.map((v) => encodeURIComponent(v))).join(separatorArrayNoExplode(style));
+		switch (style) {
+			case "label": return `.${joinedValues}`;
+			case "matrix": return `;${name}=${joinedValues}`;
+			case "simple": return joinedValues;
+			default: return `${name}=${joinedValues}`;
+		}
+	}
+	const separator = separatorArrayExplode(style);
+	const joinedValues = value.map((v) => {
+		if (style === "label" || style === "simple") return allowReserved ? v : encodeURIComponent(v);
+		return serializePrimitiveParam({
+			allowReserved,
+			name,
+			value: v
+		});
+	}).join(separator);
+	return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+const serializePrimitiveParam = ({ allowReserved, name, value }) => {
+	if (value === void 0 || value === null) return "";
+	if (typeof value === "object") throw new Error("Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.");
+	return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;
+};
+const serializeObjectParam = ({ allowReserved, explode, name, style, value, valueOnly }) => {
+	if (value instanceof Date) return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;
+	if (style !== "deepObject" && !explode) {
+		let values = [];
+		Object.entries(value).forEach(([key, v]) => {
+			values = [
+				...values,
+				key,
+				allowReserved ? v : encodeURIComponent(v)
+			];
+		});
+		const joinedValues = values.join(",");
+		switch (style) {
+			case "form": return `${name}=${joinedValues}`;
+			case "label": return `.${joinedValues}`;
+			case "matrix": return `;${name}=${joinedValues}`;
+			default: return joinedValues;
+		}
+	}
+	const separator = separatorObjectExplode(style);
+	const joinedValues = Object.entries(value).map(([key, v]) => serializePrimitiveParam({
+		allowReserved,
+		name: style === "deepObject" ? `${name}[${key}]` : key,
+		value: v
+	})).join(separator);
+	return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+//#endregion
+//#region ../../packages/api-client/src/generated/core/utils.gen.ts
+const PATH_PARAM_RE = /\{[^{}]+\}/g;
+const defaultPathSerializer = ({ path, url: _url }) => {
+	let url = _url;
+	const matches = _url.match(PATH_PARAM_RE);
+	if (matches) for (const match of matches) {
+		let explode = false;
+		let name = match.substring(1, match.length - 1);
+		let style = "simple";
+		if (name.endsWith("*")) {
+			explode = true;
+			name = name.substring(0, name.length - 1);
+		}
+		if (name.startsWith(".")) {
+			name = name.substring(1);
+			style = "label";
+		} else if (name.startsWith(";")) {
+			name = name.substring(1);
+			style = "matrix";
+		}
+		const value = path[name];
+		if (value === void 0 || value === null) continue;
+		if (Array.isArray(value)) {
+			url = url.replace(match, serializeArrayParam({
+				explode,
+				name,
+				style,
+				value
+			}));
+			continue;
+		}
+		if (typeof value === "object") {
+			url = url.replace(match, serializeObjectParam({
+				explode,
+				name,
+				style,
+				value,
+				valueOnly: true
+			}));
+			continue;
+		}
+		if (style === "matrix") {
+			url = url.replace(match, `;${serializePrimitiveParam({
+				name,
+				value
+			})}`);
+			continue;
+		}
+		const replaceValue = encodeURIComponent(style === "label" ? `.${value}` : value);
+		url = url.replace(match, replaceValue);
+	}
+	return url;
+};
+const getUrl = ({ baseUrl, path, query, querySerializer, url: _url }) => {
+	const pathUrl = _url.startsWith("/") ? _url : `/${_url}`;
+	let url = (baseUrl ?? "") + pathUrl;
+	if (path) url = defaultPathSerializer({
+		path,
+		url
+	});
+	let search = query ? querySerializer(query) : "";
+	if (search.startsWith("?")) search = search.substring(1);
+	if (search) url += `?${search}`;
+	return url;
+};
+function getValidRequestBody(options) {
+	const hasBody = options.body !== void 0;
+	if (hasBody && options.bodySerializer) {
+		if ("serializedBody" in options) return options.serializedBody !== void 0 && options.serializedBody !== "" ? options.serializedBody : null;
+		return options.body !== "" ? options.body : null;
+	}
+	if (hasBody) return options.body;
+}
+//#endregion
+//#region ../../packages/api-client/src/generated/core/auth.gen.ts
+const getAuthToken = async (auth, callback) => {
+	const token = typeof callback === "function" ? await callback(auth) : callback;
+	if (!token) return;
+	if (auth.scheme === "bearer") return `Bearer ${token}`;
+	if (auth.scheme === "basic") return `Basic ${btoa(token)}`;
+	return token;
+};
+//#endregion
+//#region ../../packages/api-client/src/generated/client/utils.gen.ts
+const createQuerySerializer = ({ parameters = {}, ...args } = {}) => {
+	const querySerializer = (queryParams) => {
+		const search = [];
+		if (queryParams && typeof queryParams === "object") for (const name in queryParams) {
+			const value = queryParams[name];
+			if (value === void 0 || value === null) continue;
+			const options = parameters[name] || args;
+			if (Array.isArray(value)) {
+				const serializedArray = serializeArrayParam({
+					allowReserved: options.allowReserved,
+					explode: true,
+					name,
+					style: "form",
+					value,
+					...options.array
+				});
+				if (serializedArray) search.push(serializedArray);
+			} else if (typeof value === "object") {
+				const serializedObject = serializeObjectParam({
+					allowReserved: options.allowReserved,
+					explode: true,
+					name,
+					style: "deepObject",
+					value,
+					...options.object
+				});
+				if (serializedObject) search.push(serializedObject);
+			} else {
+				const serializedPrimitive = serializePrimitiveParam({
+					allowReserved: options.allowReserved,
+					name,
+					value
+				});
+				if (serializedPrimitive) search.push(serializedPrimitive);
+			}
+		}
+		return search.join("&");
+	};
+	return querySerializer;
+};
+/**
+* Infers parseAs value from provided Content-Type header.
+*/
+const getParseAs = (contentType) => {
+	if (!contentType) return "stream";
+	const cleanContent = contentType.split(";")[0]?.trim();
+	if (!cleanContent) return;
+	if (cleanContent.startsWith("application/json") || cleanContent.endsWith("+json")) return "json";
+	if (cleanContent === "multipart/form-data") return "formData";
+	if ([
+		"application/",
+		"audio/",
+		"image/",
+		"video/"
+	].some((type) => cleanContent.startsWith(type))) return "blob";
+	if (cleanContent.startsWith("text/")) return "text";
+};
+const checkForExistence = (options, name) => {
+	if (!name) return false;
+	if (options.headers.has(name) || options.query?.[name] || options.headers.get("Cookie")?.includes(`${name}=`)) return true;
+	return false;
+};
+async function setAuthParams(options) {
+	for (const auth of options.security ?? []) {
+		if (checkForExistence(options, auth.name)) continue;
+		const token = await getAuthToken(auth, options.auth);
+		if (!token) continue;
+		const name = auth.name ?? "Authorization";
+		switch (auth.in) {
+			case "query":
+				if (!options.query) options.query = {};
+				options.query[name] = token;
+				break;
+			case "cookie":
+				options.headers.append("Cookie", `${name}=${token}`);
+				break;
+			default: options.headers.set(name, token);
+		}
+	}
+}
+const buildUrl = (options) => getUrl({
+	baseUrl: options.baseUrl,
+	path: options.path,
+	query: options.query,
+	querySerializer: typeof options.querySerializer === "function" ? options.querySerializer : createQuerySerializer(options.querySerializer),
+	url: options.url
+});
+const mergeConfigs = (a, b) => {
+	const config = {
+		...a,
+		...b
+	};
+	if (config.baseUrl?.endsWith("/")) config.baseUrl = config.baseUrl.substring(0, config.baseUrl.length - 1);
+	config.headers = mergeHeaders(a.headers, b.headers);
+	return config;
+};
+const headersEntries = (headers) => {
+	const entries = [];
+	headers.forEach((value, key) => {
+		entries.push([key, value]);
+	});
+	return entries;
+};
+const mergeHeaders = (...headers) => {
+	const mergedHeaders = new Headers();
+	for (const header of headers) {
+		if (!header) continue;
+		const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+		for (const [key, value] of iterator) if (value === null) mergedHeaders.delete(key);
+		else if (Array.isArray(value)) for (const v of value) mergedHeaders.append(key, v);
+		else if (value !== void 0) mergedHeaders.set(key, typeof value === "object" ? JSON.stringify(value) : value);
+	}
+	return mergedHeaders;
+};
+var Interceptors = class {
+	fns = [];
+	clear() {
+		this.fns = [];
+	}
+	eject(id) {
+		const index = this.getInterceptorIndex(id);
+		if (this.fns[index]) this.fns[index] = null;
+	}
+	exists(id) {
+		const index = this.getInterceptorIndex(id);
+		return Boolean(this.fns[index]);
+	}
+	getInterceptorIndex(id) {
+		if (typeof id === "number") return this.fns[id] ? id : -1;
+		return this.fns.indexOf(id);
+	}
+	update(id, fn) {
+		const index = this.getInterceptorIndex(id);
+		if (this.fns[index]) {
+			this.fns[index] = fn;
+			return id;
+		}
+		return false;
+	}
+	use(fn) {
+		this.fns.push(fn);
+		return this.fns.length - 1;
+	}
+};
+const createInterceptors = () => ({
+	error: new Interceptors(),
+	request: new Interceptors(),
+	response: new Interceptors()
+});
+const defaultQuerySerializer = createQuerySerializer({
+	allowReserved: false,
+	array: {
+		explode: true,
+		style: "form"
+	},
+	object: {
+		explode: true,
+		style: "deepObject"
+	}
+});
+const defaultHeaders = { "Content-Type": "application/json" };
+const createConfig = (override = {}) => ({
+	...jsonBodySerializer,
+	headers: defaultHeaders,
+	parseAs: "auto",
+	querySerializer: defaultQuerySerializer,
+	...override
+});
+//#endregion
+//#region ../../packages/api-client/src/generated/client/client.gen.ts
+const createClient = (config = {}) => {
+	let _config = mergeConfigs(createConfig(), config);
+	const getConfig = () => ({ ..._config });
+	const setConfig = (config) => {
+		_config = mergeConfigs(_config, config);
+		return getConfig();
+	};
+	const interceptors = createInterceptors();
+	const beforeRequest = async (options) => {
+		const opts = {
+			..._config,
+			...options,
+			fetch: options.fetch ?? _config.fetch ?? globalThis.fetch,
+			headers: mergeHeaders(_config.headers, options.headers),
+			serializedBody: void 0
+		};
+		if (opts.security) await setAuthParams(opts);
+		if (opts.requestValidator) await opts.requestValidator(opts);
+		if (opts.body !== void 0 && opts.bodySerializer) opts.serializedBody = opts.bodySerializer(opts.body);
+		if (opts.body === void 0 || opts.serializedBody === "") opts.headers.delete("Content-Type");
+		const resolvedOpts = opts;
+		return {
+			opts: resolvedOpts,
+			url: buildUrl(resolvedOpts)
+		};
+	};
+	const request = async (options) => {
+		const throwOnError = options.throwOnError ?? _config.throwOnError;
+		const responseStyle = options.responseStyle ?? _config.responseStyle;
+		let request;
+		let response;
+		try {
+			const { opts, url } = await beforeRequest(options);
+			const requestInit = {
+				redirect: "follow",
+				...opts,
+				body: getValidRequestBody(opts)
+			};
+			request = new Request(url, requestInit);
+			for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+			const _fetch = opts.fetch;
+			response = await _fetch(request);
+			for (const fn of interceptors.response.fns) if (fn) response = await fn(response, request, opts);
+			const result = {
+				request,
+				response
+			};
+			if (response.ok) {
+				const parseAs = (opts.parseAs === "auto" ? getParseAs(response.headers.get("Content-Type")) : opts.parseAs) ?? "json";
+				if (response.status === 204 || response.headers.get("Content-Length") === "0") {
+					let emptyData;
+					switch (parseAs) {
+						case "arrayBuffer":
+						case "blob":
+						case "text":
+							emptyData = await response[parseAs]();
+							break;
+						case "formData":
+							emptyData = new FormData();
+							break;
+						case "stream":
+							emptyData = response.body;
+							break;
+						default: emptyData = {};
+					}
+					return opts.responseStyle === "data" ? emptyData : {
+						data: emptyData,
+						...result
+					};
+				}
+				let data;
+				switch (parseAs) {
+					case "arrayBuffer":
+					case "blob":
+					case "formData":
+					case "text":
+						data = await response[parseAs]();
+						break;
+					case "json": {
+						const text = await response.text();
+						data = text ? JSON.parse(text) : {};
+						break;
+					}
+					case "stream": return opts.responseStyle === "data" ? response.body : {
+						data: response.body,
+						...result
+					};
+				}
+				if (parseAs === "json") {
+					if (opts.responseValidator) await opts.responseValidator(data);
+					if (opts.responseTransformer) data = await opts.responseTransformer(data);
+				}
+				return opts.responseStyle === "data" ? data : {
+					data,
+					...result
+				};
+			}
+			const textError = await response.text();
+			let jsonError;
+			try {
+				jsonError = JSON.parse(textError);
+			} catch {}
+			throw jsonError ?? textError;
+		} catch (error) {
+			let finalError = error;
+			for (const fn of interceptors.error.fns) if (fn) finalError = await fn(finalError, response, request, options);
+			finalError = finalError || {};
+			if (throwOnError) throw finalError;
+			return responseStyle === "data" ? void 0 : {
+				error: finalError,
+				request,
+				response
+			};
+		}
+	};
+	const makeMethodFn = (method) => (options) => request({
+		...options,
+		method
+	});
+	const makeSseFn = (method) => async (options) => {
+		const { opts, url } = await beforeRequest(options);
+		return createSseClient({
+			...opts,
+			body: opts.body,
+			method,
+			onRequest: async (url, init) => {
+				let request = new Request(url, init);
+				for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+				return request;
+			},
+			serializedBody: getValidRequestBody(opts),
+			url
+		});
+	};
+	const _buildUrl = (options) => buildUrl({
+		..._config,
+		...options
+	});
+	return {
+		buildUrl: _buildUrl,
+		connect: makeMethodFn("CONNECT"),
+		delete: makeMethodFn("DELETE"),
+		get: makeMethodFn("GET"),
+		getConfig,
+		head: makeMethodFn("HEAD"),
+		interceptors,
+		options: makeMethodFn("OPTIONS"),
+		patch: makeMethodFn("PATCH"),
+		post: makeMethodFn("POST"),
+		put: makeMethodFn("PUT"),
+		request,
+		setConfig,
+		sse: {
+			connect: makeSseFn("CONNECT"),
+			delete: makeSseFn("DELETE"),
+			get: makeSseFn("GET"),
+			head: makeSseFn("HEAD"),
+			options: makeSseFn("OPTIONS"),
+			patch: makeSseFn("PATCH"),
+			post: makeSseFn("POST"),
+			put: makeSseFn("PUT"),
+			trace: makeSseFn("TRACE")
+		},
+		trace: makeMethodFn("TRACE")
+	};
+};
+//#endregion
+//#region ../../packages/api-client/src/generated/client.gen.ts
+const client = createClient(createConfig());
+//#endregion
+//#region ../../packages/api-client/src/generated/sdk.gen.ts
+const systemCompatibility = (options) => (options?.client ?? client).get({
+	url: "/api/compatibility",
+	...options
+});
+const personalWorkspace = (options) => (options?.client ?? client).get({
+	url: "/api/v1/workspace",
+	...options
+});
+const addressAllocate = (options) => (options.client ?? client).post({
+	url: "/api/v1/workspace/address",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+const documentsCreate = (options) => (options.client ?? client).post({
+	bodySerializer: null,
+	url: "/api/v1/documents",
+	...options,
+	headers: {
+		"Content-Type": "text/html",
+		...options.headers
+	}
+});
+const documentsLimits = (options) => (options?.client ?? client).get({
+	url: "/api/v1/documents/limits",
+	...options
+});
+//#endregion
+//#region ../../packages/api-client/src/address.ts
+async function updateWorkspaceAddress(baseUrl, action, options = {}) {
+	const timeout = AbortSignal.timeout(1e4);
+	const { data, response, error } = await addressAllocate({
+		baseUrl,
+		body: action,
+		credentials: options.token ? "omit" : "include",
+		headers: options.token ? { Authorization: `Bearer ${options.token}` } : void 0,
+		redirect: "error",
+		cache: "no-store",
+		throwOnError: false,
+		signal: options.signal ? AbortSignal.any([timeout, options.signal]) : timeout
+	});
+	if (!response?.ok) throw new Error("Could not update your workspace address. Try again.", { cause: error });
+	if (data?.status === "signed_out" || data?.status === "uninvited" || data?.status === "reauthentication_required") return { status: data.status };
+	const validAddress = (value) => typeof value.subdomain === "string" && /^[a-z\d](?:[a-z\d-]{0,61}[a-z\d])?$/u.test(value.subdomain) && typeof value.hostname === "string" && value.hostname === `${value.subdomain}.pageship.dev`;
+	if (data?.status === "allocated" && validAddress(data)) return data;
+	if (data?.status === "choice_required" && ["unavailable", "stale_choice"].includes(data.reason) && Array.isArray(data.choices) && data.choices.every((choice) => choice && typeof choice.choiceId === "string" && choice.choiceId.length > 0 && validAddress(choice))) return data;
+	throw new Error("Invalid workspace address response.");
+}
+//#endregion
+//#region ../../packages/api-client/src/documents.ts
+function isDocumentId(value) {
+	return typeof value === "string" && /^[A-Za-z0-9]{6}(?![\s\S])/u.test(value);
+}
+function isRevisionId(value) {
+	return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}(?![\s\S])/iu.test(value);
+}
+function requestOptions(baseUrl, options) {
+	const timeout = AbortSignal.timeout(3e4);
+	return {
+		baseUrl,
+		credentials: options.token ? "omit" : "include",
+		headers: options.token ? { Authorization: `Bearer ${options.token}` } : {},
+		signal: options.signal ? AbortSignal.any([timeout, options.signal]) : timeout,
+		redirect: "error",
+		cache: "no-store",
+		throwOnError: false
+	};
+}
+function record(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validTitle(value) {
+	return typeof value === "string" && value.length >= 1 && value.length <= 120 && value === value.trim() && !/[\x00-\x1f\x7f-\x9f\u2028\u2029]/u.test(value);
+}
+function normalizeDocument(value) {
+	if (!record(value) || typeof value.slug !== "string") return;
+	const normalized = value.title === void 0 ? {
+		...value,
+		title: value.slug
+	} : value;
+	return validDocument(normalized) ? normalized : void 0;
+}
+function validDocument(value) {
+	return record(value) && isDocumentId(value.id) && typeof value.slug === "string" && /^[a-z0-9]+(?:-[a-z0-9]+)*(?![\s\S])/u.test(value.slug) && validTitle(value.title) && typeof value.sourcePath === "string" && value.sourcePath.length <= 1024 && /^(?!\/)(?!.*(?:^|\/)\.{1,2}(?:\/|$))(?!.*\/\/)[^\x00-\x1f\x7f\\:]*\.[hH][tT][mM][lL]?(?![\s\S])/u.test(value.sourcePath) && typeof value.sourceContext === "string" && /^(?:personal|git:[a-f0-9]{64})(?![\s\S])/u.test(value.sourceContext) && (value.visibility === "private" || value.visibility === "public") && isRevisionId(value.revisionId) && typeof value.byteLength === "number" && Number.isSafeInteger(value.byteLength) && value.byteLength > 0 && typeof value.createdAt === "number" && Number.isSafeInteger(value.createdAt) && value.createdAt >= 0 && typeof value.url === "string" && new RegExp(`^https://[a-z0-9-]+\\.pageship\\.dev/d/${value.id}-${value.slug}$`, "u").test(value.url);
+}
+var DocumentRequestError = class extends Error {
+	status;
+	httpStatus;
+	constructor(status, message, httpStatus) {
+		super(message);
+		this.status = status;
+		this.httpStatus = httpStatus;
+	}
+};
+function failed(response, error) {
+	if (response && (response.status === 401 || response.status === 403)) throw new DocumentRequestError(response.status === 401 ? "signed_out" : "uninvited", response.status === 401 ? "Your installation is not authorized. Run login again." : "This account is not invited.", response.status);
+	if (response?.status === 413) throw new DocumentRequestError("upload_too_large", "HTML exceeds the server's per-file limit.", 413);
+	throw new Error("Could not complete the document request. Retry with the same idempotency key.", { cause: error });
+}
+async function getDocumentLimits(baseUrl, options = {}) {
+	const { data: received, response, error } = await documentsLimits(requestOptions(baseUrl, options));
+	if (!response?.ok) failed(response, error);
+	const data = received;
+	if (!record(data) || typeof data.maxUploadBytes !== "number" || !Number.isSafeInteger(data.maxUploadBytes) || data.maxUploadBytes < 1) throw new Error("Invalid document limits response.");
+	if (data.publicationActions !== void 0 && data.publicationActions !== null && (!Array.isArray(data.publicationActions) || !data.publicationActions.every((action) => typeof action === "string"))) throw new Error("Invalid publication capabilities response.");
+	const publicationActions = Array.isArray(data.publicationActions) ? data.publicationActions.filter((action) => action === "new" || action === "revise") : [];
+	return {
+		maxUploadBytes: data.maxUploadBytes,
+		publicationActions
+	};
+}
+async function publishDocument(baseUrl, input, options = {}) {
+	if (input.action) {
+		if (!(await getDocumentLimits(baseUrl, options)).publicationActions.includes(input.action)) throw new DocumentRequestError("publication_action_unsupported", "This server does not support explicit publication actions. Ask the operator to update the server. No HTML was uploaded.", 400);
+	}
+	const request = requestOptions(baseUrl, options);
+	const { data: received, response, error } = await documentsCreate({
+		...request,
+		headers: {
+			...request.headers,
+			"idempotency-key": input.idempotencyKey
+		},
+		body: new Blob([new Uint8Array(input.bytes)], { type: "text/html" }),
+		query: {
+			sourcePath: input.sourcePath,
+			sourceContext: input.sourceContext,
+			action: input.action,
+			documentId: input.documentId,
+			expectedRevisionId: input.expectedRevisionId
+		}
+	});
+	if (!response?.ok) failed(response, error);
+	const data = received;
+	const published = record(data) ? normalizeDocument(data.document) : void 0;
+	if (record(data) && (data.status === "published" || data.status === "revision_conflict") && published) return {
+		status: data.status,
+		document: published
+	};
+	if (record(data) && data.status === "source_collision" && Array.isArray(data.candidates)) {
+		const candidates = data.candidates.map((document) => normalizeDocument(document));
+		if (candidates.every((document) => document !== void 0)) return {
+			status: "source_collision",
+			candidates
+		};
+	}
+	if (record(data) && (data.status === "idempotency_conflict" || data.status === "address_required" || data.status === "unavailable")) return { status: data.status };
+	throw new Error("Invalid publication response. Retry with the same idempotency key.");
+}
+//#endregion
+//#region ../../packages/api-client/src/index.ts
+async function getWorkspace(baseUrl, options = {}) {
+	const timeout = AbortSignal.timeout(1e4);
+	const { data, response, error } = await personalWorkspace({
+		baseUrl,
+		credentials: options.token ? "omit" : "include",
+		headers: options.token ? { Authorization: `Bearer ${options.token}` } : void 0,
+		redirect: "error",
+		cache: "no-store",
+		signal: options.signal ? AbortSignal.any([timeout, options.signal]) : timeout,
+		throwOnError: false
+	});
+	if (!response?.ok) throw new Error("Could not load your workspace.", { cause: error });
+	if (data?.status === "signed_out" || data?.status === "uninvited") return { status: data.status };
+	if (data?.status === "admitted" && typeof data.user?.id === "string" && data.user.id.length > 0 && typeof data.user?.name === "string" && typeof data.workspace?.id === "string" && data.workspace.id.length > 0) return data;
+	throw new Error("Invalid workspace response.");
+}
+function validateCompatibility(value) {
+	if (typeof value !== "object" || value === null) throw new Error("Invalid server compatibility response.");
+	const candidate = value;
+	const major = (value) => Number.isSafeInteger(value) && Number(value) >= 0;
+	if (typeof candidate.serverVersion !== "string" || candidate.serverVersion.length === 0 || !major(candidate.currentApiMajor) || !Array.isArray(candidate.supportedApiMajors) || candidate.supportedApiMajors.length === 0 || !candidate.supportedApiMajors.every(major) || new Set(candidate.supportedApiMajors).size !== candidate.supportedApiMajors.length || !candidate.supportedApiMajors.includes(candidate.currentApiMajor) || candidate.supportedApiMajors.some((version) => version > Number(candidate.currentApiMajor))) throw new Error("Invalid server compatibility response.");
+	return candidate;
+}
+function evaluateCompatibility(server, requiredMajor = 1) {
+	const supported = server.supportedApiMajors;
+	const status = supported.includes(requiredMajor) ? "compatible" : requiredMajor < Math.min(...supported) ? "client_too_old" : requiredMajor > server.currentApiMajor ? "server_too_old" : "unsupported";
+	return {
+		status,
+		requiredApiMajor: requiredMajor,
+		server,
+		message: {
+			compatible: `Compatible with API major ${requiredMajor}.`,
+			client_too_old: `This client is too old for this server. Update the client to use a supported API major.`,
+			server_too_old: `This server is too old for this client. Ask the server operator to update the server.`,
+			unsupported: `This server does not support API major ${requiredMajor}. Ask the operator to restore this contract or use a compatible client.`
+		}[status]
+	};
+}
+async function checkCompatibility(baseUrl, options = {}) {
+	let url;
+	try {
+		url = new URL(baseUrl);
+	} catch {
+		throw new Error("Server must be an absolute HTTP(S) URL.");
+	}
+	if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw new Error("Server must be an HTTP(S) URL without credentials, query, or fragment.");
+	const timeout = AbortSignal.timeout(1e4);
+	const signal = options.signal ? AbortSignal.any([timeout, options.signal]) : timeout;
+	const { data, response, error } = await systemCompatibility({
+		baseUrl: url.href.replace(/\/$/u, ""),
+		signal,
+		throwOnError: false,
+		credentials: "omit",
+		cache: "no-store"
+	});
+	if (!response) throw error instanceof Error ? error : /* @__PURE__ */ new Error("Could not reach the server compatibility endpoint.");
+	if (!response.ok) throw new Error(`Server returned HTTP ${response.status} during compatibility discovery.`);
+	return evaluateCompatibility(validateCompatibility(data));
+}
+//#endregion
+//#region src/windows-protection.ts
+/** DPAPI binds this ciphertext to the current Windows account on this machine. */
+function windowsProtection(value, operation) {
+	const script = `$ErrorActionPreference='Stop'; [Console]::InputEncoding=[Text.Encoding]::UTF8; [Console]::OutputEncoding=[Text.Encoding]::UTF8; Add-Type -AssemblyName System.Security; $value=[Console]::In.ReadToEnd(); [Console]::Out.Write(${operation === "protect" ? "[Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Protect([Text.Encoding]::UTF8.GetBytes($value),$null,[Security.Cryptography.DataProtectionScope]::CurrentUser))" : "[Text.Encoding]::UTF8.GetString([Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String($value),$null,[Security.Cryptography.DataProtectionScope]::CurrentUser))"})`;
+	return new Promise((resolve, reject) => {
+		const executable = join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+		const child = execFile(executable, [
+			"-NoLogo",
+			"-NoProfile",
+			"-NonInteractive",
+			"-Command",
+			script
+		], {
+			encoding: "utf8",
+			windowsHide: true,
+			timeout: 1e4,
+			maxBuffer: 1048576
+		}, (error, stdout) => {
+			if (error) reject(/* @__PURE__ */ new Error("Windows protected storage failed. Use this Windows account on this machine and ensure Windows PowerShell and DPAPI are available."));
+			else resolve(stdout);
+		});
+		child.stdin?.on("error", () => {});
+		child.stdin?.end(value);
+	});
+}
+//#endregion
+//#region src/credential-store.ts
+/** Separate files bind secrets to an exact server origin, outside project directories. */
+async function credentialStore(server, readOnly = false) {
+	const windows = process.platform === "win32";
+	const directory = process.env.PAGESHIP_CONFIG_DIR ?? join((windows ? process.env.LOCALAPPDATA : process.env.XDG_CONFIG_HOME) ?? join(homedir(), ".config"), "pageship");
+	if (!isAbsolute(directory)) throw new Error("PAGESHIP_CONFIG_DIR must be an absolute private directory.");
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const info = await lstat(directory);
+	if (!info.isDirectory() || !windows && (info.uid !== process.getuid?.() || (info.mode & 63) !== 0)) throw new Error("Credential directory must be owned by you, not a symlink, and have mode 0700. Choose a private PAGESHIP_CONFIG_DIR.");
+	const name = createHash("sha256").update(server).digest("hex");
+	const path = join(directory, `${name}.json`);
+	const lock = join(directory, `${name}.lock`);
+	try {
+		if (!readOnly) await mkdir(lock, { mode: 448 });
+	} catch {
+		throw new Error(`Another authorization command may be running. Retry after it exits. If it was killed, remove ${lock} after checking no Pageship process is running.`);
+	}
+	return {
+		async read() {
+			if (windows) try {
+				if (!(await lstat(path)).isFile()) throw new Error("Credential file must not be a link.");
+			} catch (error) {
+				if (error.code !== "ENOENT") throw error;
+			}
+			let file;
+			try {
+				file = await open(path, constants.O_RDONLY | (windows ? 0 : constants.O_NOFOLLOW));
+			} catch (error) {
+				if (error.code === "ENOENT") return {};
+				throw new Error("Could not open protected credentials. Check the credential file is not a symlink.");
+			}
+			try {
+				const stat = await file.stat();
+				if (!stat.isFile() || !windows && (stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0) || stat.nlink !== 1) throw new Error("Credential file must be owned by you and have mode 0600 with no links.");
+				const raw = await file.readFile("utf8");
+				let value;
+				try {
+					value = JSON.parse(windows ? await windowsProtection(raw, "unprotect") : raw);
+				} catch {
+					throw new Error("Could not read protected credentials. Use the original operating-system account or choose a new private PAGESHIP_CONFIG_DIR and log in again.");
+				}
+				if (!value || typeof value !== "object") throw new Error("Invalid credential file. Start again with a new private PAGESHIP_CONFIG_DIR.");
+				const candidate = value;
+				if (candidate.token !== void 0 && typeof candidate.token !== "string") throw new Error("Invalid stored credential.");
+				const p = candidate.pending;
+				if (p && (typeof p.deviceCode !== "string" || typeof p.userCode !== "string" || typeof p.verificationUri !== "string" || typeof p.verificationUriComplete !== "string" || !Number.isFinite(p.expiresAt) || !Number.isFinite(p.nextPollAt) || !Number.isFinite(p.interval) || p.interval < 1)) throw new Error("Invalid stored authorization. Start again with a new private PAGESHIP_CONFIG_DIR.");
+				return candidate;
+			} finally {
+				await file.close();
+			}
+		},
+		async write(value) {
+			if (readOnly) throw new Error("Cannot update credentials through a read-only store.");
+			const temporary = join(directory, `${name}.${randomUUID()}.tmp`);
+			try {
+				const file = await open(temporary, "wx", 384);
+				try {
+					const serialized = JSON.stringify(value);
+					await file.writeFile(windows ? await windowsProtection(serialized, "protect") : serialized);
+					await file.sync();
+				} finally {
+					await file.close();
+				}
+				await rename(temporary, path);
+			} finally {
+				await rm(temporary, { force: true });
+			}
+		},
+		close: async () => {
+			if (!readOnly) await rm(lock, {
+				recursive: true,
+				force: true
+			});
+		}
+	};
+}
+//#endregion
+//#region src/authorization.ts
+function serverOrigin(value) {
+	const url = new URL(value);
+	if (url.username || url.password || url.search || url.hash || url.pathname !== "/" || !(url.protocol === "https:" || url.protocol === "http:" && [
+		"localhost",
+		"127.0.0.1",
+		"[::1]"
+	].includes(url.hostname))) throw new Error("Authorization requires an HTTPS server origin, or HTTP on localhost for local development. Do not include a path, credentials, query or fragment.");
+	return url.origin;
+}
+async function authRequest(server, path, body, signal) {
+	const response = await fetch(`${server}/api/auth${path}`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body),
+		redirect: "error",
+		credentials: "omit",
+		cache: "no-store",
+		signal: AbortSignal.any([signal, AbortSignal.timeout(1e4)])
+	});
+	if (response.status >= 500) throw new Error(`Authorization server returned HTTP ${response.status}. Retry later with login --complete if you have a pending code.`);
+	let value;
+	try {
+		value = await response.json();
+	} catch {
+		throw new Error(`Authorization server returned an unreadable response (HTTP ${response.status}). Check the server and retry.`);
+	}
+	if (!value || typeof value !== "object") throw new Error("Invalid authorization response. Check the server and retry.");
+	const data = value;
+	if (!response.ok && typeof data.error !== "string") throw new Error(`Authorization server returned HTTP ${response.status}. Retry later.`);
+	return data;
+}
+function pendingResult(pending, server) {
+	return {
+		status: "authorization_pending",
+		message: "Approve this installation in your browser, then run the completion command.",
+		verificationUri: pending.verificationUri,
+		verificationUriComplete: pending.verificationUriComplete,
+		userCode: pending.userCode,
+		expiresAt: new Date(pending.expiresAt).toISOString(),
+		retryAfterSeconds: Math.max(0, Math.ceil((pending.nextPollAt - Date.now()) / 1e3)),
+		next: {
+			command: "login",
+			args: [
+				"--server",
+				server,
+				"--complete"
+			]
+		}
+	};
+}
+async function authorize(options) {
+	const server = serverOrigin(options.server);
+	const compatibility = await checkCompatibility(server, { signal: options.signal });
+	if (compatibility.status !== "compatible") return compatibility;
+	const store = await credentialStore(server);
+	try {
+		const credentials = await store.read();
+		if (credentials.token && !options.restart && !credentials.pending) {
+			const access = await getWorkspace(server, {
+				token: credentials.token,
+				signal: options.signal
+			});
+			if (access.status === "admitted") return {
+				...access,
+				status: "authorized",
+				message: `Authorized as ${access.user.name}.`
+			};
+			if (access.status === "uninvited") return {
+				status: "uninvited",
+				message: "This account is no longer invited. Contact the server owner or use login --restart for another account."
+			};
+			delete credentials.token;
+			await store.write(credentials);
+		}
+		if (options.restart) delete credentials.pending;
+		if (!credentials.pending) {
+			if (options.complete) return {
+				status: "invalid_attempt",
+				message: "No pending authorization. Run login without --complete to start a new attempt."
+			};
+			const data = await authRequest(server, "/device/code", { client_id: "pageship-cli" }, options.signal);
+			if (typeof data.device_code !== "string" || typeof data.user_code !== "string" || typeof data.verification_uri !== "string" || typeof data.verification_uri_complete !== "string" || typeof data.expires_in !== "number" || data.expires_in <= 0 || typeof data.interval !== "number" || data.interval < 1) throw new Error("Invalid device authorization response. Check the server and retry.");
+			for (const uri of [data.verification_uri, data.verification_uri_complete]) {
+				const parsed = new URL(uri);
+				if (!["https:", "http:"].includes(parsed.protocol) || parsed.username || parsed.password || parsed.protocol === "http:" && new URL(server).protocol !== "http:") throw new Error("Invalid browser verification URL.");
+			}
+			credentials.pending = {
+				deviceCode: data.device_code,
+				userCode: data.user_code,
+				verificationUri: data.verification_uri,
+				verificationUriComplete: data.verification_uri_complete,
+				expiresAt: Date.now() + data.expires_in * 1e3,
+				interval: data.interval,
+				nextPollAt: 0
+			};
+			await store.write(credentials);
+		}
+		const pending = credentials.pending;
+		if (options.interactive) options.progress(`Open ${pending.verificationUriComplete}\nCheck code ${pending.userCode}. Only approve an installation you started.\nWaiting for approval. Press Ctrl+C to stop; you can resume with login --complete.`);
+		do {
+			if (options.signal.aborted) return {
+				status: "interrupted",
+				message: "Authorization interrupted. Run login --complete to resume, or login --restart for a new code."
+			};
+			if (Date.now() >= pending.expiresAt) {
+				delete credentials.pending;
+				await store.write(credentials);
+				return {
+					status: "expired",
+					message: "The authorization code expired. Run login again for a new code."
+				};
+			}
+			if (!options.interactive && (!options.complete || Date.now() < pending.nextPollAt)) return pendingResult(pending, server);
+			if (Date.now() < pending.nextPollAt) await setTimeout$1(pending.nextPollAt - Date.now(), void 0, { signal: options.signal });
+			pending.nextPollAt = Date.now() + pending.interval * 1e3;
+			await store.write(credentials);
+			const data = await authRequest(server, "/device/token", {
+				client_id: "pageship-cli",
+				device_code: pending.deviceCode,
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+			}, options.signal);
+			if (typeof data.access_token === "string" && data.access_token.length > 0) {
+				credentials.token = data.access_token;
+				delete credentials.pending;
+				await store.write(credentials);
+				const access = await getWorkspace(server, {
+					token: credentials.token,
+					signal: options.signal
+				});
+				if (access.status !== "admitted") return {
+					status: access.status,
+					message: "Authorization finished, but workspace access is unavailable. Check your admission with the server owner."
+				};
+				return {
+					...access,
+					status: "authorized",
+					message: `Authorized as ${access.user.name}. Your credential is stored privately for this server.`
+				};
+			}
+			if (data.error === "slow_down") {
+				pending.interval += 5;
+				pending.nextPollAt = Date.now() + pending.interval * 1e3;
+				await store.write(credentials);
+			} else if (data.error !== "authorization_pending") {
+				delete credentials.pending;
+				await store.write(credentials);
+				const status = data.error === "access_denied" ? "denied" : data.error === "expired_token" ? "expired" : "invalid_attempt";
+				return {
+					status,
+					message: `Authorization ${status.replaceAll("_", " ")}. Run login again for a new code.`
+				};
+			}
+			if (!options.interactive) return pendingResult(pending, server);
+		} while (!options.signal.aborted);
+		return {
+			status: "interrupted",
+			message: "Authorization interrupted. Run login --complete to resume."
+		};
+	} catch (error) {
+		if (options.signal.aborted) return {
+			status: "interrupted",
+			message: "Authorization interrupted. Run login --complete to resume or login --restart to start again."
+		};
+		throw error;
+	} finally {
+		await store.close();
+	}
+}
+async function identify(serverValue, signal) {
+	const server = serverOrigin(serverValue);
+	const compatibility = await checkCompatibility(server, { signal });
+	if (compatibility.status !== "compatible") return compatibility;
+	const store = await credentialStore(server, true);
+	try {
+		const { token } = await store.read();
+		if (!token) return {
+			status: "signed_out",
+			message: "This installation is not authorized. Run login --server with this server to begin."
+		};
+		const access = await getWorkspace(server, {
+			token,
+			signal
+		});
+		return {
+			...access,
+			message: access.status === "admitted" ? `Signed in as ${access.user.name}. Personal workspace: ${access.workspace.id}${access.installation ? `\nCLI installation: ${access.installation.id}` : ""}` : access.status === "uninvited" ? "This account is not invited. Contact the server owner." : "Your credential was revoked, expired or is invalid. Run login --server with this server to sign in again."
+		};
+	} finally {
+		await store.close();
+	}
+}
+//#endregion
+//#region src/publish.ts
+const execute = promisify(execFile);
+const contained = (root, path) => {
+	const part = relative(root, path);
+	return part !== ".." && !part.startsWith(`..${sep}`) && !isAbsolute(part);
+};
+async function sourceMetadata(file) {
+	const path = await realpath(resolve(file));
+	const cwd = await realpath(process.cwd());
+	let root = contained(cwd, path) ? cwd : dirname(path);
+	let sourceContext = "personal";
+	try {
+		const git = async (...args) => (await execute("git", [
+			"-C",
+			dirname(path),
+			...args
+		], {
+			timeout: 5e3,
+			maxBuffer: 16384
+		})).stdout.trim();
+		const gitRoot = await realpath(await git("rev-parse", "--show-toplevel"));
+		if (contained(gitRoot, path)) {
+			root = gitRoot;
+			const remote = await git("remote", "get-url", "origin").catch(() => "");
+			const url = remote.includes("://") ? new URL(remote) : /^[^/]+@[^:]+:.+/u.test(remote) ? new URL(`ssh://${remote.replace(":", "/")}`) : void 0;
+			if (url && [
+				"https:",
+				"http:",
+				"ssh:",
+				"git:"
+			].includes(url.protocol) && url.hostname) {
+				const repository = `${url.hostname.toLowerCase()}${url.port ? `:${url.port}` : ""}/${url.pathname.replace(/^\/+|\/+$/gu, "").replace(/\.git$/u, "")}`;
+				sourceContext = `git:${createHash("sha256").update(repository).digest("hex")}`;
+			}
+		}
+	} catch {}
+	const sourcePath = relative(root, path).split(sep).join("/");
+	if (!/\.html?$/iu.test(sourcePath)) throw new Error("Publish one .html or .htm file.");
+	return {
+		path,
+		sourcePath,
+		sourceContext
+	};
+}
+async function fileBytes(path, limit) {
+	const file = await open(path, "r");
+	try {
+		const stat = await file.stat();
+		if (!stat.isFile()) throw new Error("Publish one regular HTML file.");
+		if (stat.size > limit) return;
+		if (stat.size === 0) throw new Error("The HTML file is empty.");
+		const chunks = [];
+		let length = 0;
+		while (length <= limit) {
+			const chunk = Buffer.alloc(Math.min(65536, limit + 1 - length));
+			const { bytesRead } = await file.read(chunk);
+			if (!bytesRead) break;
+			chunks.push(chunk.subarray(0, bytesRead));
+			length += bytesRead;
+		}
+		return length > limit ? void 0 : Buffer.concat(chunks);
+	} finally {
+		await file.close();
+	}
+}
+function invalidFile(error) {
+	return {
+		status: "invalid_file",
+		message: `Could not read the HTML file. ${error instanceof Error ? error.message : "Check the file and try again."}`
+	};
+}
+function actionArgs(action) {
+	return action.action === "new" ? ["--new"] : action.action === "revise" ? [
+		"--revise",
+		action.documentId,
+		"--expected-revision",
+		action.expectedRevisionId
+	] : [];
+}
+function resolutions(file, server, candidates) {
+	const command = "publish";
+	const args = [
+		file,
+		"--server",
+		server
+	];
+	return {
+		new: {
+			command,
+			args: [...args, "--new"]
+		},
+		revise: candidates.map((candidate) => ({
+			documentId: candidate.id,
+			url: candidate.url,
+			command,
+			args: [...args, ...actionArgs({
+				action: "revise",
+				documentId: candidate.id,
+				expectedRevisionId: candidate.revisionId
+			})]
+		}))
+	};
+}
+async function choosePublication(candidates, signal) {
+	for (;;) {
+		console.log("This source path matches published documents:");
+		candidates.forEach((candidate, index) => console.log(`${index + 1}. ${candidate.sourcePath} (${candidate.id}) ${candidate.url}`));
+		const input = createInterface({
+			input: process.stdin,
+			output: process.stdout
+		});
+		let selection;
+		try {
+			selection = (await input.question("o <number> to open, r <number> to revise, n for a separate document, or q to cancel: ", { signal })).trim();
+		} finally {
+			input.close();
+		}
+		if (selection === "q") return;
+		if (selection === "n") return { action: "new" };
+		const match = /^([or]) ([1-9][0-9]*)$/u.exec(selection);
+		const candidate = match ? candidates[Number(match[2]) - 1] : void 0;
+		if (!candidate) continue;
+		if (match[1] === "r") return {
+			action: "revise",
+			documentId: candidate.id,
+			expectedRevisionId: candidate.revisionId
+		};
+		try {
+			const [program, args] = process.platform === "darwin" ? ["open", [candidate.url]] : process.platform === "win32" ? ["rundll32.exe", ["url.dll,FileProtocolHandler", candidate.url]] : ["xdg-open", [candidate.url]];
+			await execute(program, [...args], {
+				timeout: 1e4,
+				signal
+			});
+			console.log(`Opened ${candidate.url}. No document changed.`);
+		} catch {
+			if (signal.aborted) throw new Error("Inspection interrupted.");
+			console.log(`Could not open the browser. Open ${candidate.url} to inspect it. No document changed.`);
+		}
+	}
+}
+async function publish(options) {
+	if (options.newDocument && (options.revise || options.expectedRevision) || Boolean(options.revise) !== Boolean(options.expectedRevision)) return {
+		status: "invalid_action",
+		message: "Use --new alone, or --revise <documentId> together with --expected-revision <revisionId>."
+	};
+	let action = options.newDocument ? { action: "new" } : options.revise && options.expectedRevision ? {
+		action: "revise",
+		documentId: options.revise,
+		expectedRevisionId: options.expectedRevision
+	} : {};
+	const server = serverOrigin(options.server);
+	const idempotencyKey = options.idempotencyKey ?? randomUUID();
+	let source;
+	try {
+		source = await sourceMetadata(options.file);
+	} catch (error) {
+		return invalidFile(error);
+	}
+	const compatibility = await checkCompatibility(server, { signal: options.signal });
+	if (compatibility.status !== "compatible") return compatibility;
+	const store = await credentialStore(server, true);
+	try {
+		const { token } = await store.read();
+		if (!token) return {
+			status: "signed_out",
+			message: "This installation is not authorized. Run login first."
+		};
+		const request = {
+			token,
+			signal: options.signal
+		};
+		const { maxUploadBytes } = await getDocumentLimits(server, request);
+		let bytes;
+		try {
+			bytes = await fileBytes(source.path, maxUploadBytes);
+		} catch (error) {
+			return invalidFile(error);
+		}
+		if (!bytes) return {
+			status: "upload_too_large",
+			maxUploadBytes,
+			message: `The HTML file exceeds the ${maxUploadBytes}-byte limit. No HTML was uploaded.`
+		};
+		let address = await updateWorkspaceAddress(server, options.addressChoice ? {
+			action: "select",
+			choiceId: options.addressChoice
+		} : { action: options.refreshAddresses ? "refresh" : "allocate" }, request);
+		while (address.status === "choice_required" && options.interactive) {
+			console.log("Choose your workspace address:");
+			address.choices.forEach((choice, index) => console.log(`${index + 1}. ${choice.hostname}`));
+			const input = createInterface({
+				input: process.stdin,
+				output: process.stdout
+			});
+			let selection;
+			try {
+				selection = (await input.question("Number, r to refresh, or q to cancel: ", { signal: options.signal })).trim();
+			} finally {
+				input.close();
+			}
+			if (selection === "q") return {
+				status: "cancelled",
+				message: "Publication cancelled."
+			};
+			const choice = address.choices[Number(selection) - 1];
+			if (selection !== "r" && !choice) continue;
+			address = await updateWorkspaceAddress(server, selection === "r" ? { action: "refresh" } : {
+				action: "select",
+				choiceId: choice.choiceId
+			}, request);
+		}
+		if (address.status === "choice_required") return {
+			...address,
+			message: `Choose a generated workspace address and repeat publish with --address-choice <choiceId>, or --refresh-addresses.\n${address.choices.map((choice) => `${choice.hostname}: ${choice.choiceId}`).join("\n")}`,
+			next: {
+				command: "publish",
+				args: [
+					options.file,
+					"--server",
+					server,
+					"--address-choice",
+					"<choiceId>"
+				]
+			}
+		};
+		if (address.status !== "allocated") return {
+			...address,
+			message: "Workspace address is unavailable. Sign in again or check admission."
+		};
+		const send = () => publishDocument(server, {
+			bytes,
+			sourcePath: source.sourcePath,
+			sourceContext: source.sourceContext,
+			idempotencyKey,
+			...action
+		}, request);
+		let result = await send();
+		if (result.status === "source_collision" && options.interactive) {
+			const selected = await choosePublication(result.candidates, options.signal);
+			if (!selected) return {
+				status: "cancelled",
+				message: "Publication cancelled. No document changed."
+			};
+			action = selected;
+			result = await send();
+		}
+		const message = result.status === "published" ? `Published ${result.document.visibility === "private" ? "privately" : "publicly"}: ${result.document.url}` : result.status === "source_collision" ? `Source path already published. No document changed.\n${result.candidates.map((candidate) => candidate.url).join("\n")}\nUse --new for a separate document, or --revise <documentId> --expected-revision <revisionId> from a candidate. Use --json for complete follow-up arguments.` : result.status === "revision_conflict" ? `The selected document changed. No revision was published. Inspect ${result.document.url} and select its current revision before trying again.` : result.status === "idempotency_conflict" ? "That idempotency key belongs to different content, source metadata or publication action. Reuse the original input or choose a new key." : result.status === "unavailable" ? "The selected document is unavailable for this source path. Run publish without action flags to find current candidates." : "Allocate your workspace address before publishing.";
+		return {
+			...result,
+			idempotencyKey,
+			message,
+			...result.status === "source_collision" ? { resolutions: resolutions(options.file, server, result.candidates) } : {},
+			...result.status === "revision_conflict" ? { resolutions: resolutions(options.file, server, [result.document]) } : {}
+		};
+	} catch (error) {
+		if (options.signal.aborted) return {
+			status: "interrupted",
+			idempotencyKey,
+			message: `Publication interrupted. Retry with --idempotency-key ${idempotencyKey} ${actionArgs(action).join(" ")}.`,
+			next: {
+				command: "publish",
+				args: [
+					options.file,
+					"--server",
+					server,
+					"--idempotency-key",
+					idempotencyKey,
+					...actionArgs(action)
+				]
+			}
+		};
+		if (error instanceof DocumentRequestError) return {
+			status: error.status,
+			message: error.message,
+			idempotencyKey
+		};
+		return {
+			status: "request_failed",
+			idempotencyKey,
+			message: `Publication did not finish. Retry with --idempotency-key ${idempotencyKey} ${actionArgs(action).join(" ")}. ${error instanceof Error ? error.message : "Check the server and file."}`,
+			next: {
+				command: "publish",
+				args: [
+					options.file,
+					"--server",
+					server,
+					"--idempotency-key",
+					idempotencyKey,
+					...actionArgs(action)
+				]
+			}
+		};
+	} finally {
+		await store.close();
+	}
+}
+//#endregion
 //#region package.json
-var version = "0.0.1";
+var version = "0.1.0";
 //#endregion
 //#region src/cli.ts
-const command = Command.make("pageship").pipe(Command.withDescription("Pageship is a planned HTML publishing service.\n\nEarly development: this CLI currently provides help and version information only. Hosting, authentication, and publishing are not implemented."));
 const args = process.argv.slice(2);
-Command.runWith(command, { version })(args.length === 0 ? ["--help"] : args).pipe(Effect.provide(NodeServices.layer), NodeRuntime.runMain);
+const separator = args.indexOf("--");
+const flagArgs = args.slice(0, separator === -1 ? void 0 : separator);
+const parseBoolean = Schema.decodeUnknownOption(Config.Boolean);
+const booleanValue = (value) => Option.getOrUndefined(parseBoolean(value));
+const json = flagArgs.some((arg, index) => arg === "--json" ? booleanValue(flagArgs[index + 1]) !== false : arg.startsWith("--json=") && booleanValue(arg.slice(7)) !== false);
+const jsonFlag = GlobalFlag.setting("json")({ flag: Flag.boolean("json").pipe(Flag.withDefault(false), Flag.withDescription("Emit one JSON result, including errors.")) });
+let outcome;
+const plainFormatter = CliOutput.defaultFormatter({ colors: false });
+const jsonFormatter = {
+	formatCliError: plainFormatter.formatCliError,
+	formatError: plainFormatter.formatError,
+	formatErrors: plainFormatter.formatErrors,
+	formatHelpDoc: (doc) => {
+		outcome = {
+			ok: true,
+			command: "help",
+			usage: doc.usage,
+			description: doc.description,
+			help: plainFormatter.formatHelpDoc(doc)
+		};
+		return "";
+	},
+	formatVersion: (name, version) => {
+		outcome = {
+			ok: true,
+			command: "version",
+			name,
+			version
+		};
+		return "";
+	}
+};
+const status = Command.make("status", { server: Flag.string("server").pipe(Flag.withDescription("Pageship server HTTP(S) base URL, for example http://localhost:8787.")) }, ({ server }) => Effect.gen(function* () {
+	const result = yield* Effect.tryPromise({
+		try: () => checkCompatibility(server),
+		catch: (error) => error instanceof Error ? error : new Error(String(error))
+	});
+	outcome = {
+		ok: result.status === "compatible",
+		command: "status",
+		...result
+	};
+	process.exitCode = result.status === "compatible" ? 0 : 2;
+	if (!json) yield* Console.log(`${result.message}\nServer ${result.server.serverVersion}; current API major ${result.server.currentApiMajor}; supported API majors: ${result.server.supportedApiMajors.join(", ")}.\nThis CLI requires API major ${result.requiredApiMajor}.`);
+})).pipe(Command.withDescription("Check whether this CLI can use a Pageship server."));
+const serverFlag = Flag.string("server").pipe(Flag.withDescription("Pageship HTTPS origin, or localhost HTTP for development."));
+const login = Command.make("login", {
+	server: serverFlag,
+	complete: Flag.boolean("complete").pipe(Flag.withDefault(false), Flag.withDescription("Check a pending authorization once, without waiting.")),
+	restart: Flag.boolean("restart").pipe(Flag.withDefault(false), Flag.withDescription("Start a new authorization code."))
+}, ({ server, complete, restart }) => authCommand("login", (signal) => authorize({
+	server,
+	complete,
+	restart,
+	interactive: !json && Boolean(process.stdin.isTTY && process.stdout.isTTY) && !complete,
+	progress: (message) => console.log(message),
+	signal
+}))).pipe(Command.withDescription("Authorize this installation through a browser."));
+const whoami = Command.make("whoami", { server: serverFlag }, ({ server }) => authCommand("whoami", (signal) => identify(server, signal))).pipe(Command.withDescription("Identify your personal workspace using the stored credential."));
+const publishCommand = Command.make("publish", {
+	file: Argument.string("file"),
+	server: serverFlag,
+	idempotencyKey: Flag.string("idempotency-key").pipe(Flag.filter((value) => /^[A-Za-z0-9_-]{8,128}$/u.test(value), () => "Use an 8-128 character idempotency key containing letters, digits, underscores or hyphens."), Flag.optional),
+	newDocument: Flag.boolean("new").pipe(Flag.withDefault(false), Flag.withDescription("Explicitly create a separate private document, even when the source matches.")),
+	revise: Flag.string("revise").pipe(Flag.filter((value) => isDocumentId(value), () => "Use the six-character candidate document ID."), Flag.optional),
+	expectedRevision: Flag.string("expected-revision").pipe(Flag.filter((value) => isRevisionId(value), () => "Use the candidate's current revision UUID."), Flag.optional),
+	addressChoice: Flag.string("address-choice").pipe(Flag.optional),
+	refreshAddresses: Flag.boolean("refresh-addresses").pipe(Flag.withDefault(false))
+}, ({ file, server, idempotencyKey, addressChoice, refreshAddresses, newDocument, revise, expectedRevision }) => authCommand("publish", (signal) => publish({
+	file,
+	server,
+	newDocument,
+	revise: Option.getOrUndefined(revise),
+	expectedRevision: Option.getOrUndefined(expectedRevision),
+	idempotencyKey: Option.getOrUndefined(idempotencyKey),
+	addressChoice: Option.getOrUndefined(addressChoice),
+	refreshAddresses,
+	interactive: !json && Boolean(process.stdin.isTTY && process.stdout.isTTY),
+	signal
+}))).pipe(Command.withDescription("Publish HTML, resolve source matches, or revise a selected document."));
+function authCommand(name, operation) {
+	return Effect.tryPromise({
+		try: async () => {
+			const controller = new AbortController();
+			const interrupt = () => controller.abort();
+			process.once("SIGINT", interrupt);
+			process.once("SIGTERM", interrupt);
+			try {
+				const result = await operation(controller.signal).catch((error) => {
+					if (!controller.signal.aborted) throw error;
+					return {
+						status: "interrupted",
+						message: "Operation interrupted. Run the command again to retry; use login --complete to resume a pending authorization."
+					};
+				});
+				const ok = [
+					"authorized",
+					"admitted",
+					"published"
+				].includes(result.status);
+				outcome = {
+					ok,
+					command: name,
+					...result
+				};
+				process.exitCode = ok ? 0 : result.status === "interrupted" ? 130 : [
+					"request_failed",
+					"invalid_file",
+					"invalid_action"
+				].includes(result.status) ? 1 : 2;
+				if (!json) {
+					console.log(result.message);
+					const pending = result;
+					if (typeof pending.verificationUriComplete === "string" && typeof pending.userCode === "string") console.log(`Open ${pending.verificationUriComplete}\nCheck code ${pending.userCode}.\nThen run: pageship login --server ${JSON.stringify(pending.next && pending.next.args[1])} --complete`);
+				}
+			} finally {
+				process.removeListener("SIGINT", interrupt);
+				process.removeListener("SIGTERM", interrupt);
+			}
+		},
+		catch: (error) => error instanceof Error ? error : new Error(String(error))
+	});
+}
+const command = Command.make("pageship").pipe(Command.withDescription("Pageship publishes private HTML documents.\n\nEarly development: check server API compatibility with the status command. Authorize this installation with login, then publish one HTML file with publish."), Command.withSubcommands([
+	status,
+	login,
+	whoami,
+	publishCommand
+]), Command.withGlobalFlags([jsonFlag]));
+const effectiveArgs = args.every((arg, index) => arg === "--json" || arg.startsWith("--json=") && booleanValue(arg.slice(7)) !== void 0 || index > 0 && args[index - 1] === "--json" && booleanValue(arg) !== void 0) ? [...args, "--help"] : args;
+const program = Command.runWith(command, {
+	version,
+	renderErrors: !json
+})(effectiveArgs).pipe(Effect.catch((error) => Effect.sync(() => {
+	process.exitCode = 1;
+	const usage = CliError.isCliError(error);
+	const message = usage && error._tag === "ShowHelp" ? error.errors.map((entry) => entry.message).join("\n") : error.message;
+	outcome = {
+		ok: false,
+		error: {
+			code: usage ? "usage_error" : "request_failed",
+			message
+		}
+	};
+	if (!json && !usage) console.error(`${flagArgs.includes("status") ? "Could not check server compatibility" : "Pageship request failed"}: ${message}`);
+	if (!json && usage && error._tag !== "ShowHelp" && error._tag !== "UserError") console.error(message);
+})), Effect.catchCause((cause) => Effect.sync(() => {
+	process.exitCode = 1;
+	const message = Cause.pretty(cause);
+	outcome = {
+		ok: false,
+		error: {
+			code: "internal_error",
+			message
+		}
+	};
+	if (!json) console.error(message);
+})), Effect.provide(NodeServices.layer));
+await Effect.runPromise(json ? program.pipe(Effect.provideService(CliOutput.Formatter, jsonFormatter), Effect.provideService(Console.Console, {
+	...console,
+	log: () => {},
+	error: () => {}
+}), Effect.provide(CliConfig.layer({ builtIns: [GlobalFlag.Help, GlobalFlag.Version] }))) : program);
+if (json) console.log(JSON.stringify(outcome));
 //#endregion
 export {};