peakurl 0.3.2 → 1.0.0

package/bin/peakurl.js

@@ -4,9 +4,13 @@
 import { readFile as readFile3 } from "fs/promises";
 import { Command, CommanderError, InvalidArgumentError } from "commander";
 
-// src/commands/links.ts
-import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname2, resolve } from "path";
+// src/commands/core.ts
+import { cwd } from "process";
+
+// src/config/store.ts
+import { chmod, mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+import envPaths from "env-paths";
 
 // src/lib/errors.ts
 var CliError = class extends Error {
@@ -29,296 +33,7 @@ function ensureCliError(error) {
   return new CliError("Unexpected error.");
 }
 
-// src/lib/url.ts
-function validateHttpUrl(parsed, label) {
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new CliError(`${label} must use http or https.`);
-  }
-  if (parsed.username || parsed.password) {
-    throw new CliError(`${label} must not include embedded credentials.`);
-  }
-}
-function getApiBaseUrl(value) {
-  const input = value.trim();
-  if (!input) {
-    throw new CliError("A PeakURL API base URL is required.");
-  }
-  let parsed;
-  try {
-    parsed = new URL(input);
-  } catch {
-    throw new CliError(`Invalid API base URL: ${value}`);
-  }
-  validateHttpUrl(parsed, "PeakURL API base URL");
-  parsed.hash = "";
-  parsed.search = "";
-  const pathname = parsed.pathname.replace(/\/+$/, "");
-  if (!/\/api\/v1$/i.test(pathname)) {
-    throw new CliError("PeakURL API base URL must end with /api/v1.");
-  }
-  return `${parsed.origin}${pathname}`;
-}
-function buildApiUrl(apiBaseUrl, path, query) {
-  const cleanBaseUrl = getApiBaseUrl(apiBaseUrl);
-  const cleanPath = path.replace(/^\/+/, "");
-  const url = new URL(cleanPath, `${cleanBaseUrl}/`);
-  for (const [key, value] of Object.entries(query ?? {})) {
-    if (value === void 0 || value === "") {
-      continue;
-    }
-    url.searchParams.set(key, String(value));
-  }
-  return url.toString();
-}
-function normalizeDestinationUrl(value) {
-  const input = value.trim();
-  if (!input) {
-    throw new CliError("A destination URL is required.");
-  }
-  try {
-    const parsed = new URL(input);
-    validateHttpUrl(parsed, "Destination URL");
-    return parsed.toString();
-  } catch (error) {
-    if (error instanceof CliError) {
-      throw error;
-    }
-    throw new CliError(`Invalid destination URL: ${value}`);
-  }
-}
-function normalizeWebhookUrl(value) {
-  const input = value.trim();
-  if (!input) {
-    throw new CliError("A webhook URL is required.");
-  }
-  try {
-    const parsed = new URL(input);
-    validateHttpUrl(parsed, "Webhook URL");
-    return parsed.toString();
-  } catch (error) {
-    if (error instanceof CliError) {
-      throw error;
-    }
-    throw new CliError(`Invalid webhook URL: ${value}`);
-  }
-}
-
-// src/api/client.ts
-function isApiResponse(value) {
-  return Boolean(
-    value && typeof value === "object" && "success" in value && "message" in value && "timestamp" in value
-  );
-}
-function networkError(apiBaseUrl, error) {
-  if (error instanceof Error && error.message) {
-    return `Could not reach PeakURL at ${apiBaseUrl}. ${error.message}`;
-  }
-  return `Could not reach PeakURL at ${apiBaseUrl}.`;
-}
-var ApiClient = class {
-  /**
-   * Creates a client bound to one resolved credential set.
-   *
-   * @param config Explicit API base URL plus bearer API key.
-   */
-  constructor(config) {
-    this.config = config;
-  }
-  config;
-  /**
-   * Loads the currently authenticated user.
-   *
-   * PeakURL accepts bearer API keys on `GET /users/me`, which is also the
-   * CLI login verification flow.
-   *
-   * @returns API response envelope containing the authenticated user.
-   */
-  whoami() {
-    return this.request("GET", "users/me");
-  }
-  /**
-   * Loads the current system status snapshot for the authenticated site.
-   *
-   * @returns API response envelope containing system status sections.
-   */
-  getStatus() {
-    return this.request("GET", "system/status");
-  }
-  /**
-   * Creates a short URL.
-   *
-   * @param payload Request body accepted by `POST /api/v1/urls`.
-   * @returns API response envelope containing the created link.
-   */
-  createUrl(payload) {
-    return this.request("POST", "urls", payload);
-  }
-  /**
-   * Lists short URLs with optional pagination and filtering.
-   *
-   * The current PeakURL app returns `{ items, meta }` under `data`, but the
-   * CLI keeps a slightly broader compatibility type for future-proofing.
-   *
-   * @param query Optional query-string values.
-   * @returns API response envelope containing list data.
-   */
-  listUrls(query) {
-    return this.request("GET", "urls", void 0, query);
-  }
-  /**
-   * Exports the full accessible link dataset for the authenticated user.
-   *
-   * @param query Optional search and sort values.
-   * @returns API response envelope containing the full export payload.
-   */
-  exportUrls(query) {
-    return this.request(
-      "GET",
-      "urls/export",
-      void 0,
-      query
-    );
-  }
-  /**
-   * Imports multiple short links in one bulk request.
-   *
-   * @param payload Request body accepted by `POST /api/v1/urls/bulk`.
-   * @returns API response envelope containing created rows plus row errors.
-   */
-  importUrls(payload) {
-    return this.request("POST", "urls/bulk", payload);
-  }
-  /**
-   * Loads a single short URL by identifier or alias.
-   *
-   * PeakURL resolves IDs, short codes, and aliases through the same route.
-   *
-   * @param idOrAlias Link identifier, short code, or alias.
-   * @returns API response envelope containing the resolved link.
-   */
-  getUrl(idOrAlias) {
-    return this.request(
-      "GET",
-      `urls/${encodeURIComponent(idOrAlias)}`
-    );
-  }
-  /**
-   * Deletes a short URL by its stable row ID.
-   *
-   * The current PeakURL backend delete route expects the row ID. The CLI can
-   * still accept an alias at the command layer by resolving it first.
-   *
-   * @param id Stable link row ID.
-   * @returns API response envelope containing the deletion result.
-   */
-  deleteUrl(id) {
-    return this.request(
-      "DELETE",
-      `urls/${encodeURIComponent(id)}`
-    );
-  }
-  /**
-   * Lists outbound webhooks for the authenticated user.
-   *
-   * @returns API response envelope containing webhook rows.
-   */
-  listWebhooks() {
-    return this.request("GET", "webhooks");
-  }
-  /**
-   * Creates one outbound webhook subscription.
-   *
-   * @param payload Request body accepted by `POST /api/v1/webhooks`.
-   * @returns API response envelope containing the created webhook.
-   */
-  createWebhook(payload) {
-    return this.request("POST", "webhooks", payload);
-  }
-  /**
-   * Deletes one webhook by its stable row ID.
-   *
-   * @param id Webhook identifier returned by the list/create endpoints.
-   * @returns API response envelope containing the deletion result.
-   */
-  deleteWebhook(id) {
-    return this.request(
-      "DELETE",
-      `webhooks/${encodeURIComponent(id)}`
-    );
-  }
-  /**
-   * Performs one authenticated API request and normalizes the response.
-   *
-   * @param method HTTP method to send.
-   * @param path Route path relative to `/api/v1`.
-   * @param body Optional JSON body.
-   * @param query Optional query-string values.
-   * @returns Parsed PeakURL response envelope.
-   * @throws {CliError} When the network request fails or the API returns an error.
-   */
-  async request(method, path, body, query) {
-    const url = buildApiUrl(this.config.apiBaseUrl, path, query);
-    let response;
-    try {
-      response = await fetch(url, {
-        method,
-        headers: {
-          Accept: "application/json",
-          Authorization: `Bearer ${this.config.apiKey}`,
-          ...body ? { "Content-Type": "application/json" } : {}
-        },
-        body: body ? JSON.stringify(body) : void 0
-      });
-    } catch (error) {
-      throw new CliError(networkError(this.config.apiBaseUrl, error), 1, {
-        cause: error instanceof Error ? error : void 0
-      });
-    }
-    const rawText = await response.text();
-    if (!rawText) {
-      if (!response.ok) {
-        throw new CliError(
-          `PeakURL request failed with HTTP ${response.status}.`
-        );
-      }
-      return {
-        success: true,
-        message: "Request completed.",
-        data: void 0,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      };
-    }
-    let parsed;
-    try {
-      parsed = JSON.parse(rawText);
-    } catch {
-      if (!response.ok) {
-        throw new CliError(
-          `PeakURL request failed with HTTP ${response.status}.`
-        );
-      }
-      throw new CliError("PeakURL returned an invalid JSON response.");
-    }
-    if (!isApiResponse(parsed)) {
-      throw new CliError(
-        "PeakURL returned an unexpected response envelope."
-      );
-    }
-    if (!response.ok || !parsed.success) {
-      const statusCode = response.status === 401 ? 2 : 1;
-      throw new CliError(
-        parsed.message || `PeakURL request failed with HTTP ${response.status}.`,
-        statusCode
-      );
-    }
-    return parsed;
-  }
-};
-
 // src/config/store.ts
-import { chmod, mkdir, readFile, unlink, writeFile } from "fs/promises";
-import { dirname, join } from "path";
-import envPaths from "env-paths";
 var CONFIG_FILENAME = "config.json";
 var STATE_FILENAME = "state.json";
 function getConfigPath() {
@@ -469,6 +184,80 @@ var StateStore = class {
   }
 };
 
+// src/lib/url.ts
+function validateHttpUrl(parsed, label) {
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new CliError(`${label} must use http or https.`);
+  }
+  if (parsed.username || parsed.password) {
+    throw new CliError(`${label} must not include embedded credentials.`);
+  }
+}
+function getApiBaseUrl(value) {
+  const input = value.trim();
+  if (!input) {
+    throw new CliError("A PeakURL API base URL is required.");
+  }
+  let parsed;
+  try {
+    parsed = new URL(input);
+  } catch {
+    throw new CliError(`Invalid API base URL: ${value}`);
+  }
+  validateHttpUrl(parsed, "PeakURL API base URL");
+  parsed.hash = "";
+  parsed.search = "";
+  const pathname = parsed.pathname.replace(/\/+$/, "");
+  if (!/\/api\/v1$/i.test(pathname)) {
+    throw new CliError("PeakURL API base URL must end with /api/v1.");
+  }
+  return `${parsed.origin}${pathname}`;
+}
+function buildApiUrl(apiBaseUrl, path, query) {
+  const cleanBaseUrl = getApiBaseUrl(apiBaseUrl);
+  const cleanPath = path.replace(/^\/+/, "");
+  const url = new URL(cleanPath, `${cleanBaseUrl}/`);
+  for (const [key, value] of Object.entries(query ?? {})) {
+    if (value === void 0 || value === "") {
+      continue;
+    }
+    url.searchParams.set(key, String(value));
+  }
+  return url.toString();
+}
+function normalizeDestinationUrl(value) {
+  const input = value.trim();
+  if (!input) {
+    throw new CliError("A destination URL is required.");
+  }
+  try {
+    const parsed = new URL(input);
+    validateHttpUrl(parsed, "Destination URL");
+    return parsed.toString();
+  } catch (error) {
+    if (error instanceof CliError) {
+      throw error;
+    }
+    throw new CliError(`Invalid destination URL: ${value}`);
+  }
+}
+function normalizeWebhookUrl(value) {
+  const input = value.trim();
+  if (!input) {
+    throw new CliError("A webhook URL is required.");
+  }
+  try {
+    const parsed = new URL(input);
+    validateHttpUrl(parsed, "Webhook URL");
+    return parsed.toString();
+  } catch (error) {
+    if (error instanceof CliError) {
+      throw error;
+    }
+    throw new CliError(`Invalid webhook URL: ${value}`);
+  }
+}
+
 // src/lib/auth.ts
 var AUTH_REQUIRED_MESSAGE = "PeakURL credentials are not configured.";
 var EXAMPLE_BASE_URL = "https://example.com/api/v1";
@@ -497,131 +286,44 @@ function getLoginConfig(input, env) {
   const apiKey = input.apiKey?.trim() || env.PEAKURL_API_KEY?.trim();
   if (!apiBaseUrl || !apiKey) {
     throw new CliError(
-      "Missing credentials. Provide --base-url and --api-key, or set PEAKURL_BASE_URL and PEAKURL_API_KEY."
-    );
-  }
-  return {
-    apiBaseUrl: getApiBaseUrl(apiBaseUrl),
-    apiKey
-  };
-}
-async function getAuthConfig(env, store = new ConfigStore()) {
-  const saved = await store.load();
-  const apiBaseUrl = env.PEAKURL_BASE_URL?.trim() || saved?.apiBaseUrl;
-  const apiKey = env.PEAKURL_API_KEY?.trim() || saved?.apiKey;
-  if (!apiBaseUrl || !apiKey) {
-    throw new CliError(AUTH_REQUIRED_MESSAGE, 1, {
-      kind: "auth_required"
-    });
-  }
-  return {
-    apiBaseUrl: getApiBaseUrl(apiBaseUrl),
-    apiKey
-  };
-}
-
-// src/lib/exports.ts
-var EXPORT_HEADERS = [
-  "url",
-  "alias",
-  "title",
-  "password",
-  "expires",
-  "short_url",
-  "clicks",
-  "unique_clicks",
-  "created_at"
-];
-function text(value) {
-  return typeof value === "string" ? value : "";
-}
-function csvValue(value) {
-  const content = value == null ? "" : String(value);
-  if (/[",\r\n]/.test(content)) {
-    return `"${content.replace(/"/g, '""')}"`;
-  }
-  return content;
-}
-function xmlValue(value) {
-  return String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
-}
-function aliasValue(link) {
-  return text(link.alias) || text(link.shortCode);
-}
-function parseFileFormat(value) {
-  const format = value.trim().toLowerCase();
-  if (format === "csv" || format === "json" || format === "xml") {
-    return format;
-  }
-  throw new CliError(
-    `Unsupported file format: ${value}. Use csv, json, or xml.`
-  );
-}
-function getFileFormatFromPath(filePath) {
-  const value = filePath.trim().toLowerCase();
-  if (value.endsWith(".csv")) {
-    return "csv";
-  }
-  if (value.endsWith(".json")) {
-    return "json";
-  }
-  if (value.endsWith(".xml")) {
-    return "xml";
-  }
-  return void 0;
-}
-function getExportFileName(format) {
-  return `peakurl-links.${format}`;
-}
-function buildExportRows(links) {
-  return links.map((link) => ({
-    url: text(link.destinationUrl),
-    alias: aliasValue(link),
-    title: text(link.title),
-    password: "",
-    expires: text(link.expiresAt),
-    short_url: text(link.shortUrl),
-    clicks: typeof link.clicks === "number" ? link.clicks : "",
-    unique_clicks: typeof link.uniqueClicks === "number" ? link.uniqueClicks : "",
-    created_at: text(link.createdAt)
-  }));
-}
-function serializeLinkExport(links, format) {
-  const rows2 = buildExportRows(links);
-  if (format === "json") {
-    return JSON.stringify(rows2, null, 2);
+      "Missing credentials. Provide --base-url and --api-key, or set PEAKURL_BASE_URL and PEAKURL_API_KEY."
+    );
   }
-  if (format === "xml") {
-    const body = rows2.map(
-      (row2) => `  <url>
-    <destinationUrl>${xmlValue(row2.url)}</destinationUrl>
-    <alias>${xmlValue(row2.alias)}</alias>
-    <title>${xmlValue(row2.title)}</title>
-    <password>${xmlValue(row2.password)}</password>
-    <expiresAt>${xmlValue(row2.expires)}</expiresAt>
-    <shortUrl>${xmlValue(row2.short_url)}</shortUrl>
-    <clicks>${xmlValue(row2.clicks)}</clicks>
-    <uniqueClicks>${xmlValue(row2.unique_clicks)}</uniqueClicks>
-    <createdAt>${xmlValue(row2.created_at)}</createdAt>
-  </url>`
-    ).join("\n");
-    return `<urls>
-${body}
-</urls>
-`;
+  return {
+    apiBaseUrl: getApiBaseUrl(apiBaseUrl),
+    apiKey
+  };
+}
+async function getAuthConfig(env, store = new ConfigStore()) {
+  const saved = await store.load();
+  const apiBaseUrl = env.PEAKURL_BASE_URL?.trim() || saved?.apiBaseUrl;
+  const apiKey = env.PEAKURL_API_KEY?.trim() || saved?.apiKey;
+  if (!apiBaseUrl || !apiKey) {
+    throw new CliError(AUTH_REQUIRED_MESSAGE, 1, {
+      kind: "auth_required"
+    });
   }
-  const lines = [
-    EXPORT_HEADERS.join(","),
-    ...rows2.map(
-      (row2) => EXPORT_HEADERS.map((key) => csvValue(row2[key])).join(",")
-    )
-  ];
-  return `${lines.join("\n")}
-`;
+  return {
+    apiBaseUrl: getApiBaseUrl(apiBaseUrl),
+    apiKey
+  };
 }
 
-// src/lib/imports.ts
-import { readFile as readFile2 } from "fs/promises";
+// src/lib/core.ts
+import { createHash } from "crypto";
+import {
+  chmod as chmod2,
+  copyFile,
+  lstat,
+  mkdir as mkdir2,
+  mkdtemp,
+  rm,
+  writeFile as writeFile2
+} from "fs/promises";
+import { tmpdir } from "os";
+import { dirname as dirname2, join as join2, resolve } from "path";
+import { posix as pathPosix } from "path";
+import { inflateRawSync } from "zlib";
 
 // src/lib/output.ts
 function writeStdout(message = "") {
@@ -632,13 +334,27 @@ function writeStderr(message = "") {
   process.stderr.write(`${message}
 `);
 }
+function outputStream(target) {
+  return target === "stdout" ? process.stdout : process.stderr;
+}
+function useColor(target) {
+  return Boolean(outputStream(target).isTTY && !process.env.NO_COLOR);
+}
+function successLine(message, target = "stdout") {
+  const label = useColor(target) ? "\x1B[32mSuccess\x1B[39m" : "Success";
+  return `${label}: ${message}`;
+}
+function errorLine(message, target = "stderr") {
+  const label = useColor(target) ? "\x1B[31mError\x1B[39m" : "Error";
+  return `${label}: ${message}`;
+}
 function writeNoticeBox(title, lines, target = "stderr") {
   const contentLines = lines.length > 0 ? lines : [""];
   const width = Math.max(
     title.length,
     ...contentLines.map((line) => line.length)
   );
-  const stream = target === "stdout" ? process.stdout : process.stderr;
+  const stream = outputStream(target);
   const useTuiBox = stream.isTTY;
   const border = useTuiBox ? {
     topLeft: "\u250C",
@@ -674,7 +390,7 @@ function writeNoticeBox(title, lines, target = "stderr") {
   writeLine(bottomBorder);
 }
 function formatTable(headers, rows2, target = "stdout") {
-  const stream = target === "stdout" ? process.stdout : process.stderr;
+  const stream = outputStream(target);
   const useTuiBox = stream.isTTY;
   const border = useTuiBox ? {
     topLeft: "\u250C",
@@ -710,7 +426,7 @@ function formatTable(headers, rows2, target = "stdout") {
       )
     )
   );
-  const formatTableBorder = (left, join2, right) => `${left}${widths.map((width) => border.horizontal.repeat(width + 2)).join(join2)}${right}`;
+  const formatTableBorder = (left, join3, right) => `${left}${widths.map((width) => border.horizontal.repeat(width + 2)).join(join3)}${right}`;
   const formatTableRow = (cells) => {
     const linesByCell = cells.map(getLines);
     const rowHeight = Math.max(...linesByCell.map((lines) => lines.length));
@@ -735,13 +451,435 @@ function formatTable(headers, rows2, target = "stdout") {
       border.bottomJunction,
       border.bottomRight
     )
-  ].join("\n");
-}
-function writeJson(value) {
-  writeStdout(JSON.stringify(value, null, 2));
+  ].join("\n");
+}
+function formatDetailsTable(rows2, target = "stdout") {
+  return formatTable(["Detail", "Information"], rows2, target);
+}
+function writeJson(value) {
+  writeStdout(JSON.stringify(value, null, 2));
+}
+
+// src/lib/core.ts
+var DEFAULT_RELEASE_API_URL = "https://api.peakurl.org/v1/update";
+var DEFAULT_CORE_PACKAGE_URL = "https://peakurl.org/latest.zip";
+var EOCD_SIGNATURE = 101010256;
+var CENTRAL_DIRECTORY_SIGNATURE = 33639248;
+var LOCAL_FILE_SIGNATURE = 67324752;
+var ZIP_UTF8_FLAG = 2048;
+var ZIP_ENCRYPTED_FLAG = 1;
+function getReleaseApiUrl(env) {
+  const candidate = env.PEAKURL_RELEASE_API_URL?.trim();
+  return validateUrl(candidate || DEFAULT_RELEASE_API_URL, "release feed");
+}
+function getCorePackageUrl(env) {
+  const candidate = env.PEAKURL_CORE_PACKAGE_URL?.trim();
+  return validateUrl(
+    candidate || DEFAULT_CORE_PACKAGE_URL,
+    "package download"
+  );
+}
+function asString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function validateUrl(value, label) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new CliError(`PeakURL ${label} URL is invalid.`);
+  }
+  if (parsed.protocol === "data:") {
+    return parsed.toString();
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password) {
+    throw new CliError(`PeakURL ${label} URL is invalid.`);
+  }
+  return parsed.toString();
+}
+function normalizeSha256(value) {
+  const candidate = asString(value)?.toLowerCase();
+  if (!candidate || !/^[a-f0-9]{64}$/.test(candidate)) {
+    throw new CliError(
+      "PeakURL release metadata is missing a valid SHA-256 checksum."
+    );
+  }
+  return candidate;
+}
+function assertBufferRange(buffer, offset, length, label) {
+  if (offset < 0 || length < 0 || offset + length > buffer.length) {
+    throw new CliError(`PeakURL core package has an invalid ${label}.`);
+  }
+}
+function findEndOfCentralDirectory(buffer) {
+  const start = Math.max(0, buffer.length - 65535 - 22);
+  for (let index = buffer.length - 22; index >= start; index -= 1) {
+    if (buffer.readUInt32LE(index) === EOCD_SIGNATURE) {
+      return index;
+    }
+  }
+  throw new CliError("PeakURL core package is not a valid ZIP archive.");
+}
+function normalizeZipPath(name) {
+  if (!name || name.includes("\0") || name.includes("\\")) {
+    throw new CliError(
+      "PeakURL core package contains an invalid file path."
+    );
+  }
+  const normalized = pathPosix.normalize(name);
+  if (normalized === "." || normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/") || /^[A-Za-z]:/.test(normalized)) {
+    throw new CliError(
+      "PeakURL core package contains an unsafe file path."
+    );
+  }
+  return normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
+}
+function getZipMode(externalAttributes) {
+  return externalAttributes >>> 16 & 65535;
+}
+function isSymbolicLink(mode) {
+  return (mode & 61440) === 40960;
+}
+function parseZipEntries(buffer) {
+  const endOfCentralDirectoryOffset = findEndOfCentralDirectory(buffer);
+  const entryCount = buffer.readUInt16LE(endOfCentralDirectoryOffset + 10);
+  const directoryOffset = buffer.readUInt32LE(
+    endOfCentralDirectoryOffset + 16
+  );
+  if (entryCount === 65535 || directoryOffset === 4294967295) {
+    throw new CliError(
+      "PeakURL core package uses an unsupported ZIP format."
+    );
+  }
+  let cursor = directoryOffset;
+  const entries = [];
+  const seenPaths = /* @__PURE__ */ new Set();
+  for (let index = 0; index < entryCount; index += 1) {
+    assertBufferRange(buffer, cursor, 46, "central directory header");
+    if (buffer.readUInt32LE(cursor) !== CENTRAL_DIRECTORY_SIGNATURE) {
+      throw new CliError(
+        "PeakURL core package has a broken ZIP directory."
+      );
+    }
+    const flags = buffer.readUInt16LE(cursor + 8);
+    const compressionMethod = buffer.readUInt16LE(cursor + 10);
+    const compressedSize = buffer.readUInt32LE(cursor + 20);
+    const uncompressedSize = buffer.readUInt32LE(cursor + 24);
+    const fileNameLength = buffer.readUInt16LE(cursor + 28);
+    const extraFieldLength = buffer.readUInt16LE(cursor + 30);
+    const fileCommentLength = buffer.readUInt16LE(cursor + 32);
+    const externalAttributes = buffer.readUInt32LE(cursor + 38);
+    const localHeaderOffset = buffer.readUInt32LE(cursor + 42);
+    const nameOffset = cursor + 46;
+    assertBufferRange(
+      buffer,
+      nameOffset,
+      fileNameLength + extraFieldLength + fileCommentLength,
+      "central directory entry"
+    );
+    if (flags & ZIP_ENCRYPTED_FLAG) {
+      throw new CliError(
+        "PeakURL core package uses unsupported encrypted ZIP entries."
+      );
+    }
+    if (compressionMethod !== 0 && compressionMethod !== 8) {
+      throw new CliError(
+        "PeakURL core package uses an unsupported ZIP compression method."
+      );
+    }
+    const encoding = flags & ZIP_UTF8_FLAG ? "utf8" : "utf8";
+    const rawName = buffer.subarray(nameOffset, nameOffset + fileNameLength).toString(encoding);
+    const path = normalizeZipPath(rawName);
+    const mode = getZipMode(externalAttributes);
+    const directory = rawName.endsWith("/");
+    if (isSymbolicLink(mode)) {
+      throw new CliError(
+        "PeakURL core package contains unsupported symbolic links."
+      );
+    }
+    if (seenPaths.has(path)) {
+      throw new CliError(
+        "PeakURL core package contains duplicate file paths."
+      );
+    }
+    seenPaths.add(path);
+    entries.push({
+      path,
+      mode,
+      isDirectory: directory,
+      compressedSize,
+      uncompressedSize,
+      compressionMethod,
+      flags,
+      localHeaderOffset
+    });
+    cursor = nameOffset + fileNameLength + extraFieldLength + fileCommentLength;
+  }
+  return entries;
+}
+function getLocalFileData(buffer, entry) {
+  assertBufferRange(buffer, entry.localHeaderOffset, 30, "local file header");
+  if (buffer.readUInt32LE(entry.localHeaderOffset) !== LOCAL_FILE_SIGNATURE) {
+    throw new CliError("PeakURL core package has a broken file header.");
+  }
+  const fileNameLength = buffer.readUInt16LE(entry.localHeaderOffset + 26);
+  const extraFieldLength = buffer.readUInt16LE(entry.localHeaderOffset + 28);
+  const dataOffset = entry.localHeaderOffset + 30 + fileNameLength + extraFieldLength;
+  assertBufferRange(buffer, dataOffset, entry.compressedSize, "file payload");
+  return buffer.subarray(dataOffset, dataOffset + entry.compressedSize);
+}
+function extractZipEntry(buffer, entry) {
+  const compressed = getLocalFileData(buffer, entry);
+  if (entry.compressionMethod === 0) {
+    return compressed;
+  }
+  return inflateRawSync(compressed);
+}
+async function writeZipEntry(buffer, entry, targetPath) {
+  const destinationPath = join2(targetPath, entry.path);
+  if (entry.isDirectory) {
+    await mkdir2(destinationPath, { recursive: true });
+    return;
+  }
+  const content = extractZipEntry(buffer, entry);
+  if (content.length !== entry.uncompressedSize) {
+    throw new CliError(
+      "PeakURL core package failed ZIP size verification."
+    );
+  }
+  await mkdir2(dirname2(destinationPath), { recursive: true });
+  await writeFile2(destinationPath, content);
+  const mode = entry.mode & 511;
+  if (mode > 0) {
+    await chmod2(destinationPath, mode);
+  }
+}
+async function ensureNoEntryConflicts(entries, targetPath, force) {
+  for (const entry of entries) {
+    const destinationPath = join2(targetPath, entry.path);
+    try {
+      const destinationStats = await lstat(destinationPath);
+      if (entry.isDirectory) {
+        if (!destinationStats.isDirectory()) {
+          throw new CliError(
+            `Cannot extract PeakURL core files because '${entry.path}' already exists as a file.`
+          );
+        }
+        continue;
+      }
+      if (destinationStats.isDirectory()) {
+        throw new CliError(
+          `Cannot overwrite '${entry.path}' because it already exists as a directory.`
+        );
+      }
+      if (!force) {
+        throw new CliError(
+          `Cannot extract PeakURL core files because '${entry.path}' already exists. Re-run with --force to overwrite existing files.`
+        );
+      }
+    } catch (error) {
+      const code = error.code;
+      if (code !== "ENOENT") {
+        throw error;
+      }
+    }
+  }
+}
+async function copyExtractedEntries(entries, extractedPath, targetPath) {
+  for (const entry of entries) {
+    const sourcePath = join2(extractedPath, entry.path);
+    const destinationPath = join2(targetPath, entry.path);
+    if (entry.isDirectory) {
+      await mkdir2(destinationPath, { recursive: true });
+      continue;
+    }
+    await mkdir2(dirname2(destinationPath), { recursive: true });
+    await copyFile(sourcePath, destinationPath);
+    const mode = entry.mode & 511;
+    if (mode > 0) {
+      await chmod2(destinationPath, mode);
+    }
+  }
+}
+function countExtractedFiles(entries) {
+  return entries.filter((entry) => !entry.isDirectory).length;
+}
+async function getCoreRelease(env) {
+  const releaseApiUrl = getReleaseApiUrl(env);
+  const response = await fetch(releaseApiUrl, {
+    headers: {
+      accept: "application/json"
+    },
+    redirect: "follow"
+  });
+  if (!response.ok) {
+    throw new CliError("PeakURL release metadata could not be loaded.");
+  }
+  const payload = await response.json();
+  const version = asString(payload.version) || "latest";
+  return {
+    version,
+    downloadUrl: getCorePackageUrl(env),
+    checksumSha256: normalizeSha256(payload.checksumSha256),
+    releasedAt: asString(payload.releasedAt),
+    releaseNotesUrl: asString(payload.releaseNotesUrl)
+  };
+}
+async function downloadCorePackage(release, targetPath, force = false) {
+  const response = await fetch(release.downloadUrl, {
+    headers: {
+      accept: "application/zip, application/octet-stream;q=0.9, */*;q=0.1"
+    },
+    redirect: "follow"
+  });
+  if (!response.ok) {
+    throw new CliError("PeakURL core package could not be downloaded.");
+  }
+  const archive = Buffer.from(await response.arrayBuffer());
+  const checksum = createHash("sha256").update(archive).digest("hex");
+  if (checksum !== release.checksumSha256) {
+    throw new CliError(
+      `Checksum verification failed for PeakURL ${release.version}.`
+    );
+  }
+  const entries = parseZipEntries(archive);
+  const tempRoot = await mkdtemp(join2(tmpdir(), "peakurl-core-"));
+  const extractedPath = join2(tempRoot, "extract");
+  const absoluteTargetPath = resolve(targetPath);
+  try {
+    await mkdir2(extractedPath, { recursive: true });
+    for (const entry of entries) {
+      await writeZipEntry(archive, entry, extractedPath);
+    }
+    await ensureNoEntryConflicts(entries, absoluteTargetPath, force);
+    await copyExtractedEntries(entries, extractedPath, absoluteTargetPath);
+    return {
+      version: release.version,
+      path: absoluteTargetPath,
+      downloadUrl: release.downloadUrl,
+      checksumSha256: release.checksumSha256,
+      checksumVerified: true,
+      fileCount: countExtractedFiles(entries)
+    };
+  } finally {
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+}
+function formatCoreDownload(result) {
+  return formatDetailsTable(
+    [
+      ["Version", result.version],
+      ["Path", result.path],
+      ["Checksum", "Verified (SHA-256)"],
+      ["Files", String(result.fileCount)],
+      ["Source", result.downloadUrl]
+    ],
+    "stdout"
+  );
+}
+
+// src/lib/exports.ts
+var EXPORT_HEADERS = [
+  "url",
+  "alias",
+  "title",
+  "password",
+  "expires",
+  "short_url",
+  "clicks",
+  "unique_clicks",
+  "created_at"
+];
+function text(value) {
+  return typeof value === "string" ? value : "";
+}
+function csvValue(value) {
+  const content = value == null ? "" : String(value);
+  if (/[",\r\n]/.test(content)) {
+    return `"${content.replace(/"/g, '""')}"`;
+  }
+  return content;
+}
+function xmlValue(value) {
+  return String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function aliasValue(link) {
+  return text(link.alias) || text(link.shortCode);
+}
+function parseFileFormat(value) {
+  const format = value.trim().toLowerCase();
+  if (format === "csv" || format === "json" || format === "xml") {
+    return format;
+  }
+  throw new CliError(
+    `Unsupported file format: ${value}. Use csv, json, or xml.`
+  );
+}
+function getFileFormatFromPath(filePath) {
+  const value = filePath.trim().toLowerCase();
+  if (value.endsWith(".csv")) {
+    return "csv";
+  }
+  if (value.endsWith(".json")) {
+    return "json";
+  }
+  if (value.endsWith(".xml")) {
+    return "xml";
+  }
+  return void 0;
+}
+function getExportFileName(format) {
+  return `peakurl-links.${format}`;
+}
+function buildExportRows(links) {
+  return links.map((link) => ({
+    url: text(link.destinationUrl),
+    alias: aliasValue(link),
+    title: text(link.title),
+    password: "",
+    expires: text(link.expiresAt),
+    short_url: text(link.shortUrl),
+    clicks: typeof link.clicks === "number" ? link.clicks : "",
+    unique_clicks: typeof link.uniqueClicks === "number" ? link.uniqueClicks : "",
+    created_at: text(link.createdAt)
+  }));
+}
+function serializeLinkExport(links, format) {
+  const rows2 = buildExportRows(links);
+  if (format === "json") {
+    return JSON.stringify(rows2, null, 2);
+  }
+  if (format === "xml") {
+    const body = rows2.map(
+      (row2) => `  <url>
+    <destinationUrl>${xmlValue(row2.url)}</destinationUrl>
+    <alias>${xmlValue(row2.alias)}</alias>
+    <title>${xmlValue(row2.title)}</title>
+    <password>${xmlValue(row2.password)}</password>
+    <expiresAt>${xmlValue(row2.expires)}</expiresAt>
+    <shortUrl>${xmlValue(row2.short_url)}</shortUrl>
+    <clicks>${xmlValue(row2.clicks)}</clicks>
+    <uniqueClicks>${xmlValue(row2.unique_clicks)}</uniqueClicks>
+    <createdAt>${xmlValue(row2.created_at)}</createdAt>
+  </url>`
+    ).join("\n");
+    return `<urls>
+${body}
+</urls>
+`;
+  }
+  const lines = [
+    EXPORT_HEADERS.join(","),
+    ...rows2.map(
+      (row2) => EXPORT_HEADERS.map((key) => csvValue(row2[key])).join(",")
+    )
+  ];
+  return `${lines.join("\n")}
+`;
 }
 
 // src/lib/imports.ts
+import { readFile as readFile2 } from "fs/promises";
 function text2(value) {
   return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
@@ -1001,7 +1139,7 @@ var LIST_KEYS = ["urls", "items", "results"];
 function asObject(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function asString(value) {
+function asString2(value) {
   return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
 function asNumber(value) {
@@ -1009,7 +1147,7 @@ function asNumber(value) {
 }
 function pickText(link, keys) {
   for (const key of keys) {
-    const value = asString(link[key]);
+    const value = asString2(link[key]);
     if (value) {
       return value;
     }
@@ -1076,21 +1214,24 @@ function getQuietLinkValue(link) {
   return getLinkShortUrl(link) || getLinkAlias(link) || getLinkId(link) || "";
 }
 function formatLinkDetails(link) {
-  const lines = [
+  const rows2 = [
     ["ID", getLinkId(link)],
     ["Alias", getLinkAlias(link)],
     ["Short URL", getLinkShortUrl(link)],
     ["Destination", getLinkDestination(link)],
-    ["Title", asString(link.title)],
-    ["Status", asString(link.status)],
+    ["Title", asString2(link.title)],
+    ["Status", asString2(link.status)],
     [
       "Clicks",
       asNumber(link.clicks) === void 0 ? void 0 : String(link.clicks)
     ],
-    ["Created", asString(link.createdAt)],
-    ["Updated", asString(link.updatedAt)]
+    ["Created", asString2(link.createdAt)],
+    ["Updated", asString2(link.updatedAt)]
   ].filter((entry) => Boolean(entry[1]));
-  return lines.map(([label, value]) => `${label}: ${value}`).join("\n");
+  if (rows2.length === 0) {
+    return "No link fields returned.";
+  }
+  return formatDetailsTable(rows2);
 }
 function formatLinksTable(links) {
   if (links.length === 0) {
@@ -1102,7 +1243,7 @@ function formatLinksTable(links) {
     truncate(getLinkAlias(link) || "-", 12),
     truncate(getLinkShortUrl(link) || "-", 36),
     truncate(getLinkDestination(link) || "-", 52),
-    truncate(asString(link.status) || "-", 12)
+    truncate(asString2(link.status) || "-", 12)
   ]);
   return formatTable(headers, rows2);
 }
@@ -1415,7 +1556,7 @@ function section(title, rows2) {
     return void 0;
   }
   return `${title}
-${formatTable(["Field", "Value"], rows2)}`;
+${formatDetailsTable(rows2)}`;
 }
 function getStatusValue(status2) {
   return text3(getSummary(status2).overall) || "unknown";
@@ -1668,7 +1809,7 @@ function userTable(user) {
   if (rows2.length === 0) {
     return "No user fields returned.";
   }
-  return formatTable(["Field", "Value"], rows2);
+  return formatDetailsTable(rows2);
 }
 
 // src/lib/webhooks.ts
@@ -1771,12 +1912,254 @@ function formatWebhookDetails(webhook) {
   if (rows2.length === 0) {
     return "No webhook fields returned.";
   }
-  return formatTable(["Field", "Value"], rows2);
+  return formatDetailsTable(rows2);
 }
 function formatWebhooksSummary(webhooks) {
   return `${webhooks.length} webhook${webhooks.length === 1 ? "" : "s"} returned.`;
 }
 
+// src/commands/core.ts
+async function downloadCore(options) {
+  const release = await getCoreRelease(process.env);
+  const result = await downloadCorePackage(
+    release,
+    cwd(),
+    Boolean(options.force)
+  );
+  const responseBody = {
+    success: true,
+    message: "PeakURL downloaded.",
+    data: result,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (options.json) {
+    writeJson(responseBody);
+    return;
+  }
+  if (options.quiet) {
+    writeStdout(result.path);
+    return;
+  }
+  writeStdout(successLine(responseBody.message));
+  writeStdout(formatCoreDownload(result));
+}
+
+// src/commands/links.ts
+import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3, resolve as resolve2 } from "path";
+
+// src/api/client.ts
+function isApiResponse(value) {
+  return Boolean(
+    value && typeof value === "object" && "success" in value && "message" in value && "timestamp" in value
+  );
+}
+function networkError(apiBaseUrl, error) {
+  if (error instanceof Error && error.message) {
+    return `Could not reach PeakURL at ${apiBaseUrl}. ${error.message}`;
+  }
+  return `Could not reach PeakURL at ${apiBaseUrl}.`;
+}
+var ApiClient = class {
+  /**
+   * Creates a client bound to one resolved credential set.
+   *
+   * @param config Explicit API base URL plus bearer API key.
+   */
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  /**
+   * Loads the currently authenticated user.
+   *
+   * PeakURL accepts bearer API keys on `GET /users/me`, which is also the
+   * CLI login verification flow.
+   *
+   * @returns API response envelope containing the authenticated user.
+   */
+  whoami() {
+    return this.request("GET", "users/me");
+  }
+  /**
+   * Loads the current system status snapshot for the authenticated site.
+   *
+   * @returns API response envelope containing system status sections.
+   */
+  getStatus() {
+    return this.request("GET", "system/status");
+  }
+  /**
+   * Creates a short URL.
+   *
+   * @param payload Request body accepted by `POST /api/v1/urls`.
+   * @returns API response envelope containing the created link.
+   */
+  createUrl(payload) {
+    return this.request("POST", "urls", payload);
+  }
+  /**
+   * Lists short URLs with optional pagination and filtering.
+   *
+   * The current PeakURL app returns `{ items, meta }` under `data`, but the
+   * CLI keeps a slightly broader compatibility type for future-proofing.
+   *
+   * @param query Optional query-string values.
+   * @returns API response envelope containing list data.
+   */
+  listUrls(query) {
+    return this.request("GET", "urls", void 0, query);
+  }
+  /**
+   * Exports the full accessible link dataset for the authenticated user.
+   *
+   * @param query Optional search and sort values.
+   * @returns API response envelope containing the full export payload.
+   */
+  exportUrls(query) {
+    return this.request(
+      "GET",
+      "urls/export",
+      void 0,
+      query
+    );
+  }
+  /**
+   * Imports multiple short links in one bulk request.
+   *
+   * @param payload Request body accepted by `POST /api/v1/urls/bulk`.
+   * @returns API response envelope containing created rows plus row errors.
+   */
+  importUrls(payload) {
+    return this.request("POST", "urls/bulk", payload);
+  }
+  /**
+   * Loads a single short URL by identifier or alias.
+   *
+   * PeakURL resolves IDs, short codes, and aliases through the same route.
+   *
+   * @param idOrAlias Link identifier, short code, or alias.
+   * @returns API response envelope containing the resolved link.
+   */
+  getUrl(idOrAlias) {
+    return this.request(
+      "GET",
+      `urls/${encodeURIComponent(idOrAlias)}`
+    );
+  }
+  /**
+   * Deletes a short URL by its stable row ID.
+   *
+   * The current PeakURL backend delete route expects the row ID. The CLI can
+   * still accept an alias at the command layer by resolving it first.
+   *
+   * @param id Stable link row ID.
+   * @returns API response envelope containing the deletion result.
+   */
+  deleteUrl(id) {
+    return this.request(
+      "DELETE",
+      `urls/${encodeURIComponent(id)}`
+    );
+  }
+  /**
+   * Lists outbound webhooks for the authenticated user.
+   *
+   * @returns API response envelope containing webhook rows.
+   */
+  listWebhooks() {
+    return this.request("GET", "webhooks");
+  }
+  /**
+   * Creates one outbound webhook subscription.
+   *
+   * @param payload Request body accepted by `POST /api/v1/webhooks`.
+   * @returns API response envelope containing the created webhook.
+   */
+  createWebhook(payload) {
+    return this.request("POST", "webhooks", payload);
+  }
+  /**
+   * Deletes one webhook by its stable row ID.
+   *
+   * @param id Webhook identifier returned by the list/create endpoints.
+   * @returns API response envelope containing the deletion result.
+   */
+  deleteWebhook(id) {
+    return this.request(
+      "DELETE",
+      `webhooks/${encodeURIComponent(id)}`
+    );
+  }
+  /**
+   * Performs one authenticated API request and normalizes the response.
+   *
+   * @param method HTTP method to send.
+   * @param path Route path relative to `/api/v1`.
+   * @param body Optional JSON body.
+   * @param query Optional query-string values.
+   * @returns Parsed PeakURL response envelope.
+   * @throws {CliError} When the network request fails or the API returns an error.
+   */
+  async request(method, path, body, query) {
+    const url = buildApiUrl(this.config.apiBaseUrl, path, query);
+    let response;
+    try {
+      response = await fetch(url, {
+        method,
+        headers: {
+          Accept: "application/json",
+          Authorization: `Bearer ${this.config.apiKey}`,
+          ...body ? { "Content-Type": "application/json" } : {}
+        },
+        body: body ? JSON.stringify(body) : void 0
+      });
+    } catch (error) {
+      throw new CliError(networkError(this.config.apiBaseUrl, error), 1, {
+        cause: error instanceof Error ? error : void 0
+      });
+    }
+    const rawText = await response.text();
+    if (!rawText) {
+      if (!response.ok) {
+        throw new CliError(
+          `PeakURL request failed with HTTP ${response.status}.`
+        );
+      }
+      return {
+        success: true,
+        message: "Request completed.",
+        data: void 0,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(rawText);
+    } catch {
+      if (!response.ok) {
+        throw new CliError(
+          `PeakURL request failed with HTTP ${response.status}.`
+        );
+      }
+      throw new CliError("PeakURL returned an invalid JSON response.");
+    }
+    if (!isApiResponse(parsed)) {
+      throw new CliError(
+        "PeakURL returned an unexpected response envelope."
+      );
+    }
+    if (!response.ok || !parsed.success) {
+      const statusCode = response.status === 401 ? 2 : 1;
+      throw new CliError(
+        parsed.message || `PeakURL request failed with HTTP ${response.status}.`,
+        statusCode
+      );
+    }
+    return parsed;
+  }
+};
+
 // src/commands/links.ts
 function normalizeExpiresAt(value) {
   if (!value) {
@@ -1810,7 +2193,7 @@ async function createLink(destinationUrl, options) {
     writeStdout(getQuietLinkValue(response.data));
     return;
   }
-  writeStdout(response.message);
+  writeStdout(successLine(response.message));
   writeStdout(formatLinkDetails(response.data));
 }
 async function importLinks(filePath, options) {
@@ -1833,7 +2216,7 @@ async function importLinks(filePath, options) {
     }
     return;
   }
-  writeStdout(response.message);
+  writeStdout(successLine(response.message));
   if (links.length > 0) {
     writeStdout(formatLinksTable(links));
   } else {
@@ -1861,10 +2244,10 @@ async function exportLinks(options) {
     process.stdout.write(content);
     return;
   }
-  const filePath = resolve(options.output || getExportFileName(format));
+  const filePath = resolve2(options.output || getExportFileName(format));
   try {
-    await mkdir2(dirname2(filePath), { recursive: true });
-    await writeFile2(filePath, content, "utf8");
+    await mkdir3(dirname3(filePath), { recursive: true });
+    await writeFile3(filePath, content, "utf8");
   } catch (error) {
     throw new CliError(`Could not write export file ${filePath}.`, 1, {
       cause: error instanceof Error ? error : void 0
@@ -1874,7 +2257,7 @@ async function exportLinks(options) {
     writeStdout(filePath);
     return;
   }
-  writeStdout(response.message);
+  writeStdout(successLine(response.message));
   writeStdout(
     `Saved ${links.length} link${links.length === 1 ? "" : "s"} to ${filePath}.`
   );
@@ -1902,7 +2285,7 @@ async function listLinks(options) {
     }
     return;
   }
-  writeStdout(response.message);
+  writeStdout(successLine(response.message));
   writeStdout(formatLinksTable(links));
   writeStdout(formatListSummary(response.data, links.length));
 }
@@ -1917,7 +2300,7 @@ async function getLink(idOrAlias, options) {
     writeStdout(getQuietLinkValue(response.data));
     return;
   }
-  writeStdout(response.message);
+  writeStdout(successLine(response.message));
   writeStdout(formatLinkDetails(response.data));
 }
 async function deleteLink(idOrAlias, options) {
@@ -1938,7 +2321,7 @@ async function deleteLink(idOrAlias, options) {
   if (options.quiet) {
     return;
   }
-  writeStdout(response.message);
+  writeStdout(successLine(response.message));
 }
 
 // src/commands/login.ts
@@ -1963,7 +2346,9 @@ async function login(options) {
   if (options.quiet) {
     return;
   }
-  writeStdout(`Saved credentials for ${credentials.apiBaseUrl}`);
+  writeStdout(
+    successLine(`Saved credentials for ${credentials.apiBaseUrl}.`)
+  );
   writeStdout(`Authenticated as ${userLabel(response.data)}`);
   writeStdout(userTable(response.data));
 }
@@ -1995,7 +2380,7 @@ async function logout(options) {
   if (options.quiet) {
     return;
   }
-  writeStdout(message);
+  writeStdout(successLine(message));
   if (envConfig) {
     writeStdout(
       "Environment credentials in PEAKURL_BASE_URL or PEAKURL_API_KEY still apply in this shell."
@@ -2015,7 +2400,7 @@ async function status(options) {
     writeStdout(getStatusValue(response.data));
     return;
   }
-  writeStdout(response.message);
+  writeStdout(successLine(response.message));
   writeStdout(formatStatusReport(response.data));
 }
 
@@ -2042,7 +2427,11 @@ async function checkUpdate(options, currentVersion) {
   }
   if (!status2.isOutdated) {
     if (!options.quiet) {
-      writeStdout(`PeakURL CLI ${status2.currentVersion} is up to date.`);
+      writeStdout(
+        successLine(
+          `PeakURL CLI ${status2.currentVersion} is up to date.`
+        )
+      );
     }
     return;
   }
@@ -2077,7 +2466,7 @@ async function listWebhooks(options) {
     }
     return;
   }
-  writeStdout(response.message);
+  writeStdout(successLine(response.message));
   writeStdout(formatWebhooksTable(response.data ?? []));
   writeStdout(formatWebhooksSummary(response.data ?? []));
 }
@@ -2101,7 +2490,7 @@ async function createWebhook(url, options) {
     writeStdout(getQuietWebhookValue(response.data));
     return;
   }
-  writeStdout(response.message);
+  writeStdout(successLine(response.message));
   writeStdout(formatWebhookDetails(response.data));
   if (response.data.secret) {
     writeStdout("Save the signing secret now. PeakURL only shows it once.");
@@ -2117,7 +2506,7 @@ async function deleteWebhook(id, options) {
   if (options.quiet) {
     return;
   }
-  writeStdout(response.message);
+  writeStdout(successLine(response.message));
 }
 async function listWebhookEvents(options) {
   const response = {
@@ -2136,7 +2525,7 @@ async function listWebhookEvents(options) {
     }
     return;
   }
-  writeStdout(response.message);
+  writeStdout(successLine(response.message));
   writeStdout(formatWebhookEventsTable());
 }
 
@@ -2152,7 +2541,7 @@ async function whoami(options) {
     writeStdout(userValue(response.data));
     return;
   }
-  writeStdout(response.message);
+  writeStdout(successLine(response.message));
   writeStdout(userTable(response.data));
 }
 
@@ -2211,6 +2600,7 @@ Get Started:
 
 Common Commands:
   peakurl status
+  peakurl core download
   peakurl list --limit 10
   peakurl import ./links.csv
   peakurl export --format csv
@@ -2255,6 +2645,17 @@ Run 'peakurl <command> --help' for command-specific flags and examples.`
     program.command("status").summary("Show site system status").description("Show the current PeakURL system status snapshot.").helpOption("-h, --help", "Show help").option("--json", "Print machine-readable output").option("--quiet", "Print only the overall health value").action(status),
     ["peakurl status", "peakurl status --json", "peakurl status --quiet"]
   );
+  const core = program.command("core").summary("Manage PeakURL core files").helpOption("-h, --help", "Show help").description("Manage PeakURL core package downloads.");
+  addExamples(core, [
+    "peakurl core download",
+    "peakurl core download --force"
+  ]);
+  addExamples(
+    core.command("download").summary("Download the core package").description(
+      "Download the latest PeakURL core package, verify its checksum, and extract it into the current directory."
+    ).helpOption("-h, --help", "Show help").option("--force", "Overwrite existing files when needed").option("--json", "Print machine-readable output").option("--quiet", "Print only the extracted path").action(downloadCore),
+    ["peakurl core download", "peakurl core download --force --json"]
+  );
   addExamples(
     program.command("create").summary("Create a short link").description("Create a PeakURL short link.").helpOption("-h, --help", "Show help").argument("<url>", "Destination URL to shorten").option("--alias <alias>", "Custom alias for the short link").option("--title <title>", "Title to store with the short link").option("--password <password>", "Password-protect the short link").option(
       "--status <status>",
@@ -2354,7 +2755,7 @@ Run 'peakurl <command> --help' for command-specific flags and examples.`
     const cliError = ensureCliError(error);
     if (cliError.kind === "auth_required") {
       const commandName = getRetryCommandName(process.argv);
-      writeStderr("Authentication required.");
+      writeStderr(errorLine("Authentication required."));
       writeStderr("PeakURL could not find credentials for this command.");
       writeStderr(
         "Use one of the first two steps below, then run the last command."
@@ -2367,7 +2768,7 @@ Run 'peakurl <command> --help' for command-specific flags and examples.`
         )
       );
     } else {
-      writeStderr(cliError.message);
+      writeStderr(errorLine(cliError.message));
     }
     process.exit(cliError.exitCode);
   }