pastes 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Pastes.io
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,129 @@
+# pastes
+
+Share text, code, and logs on [pastes.io](https://pastes.io) from your terminal. Pipe something in, get a link back.
+
+```bash
+npx pastes --help
+```
+
+## Install
+
+```bash
+npm install -g pastes
+```
+
+Or run it without installing: `npx pastes`.
+
+Requires Node.js 20 or newer. No runtime dependencies.
+
+## Sign in
+
+```bash
+pastes login
+```
+
+This prints a short code and a link. Open the link on any device — your laptop, your phone — approve the code, and the CLI stores the API key it is issued. Because the code is displayed rather than typed into a browser on the same machine, this works fine over SSH on a box with no GUI.
+
+For CI, containers, and production, skip the login and set an environment variable instead:
+
+```bash
+export PASTES_API_KEY=your-key
+```
+
+Create a key at [pastes.io/profile](https://pastes.io/profile). The CLI reads the key from `--api-key`, then `PASTES_API_KEY`, then its config file — so the environment variable always wins over a stale stored key.
+
+## Use
+
+```bash
+# Pipe anything
+./deploy.sh 2>&1 | pastes
+kubectl logs pod-1 | pastes -t "pod-1 crash" -s logs
+
+# Or point it at a file — title and syntax are inferred from the name
+pastes server.py
+pastes nginx.log --expire 1D
+
+# Read, list, delete
+pastes get frosty-mole-8821 > restored.txt
+pastes ls "crash"
+pastes rm frosty-mole-8821
+```
+
+The paste URL is the only thing written to stdout, so it composes:
+
+```bash
+pastes < error.log | xargs -I{} curl -X POST "$SLACK_WEBHOOK" -d "{\"text\":\"{}\"}"
+```
+
+Everything else — progress, warnings, the clipboard notice — goes to stderr.
+
+## Options
+
+| Option | Description |
+| --- | --- |
+| `-t, --title <title>` | Paste title. Defaults to the filename, or the first line of input. |
+| `-s, --syntax <slug>` | Syntax highlighting. Defaults to the one inferred from the filename, else `txt`. |
+| `-e, --expire <code>` | `10M` `1H` `1D` `1W` `2W` `1M` `6M` `1Y` `N` `SD`. Defaults to `1M`. Free accounts must use `1M`. |
+| `-p, --password <pw>` | Protect the paste with a password. |
+| `--no-copy` | Do not copy the URL to the clipboard. |
+| `--api-key <key>` | Use this key for one command. |
+| `--api-url <url>` | Point at a different host (useful for local development). |
+| `--json` | Print the raw JSON response instead of the URL. |
+| `-q, --quiet` | Suppress the non-essential stderr output. |
+
+## Environment variables
+
+| Variable | Effect |
+| --- | --- |
+| `PASTES_API_KEY` | API key to use. Overrides the stored config. |
+| `PASTES_API_URL` | API base URL. Defaults to `https://pastes.io`. |
+| `PASTES_CONFIG_HOME` | Directory for `config.json`. Defaults to `%APPDATA%\pastes` on Windows, `$XDG_CONFIG_HOME/pastes` or `~/.config/pastes` elsewhere. |
+| `PASTES_NO_BROWSER` | Never launch a browser during `pastes login`; just print the link. |
+
+## Exit codes
+
+| Code | Meaning |
+| --- | --- |
+| `0` | Success. |
+| `1` | The request failed — network error, rejected key, rate limit. |
+| `2` | Usage error — bad flag, missing input, no API key configured. |
+
+## Rate limits
+
+Free accounts have per-window and daily paste-creation limits and a daily cap on API reads and searches. Pro raises the creation limits and removes the read/search cap. See [pastes.io/pricing](https://pastes.io/pricing).
+
+## Programmatic use
+
+```js
+import { PastesClient } from 'pastes';
+
+const client = new PastesClient({
+  apiUrl: 'https://pastes.io',
+  apiKey: process.env.PASTES_API_KEY
+});
+const { success } = await client.createPaste({
+  title: 'Build log',
+  content: log,
+  syntax: 'logs'
+});
+console.log(success.paste_url);
+```
+
+## Development
+
+```bash
+npm install
+npm test
+```
+
+The test suite has no external dependencies — the end-to-end tests run the compiled binary against a local mock of the API, so nothing touches pastes.io and no key is needed.
+
+To point the CLI at a local server while developing:
+
+```bash
+npm run dev -- --api-url http://localhost:3012 --help
+```
+
+## License
+
+MIT

package/dist/api.d.ts

@@ -0,0 +1,61 @@
+export declare class ApiError extends Error {
+    status: number;
+    constructor(status: number, message: string);
+}
+export interface CreatePasteInput {
+    title: string;
+    content: string;
+    syntax: string;
+    expire?: string;
+    password?: string;
+}
+export interface PastesClientOptions {
+    apiUrl: string;
+    apiKey?: string;
+}
+export declare class PastesClient {
+    private apiUrl;
+    private apiKey?;
+    constructor({ apiUrl, apiKey }: PastesClientOptions);
+    private request;
+    createPaste(input: CreatePasteInput): Promise<{
+        success: {
+            slug: string;
+            paste_url: string;
+            messages?: string;
+        };
+    }>;
+    getPaste(slug: string, password?: string): Promise<{
+        success: Record<string, unknown>;
+    }>;
+    listPastes({ query, page }?: {
+        query?: string;
+        page?: number;
+    }): Promise<{
+        data: unknown;
+        page: number;
+    }>;
+    deletePaste(slug: string): Promise<{
+        success: string;
+    }>;
+    whoami(): Promise<{
+        success: {
+            email: string;
+            plan: string;
+        };
+    }>;
+    startDeviceAuth(): Promise<{
+        deviceCode: string;
+        userCode: string;
+        verificationUri: string;
+        verificationUriComplete: string;
+        expiresInSec: number;
+        intervalSec: number;
+    }>;
+    pollDeviceAuth(deviceCode: string): Promise<{
+        status: "pending" | "approved" | "expired" | "slow_down";
+        apiKey?: string;
+        email?: string;
+        intervalSec?: number;
+    }>;
+}

package/dist/api.js

@@ -0,0 +1,91 @@
+export class ApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+/** Pulls the human-readable message out of SvelteKit's error shape. */
+async function readError(response) {
+    const text = await response.text().catch(() => '');
+    if (text) {
+        try {
+            const parsed = JSON.parse(text);
+            const message = parsed?.message || parsed?.error?.message || parsed?.error;
+            if (typeof message === 'string' && message) {
+                return message;
+            }
+        }
+        catch {
+            // Not JSON — fall through to the raw body, which is usually an HTML page.
+        }
+        if (!text.trimStart().startsWith('<') && text.length < 300) {
+            return text.trim();
+        }
+    }
+    return `Request failed with status ${response.status}`;
+}
+export class PastesClient {
+    apiUrl;
+    apiKey;
+    constructor({ apiUrl, apiKey }) {
+        this.apiUrl = apiUrl;
+        this.apiKey = apiKey;
+    }
+    async request(path, { method = 'GET', body } = {}) {
+        const headers = { accept: 'application/json' };
+        if (this.apiKey) {
+            headers.authorization = `Bearer ${this.apiKey}`;
+        }
+        if (body !== undefined) {
+            headers['content-type'] = 'application/json';
+        }
+        let response;
+        try {
+            response = await fetch(`${this.apiUrl}${path}`, {
+                method,
+                headers,
+                body: body === undefined ? undefined : JSON.stringify(body)
+            });
+        }
+        catch (cause) {
+            throw new ApiError(0, `Could not reach ${this.apiUrl} (${cause.message})`);
+        }
+        if (!response.ok) {
+            throw new ApiError(response.status, await readError(response));
+        }
+        return (await response.json());
+    }
+    createPaste(input) {
+        return this.request('/api/paste', { method: 'POST', body: input });
+    }
+    getPaste(slug, password) {
+        if (password) {
+            return this.request(`/api/pastes/${encodeURIComponent(slug)}`, { method: 'POST', body: { password } });
+        }
+        return this.request(`/api/pastes/${encodeURIComponent(slug)}`);
+    }
+    listPastes({ query = '', page = 1 } = {}) {
+        const params = new URLSearchParams();
+        if (query)
+            params.set('q', query);
+        if (page > 1)
+            params.set('page', String(page));
+        const suffix = params.toString() ? `?${params}` : '';
+        return this.request(`/api/pastes${suffix}`);
+    }
+    deletePaste(slug) {
+        return this.request(`/api/pastes/${encodeURIComponent(slug)}`, {
+            method: 'DELETE'
+        });
+    }
+    whoami() {
+        return this.request('/api/cli/whoami');
+    }
+    startDeviceAuth() {
+        return this.request('/api/cli/auth/start', { method: 'POST', body: {} });
+    }
+    pollDeviceAuth(deviceCode) {
+        return this.request('/api/cli/auth/token', { method: 'POST', body: { deviceCode } });
+    }
+}

package/dist/args.d.ts

@@ -0,0 +1,25 @@
+export declare const COMMANDS: readonly ["create", "login", "logout", "whoami", "get", "ls", "rm"];
+export type Command = (typeof COMMANDS)[number];
+export interface ParsedArgs {
+    command: Command;
+    /** Positional argument: a file path for `create`, a slug for `get`/`rm`, a query for `ls`. */
+    target?: string;
+    title?: string;
+    syntax?: string;
+    expire?: string;
+    password?: string;
+    apiKey?: string;
+    apiUrl?: string;
+    page?: number;
+    copy: boolean;
+    quiet: boolean;
+    json: boolean;
+    help: boolean;
+    version: boolean;
+    /** `login --with-key` reads a key from stdin instead of running the device flow. */
+    withKey: boolean;
+}
+export declare class ArgError extends Error {
+}
+export declare function parseArgs(argv: string[]): ParsedArgs;
+export declare const HELP_TEXT = "pastes \u2014 share text, code, and logs on pastes.io\n\nUsage\n  pastes [file]                 Create a paste from a file, or from stdin\n  pastes login                  Connect this machine to your pastes.io account\n  pastes logout                 Forget the stored API key\n  pastes whoami                 Show the account the stored key belongs to\n  pastes get <slug>             Print a paste's content to stdout\n  pastes ls [query]             List your pastes\n  pastes rm <slug>              Delete a paste you own\n\nCreate options\n  -t, --title <title>           Paste title (default: filename, or first line)\n  -s, --syntax <slug>           Syntax highlighting (default: inferred, else txt)\n  -e, --expire <code>           10M 1H 1D 1W 2W 1M 6M 1Y N SD (default: 1M)\n  -p, --password <password>     Protect the paste with a password\n      --no-copy                 Do not copy the URL to the clipboard\n\nGeneral options\n      --api-key <key>           Use this key instead of the stored one\n      --api-url <url>           Override the API base URL\n      --json                    Print the raw JSON response\n  -q, --quiet                   Print only essential output\n  -h, --help                    Show this help\n  -v, --version                 Show the version\n\nExamples\n  ./deploy.sh 2>&1 | pastes\n  pastes server.py --expire 1D\n  kubectl logs pod-1 | pastes -t \"pod-1 crash\" -s logs\n  pastes get frosty-mole-8821 > restored.txt\n\nThe API key is read from --api-key, then PASTES_API_KEY, then the config file.\nSet PASTES_API_KEY in CI and production; run `pastes login` on your own machine.\n";

package/dist/args.js

@@ -0,0 +1,178 @@
+export const COMMANDS = ['create', 'login', 'logout', 'whoami', 'get', 'ls', 'rm'];
+export class ArgError extends Error {
+}
+const FLAG_ALIASES = {
+    '-t': '--title',
+    '-s': '--syntax',
+    '-e': '--expire',
+    '-p': '--password',
+    '-q': '--quiet',
+    '-h': '--help',
+    '-v': '--version'
+};
+const VALUE_FLAGS = new Set([
+    '--title',
+    '--syntax',
+    '--expire',
+    '--password',
+    '--api-key',
+    '--api-url',
+    '--page'
+]);
+const BOOLEAN_FLAGS = new Set([
+    '--quiet',
+    '--json',
+    '--help',
+    '--version',
+    '--copy',
+    '--no-copy',
+    '--with-key'
+]);
+export function parseArgs(argv) {
+    const parsed = {
+        command: 'create',
+        copy: true,
+        quiet: false,
+        json: false,
+        help: false,
+        version: false,
+        withKey: false
+    };
+    const positionals = [];
+    let commandRead = false;
+    let onlyPositionals = false;
+    for (let i = 0; i < argv.length; i++) {
+        const raw = argv[i];
+        if (onlyPositionals) {
+            positionals.push(raw);
+            continue;
+        }
+        if (raw === '--') {
+            onlyPositionals = true;
+            continue;
+        }
+        if (raw.startsWith('-') && raw !== '-') {
+            // Support --flag=value as well as --flag value.
+            const eq = raw.indexOf('=');
+            const name = FLAG_ALIASES[eq === -1 ? raw : raw.slice(0, eq)] || (eq === -1 ? raw : raw.slice(0, eq));
+            const inlineValue = eq === -1 ? undefined : raw.slice(eq + 1);
+            if (VALUE_FLAGS.has(name)) {
+                const value = inlineValue ?? argv[++i];
+                if (value === undefined) {
+                    throw new ArgError(`${name} needs a value`);
+                }
+                applyValueFlag(parsed, name, value);
+                continue;
+            }
+            if (BOOLEAN_FLAGS.has(name)) {
+                if (inlineValue !== undefined) {
+                    throw new ArgError(`${name} does not take a value`);
+                }
+                applyBooleanFlag(parsed, name);
+                continue;
+            }
+            throw new ArgError(`Unknown option ${name}`);
+        }
+        if (!commandRead && COMMANDS.includes(raw)) {
+            parsed.command = raw;
+            commandRead = true;
+            continue;
+        }
+        positionals.push(raw);
+    }
+    if (positionals.length > 1) {
+        throw new ArgError(`Unexpected argument ${positionals[1]}`);
+    }
+    parsed.target = positionals[0];
+    return parsed;
+}
+function applyValueFlag(parsed, name, value) {
+    switch (name) {
+        case '--title':
+            parsed.title = value;
+            return;
+        case '--syntax':
+            parsed.syntax = value;
+            return;
+        case '--expire':
+            parsed.expire = value.toUpperCase();
+            return;
+        case '--password':
+            parsed.password = value;
+            return;
+        case '--api-key':
+            parsed.apiKey = value;
+            return;
+        case '--api-url':
+            parsed.apiUrl = value.replace(/\/+$/, '');
+            return;
+        case '--page': {
+            const page = Number(value);
+            if (!Number.isInteger(page) || page < 1) {
+                throw new ArgError('--page must be a positive integer');
+            }
+            parsed.page = page;
+            return;
+        }
+    }
+}
+function applyBooleanFlag(parsed, name) {
+    switch (name) {
+        case '--quiet':
+            parsed.quiet = true;
+            return;
+        case '--json':
+            parsed.json = true;
+            return;
+        case '--help':
+            parsed.help = true;
+            return;
+        case '--version':
+            parsed.version = true;
+            return;
+        case '--copy':
+            parsed.copy = true;
+            return;
+        case '--no-copy':
+            parsed.copy = false;
+            return;
+        case '--with-key':
+            parsed.withKey = true;
+            return;
+    }
+}
+export const HELP_TEXT = `pastes — share text, code, and logs on pastes.io
+
+Usage
+  pastes [file]                 Create a paste from a file, or from stdin
+  pastes login                  Connect this machine to your pastes.io account
+  pastes logout                 Forget the stored API key
+  pastes whoami                 Show the account the stored key belongs to
+  pastes get <slug>             Print a paste's content to stdout
+  pastes ls [query]             List your pastes
+  pastes rm <slug>              Delete a paste you own
+
+Create options
+  -t, --title <title>           Paste title (default: filename, or first line)
+  -s, --syntax <slug>           Syntax highlighting (default: inferred, else txt)
+  -e, --expire <code>           10M 1H 1D 1W 2W 1M 6M 1Y N SD (default: 1M)
+  -p, --password <password>     Protect the paste with a password
+      --no-copy                 Do not copy the URL to the clipboard
+
+General options
+      --api-key <key>           Use this key instead of the stored one
+      --api-url <url>           Override the API base URL
+      --json                    Print the raw JSON response
+  -q, --quiet                   Print only essential output
+  -h, --help                    Show this help
+  -v, --version                 Show the version
+
+Examples
+  ./deploy.sh 2>&1 | pastes
+  pastes server.py --expire 1D
+  kubectl logs pod-1 | pastes -t "pod-1 crash" -s logs
+  pastes get frosty-mole-8821 > restored.txt
+
+The API key is read from --api-key, then PASTES_API_KEY, then the config file.
+Set PASTES_API_KEY in CI and production; run \`pastes login\` on your own machine.
+`;

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,217 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { ApiError, PastesClient } from './api.js';
+import { ArgError, HELP_TEXT, parseArgs } from './args.js';
+import { clearConfig, configPath, readConfig, resolveApiKey, resolveApiUrl, writeConfig } from './config.js';
+import { LoginError, deviceLogin } from './login.js';
+import { DEFAULT_SYNTAX, deriveTitle, syntaxForFilename } from './syntax.js';
+import { copyToClipboard, fail, hasPipedStdin, note, readStdin } from './terminal.js';
+// Read from package.json so `pastes --version` can never drift from the
+// published version. npm always ships package.json alongside dist/.
+function readVersion() {
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        return JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf8')).version || 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+class UsageError extends Error {
+}
+class AuthError extends Error {
+}
+function buildClient(args, { requireKey = true } = {}) {
+    const config = readConfig();
+    const apiUrl = resolveApiUrl({ flagUrl: args.apiUrl, config });
+    const resolved = resolveApiKey({ flagKey: args.apiKey, config });
+    if (requireKey && !resolved) {
+        throw new AuthError('No API key found.\n' +
+            '  Run `pastes login` to connect this machine, or set PASTES_API_KEY\n' +
+            '  for CI and production environments.');
+    }
+    return {
+        client: new PastesClient({ apiUrl, apiKey: resolved?.apiKey }),
+        apiUrl,
+        source: resolved?.source
+    };
+}
+async function readContent(args) {
+    if (args.target) {
+        try {
+            return readFileSync(args.target, 'utf8');
+        }
+        catch (e) {
+            throw new UsageError(`Could not read ${args.target}: ${e.message}`);
+        }
+    }
+    if (!hasPipedStdin()) {
+        throw new UsageError('Nothing to paste. Pass a file, or pipe input:\n  cat error.log | pastes');
+    }
+    return readStdin();
+}
+async function runCreate(args) {
+    const content = await readContent(args);
+    if (!content.trim()) {
+        throw new UsageError('Refusing to create an empty paste.');
+    }
+    const { client } = buildClient(args);
+    const response = await client.createPaste({
+        title: args.title || deriveTitle({ filename: args.target, content }),
+        content,
+        syntax: args.syntax || syntaxForFilename(args.target) || DEFAULT_SYNTAX,
+        ...(args.expire ? { expire: args.expire } : {}),
+        ...(args.password ? { password: args.password } : {})
+    });
+    if (args.json) {
+        process.stdout.write(`${JSON.stringify(response, null, 2)}\n`);
+        return;
+    }
+    const url = response.success.paste_url;
+    process.stdout.write(`${url}\n`);
+    // Only touch the clipboard for an interactive run; in a pipeline the user is
+    // consuming stdout and a clipboard write would be a surprise.
+    if (args.copy && process.stdout.isTTY && copyToClipboard(url)) {
+        note('  Copied to clipboard.', { quiet: args.quiet });
+    }
+}
+async function runLogin(args) {
+    const { client, apiUrl } = buildClient(args, { requireKey: false });
+    if (args.withKey) {
+        if (!hasPipedStdin()) {
+            throw new UsageError('`--with-key` reads the key from stdin:\n  echo $KEY | pastes login --with-key');
+        }
+        const apiKey = (await readStdin()).trim();
+        if (!apiKey) {
+            throw new UsageError('No key received on stdin.');
+        }
+        const verified = await new PastesClient({ apiUrl, apiKey }).whoami();
+        const path = writeConfig({ ...readConfig(), apiKey, email: verified.success.email, apiUrl });
+        note(`Logged in as ${verified.success.email}. Key saved to ${path}`, { quiet: args.quiet });
+        return;
+    }
+    const result = await deviceLogin({ client, apiUrl, quiet: args.quiet });
+    note('', { quiet: args.quiet });
+    note(`  Logged in as ${result.email}.`, { quiet: args.quiet });
+    note(`  Key saved to ${result.configPath}`, { quiet: args.quiet });
+}
+async function runLogout(args) {
+    const removed = clearConfig();
+    note(removed ? `Removed ${configPath()}` : 'No stored credentials to remove.', {
+        quiet: args.quiet
+    });
+    if (process.env.PASTES_API_KEY) {
+        note('  PASTES_API_KEY is still set in this environment and will keep being used.', {
+            quiet: args.quiet
+        });
+    }
+}
+async function runWhoami(args) {
+    const { client, source } = buildClient(args);
+    const response = await client.whoami();
+    if (args.json) {
+        process.stdout.write(`${JSON.stringify(response, null, 2)}\n`);
+        return;
+    }
+    process.stdout.write(`${response.success.email}\n`);
+    note(`  Plan: ${response.success.plan}  Key from: ${source}`, { quiet: args.quiet });
+}
+async function runGet(args) {
+    if (!args.target) {
+        throw new UsageError('Which paste? Try `pastes get <slug>`.');
+    }
+    const { client } = buildClient(args, { requireKey: false });
+    const response = await client.getPaste(args.target, args.password);
+    if (args.json) {
+        process.stdout.write(`${JSON.stringify(response, null, 2)}\n`);
+        return;
+    }
+    const content = response.success.content;
+    process.stdout.write(typeof content === 'string' ? content : '');
+    if (typeof content === 'string' && !content.endsWith('\n')) {
+        process.stdout.write('\n');
+    }
+}
+async function runList(args) {
+    const { client } = buildClient(args);
+    const response = await client.listPastes({ query: args.target, page: args.page || 1 });
+    if (args.json) {
+        process.stdout.write(`${JSON.stringify(response, null, 2)}\n`);
+        return;
+    }
+    const items = Array.isArray(response.data) ? response.data : [];
+    if (items.length === 0) {
+        note('No pastes found.', { quiet: args.quiet });
+        return;
+    }
+    for (const item of items) {
+        // Tab separated so `pastes ls | cut -f1` gives you a list of slugs.
+        process.stdout.write(`${item.slug}\t${item.title ?? ''}\n`);
+    }
+}
+async function runRemove(args) {
+    if (!args.target) {
+        throw new UsageError('Which paste? Try `pastes rm <slug>`.');
+    }
+    const { client } = buildClient(args);
+    await client.deletePaste(args.target);
+    note(`Deleted ${args.target}`, { quiet: args.quiet });
+}
+function explain(e) {
+    if (e instanceof ApiError) {
+        if (e.status === 401) {
+            return (`${e.message}\n` +
+                '  Run `pastes login`, or check the key in PASTES_API_KEY.');
+        }
+        if (e.status === 429) {
+            return `${e.message}\n  See https://pastes.io/pricing for higher limits.`;
+        }
+        return e.message;
+    }
+    if (e instanceof Error) {
+        return e.message;
+    }
+    return String(e);
+}
+async function main() {
+    let args;
+    try {
+        args = parseArgs(process.argv.slice(2));
+    }
+    catch (e) {
+        fail(e instanceof ArgError ? e.message : String(e));
+        process.stderr.write('\nRun `pastes --help` for usage.\n');
+        process.exitCode = 2;
+        return;
+    }
+    if (args.version) {
+        process.stdout.write(`${readVersion()}\n`);
+        return;
+    }
+    if (args.help) {
+        process.stdout.write(HELP_TEXT);
+        return;
+    }
+    const commands = {
+        create: runCreate,
+        login: runLogin,
+        logout: runLogout,
+        whoami: runWhoami,
+        get: runGet,
+        ls: runList,
+        rm: runRemove
+    };
+    try {
+        await commands[args.command](args);
+    }
+    catch (e) {
+        fail(explain(e));
+        process.exitCode = e instanceof UsageError || e instanceof AuthError ? 2 : 1;
+        if (e instanceof LoginError) {
+            process.exitCode = 1;
+        }
+    }
+}
+void main();

package/dist/config.d.ts

@@ -0,0 +1,33 @@
+export declare const DEFAULT_API_URL = "https://pastes.io";
+export interface StoredConfig {
+    apiKey?: string;
+    email?: string;
+    apiUrl?: string;
+}
+export interface ResolvedKey {
+    apiKey: string;
+    source: 'flag' | 'env' | 'config';
+}
+/**
+ * Windows users expect %APPDATA%; everyone else expects XDG. PASTES_CONFIG_HOME
+ * overrides both, which is what containers and CI images tend to want.
+ */
+export declare function configDir(env?: NodeJS.ProcessEnv): string;
+export declare function configPath(env?: NodeJS.ProcessEnv): string;
+export declare function readConfig(env?: NodeJS.ProcessEnv): StoredConfig;
+export declare function writeConfig(config: StoredConfig, env?: NodeJS.ProcessEnv): string;
+export declare function clearConfig(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Precedence is explicit flag, then environment, then the stored config, so a
+ * production box can override a stale config file without touching disk.
+ */
+export declare function resolveApiKey({ flagKey, env, config }: {
+    flagKey?: string;
+    env?: NodeJS.ProcessEnv;
+    config?: StoredConfig;
+}): ResolvedKey | undefined;
+export declare function resolveApiUrl({ flagUrl, env, config }: {
+    flagUrl?: string;
+    env?: NodeJS.ProcessEnv;
+    config?: StoredConfig;
+}): string;

package/dist/config.js

@@ -0,0 +1,77 @@
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+export const DEFAULT_API_URL = 'https://pastes.io';
+/**
+ * Windows users expect %APPDATA%; everyone else expects XDG. PASTES_CONFIG_HOME
+ * overrides both, which is what containers and CI images tend to want.
+ */
+export function configDir(env = process.env) {
+    if (env.PASTES_CONFIG_HOME) {
+        return env.PASTES_CONFIG_HOME;
+    }
+    if (process.platform === 'win32' && env.APPDATA) {
+        return join(env.APPDATA, 'pastes');
+    }
+    if (env.XDG_CONFIG_HOME) {
+        return join(env.XDG_CONFIG_HOME, 'pastes');
+    }
+    return join(homedir(), '.config', 'pastes');
+}
+export function configPath(env = process.env) {
+    return join(configDir(env), 'config.json');
+}
+export function readConfig(env = process.env) {
+    try {
+        const parsed = JSON.parse(readFileSync(configPath(env), 'utf8'));
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        // A missing or unreadable config is not an error — the env var may carry the key.
+        return {};
+    }
+}
+export function writeConfig(config, env = process.env) {
+    const path = configPath(env);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+    try {
+        // writeFileSync only applies mode when creating, so re-assert it on rewrite.
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // Permissions are advisory on Windows; the write itself already succeeded.
+    }
+    return path;
+}
+export function clearConfig(env = process.env) {
+    try {
+        rmSync(configPath(env));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Precedence is explicit flag, then environment, then the stored config, so a
+ * production box can override a stale config file without touching disk.
+ */
+export function resolveApiKey({ flagKey, env = process.env, config }) {
+    if (flagKey) {
+        return { apiKey: flagKey, source: 'flag' };
+    }
+    const fromEnv = env.PASTES_API_KEY?.trim();
+    if (fromEnv) {
+        return { apiKey: fromEnv, source: 'env' };
+    }
+    const stored = (config ?? readConfig(env)).apiKey?.trim();
+    if (stored) {
+        return { apiKey: stored, source: 'config' };
+    }
+    return undefined;
+}
+export function resolveApiUrl({ flagUrl, env = process.env, config }) {
+    const raw = flagUrl || env.PASTES_API_URL || config?.apiUrl || DEFAULT_API_URL;
+    return raw.replace(/\/+$/, '');
+}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { ApiError, PastesClient } from './api.js';
+export type { CreatePasteInput, PastesClientOptions } from './api.js';
+export { DEFAULT_API_URL, resolveApiKey, resolveApiUrl, readConfig } from './config.js';
+export type { StoredConfig } from './config.js';
+export { DEFAULT_SYNTAX, deriveTitle, syntaxForFilename } from './syntax.js';

package/dist/index.js

@@ -0,0 +1,5 @@
+// Programmatic entry point, so the client can be reused from a script:
+//   import { PastesClient } from 'pastes';
+export { ApiError, PastesClient } from './api.js';
+export { DEFAULT_API_URL, resolveApiKey, resolveApiUrl, readConfig } from './config.js';
+export { DEFAULT_SYNTAX, deriveTitle, syntaxForFilename } from './syntax.js';

package/dist/login.d.ts

@@ -0,0 +1,17 @@
+import { PastesClient } from './api.js';
+export declare class LoginError extends Error {
+}
+/**
+ * RFC 8628-style device flow: we show a short code, the user approves it in any
+ * browser (phone, laptop, doesn't matter), and we poll until the key appears.
+ * This is what makes `pastes login` work over SSH with no GUI on the host.
+ */
+export declare function deviceLogin({ client, apiUrl, quiet, now }: {
+    client: PastesClient;
+    apiUrl: string;
+    quiet?: boolean;
+    now?: () => number;
+}): Promise<{
+    email: string | undefined;
+    configPath: string;
+}>;

package/dist/login.js

@@ -0,0 +1,59 @@
+import { ApiError } from './api.js';
+import { readConfig, writeConfig } from './config.js';
+import { note, openBrowser } from './terminal.js';
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export class LoginError extends Error {
+}
+/**
+ * RFC 8628-style device flow: we show a short code, the user approves it in any
+ * browser (phone, laptop, doesn't matter), and we poll until the key appears.
+ * This is what makes `pastes login` work over SSH with no GUI on the host.
+ */
+export async function deviceLogin({ client, apiUrl, quiet = false, now = () => Date.now() }) {
+    const start = await client.startDeviceAuth();
+    note('', { quiet });
+    note(`  Your code:  ${start.userCode}`, { quiet });
+    note(`  Approve at: ${start.verificationUri}`, { quiet });
+    note('', { quiet });
+    const opened = openBrowser(start.verificationUriComplete);
+    note(opened
+        ? '  Opening your browser... waiting for approval.'
+        : '  Open that link on any device and enter the code. Waiting for approval.', { quiet });
+    const deadline = now() + start.expiresInSec * 1000;
+    let intervalMs = Math.max(1, start.intervalSec) * 1000;
+    while (now() < deadline) {
+        await sleep(intervalMs);
+        let result;
+        try {
+            result = await client.pollDeviceAuth(start.deviceCode);
+        }
+        catch (e) {
+            // A blip in connectivity should not end a login the user is midway through.
+            if (e instanceof ApiError && e.status === 0) {
+                continue;
+            }
+            throw e;
+        }
+        if (result.status === 'approved' && result.apiKey) {
+            const config = {
+                ...readConfig(),
+                apiKey: result.apiKey,
+                email: result.email
+            };
+            if (apiUrl) {
+                config.apiUrl = apiUrl;
+            }
+            const path = writeConfig(config);
+            return { email: result.email, configPath: path };
+        }
+        if (result.status === 'expired') {
+            throw new LoginError('That code expired before it was approved. Run `pastes login` again.');
+        }
+        if (result.status === 'slow_down' && result.intervalSec) {
+            intervalMs = result.intervalSec * 1000;
+        }
+    }
+    throw new LoginError('Timed out waiting for approval. Run `pastes login` again.');
+}

package/dist/syntax.d.ts

@@ -0,0 +1,10 @@
+export declare const DEFAULT_SYNTAX = "txt";
+export declare function syntaxForFilename(filename: string | undefined): string | undefined;
+/**
+ * Titles the paste after the file it came from, or the first meaningful line of
+ * whatever was piped in. The API requires a title, so this always returns one.
+ */
+export declare function deriveTitle({ filename, content }: {
+    filename?: string;
+    content: string;
+}): string;

package/dist/syntax.js

@@ -0,0 +1,97 @@
+// Maps a filename to a pastes.io syntax slug. The slugs mirror
+// services/pastes-web/src/lib/utils/syntax.json; keep them in sync when a new
+// language is activated there.
+const EXTENSION_TO_SYNTAX = {
+    as: 'actionscript',
+    bash: 'bash',
+    bas: 'basic',
+    c: 'c',
+    cc: 'cpp',
+    cjs: 'javascript',
+    cpp: 'cpp',
+    cs: 'csharp',
+    css: 'css',
+    cxx: 'cpp',
+    dart: 'dart',
+    diff: 'diff',
+    dockerfile: 'docker',
+    go: 'go',
+    h: 'c',
+    hh: 'cpp',
+    hpp: 'cpp',
+    htm: 'html',
+    html: 'html',
+    java: 'java',
+    js: 'javascript',
+    json: 'json',
+    jsx: 'jsx',
+    kt: 'kotlin',
+    kts: 'kotlin',
+    log: 'logs',
+    lua: 'lua',
+    markdown: 'markdown',
+    matlab: 'matlab',
+    md: 'markdown',
+    mjs: 'javascript',
+    mmd: 'mermaid',
+    mermaid: 'mermaid',
+    php: 'php',
+    ps1: 'powershell',
+    psm1: 'powershell',
+    patch: 'diff',
+    py: 'python',
+    pyw: 'python',
+    rb: 'ruby',
+    rs: 'rust',
+    sh: 'bash',
+    sql: 'sql',
+    swift: 'swift',
+    ts: 'typescript',
+    tsx: 'typescript',
+    txt: 'txt',
+    yaml: 'yaml',
+    yml: 'yaml',
+    zsh: 'bash'
+};
+// Files that carry their language in the name rather than an extension.
+const FILENAME_TO_SYNTAX = {
+    dockerfile: 'docker',
+    makefile: 'bash',
+    '.bashrc': 'bash',
+    '.zshrc': 'bash'
+};
+export const DEFAULT_SYNTAX = 'txt';
+export function syntaxForFilename(filename) {
+    if (!filename) {
+        return undefined;
+    }
+    const base = filename.replace(/\\/g, '/').split('/').pop() || '';
+    const byName = FILENAME_TO_SYNTAX[base.toLowerCase()];
+    if (byName) {
+        return byName;
+    }
+    const dot = base.lastIndexOf('.');
+    if (dot <= 0 || dot === base.length - 1) {
+        return undefined;
+    }
+    return EXTENSION_TO_SYNTAX[base.slice(dot + 1).toLowerCase()];
+}
+/**
+ * Titles the paste after the file it came from, or the first meaningful line of
+ * whatever was piped in. The API requires a title, so this always returns one.
+ */
+export function deriveTitle({ filename, content }) {
+    if (filename) {
+        const base = filename.replace(/\\/g, '/').split('/').pop();
+        if (base) {
+            return base;
+        }
+    }
+    for (const line of content.split('\n', 20)) {
+        const trimmed = line.trim();
+        if (trimmed) {
+            return trimmed.length > 60 ? `${trimmed.slice(0, 57)}...` : trimmed;
+        }
+    }
+    return 'Untitled paste';
+}

package/dist/terminal.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Everything the user reads goes to stderr so stdout stays a clean pipe:
+ * `pastes < log | pbcopy` must receive the URL and nothing else.
+ */
+export declare function note(message: string, { quiet }?: {
+    quiet?: boolean | undefined;
+}): void;
+export declare function fail(message: string): void;
+export declare function readStdin(): Promise<string>;
+export declare function hasPipedStdin(): boolean;
+/** True when there is plausibly a desktop session that could show a browser. */
+export declare function hasDisplay(): boolean;
+export declare function openBrowser(url: string): boolean;
+/** Best effort: a machine without a clipboard tool is not an error. */
+export declare function copyToClipboard(text: string): boolean;

package/dist/terminal.js

@@ -0,0 +1,94 @@
+import { spawn, spawnSync } from 'node:child_process';
+/**
+ * Everything the user reads goes to stderr so stdout stays a clean pipe:
+ * `pastes < log | pbcopy` must receive the URL and nothing else.
+ */
+export function note(message, { quiet = false } = {}) {
+    if (!quiet) {
+        process.stderr.write(`${message}\n`);
+    }
+}
+export function fail(message) {
+    process.stderr.write(`error: ${message}\n`);
+}
+export function readStdin() {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        process.stdin.on('data', (chunk) => chunks.push(chunk));
+        process.stdin.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        process.stdin.on('error', reject);
+    });
+}
+export function hasPipedStdin() {
+    return !process.stdin.isTTY;
+}
+/** True when there is plausibly a desktop session that could show a browser. */
+export function hasDisplay() {
+    if (process.platform === 'win32' || process.platform === 'darwin') {
+        return true;
+    }
+    if (process.env.SSH_CONNECTION || process.env.SSH_TTY) {
+        return false;
+    }
+    return Boolean(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
+}
+function runDetached(command, args) {
+    try {
+        const child = spawn(command, args, { stdio: 'ignore', detached: true });
+        child.on('error', () => {
+            // Nothing to do — callers always print the URL as a fallback.
+        });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function openBrowser(url) {
+    // Escape hatch for CI, containers, and anyone who does not want their browser
+    // taken over. The link is always printed, so nothing is lost.
+    if (process.env.PASTES_NO_BROWSER) {
+        return false;
+    }
+    if (!hasDisplay()) {
+        return false;
+    }
+    if (process.platform === 'win32') {
+        // `start` is a cmd builtin; the empty string is the (required) window title.
+        return runDetached('cmd', ['/c', 'start', '', url]);
+    }
+    if (process.platform === 'darwin') {
+        return runDetached('open', [url]);
+    }
+    return runDetached('xdg-open', [url]);
+}
+function clipboardCommand() {
+    if (process.platform === 'win32') {
+        return ['clip', []];
+    }
+    if (process.platform === 'darwin') {
+        return ['pbcopy', []];
+    }
+    if (process.env.WAYLAND_DISPLAY) {
+        return ['wl-copy', []];
+    }
+    if (process.env.DISPLAY) {
+        return ['xclip', ['-selection', 'clipboard']];
+    }
+    return undefined;
+}
+/** Best effort: a machine without a clipboard tool is not an error. */
+export function copyToClipboard(text) {
+    const command = clipboardCommand();
+    if (!command) {
+        return false;
+    }
+    try {
+        const result = spawnSync(command[0], command[1], { input: text, stdio: 'pipe' });
+        return !result.error && result.status === 0;
+    }
+    catch {
+        return false;
+    }
+}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "pastes",
+  "version": "0.1.0",
+  "description": "Create and share pastes on pastes.io from your terminal. Pipe logs, upload files, get a link.",
+  "keywords": [
+    "pastes.io",
+    "pastebin",
+    "paste",
+    "cli",
+    "share",
+    "snippet",
+    "logs",
+    "gist"
+  ],
+  "homepage": "https://pastes.io/docs",
+  "bugs": "https://github.com/pastes-io/pastes-cli/issues",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pastes-io/pastes-cli.git"
+  },
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "pastes": "dist/cli.js"
+  },
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "npm run build && node scripts/test.mjs",
+    "prepublishOnly": "npm run build",
+    "dev": "tsx src/cli.ts"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "tsx": "^4.19.2",
+    "typescript": "^5.9.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}