percher 0.5.0 → 0.5.2

package/dist/bin/percher.js

@@ -104962,249 +104962,26 @@ async function cacheReset(ctx, input = {}) {
   }
   return ctx.client.apps.resetCache(name);
 }
-// ../core/dist/commands/create.js
-import { join as join6, resolve as resolve4 } from "node:path";
-
-// ../core/dist/templates.js
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync4, statSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { basename, join as join5, normalize, relative, resolve as resolve3 } from "node:path";
-var __dirname = "C:\\dev\\Percher\\packages\\core\\dist";
-var TEMPLATES_DIR = resolve3(import.meta.dirname ?? __dirname, "../templates");
-var PLACEHOLDER = "__APP_NAME__";
-function listTemplates() {
-  return readdirSync(TEMPLATES_DIR).filter((name) => {
-    const full = join5(TEMPLATES_DIR, name);
-    return statSync(full).isDirectory();
-  });
-}
-function scaffoldTemplate(input) {
-  const { template, appName, targetDir, force } = input;
-  const available = listTemplates();
-  if (!available.includes(template)) {
-    throw new Error(`Unknown template "${template}". Available: ${available.join(", ")}`);
-  }
-  const absTarget = resolve3(targetDir);
-  if (existsSync3(absTarget)) {
-    const entries = readdirSync(absTarget);
-    if (entries.length > 0 && !force) {
-      throw new Error(`Target directory "${absTarget}" is not empty. Use --force to overwrite.`);
-    }
-  }
-  const srcDir = join5(TEMPLATES_DIR, template);
-  const files = [];
-  function copyDir(src, dest) {
-    mkdirSync3(dest, { recursive: true });
-    for (const entry of readdirSync(src)) {
-      const srcPath = join5(src, entry);
-      const destPath = join5(dest, entry);
-      const rel = relative(absTarget, normalize(destPath));
-      if (rel.startsWith("..") || resolve3(destPath) === resolve3(absTarget, "..", basename(absTarget))) {
-        throw new Error(`Template contains path traversal: ${entry}`);
-      }
-      if (statSync(srcPath).isDirectory()) {
-        copyDir(srcPath, destPath);
-      } else {
-        if (existsSync3(destPath) && !force) {
-          continue;
-        }
-        let content = readFileSync4(srcPath, "utf-8");
-        content = content.replaceAll(PLACEHOLDER, appName);
-        content = content.replace(/\r\n/g, `
-`);
-        writeFileSync3(destPath, content, "utf-8");
-        files.push(relative(absTarget, destPath).replace(/\\/g, "/"));
-      }
-    }
-  }
-  copyDir(srcDir, absTarget);
-  return { files };
-}
-
-// ../core/dist/commands/create.js
-var createInputSchema = exports_external.object({
-  name: exports_external.string().regex(APP_NAME_RE, "must be 3-40 chars, lowercase, start with a letter, [a-z0-9-] only"),
-  template: exports_external.string().min(1, "Template is required"),
-  directory: exports_external.string().optional(),
-  force: exports_external.boolean().optional()
-});
-async function create(ctx, input) {
-  const available = listTemplates();
-  if (!available.includes(input.template)) {
-    throw new PercherCoreError(`Unknown template "${input.template}". Available: ${available.join(", ")}`, {
-      code: "create.invalid-template",
-      hint: `Run "percher create --list-templates" to see available templates.`
-    });
-  }
-  let targetDir;
-  if (input.directory) {
-    targetDir = resolve4(ctx.cwd, input.directory);
-    if (!targetDir.startsWith(resolve4(ctx.cwd))) {
-      throw new PercherCoreError("Directory must be within the current workspace", {
-        code: "create.failed"
-      });
-    }
-  } else {
-    targetDir = join6(ctx.cwd, input.name);
-  }
-  try {
-    const result = scaffoldTemplate({
-      template: input.template,
-      appName: input.name,
-      targetDir,
-      force: input.force
-    });
-    return {
-      ...result,
-      name: input.name,
-      template: input.template,
-      directory: targetDir
-    };
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (msg.includes("not empty")) {
-      throw new PercherCoreError(msg, {
-        code: "create.dir-not-empty",
-        hint: "Use --force to overwrite existing files."
-      });
-    }
-    throw new PercherCoreError(msg, { code: "create.failed" });
-  }
-}
-// ../core/dist/commands/dashboard.js
-var dashboardInputSchema = exports_external.object({
-  app: exports_external.string().optional(),
-  tab: exports_external.string().optional()
-});
-var DEFAULT_BASE = "https://percher.app";
-var TAB_SHAPE = /^[a-z][a-z0-9-]{0,31}$/;
-var SETTINGS_ANCHOR_TABS = new Set(["github", "env", "domains", "crash-diagnosis"]);
-async function dashboard(ctx, input = {}) {
-  const name = input.app ?? readPercherTomlAppName(ctx.cwd);
-  if (!name) {
-    throw new PercherCoreError("No app specified and no percher.toml found", {
-      code: "dashboard.no-app",
-      hint: "Pass an app name or run from a directory with percher.toml."
-    });
-  }
-  const tab = input.tab ?? "overview";
-  if (!TAB_SHAPE.test(tab)) {
-    throw new PercherCoreError(`Invalid tab "${tab}"`, {
-      code: "dashboard.invalid-tab",
-      hint: "Tab must be lowercase letters, digits, and hyphens (≤32 chars)."
-    });
-  }
-  const base = ctx.env.PERCHER_DASHBOARD_URL ?? DEFAULT_BASE;
-  const appBase = `${base}/apps/${encodeURIComponent(name)}`;
-  const url2 = SETTINGS_ANCHOR_TABS.has(tab) ? `${appBase}/settings#${tab}` : `${appBase}?tab=${tab}`;
-  await ctx.openUrl(url2);
-  return url2;
-}
-// ../core/dist/commands/data.js
-var dataInputSchema = exports_external.object({
-  app: exports_external.string().optional(),
-  json: exports_external.boolean().optional()
-});
-async function data(ctx, input = {}) {
-  const name = input.app ?? readPercherTomlAppName(ctx.cwd);
-  if (!name) {
-    throw new PercherCoreError("No app specified and no percher.toml found", {
-      code: "data.no-app",
-      hint: "Pass an app name or run from a directory with percher.toml."
-    });
-  }
-  const status = await ctx.client.data.getStatus(name);
-  const adminLink = await ctx.client.data.getAdminLink(name);
-  let collections = [];
-  let stats = { collections: 0, totalRecords: 0 };
-  let warning = null;
-  try {
-    const cols = await ctx.client.data.getCollections(name);
-    collections = cols.map((c) => ({ name: c.name, type: c.type }));
-    stats = await ctx.client.data.getStats(name);
-  } catch (err) {
-    const code = err.code;
-    if (code === "PB_AUTH_FAILED") {
-      warning = `Could not authenticate with PocketBase — collections + stats unavailable. Try \`percher data reset-superuser ${name}\` to rotate the credentials.`;
-    } else {
-      throw err;
-    }
-  }
-  return {
-    mode: status.mode,
-    status: status.status,
-    version: status.version ?? null,
-    collections,
-    stats,
-    adminUrl: adminLink.adminUrl ?? null,
-    warning
-  };
-}
-// ../core/dist/commands/data-export.js
-import { resolve as resolve5 } from "node:path";
-var dataExportInputSchema = exports_external.object({
-  app: exports_external.string().optional().describe("App name or id. Defaults to the app in percher.toml."),
-  out: exports_external.string().optional().describe("Output file path. Defaults to ./<app>-pb-<timestamp>.tar.gz in the current directory.")
-});
-async function dataExport(ctx, input) {
-  const appName = input.app ?? readPercherTomlAppName(ctx.cwd);
-  if (!appName) {
-    throw new PercherCoreError("No app specified and no percher.toml found", {
-      code: "data-export.no-app",
-      hint: "Pass an app name with --app <name> or run from a directory with percher.toml."
-    });
-  }
-  ctx.status?.(`Exporting ${appName} data...`);
-  const stamp = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
-  const fileName = input.out ?? `${appName}-pb-${stamp}.tar.gz`;
-  const path = resolve5(ctx.cwd, fileName);
-  const res = await ctx.client.apps.streamDataExport(appName);
-  const bytes = await writeResponseToFile(res, path);
-  return {
-    app: appName,
-    path,
-    bytes,
-    exportedAt: new Date().toISOString()
-  };
-}
-// ../core/dist/commands/delete.js
-var deleteInputSchema = exports_external.object({
-  app: exports_external.string().optional().describe("App name to delete (defaults to percher.toml app name)"),
-  confirm: exports_external.boolean().describe("Must be true to confirm deletion. This is a destructive operation that permanently removes the app, its container, database, domains, env vars, and deploy history.")
-});
-async function deleteApp(ctx, input) {
-  const name = input.app ?? readPercherTomlAppName(ctx.cwd);
-  if (!name) {
-    throw new PercherCoreError("No app specified and no percher.toml found", {
-      code: "env.no-app",
-      hint: "Pass an app name or run from a directory with percher.toml."
-    });
-  }
-  if (!input.confirm) {
-    throw new PercherCoreError(`Deletion requires explicit confirmation. Set confirm: true to delete "${name}" permanently.`, {
-      code: "delete.confirmation-required",
-      hint: `This will permanently delete the app "${name}" and all its data. Pass confirm: true to proceed.`
-    });
-  }
-  await ctx.client.apps.delete(name);
-}
+// ../core/dist/commands/capabilities.js
+var capabilitiesInputSchema = exports_external.object({});
 // ../client/dist/abortable-sleep.js
 function abortableSleep(ms, signal) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve3) => {
     if (!signal) {
-      setTimeout(resolve6, ms);
+      setTimeout(resolve3, ms);
       return;
     }
     if (signal.aborted) {
-      resolve6();
+      resolve3();
       return;
     }
     const onAbort = () => {
       clearTimeout(t);
-      resolve6();
+      resolve3();
     };
     const t = setTimeout(() => {
       signal.removeEventListener("abort", onAbort);
-      resolve6();
+      resolve3();
     }, ms);
     signal.addEventListener("abort", onAbort, { once: true });
   });
@@ -105223,9 +105000,9 @@ function isAutoForwardedBuildKey(name) {
   return AUTO_FORWARD_PREFIXES.some((p) => name.startsWith(p));
 }
 // ../client/dist/config.js
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5, renameSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, renameSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname as dirname3, join as join7 } from "node:path";
+import { dirname as dirname3, join as join5 } from "node:path";
 var DEFAULT_API_URL = "https://api.percher.run";
 function home() {
   return process.env.HOME ?? process.env.USERPROFILE ?? homedir();
@@ -105233,15 +105010,15 @@ function home() {
 function configPath() {
   const xdg = process.env.XDG_CONFIG_HOME;
   if (xdg)
-    return join7(xdg, "percher", "config.json");
-  return join7(home(), ".percher", "config.json");
+    return join5(xdg, "percher", "config.json");
+  return join5(home(), ".percher", "config.json");
 }
 function readFile2() {
   const p = configPath();
-  if (!existsSync4(p))
+  if (!existsSync3(p))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync5(p, "utf8"));
+    const parsed = JSON.parse(readFileSync4(p, "utf8"));
     return parsed ?? {};
   } catch {
     return {};
@@ -105253,16 +105030,17 @@ function loadConfig() {
   const envToken = process.env.PERCHER_TOKEN;
   return {
     apiUrl: envUrl ?? file2.apiUrl ?? DEFAULT_API_URL,
-    token: envToken ?? file2.token ?? null
+    token: envToken ?? file2.token ?? null,
+    anonClaim: file2.anonClaim ?? null
   };
 }
 function saveConfig(partial2) {
   const p = configPath();
-  mkdirSync4(dirname3(p), { recursive: true });
+  mkdirSync3(dirname3(p), { recursive: true });
   const current = readFile2();
   const merged = { ...current, ...partial2 };
   const tmp = `${p}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync4(tmp, JSON.stringify(merged, null, 2), "utf8");
+  writeFileSync3(tmp, JSON.stringify(merged, null, 2), "utf8");
   renameSync(tmp, p);
 }
 
@@ -105559,6 +105337,20 @@ class AlertsResource {
   }
 }
 
+// ../client/dist/resources/anon.js
+class AnonResource {
+  http;
+  constructor(http) {
+    this.http = http;
+  }
+  requestChallenge() {
+    return this.http.get("/anon/challenge");
+  }
+  createAnonApp(input) {
+    return this.http.post("/anon/apps", input);
+  }
+}
+
 // ../client/dist/resources/apps-types.js
 function isDeployAlreadyInProgress(res) {
   return res.status === "already_in_progress";
@@ -105582,6 +105374,18 @@ class AppsResource {
   get(id, opts) {
     return this.http.get(`/apps/${encodeURIComponent(id)}`, opts);
   }
+  claim(appRef, input) {
+    return this.http.post(`/apps/${encodeURIComponent(appRef)}/claim`, input);
+  }
+  createInspectLink(appRef) {
+    return this.http.post(`/apps/${encodeURIComponent(appRef)}/inspect-link`, {});
+  }
+  inspectLinkStatus(appRef) {
+    return this.http.get(`/apps/${encodeURIComponent(appRef)}/inspect-link`);
+  }
+  revokeInspectLink(appRef) {
+    return this.http.deleteJson(`/apps/${encodeURIComponent(appRef)}/inspect-link`);
+  }
   async deploy(id, input) {
     const params = new URLSearchParams;
     if (input.type === "preview")
@@ -106076,6 +105880,9 @@ class PlatformResource {
   health() {
     return this.http.get("/health");
   }
+  capabilities() {
+    return this.http.get("/capabilities");
+  }
   preflight() {
     return this.http.get("/publish/preflight");
   }
@@ -106181,70 +105988,328 @@ class TransfersResource {
   cancel(appRef, transferId) {
     return this.http.delete(`/apps/${encodeURIComponent(appRef)}/transfer/${encodeURIComponent(transferId)}`);
   }
-  listForApp(appRef) {
-    return this.http.get(`/apps/${encodeURIComponent(appRef)}/transfer`);
+  listForApp(appRef) {
+    return this.http.get(`/apps/${encodeURIComponent(appRef)}/transfer`);
+  }
+  listIncoming() {
+    return this.http.get("/transfers/incoming");
+  }
+  accept(transferId) {
+    return this.http.post(`/transfers/${encodeURIComponent(transferId)}/accept`, {});
+  }
+  decline(transferId) {
+    return this.http.post(`/transfers/${encodeURIComponent(transferId)}/decline`, {});
+  }
+}
+
+// ../client/dist/client.js
+class PercherClient {
+  apiUrl;
+  token;
+  sessionId;
+  apps;
+  anon;
+  data;
+  env;
+  envScan;
+  export;
+  logs;
+  auth;
+  billing;
+  account;
+  alerts;
+  platform;
+  security;
+  search;
+  sharing;
+  invites;
+  transfers;
+  constructor(options = {}) {
+    const defaults = loadConfig();
+    this.apiUrl = options.apiUrl ?? defaults.apiUrl;
+    this.token = options.token !== undefined ? options.token : defaults.token;
+    this.sessionId = options.sessionId;
+    const http = new Http({
+      apiUrl: this.apiUrl,
+      token: this.token,
+      fetchImpl: options.fetchImpl,
+      clientVersion: options.clientVersion,
+      sessionId: options.sessionId
+    });
+    this.apps = new AppsResource(http);
+    this.anon = new AnonResource(http);
+    this.data = new DataResource(http);
+    this.env = new EnvResource(http);
+    this.envScan = new EnvScanResource(http);
+    this.export = new ExportResource(http);
+    this.logs = new LogsResource(http);
+    this.auth = new AuthResource(http);
+    this.billing = new BillingResource(http);
+    this.account = new AccountResource(http);
+    this.alerts = new AlertsResource(http);
+    this.platform = new PlatformResource(http);
+    this.security = new SecurityResource(http);
+    this.search = new SearchResource(http);
+    this.sharing = new SharingResource(http);
+    this.invites = new InvitesResource(http);
+    this.transfers = new TransfersResource(http);
+  }
+}
+// ../core/dist/commands/claim.js
+var claimInputSchema = exports_external.object({
+  app: exports_external.string().optional().describe("App name to claim (defaults to the persisted anon state or percher.toml)"),
+  claimToken: exports_external.string().optional().describe("The one-time claim token returned by the anonymous publish (pcl_…)")
+});
+async function claim(ctx, input = {}) {
+  const state = loadConfig().anonClaim;
+  const app = input.app ?? state?.app ?? readPercherTomlAppName(ctx.cwd) ?? undefined;
+  const claimToken = input.claimToken ?? state?.claimToken;
+  if (!app) {
+    return {
+      status: "needs_token",
+      summary: "No app to claim. Pass --app (or run from the project that published it) and the claim token."
+    };
+  }
+  if (!claimToken) {
+    return {
+      status: "needs_token",
+      summary: "No claim token found. Pass claimToken explicitly — it was returned by the anonymous publish."
+    };
+  }
+  const result = await ctx.client.apps.claim(app, { claimToken });
+  if (state)
+    saveConfig({ anonClaim: null });
+  return {
+    status: "claimed",
+    app: result.name,
+    url: result.url,
+    summary: `Claimed ${result.name} — anonymous restrictions lift on the next deploy.`
+  };
+}
+// ../core/dist/commands/create.js
+import { join as join7, resolve as resolve4 } from "node:path";
+
+// ../core/dist/templates.js
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { basename, join as join6, normalize, relative, resolve as resolve3 } from "node:path";
+var __dirname = "C:\\dev\\Percher-lakebed-clean\\packages\\core\\dist";
+var TEMPLATES_DIR = resolve3(import.meta.dirname ?? __dirname, "../templates");
+var PLACEHOLDER = "__APP_NAME__";
+function listTemplates() {
+  return readdirSync(TEMPLATES_DIR).filter((name) => {
+    const full = join6(TEMPLATES_DIR, name);
+    return statSync(full).isDirectory();
+  });
+}
+function scaffoldTemplate(input) {
+  const { template, appName, targetDir, force } = input;
+  const available = listTemplates();
+  if (!available.includes(template)) {
+    throw new Error(`Unknown template "${template}". Available: ${available.join(", ")}`);
+  }
+  const absTarget = resolve3(targetDir);
+  if (existsSync4(absTarget)) {
+    const entries = readdirSync(absTarget);
+    if (entries.length > 0 && !force) {
+      throw new Error(`Target directory "${absTarget}" is not empty. Use --force to overwrite.`);
+    }
+  }
+  const srcDir = join6(TEMPLATES_DIR, template);
+  const files = [];
+  function copyDir(src, dest) {
+    mkdirSync4(dest, { recursive: true });
+    for (const entry of readdirSync(src)) {
+      const srcPath = join6(src, entry);
+      const destPath = join6(dest, entry);
+      const rel = relative(absTarget, normalize(destPath));
+      if (rel.startsWith("..") || resolve3(destPath) === resolve3(absTarget, "..", basename(absTarget))) {
+        throw new Error(`Template contains path traversal: ${entry}`);
+      }
+      if (statSync(srcPath).isDirectory()) {
+        copyDir(srcPath, destPath);
+      } else {
+        if (existsSync4(destPath) && !force) {
+          continue;
+        }
+        let content = readFileSync5(srcPath, "utf-8");
+        content = content.replaceAll(PLACEHOLDER, appName);
+        content = content.replace(/\r\n/g, `
+`);
+        writeFileSync4(destPath, content, "utf-8");
+        files.push(relative(absTarget, destPath).replace(/\\/g, "/"));
+      }
+    }
+  }
+  copyDir(srcDir, absTarget);
+  return { files };
+}
+
+// ../core/dist/commands/create.js
+var createInputSchema = exports_external.object({
+  name: exports_external.string().regex(APP_NAME_RE, "must be 3-40 chars, lowercase, start with a letter, [a-z0-9-] only"),
+  template: exports_external.string().min(1, "Template is required"),
+  directory: exports_external.string().optional(),
+  force: exports_external.boolean().optional()
+});
+async function create(ctx, input) {
+  const available = listTemplates();
+  if (!available.includes(input.template)) {
+    throw new PercherCoreError(`Unknown template "${input.template}". Available: ${available.join(", ")}`, {
+      code: "create.invalid-template",
+      hint: `Run "percher create --list-templates" to see available templates.`
+    });
+  }
+  let targetDir;
+  if (input.directory) {
+    targetDir = resolve4(ctx.cwd, input.directory);
+    if (!targetDir.startsWith(resolve4(ctx.cwd))) {
+      throw new PercherCoreError("Directory must be within the current workspace", {
+        code: "create.failed"
+      });
+    }
+  } else {
+    targetDir = join7(ctx.cwd, input.name);
+  }
+  try {
+    const result = scaffoldTemplate({
+      template: input.template,
+      appName: input.name,
+      targetDir,
+      force: input.force
+    });
+    return {
+      ...result,
+      name: input.name,
+      template: input.template,
+      directory: targetDir
+    };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("not empty")) {
+      throw new PercherCoreError(msg, {
+        code: "create.dir-not-empty",
+        hint: "Use --force to overwrite existing files."
+      });
+    }
+    throw new PercherCoreError(msg, { code: "create.failed" });
+  }
+}
+// ../core/dist/commands/dashboard.js
+var dashboardInputSchema = exports_external.object({
+  app: exports_external.string().optional(),
+  tab: exports_external.string().optional()
+});
+var DEFAULT_BASE = "https://percher.app";
+var TAB_SHAPE = /^[a-z][a-z0-9-]{0,31}$/;
+var SETTINGS_ANCHOR_TABS = new Set(["github", "env", "domains", "crash-diagnosis"]);
+async function dashboard(ctx, input = {}) {
+  const name = input.app ?? readPercherTomlAppName(ctx.cwd);
+  if (!name) {
+    throw new PercherCoreError("No app specified and no percher.toml found", {
+      code: "dashboard.no-app",
+      hint: "Pass an app name or run from a directory with percher.toml."
+    });
+  }
+  const tab = input.tab ?? "overview";
+  if (!TAB_SHAPE.test(tab)) {
+    throw new PercherCoreError(`Invalid tab "${tab}"`, {
+      code: "dashboard.invalid-tab",
+      hint: "Tab must be lowercase letters, digits, and hyphens (≤32 chars)."
+    });
   }
-  listIncoming() {
-    return this.http.get("/transfers/incoming");
+  const base = ctx.env.PERCHER_DASHBOARD_URL ?? DEFAULT_BASE;
+  const appBase = `${base}/apps/${encodeURIComponent(name)}`;
+  const url2 = SETTINGS_ANCHOR_TABS.has(tab) ? `${appBase}/settings#${tab}` : `${appBase}?tab=${tab}`;
+  await ctx.openUrl(url2);
+  return url2;
+}
+// ../core/dist/commands/data.js
+var dataInputSchema = exports_external.object({
+  app: exports_external.string().optional(),
+  json: exports_external.boolean().optional()
+});
+async function data(ctx, input = {}) {
+  const name = input.app ?? readPercherTomlAppName(ctx.cwd);
+  if (!name) {
+    throw new PercherCoreError("No app specified and no percher.toml found", {
+      code: "data.no-app",
+      hint: "Pass an app name or run from a directory with percher.toml."
+    });
   }
-  accept(transferId) {
-    return this.http.post(`/transfers/${encodeURIComponent(transferId)}/accept`, {});
+  const status = await ctx.client.data.getStatus(name);
+  const adminLink = await ctx.client.data.getAdminLink(name);
+  let collections = [];
+  let stats = { collections: 0, totalRecords: 0 };
+  let warning = null;
+  try {
+    const cols = await ctx.client.data.getCollections(name);
+    collections = cols.map((c) => ({ name: c.name, type: c.type }));
+    stats = await ctx.client.data.getStats(name);
+  } catch (err) {
+    const code = err.code;
+    if (code === "PB_AUTH_FAILED") {
+      warning = `Could not authenticate with PocketBase — collections + stats unavailable. Try \`percher data reset-superuser ${name}\` to rotate the credentials.`;
+    } else {
+      throw err;
+    }
   }
-  decline(transferId) {
-    return this.http.post(`/transfers/${encodeURIComponent(transferId)}/decline`, {});
+  return {
+    mode: status.mode,
+    status: status.status,
+    version: status.version ?? null,
+    collections,
+    stats,
+    adminUrl: adminLink.adminUrl ?? null,
+    warning
+  };
+}
+// ../core/dist/commands/data-export.js
+import { resolve as resolve5 } from "node:path";
+var dataExportInputSchema = exports_external.object({
+  app: exports_external.string().optional().describe("App name or id. Defaults to the app in percher.toml."),
+  out: exports_external.string().optional().describe("Output file path. Defaults to ./<app>-pb-<timestamp>.tar.gz in the current directory.")
+});
+async function dataExport(ctx, input) {
+  const appName = input.app ?? readPercherTomlAppName(ctx.cwd);
+  if (!appName) {
+    throw new PercherCoreError("No app specified and no percher.toml found", {
+      code: "data-export.no-app",
+      hint: "Pass an app name with --app <name> or run from a directory with percher.toml."
+    });
   }
+  ctx.status?.(`Exporting ${appName} data...`);
+  const stamp = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
+  const fileName = input.out ?? `${appName}-pb-${stamp}.tar.gz`;
+  const path = resolve5(ctx.cwd, fileName);
+  const res = await ctx.client.apps.streamDataExport(appName);
+  const bytes = await writeResponseToFile(res, path);
+  return {
+    app: appName,
+    path,
+    bytes,
+    exportedAt: new Date().toISOString()
+  };
 }
-
-// ../client/dist/client.js
-class PercherClient {
-  apiUrl;
-  token;
-  sessionId;
-  apps;
-  data;
-  env;
-  envScan;
-  export;
-  logs;
-  auth;
-  billing;
-  account;
-  alerts;
-  platform;
-  security;
-  search;
-  sharing;
-  invites;
-  transfers;
-  constructor(options = {}) {
-    const defaults = loadConfig();
-    this.apiUrl = options.apiUrl ?? defaults.apiUrl;
-    this.token = options.token !== undefined ? options.token : defaults.token;
-    this.sessionId = options.sessionId;
-    const http = new Http({
-      apiUrl: this.apiUrl,
-      token: this.token,
-      fetchImpl: options.fetchImpl,
-      clientVersion: options.clientVersion,
-      sessionId: options.sessionId
+// ../core/dist/commands/delete.js
+var deleteInputSchema = exports_external.object({
+  app: exports_external.string().optional().describe("App name to delete (defaults to percher.toml app name)"),
+  confirm: exports_external.boolean().describe("Must be true to confirm deletion. This is a destructive operation that permanently removes the app, its container, database, domains, env vars, and deploy history.")
+});
+async function deleteApp(ctx, input) {
+  const name = input.app ?? readPercherTomlAppName(ctx.cwd);
+  if (!name) {
+    throw new PercherCoreError("No app specified and no percher.toml found", {
+      code: "env.no-app",
+      hint: "Pass an app name or run from a directory with percher.toml."
+    });
+  }
+  if (!input.confirm) {
+    throw new PercherCoreError(`Deletion requires explicit confirmation. Set confirm: true to delete "${name}" permanently.`, {
+      code: "delete.confirmation-required",
+      hint: `This will permanently delete the app "${name}" and all its data. Pass confirm: true to proceed.`
     });
-    this.apps = new AppsResource(http);
-    this.data = new DataResource(http);
-    this.env = new EnvResource(http);
-    this.envScan = new EnvScanResource(http);
-    this.export = new ExportResource(http);
-    this.logs = new LogsResource(http);
-    this.auth = new AuthResource(http);
-    this.billing = new BillingResource(http);
-    this.account = new AccountResource(http);
-    this.alerts = new AlertsResource(http);
-    this.platform = new PlatformResource(http);
-    this.security = new SecurityResource(http);
-    this.search = new SearchResource(http);
-    this.sharing = new SharingResource(http);
-    this.invites = new InvitesResource(http);
-    this.transfers = new TransfersResource(http);
   }
+  await ctx.client.apps.delete(name);
 }
 // ../core/dist/commands/deploys.js
 var deploysListInputSchema = exports_external.object({
@@ -109277,6 +109342,30 @@ async function init(ctx, input = {}) {
 var insightsInputSchema = exports_external.object({
   app: exports_external.string().optional()
 });
+// ../core/dist/commands/inspect-link.js
+var inspectLinkInputSchema = exports_external.object({
+  app: exports_external.string().optional().describe("App name (defaults to percher.toml)"),
+  revoke: exports_external.boolean().optional().describe("Revoke the app's inspect link instead of creating one")
+});
+async function inspectLink(ctx, input = {}) {
+  const app = input.app ?? readPercherTomlAppName(ctx.cwd);
+  if (!app) {
+    throw new PercherCoreError("No app specified and no percher.toml found", {
+      code: "env.no-app",
+      hint: "Pass an app name or run from a directory with percher.toml."
+    });
+  }
+  if (input.revoke) {
+    await ctx.client.apps.revokeInspectLink(app);
+    return { revoked: true, app, summary: `Inspect link for ${app} revoked.` };
+  }
+  const { inspectUrl } = await ctx.client.apps.createInspectLink(app);
+  return {
+    inspectUrl,
+    app,
+    summary: `Share ${inspectUrl} — read-only status + deploy history, no login needed. Re-running rotates the link; --revoke kills it.`
+  };
+}
 // ../core/dist/commands/login.js
 var loginInputSchema = exports_external.object({
   token: exports_external.string().optional(),
@@ -110276,24 +110365,23 @@ function topologicalSort(collections) {
         continue;
       if (!byName.has(target))
         continue;
-      dependsOn.get(c.name).add(target);
-      dependents.get(target).add(c.name);
+      dependsOn.get(c.name)?.add(target);
+      dependents.get(target)?.add(c.name);
     }
   }
   const inputOrder = collections.map((c) => c.name);
   const inDegree = new Map;
   for (const name of inputOrder)
-    inDegree.set(name, dependsOn.get(name).size);
+    inDegree.set(name, dependsOn.get(name)?.size ?? 0);
   const ready = [];
   for (const name of inputOrder) {
     if (inDegree.get(name) === 0)
       ready.push(name);
   }
   const out = [];
-  while (ready.length > 0) {
-    const name = ready.shift();
+  for (let name = ready.shift();name !== undefined; name = ready.shift()) {
     out.push(name);
-    for (const dependent of dependents.get(name)) {
+    for (const dependent of dependents.get(name) ?? []) {
       const next = (inDegree.get(dependent) ?? 0) - 1;
       inDegree.set(dependent, next);
       if (next === 0)
@@ -111013,6 +111101,35 @@ async function previewBranchShow(ctx, input = {}) {
 import { existsSync as existsSync14 } from "node:fs";
 import { join as join20 } from "node:path";
 
+// ../shared/dist/pow.js
+import { createHash as createHash3 } from "node:crypto";
+function digest(nonce, solution) {
+  return createHash3("sha256").update(`${nonce}:${solution}`).digest("hex");
+}
+function leadingZeroBits(hexDigest) {
+  let bits = 0;
+  for (const ch of hexDigest) {
+    const nibble = Number.parseInt(ch, 16);
+    if (nibble === 0) {
+      bits += 4;
+      continue;
+    }
+    bits += Math.clz32(nibble) - 28;
+    break;
+  }
+  return bits;
+}
+function solvePow(nonce, difficulty, maxIterations = 50000000) {
+  if (difficulty <= 0)
+    return "0";
+  for (let i = 0;i < maxIterations; i++) {
+    const solution = i.toString(36);
+    if (leadingZeroBits(digest(nonce, solution)) >= difficulty)
+      return solution;
+  }
+  return null;
+}
+
 // ../core/dist/event-renderer.js
 function renderDeployEvent(event) {
   if (event.stage === "queue") {
@@ -111819,7 +111936,8 @@ var publishInputSchema = exports_external.object({
   message: exports_external.string().optional().describe("Deploy note (visible in deploy history and version timeline)"),
   dryRun: exports_external.boolean().optional().describe("Show what would be deployed (file count, bytes, top files) without uploading or building. Useful for verifying the bundle before a real deploy."),
   noCache: exports_external.boolean().optional().describe("Skip the image-cache lookup and force a fresh build. Use this when you suspect the cached image doesn't reflect your latest source — the new build's resulting image still gets cached, so future deploys benefit."),
-  waitForLive: exports_external.boolean().optional().describe("If true (default), publish blocks until the deploy is live or failed. If false, publish returns as soon as the deploy is queued and the agent can resume with percher_wait_for_deploy. Recommended for AI agents — gives back control quickly with a deployId so they can decide between waiting, asking the user, or working on something else.")
+  waitForLive: exports_external.boolean().optional().describe("If true (default), publish blocks until the deploy is live or failed. If false, publish returns as soon as the deploy is queued and the agent can resume with percher_wait_for_deploy. Recommended for AI agents — gives back control quickly with a deployId so they can decide between waiting, asking the user, or working on something else."),
+  anonymous: exports_external.boolean().optional().describe("Publish WITHOUT an account. Creates a throwaway anonymous app that expires in 72h unless claimed (percher_claim_app). The app runs with no outbound network, no database, and no env vars until claimed. Only honored when the caller has no token; ignored once signed in. Server-gated — fails with ANON_DEPLOYS_DISABLED if the instance hasn't enabled it.")
 });
 var SUSPICIOUS_BYTES = 50 * 1024 * 1024;
 var SUSPICIOUS_FILES = 1e4;
@@ -112320,6 +112438,16 @@ async function executeDeploy(opts) {
   };
 }
 async function handleUnauthorized(ctx, config2, tarball, input) {
+  if (input.anonymous) {
+    return handleAnonymousPublish(ctx, config2, input, tarball);
+  }
+  const anonAlternative = {
+    action: "retry",
+    suggestedTool: "percher_publish",
+    args: { ...input, anonymous: true },
+    when: "to publish without an account (expires in 72h, claim later with percher_claim_app)"
+  };
+  const needsLoginRecovery = { ...RECOVERY_NEEDS_LOGIN, alternativeActions: [anonAlternative] };
   if (!ctx.interactiveLogin) {
     try {
       const deviceClient = new PercherClient({
@@ -112334,7 +112462,7 @@ async function handleUnauthorized(ctx, config2, tarball, input) {
         loginCode: userCode,
         fileCount: tarball.fileCount,
         bytes: tarball.bytes,
-        recovery: RECOVERY_NEEDS_LOGIN,
+        recovery: needsLoginRecovery,
         summary: `Login required: open ${loginUrl} (code: ${userCode}).`,
         configPath: tomlPathFor2(ctx.cwd),
         bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes }
@@ -112349,7 +112477,7 @@ async function handleUnauthorized(ctx, config2, tarball, input) {
           explanation: "No valid Percher token found.",
           suggestion: "Run the percher_login tool first, or set PERCHER_TOKEN environment variable."
         },
-        recovery: RECOVERY_NEEDS_LOGIN,
+        recovery: needsLoginRecovery,
         summary: "Login required — run percher_login or set PERCHER_TOKEN.",
         configPath: tomlPathFor2(ctx.cwd),
         bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes }
@@ -112379,6 +112507,107 @@ async function handleUnauthorized(ctx, config2, tarball, input) {
     missingBuildEnvKeys: []
   });
 }
+async function handleAnonymousPublish(ctx, config2, input, tarball) {
+  const anonClient = new PercherClient({
+    apiUrl: ctx.client.apiUrl,
+    sessionId: ctx.client.sessionId
+  });
+  let created;
+  try {
+    const ch = await anonClient.anon.requestChallenge();
+    const solution = solvePow(ch.nonce, ch.difficulty);
+    if (solution === null) {
+      throw new Error("proof-of-work unsolvable (difficulty too high)");
+    }
+    created = await anonClient.anon.createAnonApp({
+      name: config2.app.name,
+      powChallengeId: ch.challengeId,
+      powSolution: solution
+    });
+  } catch (err) {
+    const httpStatus = err.status;
+    const code = err.code;
+    if (httpStatus === 429) {
+      return {
+        status: "failed",
+        fileCount: tarball.fileCount,
+        bytes: tarball.bytes,
+        error: {
+          title: "Too many anonymous deploys",
+          explanation: "Anonymous publishing is rate-limited per network to deter abuse. Wait a bit and try again, or log in to publish with an account.",
+          suggestion: "Retry in a little while, or run percher login to publish with an account."
+        },
+        recovery: recoveryAsk({
+          prompt: "Anonymous publishing is rate-limited per network. Wait and retry, or run `percher login` to publish with an account.",
+          reasonCode: "quota_exceeded"
+        }),
+        summary: "Rate limited — too many anonymous deploys from your network. Try again later.",
+        configPath: tomlPathFor2(ctx.cwd),
+        bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes }
+      };
+    }
+    const detail = code === "ANON_CAPACITY" ? "Anonymous capacity is full right now." : "Anonymous deploys are not enabled on this instance.";
+    return {
+      status: "needs_login",
+      fileCount: tarball.fileCount,
+      bytes: tarball.bytes,
+      error: {
+        title: "Anonymous publish unavailable",
+        explanation: detail,
+        suggestion: "Run the percher_login tool to publish with an account instead."
+      },
+      recovery: RECOVERY_NEEDS_LOGIN,
+      summary: `${detail} Log in to publish instead.`,
+      configPath: tomlPathFor2(ctx.cwd),
+      bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes }
+    };
+  }
+  saveConfig({
+    token: created.token,
+    anonClaim: {
+      app: created.app.name,
+      claimToken: created.claimToken,
+      expiresAt: created.expiresAt
+    }
+  });
+  const newClient = new PercherClient({
+    apiUrl: ctx.client.apiUrl,
+    token: created.token,
+    sessionId: ctx.client.sessionId
+  });
+  ctx.client = newClient;
+  ctx.setClient?.(newClient);
+  config2.app.name = created.app.name;
+  const t0 = Date.now();
+  const freshTarball = await createTarball({ cwd: ctx.cwd, config: config2 });
+  const packageMs = Date.now() - t0;
+  const { app, firstDeploy } = await ensureApp2(ctx, config2);
+  const result = await executeDeploy({
+    ctx,
+    config: config2,
+    input,
+    app,
+    firstDeploy,
+    tarball: freshTarball,
+    t0,
+    packageMs,
+    missingBuildEnvKeys: []
+  });
+  return {
+    ...result,
+    anonymous: true,
+    claim: {
+      claimUrl: created.claimUrl,
+      claimToken: created.claimToken,
+      expiresAt: created.expiresAt
+    },
+    warnings: [
+      ...result.warnings ?? [],
+      `Anonymous app: expires ${created.expiresAt} unless claimed — run percher_claim_app (claim token is in claim.claimToken).`,
+      "No outbound network, no database, and no env vars until claimed."
+    ]
+  };
+}
 async function loadOrGenerate(ctx) {
   const tomlPath = join20(ctx.cwd, "percher.toml");
   if (!existsSync14(tomlPath)) {
@@ -113761,9 +113990,43 @@ var PLAN_CATALOG = {
       vcpuPool: 4,
       diskPoolMb: 75000
     }
+  },
+  anonymous: {
+    label: "Anonymous",
+    priceEur: 0,
+    hidden: true,
+    limits: {
+      apps: 1,
+      deploysPerMonth: 20,
+      deploysPerHour: 6,
+      memory: "128mb",
+      cpu: 0.25,
+      pids: 64,
+      activePreviewsPerApp: 0,
+      customDomainsPerApp: 0,
+      removesPercherBadge: false,
+      autoSleep: true,
+      inactivityWarningDays: 1,
+      inactivityGraceDays: 1,
+      deployRetention: 2,
+      logRetentionDays: 1,
+      buildLogRetentionDays: 1,
+      cronJobs: 0,
+      storageMb: 0,
+      instances: 1,
+      kvStorageMb: 0,
+      uptimeIntervalSec: 0,
+      dailyLiveDeploys: 10,
+      dailyPreviewDeploys: 0,
+      userConcurrentDeploys: 1,
+      ramPoolMb: 128,
+      vcpuPool: 0.25,
+      diskPoolMb: 200
+    }
   }
 };
-var PLAN_IDS = Object.keys(PLAN_CATALOG);
+var ALL_PLAN_IDS = Object.keys(PLAN_CATALOG);
+var PLAN_IDS = Object.entries(PLAN_CATALOG).filter(([, info]) => !info.hidden).map(([id]) => id);
 
 // ../core/dist/index.js
 init_qr();
@@ -114392,7 +114655,16 @@ async function handlePublishResult(ctx, result, options = {}) {
           await writeLine(ctx, qr);
         } catch {}
       }
-      if (result.firstDeploy) {
+      if (result.anonymous && result.claim) {
+        await writeLine(ctx, "");
+        await writeLine(ctx, import_picocolors4.default.bold("Anonymous app — claim it to keep it:"));
+        await writeLine(ctx, `  Expires:     ${new Date(result.claim.expiresAt).toLocaleString()}`);
+        await writeLine(ctx, `  Claim token: ${result.claim.claimToken}`);
+        await writeLine(ctx, `  ${import_picocolors4.default.cyan("percher claim")}   claim into your account (lifts the limits on next deploy)`);
+        for (const w of result.warnings ?? []) {
+          await writeLine(ctx, import_picocolors4.default.dim(`  ${w}`));
+        }
+      } else if (result.firstDeploy) {
         await writeLine(ctx, "");
         await writeLine(ctx, import_picocolors4.default.bold("First deploy — next steps:"));
         await writeLine(ctx, `  ${import_picocolors4.default.cyan("percher dev")}          watch for changes and re-deploy`);
@@ -114417,7 +114689,7 @@ function registerAppsCommands(cli, ctx) {
       await writeLine(ctx, `${import_picocolors4.default.green("✓")} wrote ${file2}`);
     }
   });
-  cli.command("publish", "Publish this project to Percher (recommended deploy command)").option("--force", "Skip size warnings").option("--preview", "Deploy as preview (does not replace the live version)").option("-m, --message <msg>", "Deploy note (visible in deploy history)").option("--dry-run", "Show what would be deployed (file count, bytes) without uploading").option("--no-cache", "Skip image-cache lookup and force a fresh build (use when you suspect cached image is stale)").action(async (options) => {
+  cli.command("publish", "Publish this project to Percher (recommended deploy command)").option("--force", "Skip size warnings").option("--preview", "Deploy as preview (does not replace the live version)").option("-m, --message <msg>", "Deploy note (visible in deploy history)").option("--dry-run", "Show what would be deployed (file count, bytes) without uploading").option("--no-cache", "Skip image-cache lookup and force a fresh build (use when you suspect cached image is stale)").option("--anonymous", "Publish without an account — a 72h sandbox you can claim later (where enabled)").action(async (options) => {
     const { detectCiBranchMessage: detectCiBranchMessage2 } = await Promise.resolve().then(() => exports_ci_env);
     let messageOverride = options.message;
     if (options.preview && !options.message) {
@@ -114432,7 +114704,8 @@ function registerAppsCommands(cli, ctx) {
       preview: options.preview,
       message: messageOverride,
       dryRun: options.dryRun,
-      noCache: options.cache === false
+      noCache: options.cache === false,
+      anonymous: options.anonymous
     });
     await handlePublishResult(ctx, result, { preview: options.preview });
   });
@@ -114625,6 +114898,21 @@ function registerAppsCommands(cli, ctx) {
     const result = await resume(ctx, { app });
     await writeLine(ctx, `${import_picocolors4.default.green("✓")} ${result.message}`);
   });
+  cli.command("claim", "Claim an anonymous app into your account").option("--app <name>", "App name (defaults to the persisted anon state or percher.toml)").option("--claim-token <token>", "Claim token from the anonymous publish").action(async (options) => {
+    const result = await claim(ctx, { app: options.app, claimToken: options.claimToken });
+    if (result.status === "claimed") {
+      await writeLine(ctx, `${import_picocolors4.default.green("✓")} ${result.summary}`);
+    } else {
+      await writeLine(ctx, `${import_picocolors4.default.yellow("!")} ${result.summary}`);
+    }
+  });
+  cli.command("inspect-link [app]", "Create a public read-only inspect link (or --revoke it)").option("--app <name>", "App name (defaults to percher.toml)").option("--revoke", "Revoke the app's inspect link instead of creating one").action(async (app, options) => {
+    const result = await inspectLink(ctx, {
+      app: app ?? options.app,
+      revoke: options.revoke
+    });
+    await writeLine(ctx, `${import_picocolors4.default.green("✓")} ${result.summary}`);
+  });
   cli.command("cache <action> [app]", "Manage the app's build cache (reset)").action(async (action, app) => {
     if (action !== "reset") {
       throw new Error(`Unknown cache action "${action}". Use: percher cache reset [app]`);
@@ -115564,7 +115852,7 @@ async function renderError(stderr, error48) {
 // package.json
 var package_default = {
   name: "percher",
-  version: "0.5.0",
+  version: "0.5.2",
   description: "CLI for the Percher hosting platform — publish apps with one command",
   type: "module",
   bin: {
@@ -115588,9 +115876,9 @@ var package_default = {
     typecheck: "tsc --noEmit"
   },
   dependencies: {
-    "@percher/client": "^0.2.7",
-    "@percher/core": "^0.4.0",
-    "@percher/toml": "^0.1.3",
+    "@percher/client": "^0.2.10",
+    "@percher/core": "^0.4.5",
+    "@percher/toml": "^0.1.5",
     cac: "^7.0.0",
     picocolors: "^1.1.1"
   },