pageship 0.1.0 → 0.2.0

package/dist/cli.mjs

@@ -1,16 +1,17 @@
 #!/usr/bin/env node
 import { execFile } from "node:child_process";
-import { createHash, randomUUID } from "node:crypto";
-import { lstat, mkdir, open, realpath, rename, rm } from "node:fs/promises";
+import { access, cp, lstat, mkdir, open, readFile, readdir, readlink, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { promisify } from "node:util";
+import { createHash, randomUUID } from "node:crypto";
 import { constants } from "node:fs";
 import { homedir } from "node:os";
-import { setTimeout as setTimeout$1 } from "node:timers/promises";
-import { NodeServices } from "@effect/platform-node";
 import { Cause, Config, Console, Effect, Option, Schema } from "effect";
-import { Argument, CliConfig, CliError, CliOutput, Command, Flag, GlobalFlag } from "effect/unstable/cli";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { Argument, CliConfig, CliOutput, Command, Flag, GlobalFlag } from "effect/unstable/cli";
+import { fileURLToPath } from "node:url";
 //#region ../../packages/api-client/src/generated/core/bodySerializer.gen.ts
 const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
 Object.entries({
@@ -633,6 +634,10 @@ const addressAllocate = (options) => (options.client ?? client).post({
 		...options.headers
 	}
 });
+const documentsList = (options) => (options?.client ?? client).get({
+	url: "/api/v1/documents",
+	...options
+});
 const documentsCreate = (options) => (options.client ?? client).post({
 	bodySerializer: null,
 	url: "/api/v1/documents",
@@ -646,8 +651,52 @@ const documentsLimits = (options) => (options?.client ?? client).get({
 	url: "/api/v1/documents/limits",
 	...options
 });
+const documentsGet = (options) => (options.client ?? client).get({
+	url: "/api/v1/documents/{id}",
+	...options
+});
+const documentsContent = (options) => (options.client ?? client).get({
+	url: "/api/v1/documents/{id}/content",
+	...options
+});
+const documentsListRevisions = (options) => (options.client ?? client).get({
+	url: "/api/v1/documents/{id}/revisions",
+	...options
+});
+const documentsRevisionContent = (options) => (options.client ?? client).get({
+	url: "/api/v1/documents/{id}/revisions/{revisionId}/content",
+	...options
+});
+const documentsRestore = (options) => (options.client ?? client).post({
+	url: "/api/v1/documents/{id}/restore",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+const documentsUpdateVisibility = (options) => (options.client ?? client).patch({
+	url: "/api/v1/documents/{id}/visibility",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+//#endregion
+//#region ../../packages/api-client/src/generated/workspace-domain.gen.ts
+/** Every workspace address and document URL is a subdomain of this domain. */
+const workspaceDomain = "pageship.dev";
+/** The workspace domain escaped for use inside a regular expression. */
+const workspaceDomainPattern = workspaceDomain.replaceAll(".", "\\.");
+/** The hostname of the workspace address with this subdomain label. */
+const workspaceHostname = (subdomain) => `${subdomain}.${workspaceDomain}`;
+/** A valid workspace label: the subdomain of one workspace address, as a DNS label. */
+const workspaceLabelPattern = /^[a-z\d](?:[a-z\d-]{0,61}[a-z\d])?$/u;
 //#endregion
 //#region ../../packages/api-client/src/address.ts
+/** Generated TypeScript does not validate remote JSON, so check an address before showing it. */
+const isWorkspaceAddress = (value) => typeof value.subdomain === "string" && workspaceLabelPattern.test(value.subdomain) && typeof value.hostname === "string" && value.hostname === workspaceHostname(value.subdomain);
 async function updateWorkspaceAddress(baseUrl, action, options = {}) {
 	const timeout = AbortSignal.timeout(1e4);
 	const { data, response, error } = await addressAllocate({
@@ -662,9 +711,8 @@ async function updateWorkspaceAddress(baseUrl, action, options = {}) {
 	});
 	if (!response?.ok) throw new Error("Could not update your workspace address. Try again.", { cause: error });
 	if (data?.status === "signed_out" || data?.status === "uninvited" || data?.status === "reauthentication_required") return { status: data.status };
-	const validAddress = (value) => typeof value.subdomain === "string" && /^[a-z\d](?:[a-z\d-]{0,61}[a-z\d])?$/u.test(value.subdomain) && typeof value.hostname === "string" && value.hostname === `${value.subdomain}.pageship.dev`;
-	if (data?.status === "allocated" && validAddress(data)) return data;
-	if (data?.status === "choice_required" && ["unavailable", "stale_choice"].includes(data.reason) && Array.isArray(data.choices) && data.choices.every((choice) => choice && typeof choice.choiceId === "string" && choice.choiceId.length > 0 && validAddress(choice))) return data;
+	if (data?.status === "allocated" && isWorkspaceAddress(data)) return data;
+	if (data?.status === "choice_required" && ["unavailable", "stale_choice"].includes(data.reason) && Array.isArray(data.choices) && data.choices.every((choice) => choice && typeof choice.choiceId === "string" && choice.choiceId.length > 0 && isWorkspaceAddress(choice))) return data;
 	throw new Error("Invalid workspace address response.");
 }
 //#endregion
@@ -675,6 +723,13 @@ function isDocumentId(value) {
 function isRevisionId(value) {
 	return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}(?![\s\S])/iu.test(value);
 }
+/** Same readable normalized Git remote grammar as the Effect contract. */
+function isProject(value) {
+	return typeof value === "string" && value.length <= 512 && /^[a-z0-9._-]+(?::[0-9]{1,5})?(?:\/(?!\.{1,2}(?:\/|$))[^\x00-\x20\x7f/\\?#]+)+(?![\s\S])/u.test(value);
+}
+function isCliVersion(value) {
+	return typeof value === "string" && /^[0-9A-Za-z][0-9A-Za-z.+-]{0,63}(?![\s\S])/u.test(value);
+}
 function requestOptions(baseUrl, options) {
 	const timeout = AbortSignal.timeout(3e4);
 	return {
@@ -702,7 +757,10 @@ function normalizeDocument(value) {
 	return validDocument(normalized) ? normalized : void 0;
 }
 function validDocument(value) {
-	return record(value) && isDocumentId(value.id) && typeof value.slug === "string" && /^[a-z0-9]+(?:-[a-z0-9]+)*(?![\s\S])/u.test(value.slug) && validTitle(value.title) && typeof value.sourcePath === "string" && value.sourcePath.length <= 1024 && /^(?!\/)(?!.*(?:^|\/)\.{1,2}(?:\/|$))(?!.*\/\/)[^\x00-\x1f\x7f\\:]*\.[hH][tT][mM][lL]?(?![\s\S])/u.test(value.sourcePath) && typeof value.sourceContext === "string" && /^(?:personal|git:[a-f0-9]{64})(?![\s\S])/u.test(value.sourceContext) && (value.visibility === "private" || value.visibility === "public") && isRevisionId(value.revisionId) && typeof value.byteLength === "number" && Number.isSafeInteger(value.byteLength) && value.byteLength > 0 && typeof value.createdAt === "number" && Number.isSafeInteger(value.createdAt) && value.createdAt >= 0 && typeof value.url === "string" && new RegExp(`^https://[a-z0-9-]+\\.pageship\\.dev/d/${value.id}-${value.slug}$`, "u").test(value.url);
+	return record(value) && isDocumentId(value.id) && typeof value.slug === "string" && /^[a-z0-9]+(?:-[a-z0-9]+)*(?![\s\S])/u.test(value.slug) && validTitle(value.title) && typeof value.sourcePath === "string" && value.sourcePath.length <= 1024 && /^(?!\/)(?!.*(?:^|\/)\.{1,2}(?:\/|$))(?!.*\/\/)[^\x00-\x1f\x7f\\:]*\.[hH][tT][mM][lL]?(?![\s\S])/u.test(value.sourcePath) && (value.project === null || isProject(value.project)) && (value.visibility === "private" || value.visibility === "public") && isRevisionId(value.revisionId) && typeof value.byteLength === "number" && Number.isSafeInteger(value.byteLength) && value.byteLength > 0 && typeof value.createdAt === "number" && Number.isSafeInteger(value.createdAt) && value.createdAt >= 0 && typeof value.publishedAt === "number" && Number.isSafeInteger(value.publishedAt) && value.publishedAt >= 0 && typeof value.url === "string" && new RegExp(`^https://[a-z0-9-]+\\.${workspaceDomainPattern}/d/${value.id}-${value.slug}$`, "u").test(value.url);
+}
+function validRevision(value, documentId) {
+	return record(value) && isRevisionId(value.id) && typeof value.createdAt === "number" && Number.isSafeInteger(value.createdAt) && value.createdAt >= 0 && typeof value.byteLength === "number" && Number.isSafeInteger(value.byteLength) && value.byteLength > 0 && typeof value.isCurrent === "boolean" && (value.cliVersion === null || isCliVersion(value.cliVersion)) && typeof value.url === "string" && new RegExp(`^https://[a-z0-9-]+\\.${workspaceDomainPattern}/d/${documentId}-[a-z0-9]+(?:-[a-z0-9]+)*/revisions/${value.id}$`, "u").test(value.url);
 }
 var DocumentRequestError = class extends Error {
 	status;
@@ -716,7 +774,7 @@ var DocumentRequestError = class extends Error {
 function failed(response, error) {
 	if (response && (response.status === 401 || response.status === 403)) throw new DocumentRequestError(response.status === 401 ? "signed_out" : "uninvited", response.status === 401 ? "Your installation is not authorized. Run login again." : "This account is not invited.", response.status);
 	if (response?.status === 413) throw new DocumentRequestError("upload_too_large", "HTML exceeds the server's per-file limit.", 413);
-	throw new Error("Could not complete the document request. Retry with the same idempotency key.", { cause: error });
+	throw new Error("Could not complete the document request.", { cause: error });
 }
 async function getDocumentLimits(baseUrl, options = {}) {
 	const { data: received, response, error } = await documentsLimits(requestOptions(baseUrl, options));
@@ -730,6 +788,127 @@ async function getDocumentLimits(baseUrl, options = {}) {
 		publicationActions
 	};
 }
+async function getDocuments(baseUrl, options = {}) {
+	const { data: received, response, error } = await documentsList({
+		...requestOptions(baseUrl, options),
+		query: { cursor: options.cursor }
+	});
+	if (!response?.ok) failed(response, error);
+	const data = received;
+	const documents = record(data) && Array.isArray(data.documents) ? data.documents.map((document) => normalizeDocument(document)) : [];
+	if (!record(data) || data.status !== "listed" || !Array.isArray(data.documents) || !documents.every((document) => document !== void 0) || !(data.nextCursor === null || typeof data.nextCursor === "string" && /^[A-Za-z0-9]{6}(?![\s\S])/u.test(data.nextCursor))) throw new Error("Invalid document listing response.");
+	return {
+		status: "listed",
+		documents,
+		nextCursor: data.nextCursor
+	};
+}
+/** Current metadata of one owned document. Another owner's or a deleted one is `unavailable`. */
+async function getDocument(baseUrl, id, options = {}) {
+	const { data: received, response, error } = await documentsGet({
+		...requestOptions(baseUrl, options),
+		path: { id }
+	});
+	if (!response?.ok) {
+		if (response?.status === 404) throw new DocumentRequestError("unavailable", "Document unavailable.", 404);
+		failed(response, error);
+	}
+	const data = received;
+	const document = record(data) ? normalizeDocument(data.document) : void 0;
+	if (record(data) && data.status === "found" && document?.id === id) return document;
+	throw new Error("Invalid document response.");
+}
+async function getDocumentRevisions(baseUrl, id, options = {}) {
+	const { data: received, response, error } = await documentsListRevisions({
+		...requestOptions(baseUrl, options),
+		path: { id },
+		query: { cursor: options.cursor }
+	});
+	if (!response?.ok) {
+		if (response?.status === 404) throw new DocumentRequestError("unavailable", "Document unavailable.", 404);
+		failed(response, error);
+	}
+	const data = received;
+	if (record(data) && data.status === "listed" && Array.isArray(data.revisions) && data.revisions.every((revision) => validRevision(revision, id)) && (data.nextCursor === null || isRevisionId(data.nextCursor))) return {
+		status: "listed",
+		revisions: data.revisions,
+		nextCursor: data.nextCursor
+	};
+	throw new Error("Invalid document revision listing response.");
+}
+/** Exact owner-only bytes of the current revision, or of one selected historical revision. */
+async function getDocumentContent(baseUrl, id, options = {}) {
+	const request = {
+		...requestOptions(baseUrl, options),
+		parseAs: "arrayBuffer"
+	};
+	const { data: received, response, error } = options.revisionId ? await documentsRevisionContent({
+		...request,
+		path: {
+			id,
+			revisionId: options.revisionId
+		}
+	}) : await documentsContent({
+		...request,
+		path: { id }
+	});
+	if (!response?.ok) {
+		if (response?.status === 404) throw new DocumentRequestError("unavailable", options.revisionId ? "Document or revision unavailable." : "Document unavailable.", 404);
+		failed(response, error);
+	}
+	const data = received;
+	if (data instanceof ArrayBuffer && response.headers.get("Content-Type")?.split(";")[0]?.trim().toLowerCase() === "text/html") return new Uint8Array(data);
+	throw new Error("Invalid document content response.");
+}
+async function restoreDocumentRevision(baseUrl, id, input, options = {}) {
+	const request = requestOptions(baseUrl, options);
+	const { data: received, response, error } = await documentsRestore({
+		...request,
+		path: { id },
+		headers: {
+			...request.headers,
+			"idempotency-key": input.idempotencyKey
+		},
+		body: {
+			revisionId: input.revisionId,
+			expectedRevisionId: input.expectedRevisionId
+		}
+	});
+	if (!response?.ok) {
+		const refusal = error;
+		if (response?.status === 400 && record(refusal) && refusal.status === "invalid_restore") throw new DocumentRequestError("invalid_restore", typeof refusal.message === "string" ? refusal.message : "Choose an older revision to restore.", 400);
+		if (response?.status === 404) throw new DocumentRequestError("unavailable", "Document or revision unavailable.", 404);
+		failed(response, error);
+	}
+	const data = received;
+	const restored = record(data) ? normalizeDocument(data.document) : void 0;
+	if (record(data) && (data.status === "restored" || data.status === "revision_conflict") && restored) return {
+		status: data.status,
+		document: restored
+	};
+	if (record(data) && data.status === "idempotency_conflict") return { status: "idempotency_conflict" };
+	throw new Error("Invalid document restoration response. Retry with the same idempotency key.");
+}
+async function updateDocumentVisibility(baseUrl, id, visibility, options = {}) {
+	const { data: received, response, error } = await documentsUpdateVisibility({
+		...requestOptions(baseUrl, options),
+		path: { id },
+		body: { visibility }
+	});
+	if (!response?.ok) {
+		if (response?.status === 400) throw new DocumentRequestError("invalid_visibility", "Choose private or public.", 400);
+		if (response?.status === 401) throw new DocumentRequestError("signed_out", "Sign in to update this document.", 401);
+		if (response?.status === 403) throw new DocumentRequestError("uninvited", "Access unavailable.", 403);
+		if (response?.status === 404) throw new DocumentRequestError("unavailable", "Document unavailable.", 404);
+		throw new Error("Could not update document visibility. Try again.", { cause: error });
+	}
+	const data = received;
+	if (record(data) && data.status === "visibility_updated" && validDocument(data.document) && data.document.visibility === visibility) return {
+		status: "visibility_updated",
+		document: data.document
+	};
+	throw new Error("Invalid document visibility response.");
+}
 async function publishDocument(baseUrl, input, options = {}) {
 	if (input.action) {
 		if (!(await getDocumentLimits(baseUrl, options)).publicationActions.includes(input.action)) throw new DocumentRequestError("publication_action_unsupported", "This server does not support explicit publication actions. Ask the operator to update the server. No HTML was uploaded.", 400);
@@ -744,7 +923,8 @@ async function publishDocument(baseUrl, input, options = {}) {
 		body: new Blob([new Uint8Array(input.bytes)], { type: "text/html" }),
 		query: {
 			sourcePath: input.sourcePath,
-			sourceContext: input.sourceContext,
+			project: input.project,
+			cliVersion: input.cliVersion,
 			action: input.action,
 			documentId: input.documentId,
 			expectedRevisionId: input.expectedRevisionId
@@ -764,7 +944,7 @@ async function publishDocument(baseUrl, input, options = {}) {
 			candidates
 		};
 	}
-	if (record(data) && (data.status === "idempotency_conflict" || data.status === "address_required" || data.status === "unavailable")) return { status: data.status };
+	if (record(data) && (data.status === "idempotency_conflict" || data.status === "address_required" || data.status === "unavailable" || data.status === "document_id_taken")) return { status: data.status };
 	throw new Error("Invalid publication response. Retry with the same idempotency key.");
 }
 //#endregion
@@ -782,7 +962,7 @@ async function getWorkspace(baseUrl, options = {}) {
 	});
 	if (!response?.ok) throw new Error("Could not load your workspace.", { cause: error });
 	if (data?.status === "signed_out" || data?.status === "uninvited") return { status: data.status };
-	if (data?.status === "admitted" && typeof data.user?.id === "string" && data.user.id.length > 0 && typeof data.user?.name === "string" && typeof data.workspace?.id === "string" && data.workspace.id.length > 0) return data;
+	if (data?.status === "admitted" && typeof data.user?.id === "string" && data.user.id.length > 0 && typeof data.user?.name === "string" && (data.user.login === void 0 || typeof data.user.login === "string") && typeof data.workspace?.id === "string" && data.workspace.id.length > 0 && (data.address === void 0 || data.address === null || isWorkspaceAddress(data.address))) return data;
 	throw new Error("Invalid workspace response.");
 }
 function validateCompatibility(value) {
@@ -829,39 +1009,51 @@ async function checkCompatibility(baseUrl, options = {}) {
 	return evaluateCompatibility(validateCompatibility(data));
 }
 //#endregion
-//#region src/windows-protection.ts
-/** DPAPI binds this ciphertext to the current Windows account on this machine. */
-function windowsProtection(value, operation) {
-	const script = `$ErrorActionPreference='Stop'; [Console]::InputEncoding=[Text.Encoding]::UTF8; [Console]::OutputEncoding=[Text.Encoding]::UTF8; Add-Type -AssemblyName System.Security; $value=[Console]::In.ReadToEnd(); [Console]::Out.Write(${operation === "protect" ? "[Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Protect([Text.Encoding]::UTF8.GetBytes($value),$null,[Security.Cryptography.DataProtectionScope]::CurrentUser))" : "[Text.Encoding]::UTF8.GetString([Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String($value),$null,[Security.Cryptography.DataProtectionScope]::CurrentUser))"})`;
-	return new Promise((resolve, reject) => {
-		const executable = join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
-		const child = execFile(executable, [
-			"-NoLogo",
-			"-NoProfile",
-			"-NonInteractive",
-			"-Command",
-			script
-		], {
-			encoding: "utf8",
-			windowsHide: true,
-			timeout: 1e4,
-			maxBuffer: 1048576
-		}, (error, stdout) => {
-			if (error) reject(/* @__PURE__ */ new Error("Windows protected storage failed. Use this Windows account on this machine and ensure Windows PowerShell and DPAPI are available."));
-			else resolve(stdout);
+//#region src/credential-store.ts
+/** Write a private 0600 file through a synced temporary file, so a crash cannot leave it half written. */
+async function replaceFile(path, contents) {
+	const temporary = `${path}.${randomUUID()}.tmp`;
+	try {
+		const file = await open(temporary, "wx", 384);
+		try {
+			await file.writeFile(contents);
+			await file.sync();
+		} finally {
+			await file.close();
+		}
+		await rename(temporary, path);
+	} finally {
+		await rm(temporary, { force: true });
+	}
+}
+/** The CLI configuration directory that holds credentials. */
+const configDirectory = () => process.env.PAGESHIP_CONFIG_DIR ?? join((process.platform === "win32" ? process.env.LOCALAPPDATA : process.env.XDG_CONFIG_HOME) ?? join(homedir(), ".config"), "pageship");
+/**
+* Read one origin's credentials without creating the configuration directory, its lock
+* or any file. A missing directory has no credentials.
+*/
+async function inspectCredentials(server) {
+	const directory = configDirectory();
+	if (await lstat(directory).then(() => false, (error) => {
+		if (error.code === "ENOENT") return true;
+		throw error;
+	}) && isAbsolute(directory)) return {};
+	const store = await credentialStore(server, true, { create: false });
+	try {
+		await access(directory, constants.R_OK | constants.X_OK).catch(() => {
+			throw new Error("You do not have permission to read it.");
 		});
-		child.stdin?.on("error", () => {});
-		child.stdin?.end(value);
-	});
+		return await store.read();
+	} finally {
+		await store.close();
+	}
 }
-//#endregion
-//#region src/credential-store.ts
 /** Separate files bind secrets to an exact server origin, outside project directories. */
-async function credentialStore(server, readOnly = false) {
+async function credentialStore(server, readOnly = false, { create = true } = {}) {
 	const windows = process.platform === "win32";
-	const directory = process.env.PAGESHIP_CONFIG_DIR ?? join((windows ? process.env.LOCALAPPDATA : process.env.XDG_CONFIG_HOME) ?? join(homedir(), ".config"), "pageship");
+	const directory = configDirectory();
 	if (!isAbsolute(directory)) throw new Error("PAGESHIP_CONFIG_DIR must be an absolute private directory.");
-	await mkdir(directory, {
+	if (create) await mkdir(directory, {
 		recursive: true,
 		mode: 448
 	});
@@ -876,6 +1068,9 @@ async function credentialStore(server, readOnly = false) {
 		throw new Error(`Another authorization command may be running. Retry after it exits. If it was killed, remove ${lock} after checking no Pageship process is running.`);
 	}
 	return {
+		/** The verified private directory and this origin's file stem, shared with the publish manifest. */
+		directory,
+		name,
 		async read() {
 			if (windows) try {
 				if (!(await lstat(path)).isFile()) throw new Error("Credential file must not be a link.");
@@ -887,7 +1082,7 @@ async function credentialStore(server, readOnly = false) {
 				file = await open(path, constants.O_RDONLY | (windows ? 0 : constants.O_NOFOLLOW));
 			} catch (error) {
 				if (error.code === "ENOENT") return {};
-				throw new Error("Could not open protected credentials. Check the credential file is not a symlink.");
+				throw new Error("Could not open credentials. Check the credential file is not a symlink.");
 			}
 			try {
 				const stat = await file.stat();
@@ -895,9 +1090,9 @@ async function credentialStore(server, readOnly = false) {
 				const raw = await file.readFile("utf8");
 				let value;
 				try {
-					value = JSON.parse(windows ? await windowsProtection(raw, "unprotect") : raw);
+					value = JSON.parse(raw);
 				} catch {
-					throw new Error("Could not read protected credentials. Use the original operating-system account or choose a new private PAGESHIP_CONFIG_DIR and log in again.");
+					throw new Error("Could not read credential JSON. Choose a new private PAGESHIP_CONFIG_DIR and log in again.");
 				}
 				if (!value || typeof value !== "object") throw new Error("Invalid credential file. Start again with a new private PAGESHIP_CONFIG_DIR.");
 				const candidate = value;
@@ -911,20 +1106,7 @@ async function credentialStore(server, readOnly = false) {
 		},
 		async write(value) {
 			if (readOnly) throw new Error("Cannot update credentials through a read-only store.");
-			const temporary = join(directory, `${name}.${randomUUID()}.tmp`);
-			try {
-				const file = await open(temporary, "wx", 384);
-				try {
-					const serialized = JSON.stringify(value);
-					await file.writeFile(windows ? await windowsProtection(serialized, "protect") : serialized);
-					await file.sync();
-				} finally {
-					await file.close();
-				}
-				await rename(temporary, path);
-			} finally {
-				await rm(temporary, { force: true });
-			}
+			await replaceFile(path, JSON.stringify(value));
 		},
 		close: async () => {
 			if (!readOnly) await rm(lock, {
@@ -935,7 +1117,267 @@ async function credentialStore(server, readOnly = false) {
 	};
 }
 //#endregion
-//#region src/authorization.ts
+//#region src/document-marker.ts
+const prefix = "<!-- pageship:v1 document=";
+const trailing = /<!-- pageship:v1 document=([A-Za-z0-9]{6}) -->[\t\n\f\r ]*$/u;
+const text = (bytes) => bytes.toString("latin1");
+/**
+* Whether the file starts with a UTF-16 byte-order mark, in either byte order. The ASCII
+* marker would corrupt such a file's encoding, so it gets none.
+*/
+const isUtf16 = (bytes) => bytes[0] === 255 && bytes[1] === 254 || bytes[0] === 254 && bytes[1] === 255;
+/** The document ID named by the file's marker, if it ends with one. */
+function readMarker(bytes) {
+	const id = trailing.exec(text(bytes))?.[1];
+	return isDocumentId(id) ? id : void 0;
+}
+/**
+* Points the marker at `id` without changing any other byte. An existing marker keeps
+* everything but its ID. A new marker follows the file's final line ending; a file
+* without one gets the marker on a new last line and still has no final line ending.
+*/
+function withMarker(bytes, id) {
+	const source = text(bytes);
+	const match = trailing.exec(source);
+	if (match) {
+		const start = match.index + 26;
+		return Buffer.concat([
+			bytes.subarray(0, start),
+			Buffer.from(id, "latin1"),
+			bytes.subarray(start + id.length)
+		]);
+	}
+	const marker = `${prefix}${id} -->`;
+	const ending = source.endsWith("\r\n") ? "\r\n" : source.endsWith("\n") ? "\n" : void 0;
+	const added = ending ? `${marker}${ending}` : `${source.includes("\r\n") ? "\r\n" : "\n"}${marker}`;
+	return Buffer.concat([bytes, Buffer.from(added, "latin1")]);
+}
+/**
+* The ID a new document proposes. It follows from the idempotency key, so a retry with
+* the same key proposes the same ID and uploads the same marked bytes.
+*/
+function proposedDocumentId(idempotencyKey) {
+	const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+	let id = "";
+	for (let round = 0; id.length < 6; round++) for (const byte of createHash("sha256").update(`${round}:${idempotencyKey}`).digest()) if (byte < 248 && id.length < 6) id += alphabet[byte % 62];
+	if (!isDocumentId(id)) throw new Error("Could not derive a document ID.");
+	return id;
+}
+/**
+* Writes the marked bytes over the local file in place, keeping its inode and mode.
+* Only the bytes after the first difference are written, and only while the file still
+* holds exactly the bytes that were published.
+*/
+async function writeMarker(path, original, marked) {
+	const file = await open(path, "r+");
+	try {
+		const current = Buffer.alloc(original.length + 1);
+		let length = 0;
+		for (;;) {
+			const { bytesRead } = await file.read(current, length, current.length - length, length);
+			if (!bytesRead || (length += bytesRead) === current.length) break;
+		}
+		if (length !== original.length || !current.subarray(0, length).equals(original)) throw new Error("The file changed while it was being published.");
+		let offset = 0;
+		while (offset < original.length && original[offset] === marked[offset]) offset++;
+		while (offset < marked.length) {
+			const { bytesWritten } = await file.write(marked, offset, marked.length - offset, offset);
+			offset += bytesWritten;
+		}
+	} finally {
+		await file.close();
+	}
+}
+//#endregion
+//#region src/publish-manifest.ts
+const Time = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
+const Entry$1 = Schema.Struct({
+	documentId: Schema.String.pipe(Schema.refine(isDocumentId)),
+	revisionId: Schema.String.pipe(Schema.refine(isRevisionId)),
+	/** When the recorded publication started, from its idempotency key. Older entries omit it. */
+	startedAt: Schema.optionalKey(Time)
+});
+/** Maps a file's real path to its document and the last revision published from this machine. */
+const Manifest = Schema.fromJsonString(Schema.Record(Schema.String, Entry$1));
+const decode = Schema.decodeUnknownOption(Manifest);
+const LockOwner = Schema.fromJsonString(Schema.Struct({
+	pid: Schema.Int,
+	acquiredAt: Time
+}));
+const decodeOwner = Schema.decodeUnknownOption(LockOwner);
+/**
+* A lock is stale once its process has exited or it is older than this. The lock covers only
+* one small read and write, so a live holder releases it long before.
+*/
+const staleLockMs = 1e4;
+/** A UUIDv7 idempotency key, whose first 48 bits hold its creation time in milliseconds. */
+function publicationKey(now = Date.now()) {
+	const hex = `${now.toString(16).padStart(12, "0")}7${randomUUID().replaceAll("-", "").slice(13)}`;
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+/** When a UUIDv7 key was made, no later than now. Other keys count as made now. */
+const keyTime = (key) => {
+	const time = /^([0-9a-f]{8})-([0-9a-f]{4})-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.exec(key);
+	return Math.min(time ? Number.parseInt(time[1] + time[2], 16) : Infinity, Date.now());
+};
+const running = (pid) => {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code === "EPERM";
+	}
+};
+/** The stale lock's contents, or undefined while it is held or already gone. */
+async function stale(lock) {
+	const [raw, info] = await Promise.all([readFile(lock, "utf8"), stat(lock)]).catch(() => []);
+	if (raw === void 0 || !info) return;
+	const owner = Option.getOrUndefined(decodeOwner(raw));
+	return Date.now() - (owner?.acquiredAt ?? info.mtimeMs) > 1e4 || owner !== void 0 && !running(owner.pid) ? raw : void 0;
+}
+/** Remove the lock only while it still holds these contents, so another holder's lock stays. */
+async function release(lock, contents) {
+	if (await readFile(lock, "utf8").catch(() => void 0) === contents) await rm(lock, { force: true });
+}
+/** Run with an exclusive-create lock file holding this process's ID and the time it was taken. */
+async function locked(lock, run) {
+	const deadline = Date.now() + 2 * staleLockMs;
+	const token = randomUUID();
+	let contents;
+	for (;;) {
+		contents = JSON.stringify({
+			pid: process.pid,
+			acquiredAt: Date.now(),
+			token
+		});
+		try {
+			await writeFile(lock, contents, {
+				flag: "wx",
+				mode: 384
+			});
+			break;
+		} catch (error) {
+			const { code } = error;
+			if (code !== "EEXIST" && !(process.platform === "win32" && code === "EPERM")) throw error;
+		}
+		const abandoned = await stale(lock);
+		if (abandoned !== void 0) await release(lock, abandoned);
+		else if (Date.now() > deadline) throw new Error(`Another publish kept ${lock} for too long. Publish again.`);
+		else await setTimeout$1(20);
+	}
+	try {
+		return await run();
+	} finally {
+		await release(lock, contents);
+	}
+}
+/**
+* The publish manifest for one server origin, stored next to that origin's credentials.
+* An unreadable manifest counts as empty and is replaced by the next successful publish.
+*/
+function publishManifest(store) {
+	const path = join(store.directory, `${store.name}.manifest.json`);
+	const lock = join(store.directory, `${store.name}.manifest.lock`);
+	const read = async () => {
+		const raw = await readFile(path, "utf8").catch(() => void 0);
+		return raw === void 0 ? {} : Option.getOrElse(decode(raw), () => ({}));
+	};
+	return {
+		find: async (file) => (await read())[file],
+		/**
+		* Under the lock, reread to keep other entries, then replace the file atomically. A
+		* publication that started before the file's entry, such as a replayed key, leaves it
+		* alone. Returns whether the entry now names this publication.
+		*/
+		record: (file, entry) => locked(lock, async () => {
+			const manifest = await read();
+			const current = manifest[file];
+			if (current?.documentId === entry.documentId && current.revisionId === entry.revisionId) return true;
+			if ((current?.startedAt ?? -1) > entry.startedAt) return false;
+			await replaceFile(path, JSON.stringify({
+				...manifest,
+				[file]: entry
+			}));
+			return true;
+		})
+	};
+}
+//#endregion
+//#region src/result.ts
+/** Every status a command returns, with its outcome. A new status must be classified here. */
+const outcomes = {
+	help: "succeeded",
+	version: "succeeded",
+	admitted: "succeeded",
+	authorized: "succeeded",
+	published: "succeeded",
+	listed: "succeeded",
+	downloaded: "succeeded",
+	visibility_updated: "succeeded",
+	restored: "succeeded",
+	skills_installed: "succeeded",
+	authorization_pending: "pending",
+	expired: "pending",
+	signed_out: "pending",
+	reauthentication_required: "pending",
+	choice_required: "pending",
+	address_required: "pending",
+	source_collision: "pending",
+	project_mismatch: "pending",
+	marker_unavailable: "pending",
+	revision_conflict: "pending",
+	cancelled: "pending",
+	usage_error: "failed",
+	internal_error: "failed",
+	request_failed: "failed",
+	interrupted: "failed",
+	unreachable: "failed",
+	client_too_old: "failed",
+	server_too_old: "failed",
+	unsupported: "failed",
+	configuration_unreadable: "failed",
+	uninvited: "failed",
+	denied: "failed",
+	invalid_attempt: "failed",
+	invalid_action: "failed",
+	invalid_file: "failed",
+	invalid_output: "failed",
+	invalid_restore: "failed",
+	output_exists: "failed",
+	upload_too_large: "failed",
+	unavailable: "failed",
+	idempotency_conflict: "failed",
+	document_id_taken: "failed",
+	publication_action_unsupported: "failed",
+	skills_modified: "failed"
+};
+const isStatus = (value) => Object.hasOwn(outcomes, value);
+const commandNames = [
+	"status",
+	"login",
+	"whoami",
+	"publish",
+	"list",
+	"history",
+	"download",
+	"visibility",
+	"restore",
+	"skills"
+];
+const isCommandName = (value) => commandNames.some((name) => name === value);
+/** Exit codes follow the outcome, except an interruption, which exits 130. */
+function exitCode(status) {
+	if (status === "interrupted") return 130;
+	const outcome = outcomes[status];
+	return outcome === "succeeded" ? 0 : outcome === "pending" ? 2 : 1;
+}
+//#endregion
+//#region src/server.ts
+/**
+* Hosted Pageship API origin. Keep in sync with `apiOrigin` in the repository's
+* `DEPLOYMENT_CONFIG` variable used by application deployment.
+*/
+const hostedServer = "https://api.pageship.dev";
 function serverOrigin(value) {
 	const url = new URL(value);
 	if (url.username || url.password || url.search || url.hash || url.pathname !== "/" || !(url.protocol === "https:" || url.protocol === "http:" && [
@@ -945,258 +1387,102 @@ function serverOrigin(value) {
 	].includes(url.hostname))) throw new Error("Authorization requires an HTTPS server origin, or HTTP on localhost for local development. Do not include a path, credentials, query or fragment.");
 	return url.origin;
 }
-async function authRequest(server, path, body, signal) {
-	const response = await fetch(`${server}/api/auth${path}`, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify(body),
-		redirect: "error",
-		credentials: "omit",
-		cache: "no-store",
-		signal: AbortSignal.any([signal, AbortSignal.timeout(1e4)])
-	});
-	if (response.status >= 500) throw new Error(`Authorization server returned HTTP ${response.status}. Retry later with login --complete if you have a pending code.`);
-	let value;
+/** An explicit `--server` overrides the hosted service and is repeated in every follow-up. */
+function selectServer(value) {
+	if (value === void 0) return {
+		origin: hostedServer,
+		args: []
+	};
+	const origin = serverOrigin(value);
+	return {
+		origin,
+		args: ["--server", origin]
+	};
+}
+/**
+* Display a follow-up command for a POSIX shell. Values such as `[::1]` origins are
+* single-quoted, so `$`, backticks and quotes in an origin stay literal.
+*/
+function commandLine(command, args) {
+	return [
+		"pageship",
+		command,
+		...args
+	].map((part) => /^[\w./:=@%+,-]+$/u.test(part) ? part : `'${part.replaceAll("'", "'\\''")}'`).join(" ");
+}
+//#endregion
+//#region package.json
+var version = "0.2.0";
+//#endregion
+//#region src/publish.ts
+const execute = promisify(execFile);
+const contained = (root, path) => {
+	const part = relative(root, path);
+	return part !== ".." && !part.startsWith(`..${sep}`) && !isAbsolute(part);
+};
+async function sourceMetadata(file) {
+	const path = await realpath(resolve(file));
+	const cwd = await realpath(process.cwd());
+	let root = contained(cwd, path) ? cwd : dirname(path);
+	let project;
 	try {
-		value = await response.json();
-	} catch {
-		throw new Error(`Authorization server returned an unreadable response (HTTP ${response.status}). Check the server and retry.`);
+		const git = async (...args) => (await execute("git", [
+			"-C",
+			dirname(path),
+			...args
+		], {
+			timeout: 5e3,
+			maxBuffer: 16384
+		})).stdout.trim();
+		const gitRoot = await realpath(await git("rev-parse", "--show-toplevel"));
+		if (contained(gitRoot, path)) {
+			root = gitRoot;
+			const remote = await git("remote", "get-url", "origin").catch(() => "");
+			const url = remote.includes("://") ? new URL(remote) : /^[^/]+@[^:]+:.+/u.test(remote) ? new URL(`ssh://${remote.replace(":", "/")}`) : void 0;
+			if (url && [
+				"https:",
+				"http:",
+				"ssh:",
+				"git:"
+			].includes(url.protocol) && url.hostname) {
+				const repository = `${url.hostname.toLowerCase()}${url.port ? `:${url.port}` : ""}/${url.pathname.replace(/^\/+|\/+$/gu, "").replace(/\.git$/u, "")}`;
+				if (isProject(repository)) project = repository;
+			}
+		}
+	} catch {}
+	const sourcePath = relative(root, path).split(sep).join("/");
+	if (!/\.html?$/iu.test(sourcePath)) throw new Error("Publish one .html or .htm file.");
+	return {
+		path,
+		sourcePath,
+		project
+	};
+}
+async function fileBytes(path, limit) {
+	const file = await open(path, "r");
+	try {
+		const stat = await file.stat();
+		if (!stat.isFile()) throw new Error("Publish one regular HTML file.");
+		if (stat.size > limit) return;
+		if (stat.size === 0) throw new Error("The HTML file is empty.");
+		const chunks = [];
+		let length = 0;
+		while (length <= limit) {
+			const chunk = Buffer.alloc(Math.min(65536, limit + 1 - length));
+			const { bytesRead } = await file.read(chunk);
+			if (!bytesRead) break;
+			chunks.push(chunk.subarray(0, bytesRead));
+			length += bytesRead;
+		}
+		return length > limit ? void 0 : Buffer.concat(chunks);
+	} finally {
+		await file.close();
 	}
-	if (!value || typeof value !== "object") throw new Error("Invalid authorization response. Check the server and retry.");
-	const data = value;
-	if (!response.ok && typeof data.error !== "string") throw new Error(`Authorization server returned HTTP ${response.status}. Retry later.`);
-	return data;
 }
-function pendingResult(pending, server) {
+function invalidFile(error) {
 	return {
-		status: "authorization_pending",
-		message: "Approve this installation in your browser, then run the completion command.",
-		verificationUri: pending.verificationUri,
-		verificationUriComplete: pending.verificationUriComplete,
-		userCode: pending.userCode,
-		expiresAt: new Date(pending.expiresAt).toISOString(),
-		retryAfterSeconds: Math.max(0, Math.ceil((pending.nextPollAt - Date.now()) / 1e3)),
-		next: {
-			command: "login",
-			args: [
-				"--server",
-				server,
-				"--complete"
-			]
-		}
-	};
-}
-async function authorize(options) {
-	const server = serverOrigin(options.server);
-	const compatibility = await checkCompatibility(server, { signal: options.signal });
-	if (compatibility.status !== "compatible") return compatibility;
-	const store = await credentialStore(server);
-	try {
-		const credentials = await store.read();
-		if (credentials.token && !options.restart && !credentials.pending) {
-			const access = await getWorkspace(server, {
-				token: credentials.token,
-				signal: options.signal
-			});
-			if (access.status === "admitted") return {
-				...access,
-				status: "authorized",
-				message: `Authorized as ${access.user.name}.`
-			};
-			if (access.status === "uninvited") return {
-				status: "uninvited",
-				message: "This account is no longer invited. Contact the server owner or use login --restart for another account."
-			};
-			delete credentials.token;
-			await store.write(credentials);
-		}
-		if (options.restart) delete credentials.pending;
-		if (!credentials.pending) {
-			if (options.complete) return {
-				status: "invalid_attempt",
-				message: "No pending authorization. Run login without --complete to start a new attempt."
-			};
-			const data = await authRequest(server, "/device/code", { client_id: "pageship-cli" }, options.signal);
-			if (typeof data.device_code !== "string" || typeof data.user_code !== "string" || typeof data.verification_uri !== "string" || typeof data.verification_uri_complete !== "string" || typeof data.expires_in !== "number" || data.expires_in <= 0 || typeof data.interval !== "number" || data.interval < 1) throw new Error("Invalid device authorization response. Check the server and retry.");
-			for (const uri of [data.verification_uri, data.verification_uri_complete]) {
-				const parsed = new URL(uri);
-				if (!["https:", "http:"].includes(parsed.protocol) || parsed.username || parsed.password || parsed.protocol === "http:" && new URL(server).protocol !== "http:") throw new Error("Invalid browser verification URL.");
-			}
-			credentials.pending = {
-				deviceCode: data.device_code,
-				userCode: data.user_code,
-				verificationUri: data.verification_uri,
-				verificationUriComplete: data.verification_uri_complete,
-				expiresAt: Date.now() + data.expires_in * 1e3,
-				interval: data.interval,
-				nextPollAt: 0
-			};
-			await store.write(credentials);
-		}
-		const pending = credentials.pending;
-		if (options.interactive) options.progress(`Open ${pending.verificationUriComplete}\nCheck code ${pending.userCode}. Only approve an installation you started.\nWaiting for approval. Press Ctrl+C to stop; you can resume with login --complete.`);
-		do {
-			if (options.signal.aborted) return {
-				status: "interrupted",
-				message: "Authorization interrupted. Run login --complete to resume, or login --restart for a new code."
-			};
-			if (Date.now() >= pending.expiresAt) {
-				delete credentials.pending;
-				await store.write(credentials);
-				return {
-					status: "expired",
-					message: "The authorization code expired. Run login again for a new code."
-				};
-			}
-			if (!options.interactive && (!options.complete || Date.now() < pending.nextPollAt)) return pendingResult(pending, server);
-			if (Date.now() < pending.nextPollAt) await setTimeout$1(pending.nextPollAt - Date.now(), void 0, { signal: options.signal });
-			pending.nextPollAt = Date.now() + pending.interval * 1e3;
-			await store.write(credentials);
-			const data = await authRequest(server, "/device/token", {
-				client_id: "pageship-cli",
-				device_code: pending.deviceCode,
-				grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-			}, options.signal);
-			if (typeof data.access_token === "string" && data.access_token.length > 0) {
-				credentials.token = data.access_token;
-				delete credentials.pending;
-				await store.write(credentials);
-				const access = await getWorkspace(server, {
-					token: credentials.token,
-					signal: options.signal
-				});
-				if (access.status !== "admitted") return {
-					status: access.status,
-					message: "Authorization finished, but workspace access is unavailable. Check your admission with the server owner."
-				};
-				return {
-					...access,
-					status: "authorized",
-					message: `Authorized as ${access.user.name}. Your credential is stored privately for this server.`
-				};
-			}
-			if (data.error === "slow_down") {
-				pending.interval += 5;
-				pending.nextPollAt = Date.now() + pending.interval * 1e3;
-				await store.write(credentials);
-			} else if (data.error !== "authorization_pending") {
-				delete credentials.pending;
-				await store.write(credentials);
-				const status = data.error === "access_denied" ? "denied" : data.error === "expired_token" ? "expired" : "invalid_attempt";
-				return {
-					status,
-					message: `Authorization ${status.replaceAll("_", " ")}. Run login again for a new code.`
-				};
-			}
-			if (!options.interactive) return pendingResult(pending, server);
-		} while (!options.signal.aborted);
-		return {
-			status: "interrupted",
-			message: "Authorization interrupted. Run login --complete to resume."
-		};
-	} catch (error) {
-		if (options.signal.aborted) return {
-			status: "interrupted",
-			message: "Authorization interrupted. Run login --complete to resume or login --restart to start again."
-		};
-		throw error;
-	} finally {
-		await store.close();
-	}
-}
-async function identify(serverValue, signal) {
-	const server = serverOrigin(serverValue);
-	const compatibility = await checkCompatibility(server, { signal });
-	if (compatibility.status !== "compatible") return compatibility;
-	const store = await credentialStore(server, true);
-	try {
-		const { token } = await store.read();
-		if (!token) return {
-			status: "signed_out",
-			message: "This installation is not authorized. Run login --server with this server to begin."
-		};
-		const access = await getWorkspace(server, {
-			token,
-			signal
-		});
-		return {
-			...access,
-			message: access.status === "admitted" ? `Signed in as ${access.user.name}. Personal workspace: ${access.workspace.id}${access.installation ? `\nCLI installation: ${access.installation.id}` : ""}` : access.status === "uninvited" ? "This account is not invited. Contact the server owner." : "Your credential was revoked, expired or is invalid. Run login --server with this server to sign in again."
-		};
-	} finally {
-		await store.close();
-	}
-}
-//#endregion
-//#region src/publish.ts
-const execute = promisify(execFile);
-const contained = (root, path) => {
-	const part = relative(root, path);
-	return part !== ".." && !part.startsWith(`..${sep}`) && !isAbsolute(part);
-};
-async function sourceMetadata(file) {
-	const path = await realpath(resolve(file));
-	const cwd = await realpath(process.cwd());
-	let root = contained(cwd, path) ? cwd : dirname(path);
-	let sourceContext = "personal";
-	try {
-		const git = async (...args) => (await execute("git", [
-			"-C",
-			dirname(path),
-			...args
-		], {
-			timeout: 5e3,
-			maxBuffer: 16384
-		})).stdout.trim();
-		const gitRoot = await realpath(await git("rev-parse", "--show-toplevel"));
-		if (contained(gitRoot, path)) {
-			root = gitRoot;
-			const remote = await git("remote", "get-url", "origin").catch(() => "");
-			const url = remote.includes("://") ? new URL(remote) : /^[^/]+@[^:]+:.+/u.test(remote) ? new URL(`ssh://${remote.replace(":", "/")}`) : void 0;
-			if (url && [
-				"https:",
-				"http:",
-				"ssh:",
-				"git:"
-			].includes(url.protocol) && url.hostname) {
-				const repository = `${url.hostname.toLowerCase()}${url.port ? `:${url.port}` : ""}/${url.pathname.replace(/^\/+|\/+$/gu, "").replace(/\.git$/u, "")}`;
-				sourceContext = `git:${createHash("sha256").update(repository).digest("hex")}`;
-			}
-		}
-	} catch {}
-	const sourcePath = relative(root, path).split(sep).join("/");
-	if (!/\.html?$/iu.test(sourcePath)) throw new Error("Publish one .html or .htm file.");
-	return {
-		path,
-		sourcePath,
-		sourceContext
-	};
-}
-async function fileBytes(path, limit) {
-	const file = await open(path, "r");
-	try {
-		const stat = await file.stat();
-		if (!stat.isFile()) throw new Error("Publish one regular HTML file.");
-		if (stat.size > limit) return;
-		if (stat.size === 0) throw new Error("The HTML file is empty.");
-		const chunks = [];
-		let length = 0;
-		while (length <= limit) {
-			const chunk = Buffer.alloc(Math.min(65536, limit + 1 - length));
-			const { bytesRead } = await file.read(chunk);
-			if (!bytesRead) break;
-			chunks.push(chunk.subarray(0, bytesRead));
-			length += bytesRead;
-		}
-		return length > limit ? void 0 : Buffer.concat(chunks);
-	} finally {
-		await file.close();
-	}
-}
-function invalidFile(error) {
-	return {
-		status: "invalid_file",
-		message: `Could not read the HTML file. ${error instanceof Error ? error.message : "Check the file and try again."}`
+		status: "invalid_file",
+		message: `Could not read the HTML file. ${error instanceof Error ? error.message : "Check the file and try again."}`
 	};
 }
 function actionArgs(action) {
@@ -1207,13 +1493,10 @@ function actionArgs(action) {
 		action.expectedRevisionId
 	] : [];
 }
-function resolutions(file, server, candidates) {
+/** `contextArgs` are the server and marker arguments every follow-up keeps. */
+function resolutions(file, contextArgs, candidates) {
 	const command = "publish";
-	const args = [
-		file,
-		"--server",
-		server
-	];
+	const args = [file, ...contextArgs];
 	return {
 		new: {
 			command,
@@ -1278,8 +1561,26 @@ async function publish(options) {
 		documentId: options.revise,
 		expectedRevisionId: options.expectedRevision
 	} : {};
-	const server = serverOrigin(options.server);
-	const idempotencyKey = options.idempotencyKey ?? randomUUID();
+	const selection = selectServer(options.server);
+	const server = selection.origin;
+	const contextArgs = [...selection.args, ...options.noMarker ? ["--no-marker"] : []];
+	const login = {
+		command: "login",
+		args: selection.args
+	};
+	if (options.addressChoice !== void 0 || options.refreshAddresses) {
+		const args = [...selection.args, ...options.addressChoice !== void 0 ? ["--address-choice", options.addressChoice] : ["--refresh-addresses"]];
+		return {
+			status: "invalid_action",
+			message: `Workspace address selection moved to login. Run ${commandLine("login", args)}, then publish again. No HTML was uploaded.`,
+			next: {
+				command: "login",
+				args
+			}
+		};
+	}
+	let idempotencyKey = options.idempotencyKey ?? publicationKey();
+	let started = false;
 	let source;
 	try {
 		source = await sourceMetadata(options.file);
@@ -1287,13 +1588,17 @@ async function publish(options) {
 		return invalidFile(error);
 	}
 	const compatibility = await checkCompatibility(server, { signal: options.signal });
-	if (compatibility.status !== "compatible") return compatibility;
+	if (compatibility.status !== "compatible") return {
+		...compatibility,
+		status: compatibility.status
+	};
 	const store = await credentialStore(server, true);
 	try {
 		const { token } = await store.read();
 		if (!token) return {
 			status: "signed_out",
-			message: "This installation is not authorized. Run login first."
+			message: `This installation is not authorized. Run ${commandLine("login", selection.args)} first.`,
+			next: login
 		};
 		const request = {
 			token,
@@ -1311,124 +1616,1097 @@ async function publish(options) {
 			maxUploadBytes,
 			message: `The HTML file exceeds the ${maxUploadBytes}-byte limit. No HTML was uploaded.`
 		};
-		let address = await updateWorkspaceAddress(server, options.addressChoice ? {
-			action: "select",
-			choiceId: options.addressChoice
-		} : { action: options.refreshAddresses ? "refresh" : "allocate" }, request);
-		while (address.status === "choice_required" && options.interactive) {
-			console.log("Choose your workspace address:");
-			address.choices.forEach((choice, index) => console.log(`${index + 1}. ${choice.hostname}`));
-			const input = createInterface({
-				input: process.stdin,
-				output: process.stdout
+		const utf16 = !options.noMarker && isUtf16(bytes);
+		const skipMarker = options.noMarker || utf16;
+		if (!skipMarker && withMarker(bytes, "AAAAAA").length > maxUploadBytes) return {
+			status: "upload_too_large",
+			maxUploadBytes,
+			message: `With its document marker, the HTML file exceeds the ${maxUploadBytes}-byte limit. Make it smaller, or publish with --no-marker. No HTML was uploaded.`
+		};
+		const manifest = publishManifest(store);
+		const marker = readMarker(bytes);
+		const detect = action.action === void 0 && options.idempotencyKey === void 0;
+		let automatic;
+		let fallback = false;
+		if (detect && marker) {
+			const target = await getDocument(server, marker, request).catch((error) => {
+				if (error instanceof DocumentRequestError && error.status === "unavailable") return;
+				throw error;
 			});
-			let selection;
-			try {
-				selection = (await input.question("Number, r to refresh, or q to cancel: ", { signal: options.signal })).trim();
-			} finally {
-				input.close();
-			}
-			if (selection === "q") return {
-				status: "cancelled",
-				message: "Publication cancelled."
+			if (!target) return {
+				status: "marker_unavailable",
+				message: `Document ${marker} from this file's marker not found or not yours. No HTML was uploaded. Use --new to publish a separate document${options.noMarker ? "" : " and point the marker at it"}.`,
+				next: {
+					command: "publish",
+					args: [
+						options.file,
+						...contextArgs,
+						"--new"
+					]
+				}
 			};
-			const choice = address.choices[Number(selection) - 1];
-			if (selection !== "r" && !choice) continue;
-			address = await updateWorkspaceAddress(server, selection === "r" ? { action: "refresh" } : {
-				action: "select",
-				choiceId: choice.choiceId
-			}, request);
+			const entry = await manifest.find(source.path);
+			if (entry?.documentId === target.id) {
+				action = {
+					action: "revise",
+					documentId: target.id,
+					expectedRevisionId: entry.revisionId
+				};
+				automatic = "manifest";
+			} else if (target.project === (source.project ?? null)) {
+				action = {
+					action: "revise",
+					documentId: target.id,
+					expectedRevisionId: target.revisionId
+				};
+				automatic = "marker";
+			} else return {
+				status: "project_mismatch",
+				document: target,
+				message: `This file's marker names ${target.url}, a document from ${target.project ?? "a loose file"}, but this file ${source.project ? `belongs to ${source.project}` : "is a loose file"}. No document changed. To revise that document anyway, publish with --revise ${target.id} --expected-revision ${target.revisionId}, or use --new for a separate document. Use --json for complete follow-up arguments.`,
+				resolutions: resolutions(options.file, contextArgs, [target])
+			};
+		} else if (detect) {
+			const entry = await manifest.find(source.path);
+			if (entry) {
+				action = {
+					action: "revise",
+					documentId: entry.documentId,
+					expectedRevisionId: entry.revisionId
+				};
+				automatic = "manifest";
+				fallback = true;
+			}
 		}
-		if (address.status === "choice_required") return {
-			...address,
-			message: `Choose a generated workspace address and repeat publish with --address-choice <choiceId>, or --refresh-addresses.\n${address.choices.map((choice) => `${choice.hostname}: ${choice.choiceId}`).join("\n")}`,
-			next: {
-				command: "publish",
-				args: [
-					options.file,
-					"--server",
-					server,
-					"--address-choice",
-					"<choiceId>"
-				]
+		let uploaded = bytes;
+		const send = async () => {
+			for (let tries = 1;; tries++) {
+				const target = action.action === "revise" ? action.documentId : skipMarker ? void 0 : proposedDocumentId(idempotencyKey);
+				const proposal = action.action === "revise" || !target ? action : {
+					...action,
+					documentId: target
+				};
+				uploaded = target && !skipMarker ? withMarker(bytes, target) : bytes;
+				started = true;
+				const result = await publishDocument(server, {
+					bytes: uploaded,
+					sourcePath: source.sourcePath,
+					...source.project ? { project: source.project } : {},
+					cliVersion: version,
+					idempotencyKey,
+					...proposal
+				}, request);
+				if (result.status !== "document_id_taken" || tries === 8) return result;
+				idempotencyKey = publicationKey();
 			}
 		};
-		if (address.status !== "allocated") return {
-			...address,
-			message: "Workspace address is unavailable. Sign in again or check admission."
-		};
-		const send = () => publishDocument(server, {
-			bytes,
-			sourcePath: source.sourcePath,
-			sourceContext: source.sourceContext,
-			idempotencyKey,
-			...action
-		}, request);
 		let result = await send();
+		if (fallback && result.status === "unavailable") {
+			action = {};
+			automatic = void 0;
+			idempotencyKey = publicationKey();
+			result = await send();
+		}
+		const revisedFromManifest = automatic === "manifest";
 		if (result.status === "source_collision" && options.interactive) {
 			const selected = await choosePublication(result.candidates, options.signal);
 			if (!selected) return {
 				status: "cancelled",
-				message: "Publication cancelled. No document changed."
+				message: "Publication cancelled. No document changed.",
+				next: {
+					command: "publish",
+					args: [options.file, ...contextArgs]
+				}
 			};
 			action = selected;
 			result = await send();
 		}
-		const message = result.status === "published" ? `Published ${result.document.visibility === "private" ? "privately" : "publicly"}: ${result.document.url}` : result.status === "source_collision" ? `Source path already published. No document changed.\n${result.candidates.map((candidate) => candidate.url).join("\n")}\nUse --new for a separate document, or --revise <documentId> --expected-revision <revisionId> from a candidate. Use --json for complete follow-up arguments.` : result.status === "revision_conflict" ? `The selected document changed. No revision was published. Inspect ${result.document.url} and select its current revision before trying again.` : result.status === "idempotency_conflict" ? "That idempotency key belongs to different content, source metadata or publication action. Reuse the original input or choose a new key." : result.status === "unavailable" ? "The selected document is unavailable for this source path. Run publish without action flags to find current candidates." : "Allocate your workspace address before publishing.";
+		let unrecorded = "";
+		let manifestWarning = "";
+		let superseded = false;
+		if (result.status === "published") {
+			const { id, revisionId } = result.document;
+			const startedAt = idempotencyKey === options.idempotencyKey ? keyTime(idempotencyKey) : Date.now();
+			superseded = await manifest.record(source.path, {
+				documentId: id,
+				revisionId,
+				startedAt
+			}).then((recorded) => !recorded, (error) => {
+				manifestWarning = ` Could not update the publish manifest, so a plain publish of this file may not revise this document. To continue it, publish with --revise ${id} --expected-revision ${revisionId}. ${error instanceof Error ? error.message : ""}`;
+				return false;
+			});
+		}
+		if (result.status === "published" && !superseded && !uploaded.equals(bytes)) try {
+			if (readMarker(uploaded) !== result.document.id) throw new Error("The published document ID differs from the marker.");
+			await writeMarker(source.path, bytes, uploaded);
+		} catch (error) {
+			unrecorded += ` Could not write the document marker to the local file, so the file has no marker for this document and differs from the published bytes. ${error instanceof Error ? error.message : ""}`;
+		}
+		if (result.status === "published" && utf16) unrecorded += " This file is UTF-16, so no document marker was added: the ASCII marker would corrupt its encoding. Publish it with --no-marker to skip this warning.";
+		unrecorded += manifestWarning;
+		if (superseded) unrecorded += " This file's publish manifest entry names a newer publication, so the entry and the file's marker stay unchanged.";
+		const change = action.action === "revise" ? "revised" : "created";
+		const message = result.status === "published" ? `Published ${result.document.visibility === "private" ? "privately" : "publicly"} as a new ${change === "revised" ? "revision" : "document"}: ${result.document.url}${unrecorded}` : result.status === "source_collision" ? `Source path already published. No document changed.\n${result.candidates.map((candidate) => candidate.url).join("\n")}\nUse --new for a separate document, or --revise <documentId> --expected-revision <revisionId> from a candidate. Use --json for complete follow-up arguments.` : result.status === "revision_conflict" ? revisedFromManifest ? `This file's document changed after this machine last published it, for example from another machine or the dashboard. No revision was published. Inspect ${result.document.url}, then revise its current revision or use --new. Use --json for complete follow-up arguments.` : `The selected document changed. No revision was published. Inspect ${result.document.url} and select its current revision before trying again.` : result.status === "idempotency_conflict" ? "That idempotency key belongs to different content, source metadata or publication action. Reuse the original input or choose a new key." : result.status === "unavailable" ? "Document not found or not yours. No revision was published." : result.status === "document_id_taken" ? "Every proposed document ID was already taken. No document changed. Publish again." : `Your workspace address is not selected yet. Run ${commandLine("login", selection.args)} to choose one, then publish again. No document changed.`;
 		return {
 			...result,
+			...result.status === "published" ? { change } : {},
 			idempotencyKey,
 			message,
-			...result.status === "source_collision" ? { resolutions: resolutions(options.file, server, result.candidates) } : {},
-			...result.status === "revision_conflict" ? { resolutions: resolutions(options.file, server, [result.document]) } : {}
+			...result.status === "source_collision" ? { resolutions: resolutions(options.file, contextArgs, result.candidates) } : {},
+			...result.status === "revision_conflict" ? { resolutions: resolutions(options.file, contextArgs, [result.document]) } : {},
+			...result.status === "address_required" ? { next: login } : {}
 		};
 	} catch (error) {
+		const retry = [...started || options.idempotencyKey !== void 0 ? ["--idempotency-key", idempotencyKey] : [], ...actionArgs(action)];
+		const next = {
+			command: "publish",
+			args: [
+				options.file,
+				...contextArgs,
+				...retry
+			]
+		};
+		const guidance = retry.length ? `Retry with ${retry.join(" ")}.` : "Run the same command again.";
 		if (options.signal.aborted) return {
 			status: "interrupted",
 			idempotencyKey,
-			message: `Publication interrupted. Retry with --idempotency-key ${idempotencyKey} ${actionArgs(action).join(" ")}.`,
-			next: {
-				command: "publish",
-				args: [
-					options.file,
-					"--server",
-					server,
-					"--idempotency-key",
-					idempotencyKey,
-					...actionArgs(action)
-				]
-			}
+			message: `Publication interrupted. ${guidance}`,
+			next
 		};
-		if (error instanceof DocumentRequestError) return {
+		if (error instanceof DocumentRequestError && isStatus(error.status)) return {
 			status: error.status,
-			message: error.message,
-			idempotencyKey
+			message: error.status === "signed_out" ? `Your installation is not authorized. Run ${commandLine("login", selection.args)} again.` : error.message,
+			idempotencyKey,
+			...error.status === "signed_out" ? { next: login } : {}
 		};
 		return {
 			status: "request_failed",
 			idempotencyKey,
-			message: `Publication did not finish. Retry with --idempotency-key ${idempotencyKey} ${actionArgs(action).join(" ")}. ${error instanceof Error ? error.message : "Check the server and file."}`,
-			next: {
-				command: "publish",
-				args: [
-					options.file,
-					"--server",
-					server,
-					"--idempotency-key",
-					idempotencyKey,
-					...actionArgs(action)
-				]
-			}
+			message: `Publication did not finish. ${guidance} ${error instanceof Error ? error.message : "Check the server and file."}`,
+			next
 		};
 	} finally {
 		await store.close();
 	}
 }
 //#endregion
-//#region package.json
-var version = "0.1.0";
-//#endregion
-//#region src/cli.ts
+//#region src/authorization.ts
+async function authRequest(selection, path, body, signal) {
+	const response = await fetch(`${selection.origin}/api/auth${path}`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body),
+		redirect: "error",
+		credentials: "omit",
+		cache: "no-store",
+		signal: AbortSignal.any([signal, AbortSignal.timeout(1e4)])
+	});
+	if (response.status >= 500) throw new Error(`Authorization server returned HTTP ${response.status}. Retry later with ${commandLine("login", [...selection.args, "--complete"])} if you have a pending code.`);
+	let value;
+	try {
+		value = await response.json();
+	} catch {
+		throw new Error(`Authorization server returned an unreadable response (HTTP ${response.status}). Check the server and retry.`);
+	}
+	if (!value || typeof value !== "object") throw new Error("Invalid authorization response. Check the server and retry.");
+	const data = value;
+	if (!response.ok && typeof data.error !== "string") throw new Error(`Authorization server returned HTTP ${response.status}. Retry later.`);
+	return data;
+}
+function pendingResult(pending, selection) {
+	return {
+		status: "authorization_pending",
+		message: "Approve this installation in your browser, then run the completion command.",
+		verificationUri: pending.verificationUri,
+		verificationUriComplete: pending.verificationUriComplete,
+		userCode: pending.userCode,
+		expiresAt: new Date(pending.expiresAt).toISOString(),
+		retryAfterSeconds: Math.max(0, Math.ceil((pending.nextPollAt - Date.now()) / 1e3)),
+		next: {
+			command: "login",
+			args: [...selection.args, "--complete"]
+		}
+	};
+}
+/** Authorize the installation, then establish its personal workspace address. */
+async function authorize(options) {
+	const selection = selectServer(options.server);
+	if (options.addressChoice !== void 0 && options.refreshAddresses) return {
+		status: "invalid_action",
+		message: "Use --address-choice <choiceId> or --refresh-addresses, not both."
+	};
+	const { token, address: _accessAddress, ...result } = await authorizeInstallation(selection, options);
+	if (result.status !== "authorized" || typeof token !== "string") return result;
+	return onboardAddress(selection, token, result, {
+		action: options.addressChoice !== void 0 ? {
+			action: "select",
+			choiceId: options.addressChoice
+		} : { action: options.refreshAddresses ? "refresh" : "allocate" },
+		interactive: options.addressInteractive,
+		signal: options.signal
+	});
+}
+async function onboardAddress(selection, token, authorized, options) {
+	const server = selection.origin;
+	const resume = {
+		command: "login",
+		args: [...selection.args]
+	};
+	const retry = {
+		command: "login",
+		args: [...selection.args, ...options.action.action === "select" ? ["--address-choice", options.action.choiceId] : []]
+	};
+	const login = (...args) => commandLine("login", [...selection.args, ...args]);
+	const incomplete = `${authorized.message} Your workspace address is not selected yet, so publishing is not ready.`;
+	const request = {
+		token,
+		signal: options.signal
+	};
+	const interrupted = {
+		...authorized,
+		status: "interrupted",
+		message: `${incomplete} Address selection was interrupted; your credential is kept. Run ${commandLine(retry.command, retry.args)} to choose one.`,
+		next: retry
+	};
+	try {
+		let address = await updateWorkspaceAddress(server, options.action, request);
+		while (address.status === "choice_required" && options.interactive) {
+			console.log(`${address.reason === "stale_choice" ? "That address choice is no longer available. " : "Authorization succeeded. "}Choose your workspace address:`);
+			address.choices.forEach((choice, index) => console.log(`${index + 1}. ${choice.hostname}`));
+			const input = createInterface({
+				input: process.stdin,
+				output: process.stdout
+			});
+			let selection;
+			try {
+				selection = (await input.question("Number, r to refresh, or q to cancel: ", { signal: options.signal })).trim();
+			} catch (error) {
+				if (error instanceof Error && error.name === "AbortError") return interrupted;
+				throw error;
+			} finally {
+				input.close();
+			}
+			if (selection === "q") return {
+				...authorized,
+				status: "cancelled",
+				message: `${incomplete} Run ${login()} to choose one.`,
+				next: resume
+			};
+			const choice = address.choices[Number(selection) - 1];
+			if (selection !== "r" && !choice) continue;
+			address = await updateWorkspaceAddress(server, choice ? {
+				action: "select",
+				choiceId: choice.choiceId
+			} : { action: "refresh" }, request);
+		}
+		if (address.status === "allocated") return {
+			...authorized,
+			address: {
+				subdomain: address.subdomain,
+				hostname: address.hostname
+			},
+			message: `${authorized.message} Workspace address: ${address.hostname}.`
+		};
+		if (address.status === "choice_required") return {
+			...authorized,
+			...address,
+			message: `${incomplete} ${address.reason === "stale_choice" ? "That address choice is no longer available. " : ""}Choose a generated address and run ${login("--address-choice")} <choiceId>, or ${login("--refresh-addresses")} for new choices.\n${address.choices.map((choice) => `${choice.hostname}: ${choice.choiceId}`).join("\n")}`,
+			resolutions: {
+				select: address.choices.map((choice) => ({
+					choiceId: choice.choiceId,
+					hostname: choice.hostname,
+					command: "login",
+					args: [
+						...resume.args,
+						"--address-choice",
+						choice.choiceId
+					]
+				})),
+				refresh: {
+					command: "login",
+					args: [...resume.args, "--refresh-addresses"]
+				}
+			}
+		};
+		if (address.status === "reauthentication_required") return {
+			...authorized,
+			status: address.status,
+			message: `${incomplete} Sign in to the dashboard again so Pageship can verify your GitHub login, then run ${login()}.`,
+			next: resume
+		};
+		if (address.status === "signed_out") return {
+			...authorized,
+			status: address.status,
+			message: `${incomplete} The credential was rejected. Run ${login("--restart")} to sign in again.`,
+			next: {
+				command: "login",
+				args: [...selection.args, "--restart"]
+			}
+		};
+		return {
+			...authorized,
+			status: address.status,
+			message: `${incomplete} Workspace access is unavailable. Check your admission with the server owner.`
+		};
+	} catch (error) {
+		if (options.signal.aborted) return interrupted;
+		return {
+			...authorized,
+			status: "request_failed",
+			message: `${incomplete} ${error instanceof Error ? error.message : "Could not update your workspace address."} Your credential is kept. Run ${commandLine(retry.command, retry.args)} to retry.`,
+			next: retry
+		};
+	}
+}
+async function authorizeInstallation(selection, options) {
+	const server = selection.origin;
+	const login = (...args) => commandLine("login", [...selection.args, ...args]);
+	const next = (...args) => ({
+		command: "login",
+		args: [...selection.args, ...args]
+	});
+	const compatibility = await checkCompatibility(server, { signal: options.signal });
+	if (compatibility.status !== "compatible") return {
+		...compatibility,
+		status: compatibility.status
+	};
+	const store = await credentialStore(server);
+	try {
+		const credentials = await store.read();
+		if (credentials.token && !options.restart && !credentials.pending) {
+			const access = await getWorkspace(server, {
+				token: credentials.token,
+				signal: options.signal
+			});
+			if (access.status === "admitted") return {
+				...access,
+				status: "authorized",
+				message: `Authorized as ${access.user.name}.`,
+				token: credentials.token
+			};
+			if (access.status === "uninvited") return {
+				status: "uninvited",
+				message: `This account is no longer invited. Contact the server owner or run ${login("--restart")} for another account.`
+			};
+			delete credentials.token;
+			await store.write(credentials);
+		}
+		if (options.restart) delete credentials.pending;
+		if (!credentials.pending) {
+			if (options.complete) return {
+				status: "invalid_attempt",
+				message: `No pending authorization. Run ${login()} to start a new attempt.`
+			};
+			const data = await authRequest(selection, "/device/code", { client_id: "pageship-cli" }, options.signal);
+			if (typeof data.device_code !== "string" || typeof data.user_code !== "string" || typeof data.verification_uri !== "string" || typeof data.verification_uri_complete !== "string" || typeof data.expires_in !== "number" || data.expires_in <= 0 || typeof data.interval !== "number" || data.interval < 1) throw new Error("Invalid device authorization response. Check the server and retry.");
+			for (const uri of [data.verification_uri, data.verification_uri_complete]) {
+				const parsed = new URL(uri);
+				if (!["https:", "http:"].includes(parsed.protocol) || parsed.username || parsed.password || parsed.protocol === "http:" && new URL(server).protocol !== "http:") throw new Error("Invalid browser verification URL.");
+			}
+			credentials.pending = {
+				deviceCode: data.device_code,
+				userCode: data.user_code,
+				verificationUri: data.verification_uri,
+				verificationUriComplete: data.verification_uri_complete,
+				expiresAt: Date.now() + data.expires_in * 1e3,
+				interval: data.interval,
+				nextPollAt: 0
+			};
+			await store.write(credentials);
+		}
+		const pending = credentials.pending;
+		if (options.interactive) options.progress(`Open ${pending.verificationUriComplete}\nCheck code ${pending.userCode}. Only approve an installation you started.\nWaiting for approval. Press Ctrl+C to stop; you can resume with ${login("--complete")}.`);
+		do {
+			if (options.signal.aborted) return {
+				status: "interrupted",
+				message: `Authorization interrupted. Run ${login("--complete")} to resume, or ${login("--restart")} for a new code.`,
+				next: next("--complete")
+			};
+			if (Date.now() >= pending.expiresAt) {
+				delete credentials.pending;
+				await store.write(credentials);
+				return {
+					status: "expired",
+					message: `The authorization code expired. Run ${login()} again for a new code.`,
+					next: next()
+				};
+			}
+			if (!options.interactive && (!options.complete || Date.now() < pending.nextPollAt)) return pendingResult(pending, selection);
+			if (Date.now() < pending.nextPollAt) await setTimeout$1(pending.nextPollAt - Date.now(), void 0, { signal: options.signal });
+			pending.nextPollAt = Date.now() + pending.interval * 1e3;
+			await store.write(credentials);
+			const data = await authRequest(selection, "/device/token", {
+				client_id: "pageship-cli",
+				device_code: pending.deviceCode,
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+			}, options.signal);
+			if (typeof data.access_token === "string" && data.access_token.length > 0) {
+				credentials.token = data.access_token;
+				delete credentials.pending;
+				await store.write(credentials);
+				const access = await getWorkspace(server, {
+					token: credentials.token,
+					signal: options.signal
+				});
+				if (access.status === "signed_out") return {
+					status: access.status,
+					message: `Authorization finished, but the server rejected the new credential. Run ${login("--restart")} to sign in again.`,
+					next: next("--restart")
+				};
+				if (access.status !== "admitted") return {
+					status: access.status,
+					message: "Authorization finished, but workspace access is unavailable. Check your admission with the server owner."
+				};
+				return {
+					...access,
+					status: "authorized",
+					message: `Authorized as ${access.user.name}. Your credential is stored privately for this server.`,
+					token: credentials.token
+				};
+			}
+			if (data.error === "slow_down") {
+				pending.interval += 5;
+				pending.nextPollAt = Date.now() + pending.interval * 1e3;
+				await store.write(credentials);
+			} else if (data.error !== "authorization_pending") {
+				delete credentials.pending;
+				await store.write(credentials);
+				const status = data.error === "access_denied" ? "denied" : data.error === "expired_token" ? "expired" : "invalid_attempt";
+				return {
+					status,
+					message: `Authorization ${status.replaceAll("_", " ")}. Run ${login()} again for a new code.`,
+					...status === "expired" ? { next: next() } : {}
+				};
+			}
+			if (!options.interactive) return pendingResult(pending, selection);
+		} while (!options.signal.aborted);
+		return {
+			status: "interrupted",
+			message: `Authorization interrupted. Run ${login("--complete")} to resume.`,
+			next: next("--complete")
+		};
+	} catch (error) {
+		if (options.signal.aborted) return {
+			status: "interrupted",
+			message: `Authorization interrupted. Run ${login("--complete")} to resume or ${login("--restart")} to start again.`,
+			next: next("--complete")
+		};
+		throw error;
+	} finally {
+		await store.close();
+	}
+}
+async function identify(serverValue, signal) {
+	const selection = selectServer(serverValue);
+	const server = selection.origin;
+	const login = commandLine("login", selection.args);
+	const next = {
+		command: "login",
+		args: selection.args
+	};
+	const compatibility = await checkCompatibility(server, { signal });
+	if (compatibility.status !== "compatible") return {
+		...compatibility,
+		status: compatibility.status
+	};
+	const store = await credentialStore(server, true);
+	try {
+		const { token } = await store.read();
+		if (!token) return {
+			status: "signed_out",
+			message: `This installation is not authorized. Run ${login} to begin.`,
+			next
+		};
+		const access = await getWorkspace(server, {
+			token,
+			signal
+		});
+		return {
+			...access,
+			...access.status === "signed_out" ? { next } : {},
+			message: access.status === "admitted" ? `Signed in as ${access.user.name}. Personal workspace: ${access.workspace.id}${access.installation ? `\nCLI installation: ${access.installation.id}` : ""}` : access.status === "uninvited" ? "This account is not invited. Contact the server owner." : `Your credential was revoked, expired or is invalid. Run ${login} to sign in again.`
+		};
+	} finally {
+		await store.close();
+	}
+}
+//#endregion
+//#region src/documents.ts
+/** Checks compatibility and the stored credential; the server enforces ownership and admission. */
+async function asOwner(serverValue, signal, operation) {
+	const selection = selectServer(serverValue);
+	const server = selection.origin;
+	const next = {
+		command: "login",
+		args: selection.args
+	};
+	const login = commandLine(next.command, next.args);
+	const compatibility = await checkCompatibility(server, { signal });
+	if (compatibility.status !== "compatible") return {
+		...compatibility,
+		status: compatibility.status
+	};
+	const store = await credentialStore(server, true);
+	let token;
+	try {
+		({token} = await store.read());
+	} finally {
+		await store.close();
+	}
+	if (!token) return {
+		status: "signed_out",
+		message: `This installation is not authorized. Run ${login} first.`,
+		next
+	};
+	try {
+		return await operation(selection, {
+			token,
+			signal
+		});
+	} catch (error) {
+		if (!(error instanceof DocumentRequestError && isStatus(error.status))) throw error;
+		return {
+			status: error.status,
+			message: error.status === "signed_out" ? `Your credential was revoked, expired or is invalid. Run ${login} to sign in again.` : error.status === "uninvited" ? "This account is not invited. Contact the server owner." : error.message,
+			...error.status === "signed_out" ? { next } : {}
+		};
+	}
+}
+function listDocuments(options) {
+	return asOwner(options.server, options.signal, async ({ origin, args }, request) => {
+		const page = await getDocuments(origin, {
+			...request,
+			cursor: options.cursor
+		});
+		const next = page.nextCursor ? {
+			command: "list",
+			args: [
+				...args,
+				"--cursor",
+				page.nextCursor
+			]
+		} : void 0;
+		return {
+			...page,
+			...next ? { next } : {},
+			message: [
+				page.documents.length ? "Documents:" : options.cursor ? "No more documents." : "No documents.",
+				...page.documents.map((document) => `${document.id}  ${document.visibility}  ${document.title}\n` + (document.project ? `  project ${document.project}\n` : "") + `  source ${document.sourcePath}\n  current revision ${document.revisionId}\n  ${document.url}`),
+				...next ? [`More documents: run ${commandLine(next.command, next.args)}`] : []
+			].join("\n")
+		};
+	});
+}
+function listRevisions(options) {
+	return asOwner(options.server, options.signal, async ({ origin, args }, request) => {
+		const page = await getDocumentRevisions(origin, options.documentId, {
+			...request,
+			cursor: options.cursor
+		});
+		const next = page.nextCursor ? {
+			command: "history",
+			args: [
+				options.documentId,
+				...args,
+				"--cursor",
+				page.nextCursor
+			]
+		} : void 0;
+		return {
+			...page,
+			documentId: options.documentId,
+			...next ? { next } : {},
+			message: [
+				page.revisions.length ? `Revisions of ${options.documentId}, newest first:` : "No more revisions.",
+				...page.revisions.map((revision) => `${revision.id}${revision.isCurrent ? "  current" : ""}  ${new Date(revision.createdAt).toISOString()}  ${revision.byteLength} bytes\n  ${revision.url}`),
+				...next ? [`More revisions: run ${commandLine(next.command, next.args)}`] : []
+			].join("\n")
+		};
+	});
+}
+function invalidOutput(output, error) {
+	return {
+		status: "invalid_output",
+		output,
+		message: `Could not write ${output}. ${error instanceof Error ? error.message : "Check the path and try again."}`
+	};
+}
+function downloadDocument(options) {
+	const output = resolve(options.output);
+	return asOwner(options.server, options.signal, async ({ origin }, request) => {
+		const bytes = await getDocumentContent(origin, options.documentId, {
+			...request,
+			revisionId: options.revisionId
+		});
+		let file;
+		try {
+			file = await open(output, "wx");
+		} catch (error) {
+			if (error.code === "EEXIST") return {
+				status: "output_exists",
+				output,
+				message: `${output} already exists and was not changed. Choose another --output path or remove the file first.`
+			};
+			return invalidOutput(output, error);
+		}
+		try {
+			await file.writeFile(bytes);
+		} catch (error) {
+			await file.close();
+			await rm(output, { force: true });
+			return invalidOutput(output, error);
+		}
+		await file.close();
+		return {
+			status: "downloaded",
+			documentId: options.documentId,
+			revisionId: options.revisionId ?? null,
+			output,
+			byteLength: bytes.byteLength,
+			message: `Saved ${bytes.byteLength} bytes of ${options.documentId}${options.revisionId ? ` revision ${options.revisionId}` : ""} to ${output}.`
+		};
+	});
+}
+function changeVisibility(options) {
+	return asOwner(options.server, options.signal, async ({ origin }, request) => {
+		const result = await updateDocumentVisibility(origin, options.documentId, options.visibility, request);
+		return {
+			...result,
+			message: result.document.visibility === "public" ? `${result.document.id} is public. Anyone with the URL can read its current revision: ${result.document.url}` : `${result.document.id} is private. Only you can read it after signing in: ${result.document.url}`
+		};
+	});
+}
+function restoreRevision(options) {
+	const { documentId, revisionId, expectedRevisionId } = options;
+	const idempotencyKey = options.idempotencyKey ?? randomUUID();
+	return asOwner(options.server, options.signal, async ({ origin, args }, request) => {
+		const retry = {
+			command: "restore",
+			args: [
+				documentId,
+				...args,
+				"--revision",
+				revisionId,
+				"--expected-revision",
+				expectedRevisionId,
+				"--idempotency-key",
+				idempotencyKey
+			]
+		};
+		let result;
+		try {
+			result = await restoreDocumentRevision(origin, documentId, {
+				revisionId,
+				expectedRevisionId,
+				idempotencyKey
+			}, request);
+		} catch (error) {
+			if (error instanceof DocumentRequestError) throw error;
+			return {
+				status: options.signal.aborted ? "interrupted" : "request_failed",
+				idempotencyKey,
+				message: `Restoration ${options.signal.aborted ? "was interrupted" : "did not finish"} and may have completed. Retry with --idempotency-key ${idempotencyKey}; it returns the original result instead of restoring twice.${options.signal.aborted || !(error instanceof Error) ? "" : ` ${error.message}`}`,
+				next: retry
+			};
+		}
+		if (result.status === "idempotency_conflict") return {
+			...result,
+			idempotencyKey,
+			message: "That idempotency key belongs to a different restoration. Reuse the original arguments, or omit --idempotency-key for a new restoration."
+		};
+		if (result.status === "revision_conflict") return {
+			...result,
+			idempotencyKey,
+			message: `${documentId} changed after you inspected its history. No revision was restored. Its current revision is now ${result.document.revisionId}. Inspect the history again, then restore with --expected-revision ${result.document.revisionId} only if you still want to replace it.`,
+			next: {
+				command: "history",
+				args: [documentId, ...args]
+			}
+		};
+		return {
+			...result,
+			idempotencyKey,
+			message: `Restored revision ${revisionId} as new current revision ${result.document.revisionId}. Earlier revisions remain in history, and ${documentId} stays ${result.document.visibility}: ${result.document.url}`
+		};
+	});
+}
+//#endregion
+//#region src/skill-files.ts
+const frontmatter = /^---\r?\n([\s\S]*?)\r?\n---(?=\r?\n|$)/u;
+/** The CLI version a packed SKILL.md was stamped with, or undefined for an unstamped one. */
+function skillVersion(text) {
+	const fields = frontmatter.exec(text)?.[1];
+	if (fields === void 0) return void 0;
+	return (/^metadata:[ \t]*\r?\n(?:[ \t]+.*\r?\n)*?[ \t]+version:[ \t]*(.+?)[ \t]*$/mu.exec(fields)?.[1])?.replace(/^(["'])(.*)\1$/u, "$2");
+}
+//#endregion
+//#region src/skills.ts
+const isSkillName = (name) => /^pageship(?:-[a-z0-9-]+)?$/u.test(name);
+/** Third-party skills the setup guide offers. The CLI only looks for them. */
+const recommendedSkills = ["frontend-design", "design-taste-frontend"];
+/** The oldest Node major that runs the authoring skills' scripts. */
+const authoringNodeMajor = 20;
+const setupGuide = "https://pageship.dev/setup-guide";
+const installNext = {
+	command: "skills",
+	args: ["install"]
+};
+/** The output of `node --version` from PATH, or undefined when it does not run. */
+const nodeOnPath = () => new Promise((resolve) => {
+	execFile("node", ["--version"], {
+		timeout: 5e3,
+		windowsHide: true
+	}, (error, stdout) => resolve(error ? void 0 : stdout.trim()));
+});
+const Entry = Schema.Union([Schema.Struct({
+	version: Schema.String,
+	hash: Schema.String
+}), Schema.Struct({
+	version: Schema.String,
+	link: Schema.String
+})]);
+/** Maps each folder or link the CLI wrote to what it wrote there. */
+const SkillsRecord = Schema.fromJsonString(Schema.Record(Schema.String, Entry));
+const decodeRecord = Schema.decodeUnknownOption(SkillsRecord);
+const absent = (error) => {
+	if (error.code === "ENOENT" || error.code === "ENOTDIR") return void 0;
+	throw error;
+};
+const isDirectory = (path) => stat(path).then((info) => info.isDirectory(), () => false);
+const hasSkill = (folder) => stat(join(folder, "SKILL.md")).then((info) => info.isFile(), () => false);
+const names = async (path) => (await readdir(path).catch(absent) ?? []).filter(isSkillName).sort();
+/** A hash of a folder's paths and contents. Links count by their target, unfollowed. */
+async function folderHash(path) {
+	const hash = createHash("sha256");
+	const files = (await readdir(path, {
+		recursive: true,
+		withFileTypes: true
+	})).map((entry) => ({
+		entry,
+		name: relative(path, join(entry.parentPath, entry.name))
+	})).map(({ entry, name }) => ({
+		entry,
+		name: name.split("\\").join("/")
+	})).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+	for (const { entry, name } of files) {
+		const full = join(entry.parentPath, entry.name);
+		if (entry.isDirectory()) hash.update(`d ${name}\0`);
+		else if (entry.isSymbolicLink()) hash.update(`l ${name}\0${await readlink(full)}\0`);
+		else {
+			const contents = await readFile(full);
+			hash.update(`f ${name}\0${contents.length}\0`).update(contents);
+		}
+	}
+	return hash.digest("hex");
+}
+/** Whether the folder or link at a path is absent, or still holds what the CLI recorded. */
+async function unchanged(path, entry) {
+	const info = await lstat(path).catch(absent);
+	if (!info) return true;
+	if (!entry) return false;
+	if ("link" in entry) return info.isSymbolicLink() && await readlink(path) === entry.link;
+	return info.isDirectory() && await folderHash(path) === entry.hash;
+}
+/** Copy a folder through a hidden temporary sibling, so an agent never loads half a skill. */
+async function replaceFolder(source, target) {
+	const temporary = join(target, "..", `.${randomUUID()}.tmp`);
+	try {
+		await cp(source, temporary, { recursive: true });
+		await rm(target, {
+			recursive: true,
+			force: true
+		});
+		await rename(temporary, target);
+	} finally {
+		await rm(temporary, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+const parseMajor = (version) => Number(/^v?(\d+)\./u.exec(version)?.[1] ?? NaN);
+const older = (installed, cli) => {
+	const parts = (version) => version.split(/[.+-]/u).slice(0, 3).map(Number);
+	const [a, b] = [parts(installed), parts(cli)];
+	for (let index = 0; index < 3; index++) {
+		if (!(a[index] >= 0)) return true;
+		if (a[index] !== b[index]) return a[index] < b[index];
+	}
+	return false;
+};
+/** The recommended skills and Node that the CLI could not find. It installs none of them. */
+async function findMissing(environment) {
+	const { home } = environment;
+	const cache = join(home, ".claude", "plugins", "cache");
+	const plugins = [];
+	for (const marketplace of await readdir(cache).catch(() => void 0) ?? []) for (const plugin of await readdir(join(cache, marketplace)).catch(() => void 0) ?? []) for (const version of await readdir(join(cache, marketplace, plugin)).catch(() => void 0) ?? []) plugins.push(join(cache, marketplace, plugin, version, "skills"));
+	const missing = [];
+	for (const name of recommendedSkills) {
+		const places = [
+			join(home, ".agents", "skills"),
+			join(home, ".claude", "skills"),
+			...plugins
+		];
+		if (!(await Promise.all(places.map((place) => hasSkill(join(place, name))))).includes(true)) missing.push(name);
+	}
+	const node = await environment.nodeVersion();
+	if (node === void 0 || !(parseMajor(node) >= authoringNodeMajor)) missing.push("node");
+	return missing;
+}
+/** One line naming what was not found, or undefined when everything was. */
+function notFound(missing) {
+	if (missing.length === 0) return void 0;
+	const named = missing.map((entry) => entry === "node" ? `Node ${authoringNodeMajor} or later` : entry);
+	return `${named.length > 1 ? `${named.slice(0, -1).join(", ")} and ${named.at(-1)}` : named[0]} ${named.length > 1 ? "were" : "was"} not found. The setup guide at ${setupGuide} covers them.`;
+}
+/**
+* Whether the Pageship skills in ~/.agents/skills are missing, current, or older than this
+* CLI, and what else was not found. Only reads.
+*/
+async function inspectSkills(environment) {
+	const shipped = await names(environment.source);
+	const versions = await Promise.all(shipped.map((name) => readFile(join(environment.home, ".agents", "skills", name, "SKILL.md"), "utf8").then(skillVersion, () => null)));
+	const skills = versions.every((version) => version === null) ? "missing" : versions.some((version) => version == null || older(version, environment.version)) ? "older" : "current";
+	const missing = await findMissing(environment);
+	const install = commandLine(installNext.command, installNext.args);
+	return {
+		skills,
+		missing,
+		message: [skills === "missing" ? `The Pageship skills are not installed. Run ${install} to install them.` : skills === "older" ? `The installed Pageship skills are older than this CLI (${environment.version}). Run ${install} to update them.` : `The Pageship skills match this CLI (${environment.version}).`, ...[notFound(missing)].filter((line) => line !== void 0)].join("\n")
+	};
+}
+/**
+* Install the packed Pageship skills into ~/.agents/skills, and link them into
+* ~/.claude/skills when ~/.claude exists. It replaces only folders it recorded and that are
+* unchanged since, and otherwise writes nothing unless forced.
+*/
+async function installSkills(environment, { force, signal }) {
+	const { home, version } = environment;
+	const shipped = (await readdir(environment.source).catch(() => [])).filter(isSkillName).sort();
+	if (shipped.length === 0) throw new Error(`This CLI's packed skills are missing from ${environment.source}. Reinstall the CLI, then run the install again.`);
+	const missing = await findMissing(environment);
+	const agents = join(home, ".agents", "skills");
+	const sameFolder = async (path) => await isDirectory(path) && await isDirectory(agents) && await realpath(path) === await realpath(agents);
+	let claude = await isDirectory(join(home, ".claude")) ? join(home, ".claude", "skills") : void 0;
+	if (claude && await sameFolder(claude)) claude = void 0;
+	const roots = claude ? [agents, claude] : [agents];
+	const directory = configDirectory();
+	if (!isAbsolute(directory)) throw new Error("PAGESHIP_CONFIG_DIR must be an absolute private directory.");
+	const recordPath = join(directory, "skills.json");
+	const raw = await readFile(recordPath, "utf8").catch(absent);
+	const record = raw === void 0 ? {} : Option.getOrElse(decodeRecord(raw), () => ({}));
+	const targets = roots.flatMap((root) => shipped.map((name) => join(root, name)));
+	const removed = (await Promise.all(roots.map(async (root) => (await names(root)).filter((name) => !shipped.includes(name)).map((name) => join(root, name)).filter((path) => Object.hasOwn(record, path))))).flat();
+	const modified = [];
+	if (!force) for (const path of [...targets, ...removed]) {
+		signal.throwIfAborted();
+		if (!await unchanged(path, record[path])) modified.push(path);
+	}
+	if (modified.length > 0) {
+		const resolution = {
+			command: "skills",
+			args: ["install", "--force"]
+		};
+		return {
+			status: "skills_modified",
+			message: [
+				"Did not install the Pageship skills. These folders changed after the CLI installed them, or the CLI has no record of installing them:",
+				...modified.map((path) => `  ${path}`),
+				`Nothing was written. To replace them with this CLI's skills and lose those changes, run ${commandLine(resolution.command, resolution.args)}.`,
+				...[notFound(missing)].filter((line) => line !== void 0)
+			].join("\n"),
+			version,
+			folders: modified,
+			missing,
+			resolutions: { force: resolution }
+		};
+	}
+	const next = { ...record };
+	const folders = [];
+	const links = [];
+	signal.throwIfAborted();
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		await mkdir(agents, { recursive: true });
+		if (claude && await sameFolder(claude)) claude = void 0;
+		if (claude) await mkdir(claude, { recursive: true });
+		const hashes = /* @__PURE__ */ new Map();
+		for (const name of shipped) {
+			signal.throwIfAborted();
+			const source = join(environment.source, name);
+			hashes.set(name, await folderHash(source));
+			await replaceFolder(source, join(agents, name));
+			next[join(agents, name)] = {
+				version,
+				hash: hashes.get(name)
+			};
+			folders.push(join(agents, name));
+		}
+		if (claude) for (const name of shipped) {
+			signal.throwIfAborted();
+			const target = join(claude, name);
+			if (environment.platform === "win32") {
+				await replaceFolder(join(environment.source, name), target);
+				next[target] = {
+					version,
+					hash: hashes.get(name)
+				};
+				folders.push(target);
+			} else {
+				await rm(target, {
+					recursive: true,
+					force: true
+				});
+				await symlink(join(agents, name), target, "dir");
+				next[target] = {
+					version,
+					link: join(agents, name)
+				};
+				links.push(target);
+			}
+		}
+		for (const path of removed) {
+			signal.throwIfAborted();
+			await rm(path, {
+				recursive: true,
+				force: true
+			});
+			delete next[path];
+		}
+	} finally {
+		await replaceFile(recordPath, JSON.stringify(next, null, 2));
+	}
+	return {
+		status: "skills_installed",
+		message: [
+			`Installed ${shipped.length} Pageship skills for CLI ${version} in ${agents}.`,
+			...claude ? [environment.platform === "win32" ? `Copied them to ${claude} for Claude Code.` : `Linked them from ${claude} for Claude Code.`] : [],
+			...removed.length > 0 ? [`Removed skills this version no longer ships: ${removed.join(", ")}.`] : [],
+			...[notFound(missing)].filter((line) => line !== void 0)
+		].join("\n"),
+		version,
+		folders,
+		links,
+		removed,
+		missing
+	};
+}
+//#endregion
+//#region src/status.ts
+/**
+* Report whether this installation can publish, using read-only requests. Status never
+* starts authorization, claims an address, opens a browser or writes to the configuration
+* directory, including creating it.
+*/
+async function checkStatus(serverValue, signal, skillsEnvironment) {
+	const [readiness, { message, ...skills }] = await Promise.all([checkReadiness(serverValue, signal), inspectSkills(skillsEnvironment)]);
+	const install = readiness.status === "admitted" && !readiness.next && skills.skills !== "current";
+	return {
+		...readiness,
+		...skills,
+		message: `${readiness.message}\n${message}`,
+		...install ? { next: installNext } : {}
+	};
+}
+async function checkReadiness(serverValue, signal) {
+	const selection = selectServer(serverValue);
+	const server = selection.origin;
+	const loginNext = (...args) => ({
+		command: "login",
+		args: [...selection.args, ...args]
+	});
+	const shown = (next) => commandLine(next.command, next.args);
+	let compatibility;
+	try {
+		compatibility = await checkCompatibility(server, { signal });
+	} catch (error) {
+		if (signal.aborted) throw error;
+		return {
+			status: "unreachable",
+			message: `Could not reach a working Pageship API at ${server}. ${error instanceof Error ? error.message : ""}`.trim()
+		};
+	}
+	const { status, message, ...service } = compatibility;
+	const serviceLine = `${message} Server ${service.server.serverVersion}; supported API majors: ${service.server.supportedApiMajors.join(", ")}.`;
+	if (status !== "compatible") return {
+		...compatibility,
+		status,
+		message: `${serviceLine}\nThis CLI requires API major ${service.requiredApiMajor}.`
+	};
+	let credentials;
+	try {
+		credentials = await inspectCredentials(server);
+	} catch (error) {
+		return {
+			status: "configuration_unreadable",
+			...service,
+			message: `${serviceLine}\nCould not read the Pageship configuration directory ${configDirectory()}. ${error instanceof Error ? error.message : ""}\nFix it, or set PAGESHIP_CONFIG_DIR to another absolute private directory. Then run ${commandLine("status", selection.args)} again.`
+		};
+	}
+	if (!credentials.token) {
+		const pending = credentials.pending;
+		const waiting = pending !== void 0 && pending.expiresAt > Date.now();
+		const next = waiting ? loginNext("--complete") : pending ? loginNext("--restart") : loginNext();
+		return {
+			status: "signed_out",
+			...service,
+			message: waiting ? `${serviceLine}\nNot signed in. An authorization is waiting for browser approval. After approving it, run ${shown(next)}.` : pending ? `${serviceLine}\nNot signed in. The last authorization code expired. Run ${shown(next)} for a new code.` : `${serviceLine}\nNot signed in. Run ${shown(next)} to authorize this installation.`,
+			next
+		};
+	}
+	const access = await getWorkspace(server, {
+		token: credentials.token,
+		signal
+	});
+	if (access.status === "signed_out") return {
+		status: "signed_out",
+		...service,
+		message: `${serviceLine}\nThe stored credential was revoked, expired or is invalid. Run ${shown(loginNext())} to sign in again.`,
+		next: loginNext()
+	};
+	if (access.status === "uninvited") return {
+		status: "uninvited",
+		...service,
+		message: `${serviceLine}\nThis GitHub account is not invited to this Pageship server. Contact the server owner, or run ${shown(loginNext("--restart"))} to use another account.`
+	};
+	const lines = [
+		serviceLine,
+		`Signed in as ${access.user.name}.`,
+		`Personal workspace: ${access.workspace.id}`,
+		...access.installation ? [`CLI installation: ${access.installation.id}`] : []
+	];
+	if (access.address) {
+		lines.push(`Workspace address: ${access.address.hostname}`, "Publishing setup is complete. Status does not check storage or publish anything.");
+		return {
+			...access,
+			...service,
+			message: lines.join("\n")
+		};
+	}
+	const next = loginNext();
+	if (access.address === void 0) {
+		lines.push(`Workspace address: this server does not report it. Run ${shown(next)} to confirm or choose it.`);
+		return {
+			...access,
+			...service,
+			message: lines.join("\n"),
+			next
+		};
+	}
+	lines.push(`Workspace address: not selected yet. Run ${shown(next)} to choose one, then publish.`);
+	return {
+		...access,
+		...service,
+		status: "address_required",
+		message: lines.join("\n"),
+		next
+	};
+}
+//#endregion
+//#region src/cli.ts
 const args = process.argv.slice(2);
 const separator = args.indexOf("--");
 const flagArgs = args.slice(0, separator === -1 ? void 0 : separator);
@@ -1436,72 +2714,100 @@ const parseBoolean = Schema.decodeUnknownOption(Config.Boolean);
 const booleanValue = (value) => Option.getOrUndefined(parseBoolean(value));
 const json = flagArgs.some((arg, index) => arg === "--json" ? booleanValue(flagArgs[index + 1]) !== false : arg.startsWith("--json=") && booleanValue(arg.slice(7)) !== false);
 const jsonFlag = GlobalFlag.setting("json")({ flag: Flag.boolean("json").pipe(Flag.withDefault(false), Flag.withDescription("Emit one JSON result, including errors.")) });
-let outcome;
+let envelope;
+function settle(command, result) {
+	const outcome = outcomes[result.status];
+	envelope = {
+		ok: outcome === "succeeded",
+		command,
+		outcome,
+		...result
+	};
+	process.exitCode = exitCode(result.status);
+}
 const plainFormatter = CliOutput.defaultFormatter({ colors: false });
 const jsonFormatter = {
 	formatCliError: plainFormatter.formatCliError,
 	formatError: plainFormatter.formatError,
 	formatErrors: plainFormatter.formatErrors,
 	formatHelpDoc: (doc) => {
-		outcome = {
-			ok: true,
-			command: "help",
+		settle("help", {
+			status: "help",
+			message: plainFormatter.formatHelpDoc(doc),
 			usage: doc.usage,
-			description: doc.description,
-			help: plainFormatter.formatHelpDoc(doc)
-		};
+			description: doc.description
+		});
 		return "";
 	},
 	formatVersion: (name, version) => {
-		outcome = {
-			ok: true,
-			command: "version",
+		settle("version", {
+			status: "version",
+			message: plainFormatter.formatVersion(name, version),
 			name,
 			version
-		};
+		});
 		return "";
 	}
 };
-const status = Command.make("status", { server: Flag.string("server").pipe(Flag.withDescription("Pageship server HTTP(S) base URL, for example http://localhost:8787.")) }, ({ server }) => Effect.gen(function* () {
-	const result = yield* Effect.tryPromise({
-		try: () => checkCompatibility(server),
-		catch: (error) => error instanceof Error ? error : new Error(String(error))
-	});
-	outcome = {
-		ok: result.status === "compatible",
-		command: "status",
-		...result
-	};
-	process.exitCode = result.status === "compatible" ? 0 : 2;
-	if (!json) yield* Console.log(`${result.message}\nServer ${result.server.serverVersion}; current API major ${result.server.currentApiMajor}; supported API majors: ${result.server.supportedApiMajors.join(", ")}.\nThis CLI requires API major ${result.requiredApiMajor}.`);
-})).pipe(Command.withDescription("Check whether this CLI can use a Pageship server."));
-const serverFlag = Flag.string("server").pipe(Flag.withDescription("Pageship HTTPS origin, or localhost HTTP for development."));
+const validServer = (value) => {
+	try {
+		serverOrigin(value);
+		return true;
+	} catch {
+		return false;
+	}
+};
+const serverFlag = Flag.string("server").pipe(Flag.filter(validServer, () => "Use an HTTPS server origin, or HTTP on localhost for local development, without a path, credentials, query or fragment."), Flag.withDescription("Advanced: use another Pageship server instead of the hosted service. HTTPS origin, or localhost HTTP for development."), Flag.optional);
+const addressChoiceFlag = (description) => Flag.string("address-choice").pipe(Flag.filter((value) => value.length > 0 && value.length <= 100, () => "Use a choiceId returned by login."), Flag.withDescription(description), Flag.optional);
+const skillsEnvironment = {
+	source: fileURLToPath(new URL("./skills/", import.meta.url)),
+	version,
+	home: homedir(),
+	platform: process.platform,
+	nodeVersion: nodeOnPath
+};
+const status = Command.make("status", { server: serverFlag }, ({ server }) => authCommand("status", (signal) => checkStatus(Option.getOrUndefined(server), signal, skillsEnvironment))).pipe(Command.withDescription("Check the service, sign-in, personal workspace, address and Pageship skills without changing anything."));
+const skills = Command.make("skills").pipe(Command.withDescription("Manage the Pageship skills that ship with this CLI."), Command.withSubcommands([Command.make("install", { force: Flag.boolean("force").pipe(Flag.withDefault(false), Flag.withDescription("Replace Pageship skill folders that were changed or not installed by this CLI.")) }, ({ force }) => authCommand("skills", (signal) => installSkills(skillsEnvironment, {
+	force,
+	signal
+}))).pipe(Command.withDescription("Install the Pageship skills in ~/.agents/skills, and link them in ~/.claude/skills when ~/.claude exists."))]));
 const login = Command.make("login", {
-	server: serverFlag,
 	complete: Flag.boolean("complete").pipe(Flag.withDefault(false), Flag.withDescription("Check a pending authorization once, without waiting.")),
-	restart: Flag.boolean("restart").pipe(Flag.withDefault(false), Flag.withDescription("Start a new authorization code."))
-}, ({ server, complete, restart }) => authCommand("login", (signal) => authorize({
-	server,
-	complete,
-	restart,
-	interactive: !json && Boolean(process.stdin.isTTY && process.stdout.isTTY) && !complete,
-	progress: (message) => console.log(message),
-	signal
-}))).pipe(Command.withDescription("Authorize this installation through a browser."));
-const whoami = Command.make("whoami", { server: serverFlag }, ({ server }) => authCommand("whoami", (signal) => identify(server, signal))).pipe(Command.withDescription("Identify your personal workspace using the stored credential."));
+	restart: Flag.boolean("restart").pipe(Flag.withDefault(false), Flag.withDescription("Start a new authorization code.")),
+	addressChoice: addressChoiceFlag("Select a server-generated workspace address choice by its ID."),
+	refreshAddresses: Flag.boolean("refresh-addresses").pipe(Flag.withDefault(false), Flag.withDescription("Replace the offered workspace address choices.")),
+	server: serverFlag
+}, ({ server, complete, restart, addressChoice, refreshAddresses }) => authCommand("login", (signal) => {
+	const terminal = !json && Boolean(process.stdin.isTTY && process.stdout.isTTY);
+	return authorize({
+		server: Option.getOrUndefined(server),
+		complete,
+		restart,
+		addressChoice: Option.getOrUndefined(addressChoice),
+		refreshAddresses,
+		interactive: terminal && !complete,
+		addressInteractive: terminal,
+		progress: (message) => console.log(message),
+		signal
+	});
+})).pipe(Command.withDescription("Authorize this installation through a browser and choose your workspace address."));
+const whoami = Command.make("whoami", { server: serverFlag }, ({ server }) => authCommand("whoami", (signal) => identify(Option.getOrUndefined(server), signal))).pipe(Command.withDescription("Identify your personal workspace using the stored credential."));
+const idempotencyKeyFlag = Flag.string("idempotency-key").pipe(Flag.filter((value) => /^[A-Za-z0-9_-]{8,128}$/u.test(value), () => "Use an 8-128 character idempotency key containing letters, digits, underscores or hyphens."), Flag.withDescription("Retry an uncertain operation with the key its result returned."), Flag.optional);
 const publishCommand = Command.make("publish", {
 	file: Argument.string("file"),
-	server: serverFlag,
-	idempotencyKey: Flag.string("idempotency-key").pipe(Flag.filter((value) => /^[A-Za-z0-9_-]{8,128}$/u.test(value), () => "Use an 8-128 character idempotency key containing letters, digits, underscores or hyphens."), Flag.optional),
+	idempotencyKey: idempotencyKeyFlag,
 	newDocument: Flag.boolean("new").pipe(Flag.withDefault(false), Flag.withDescription("Explicitly create a separate private document, even when the source matches.")),
-	revise: Flag.string("revise").pipe(Flag.filter((value) => isDocumentId(value), () => "Use the six-character candidate document ID."), Flag.optional),
-	expectedRevision: Flag.string("expected-revision").pipe(Flag.filter((value) => isRevisionId(value), () => "Use the candidate's current revision UUID."), Flag.optional),
-	addressChoice: Flag.string("address-choice").pipe(Flag.optional),
-	refreshAddresses: Flag.boolean("refresh-addresses").pipe(Flag.withDefault(false))
-}, ({ file, server, idempotencyKey, addressChoice, refreshAddresses, newDocument, revise, expectedRevision }) => authCommand("publish", (signal) => publish({
+	noMarker: Flag.boolean("no-marker").pipe(Flag.withDefault(false), Flag.withDescription("Publish the file as it is, without adding or changing its document marker.")),
+	revise: Flag.string("revise").pipe(Flag.filter((value) => isDocumentId(value), () => "Use the six-character candidate document ID."), Flag.withDescription("Publish a new revision of this document. Needs --expected-revision."), Flag.optional),
+	expectedRevision: Flag.string("expected-revision").pipe(Flag.filter((value) => isRevisionId(value), () => "Use the candidate's current revision UUID."), Flag.withDescription("The document's current revision, as you last saw it. A newer revision stops the publish."), Flag.optional),
+	addressChoice: addressChoiceFlag("No longer supported. Use login --address-choice."),
+	refreshAddresses: Flag.boolean("refresh-addresses").pipe(Flag.withDefault(false), Flag.withDescription("No longer supported. Use login --refresh-addresses.")),
+	server: serverFlag
+}, ({ file, server, idempotencyKey, addressChoice, refreshAddresses, newDocument, noMarker, revise, expectedRevision }) => authCommand("publish", (signal) => publish({
 	file,
-	server,
+	server: Option.getOrUndefined(server),
 	newDocument,
+	noMarker,
 	revise: Option.getOrUndefined(revise),
 	expectedRevision: Option.getOrUndefined(expectedRevision),
 	idempotencyKey: Option.getOrUndefined(idempotencyKey),
@@ -1510,82 +2816,151 @@ const publishCommand = Command.make("publish", {
 	interactive: !json && Boolean(process.stdin.isTTY && process.stdout.isTTY),
 	signal
 }))).pipe(Command.withDescription("Publish HTML, resolve source matches, or revise a selected document."));
+const documentIdArgument = Argument.string("documentId").pipe(Argument.filter((value) => isDocumentId(value), () => "Use a six-character document ID from list."), Argument.withDescription("Six-character document ID from list."));
+const revisionFlag = (name, description) => Flag.string(name).pipe(Flag.filter((value) => isRevisionId(value), () => "Use a revision UUID from history."), Flag.withDescription(description));
+const list = Command.make("list", {
+	server: serverFlag,
+	cursor: Flag.string("cursor").pipe(Flag.filter((value) => isDocumentId(value), () => "Use the nextCursor document ID from a previous list."), Flag.withDescription("Continue after this nextCursor from a previous page."), Flag.optional)
+}, ({ server, cursor }) => authCommand("list", (signal) => listDocuments({
+	server: Option.getOrUndefined(server),
+	cursor: Option.getOrUndefined(cursor),
+	signal
+}))).pipe(Command.withDescription("List your documents with their IDs, visibility and current revisions, 100 per page."));
+const history = Command.make("history", {
+	documentId: documentIdArgument,
+	server: serverFlag,
+	cursor: revisionFlag("cursor", "Continue after this nextCursor from a previous page.").pipe(Flag.optional)
+}, ({ documentId, server, cursor }) => authCommand("history", (signal) => listRevisions({
+	server: Option.getOrUndefined(server),
+	documentId,
+	cursor: Option.getOrUndefined(cursor),
+	signal
+}))).pipe(Command.withDescription("List a document's revisions, newest first, 50 per page."));
+const download = Command.make("download", {
+	documentId: documentIdArgument,
+	server: serverFlag,
+	output: Flag.string("output").pipe(Flag.withDescription("New file to write the exact HTML bytes to. Existing files are kept.")),
+	revision: revisionFlag("revision", "Download this historical revision instead of the current one.").pipe(Flag.optional)
+}, ({ documentId, server, output, revision }) => authCommand("download", (signal) => downloadDocument({
+	server: Option.getOrUndefined(server),
+	documentId,
+	output,
+	revisionId: Option.getOrUndefined(revision),
+	signal
+}))).pipe(Command.withDescription("Save a document's current or historical HTML to a new file. Visibility is unchanged."));
+const visibility = Command.make("visibility", {
+	documentId: documentIdArgument,
+	visibility: Argument.choice("visibility", ["private", "public"]),
+	server: serverFlag
+}, ({ documentId, visibility, server }) => authCommand("visibility", (signal) => changeVisibility({
+	server: Option.getOrUndefined(server),
+	documentId,
+	visibility,
+	signal
+}))).pipe(Command.withDescription("Make a document private or public."));
+const restore = Command.make("restore", {
+	documentId: documentIdArgument,
+	server: serverFlag,
+	revision: revisionFlag("revision", "Historical revision to restore."),
+	expectedRevision: revisionFlag("expected-revision", "Current revision you inspected. A newer revision makes restore stop."),
+	idempotencyKey: idempotencyKeyFlag
+}, ({ documentId, server, revision, expectedRevision, idempotencyKey }) => authCommand("restore", (signal) => restoreRevision({
+	server: Option.getOrUndefined(server),
+	documentId,
+	revisionId: revision,
+	expectedRevisionId: expectedRevision,
+	idempotencyKey: Option.getOrUndefined(idempotencyKey),
+	signal
+}))).pipe(Command.withDescription("Restore a historical revision's content as a new current revision."));
+/** This invocation as a continuation: its own arguments unchanged, without `--json`. */
+function sameCommand(name) {
+	const rest = [];
+	let named = false;
+	for (let index = 0; index < args.length; index++) {
+		const arg = args[index];
+		if (index < flagArgs.length) {
+			if (arg === "--json") {
+				if (booleanValue(args[index + 1]) !== void 0) index++;
+				continue;
+			}
+			if (arg.startsWith("--json=")) continue;
+			if (!named && arg === name) {
+				named = true;
+				continue;
+			}
+		}
+		rest.push(arg);
+	}
+	return {
+		command: name,
+		args: rest
+	};
+}
 function authCommand(name, operation) {
-	return Effect.tryPromise({
-		try: async () => {
-			const controller = new AbortController();
-			const interrupt = () => controller.abort();
-			process.once("SIGINT", interrupt);
-			process.once("SIGTERM", interrupt);
-			try {
-				const result = await operation(controller.signal).catch((error) => {
-					if (!controller.signal.aborted) throw error;
-					return {
-						status: "interrupted",
-						message: "Operation interrupted. Run the command again to retry; use login --complete to resume a pending authorization."
-					};
-				});
-				const ok = [
-					"authorized",
-					"admitted",
-					"published"
-				].includes(result.status);
-				outcome = {
-					ok,
-					command: name,
-					...result
+	return Effect.promise(async () => {
+		const controller = new AbortController();
+		const interrupt = () => controller.abort();
+		process.once("SIGINT", interrupt);
+		process.once("SIGTERM", interrupt);
+		try {
+			let thrown = false;
+			const result = await operation(controller.signal).catch((error) => {
+				if (controller.signal.aborted) return {
+					status: "interrupted",
+					message: "Operation interrupted. Run the same command again to retry or resume.",
+					next: sameCommand(name)
 				};
-				process.exitCode = ok ? 0 : result.status === "interrupted" ? 130 : [
-					"request_failed",
-					"invalid_file",
-					"invalid_action"
-				].includes(result.status) ? 1 : 2;
-				if (!json) {
-					console.log(result.message);
-					const pending = result;
-					if (typeof pending.verificationUriComplete === "string" && typeof pending.userCode === "string") console.log(`Open ${pending.verificationUriComplete}\nCheck code ${pending.userCode}.\nThen run: pageship login --server ${JSON.stringify(pending.next && pending.next.args[1])} --complete`);
-				}
-			} finally {
-				process.removeListener("SIGINT", interrupt);
-				process.removeListener("SIGTERM", interrupt);
+				thrown = true;
+				return {
+					status: "request_failed",
+					message: error instanceof Error ? error.message : String(error)
+				};
+			});
+			settle(name, result);
+			if (json) return;
+			if (thrown) {
+				console.error(`${name === "status" ? "Could not check status" : name === "skills" ? "Could not install the Pageship skills" : "Pageship request failed"}: ${result.message}`);
+				return;
 			}
-		},
-		catch: (error) => error instanceof Error ? error : new Error(String(error))
+			console.log(result.message);
+			if (typeof result.verificationUriComplete === "string" && typeof result.userCode === "string" && result.next) console.log(`Open ${result.verificationUriComplete}\nCheck code ${result.userCode}.\nThen run: ${commandLine(result.next.command, result.next.args)}`);
+		} finally {
+			process.removeListener("SIGINT", interrupt);
+			process.removeListener("SIGTERM", interrupt);
+		}
 	});
 }
-const command = Command.make("pageship").pipe(Command.withDescription("Pageship publishes private HTML documents.\n\nEarly development: check server API compatibility with the status command. Authorize this installation with login, then publish one HTML file with publish."), Command.withSubcommands([
+const command = Command.make("pageship").pipe(Command.withDescription("Pageship publishes private HTML documents on the hosted Pageship service.\n\nEarly development: check whether this installation is ready with the status command. Authorize this installation with login, then publish one HTML file with publish. Manage published documents with list, history, download, visibility and restore. Install the Pageship skills for your agents with skills install."), Command.withSubcommands([
 	status,
 	login,
 	whoami,
-	publishCommand
+	publishCommand,
+	list,
+	history,
+	download,
+	visibility,
+	restore,
+	skills
 ]), Command.withGlobalFlags([jsonFlag]));
 const effectiveArgs = args.every((arg, index) => arg === "--json" || arg.startsWith("--json=") && booleanValue(arg.slice(7)) !== void 0 || index > 0 && args[index - 1] === "--json" && booleanValue(arg) !== void 0) ? [...args, "--help"] : args;
 const program = Command.runWith(command, {
 	version,
 	renderErrors: !json
 })(effectiveArgs).pipe(Effect.catch((error) => Effect.sync(() => {
-	process.exitCode = 1;
-	const usage = CliError.isCliError(error);
-	const message = usage && error._tag === "ShowHelp" ? error.errors.map((entry) => entry.message).join("\n") : error.message;
-	outcome = {
-		ok: false,
-		error: {
-			code: usage ? "usage_error" : "request_failed",
-			message
-		}
-	};
-	if (!json && !usage) console.error(`${flagArgs.includes("status") ? "Could not check server compatibility" : "Pageship request failed"}: ${message}`);
-	if (!json && usage && error._tag !== "ShowHelp" && error._tag !== "UserError") console.error(message);
+	const help = error._tag === "ShowHelp" ? error : void 0;
+	const subcommand = help?.commandPath[1];
+	const message = !help ? error.message : help.errors.length > 0 ? help.errors.map((entry) => entry.message).join("\n") : `Missing subcommand. Run ${help.commandPath.join(" ")} --help to list them.`;
+	settle(isCommandName(subcommand) ? subcommand : null, {
+		status: "usage_error",
+		message
+	});
+	if (!json && !help && error._tag !== "UserError") console.error(message);
 })), Effect.catchCause((cause) => Effect.sync(() => {
-	process.exitCode = 1;
 	const message = Cause.pretty(cause);
-	outcome = {
-		ok: false,
-		error: {
-			code: "internal_error",
-			message
-		}
-	};
+	settle(null, {
+		status: "internal_error",
+		message
+	});
 	if (!json) console.error(message);
 })), Effect.provide(NodeServices.layer));
 await Effect.runPromise(json ? program.pipe(Effect.provideService(CliOutput.Formatter, jsonFormatter), Effect.provideService(Console.Console, {
@@ -1593,6 +2968,12 @@ await Effect.runPromise(json ? program.pipe(Effect.provideService(CliOutput.Form
 	log: () => {},
 	error: () => {}
 }), Effect.provide(CliConfig.layer({ builtIns: [GlobalFlag.Help, GlobalFlag.Version] }))) : program);
-if (json) console.log(JSON.stringify(outcome));
+if (json) {
+	if (!envelope) settle(null, {
+		status: "internal_error",
+		message: "The command produced no result."
+	});
+	console.log(JSON.stringify(envelope));
+}
 //#endregion
 export {};