pockethost 3.0.0 → 3.1.0

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 Formerly published as `phio`. Versions below 3.0.0 are phio's history.
 
+## 3.1.0
+
+### Minor Changes
+
+- `deploy` and `dev` now upload over HTTPS instead of SFTP. The CLI sends a list of file hashes, uploads only the
+  files PocketHost doesn't have yet (compressed), and PocketHost swaps the new set in all at once, restarting the
+  instance when anything outside `pb_public` changed. Files in the deployed folders that aren't in your project are
+  removed. Dotfiles (for example `pb_public/.well-known/`) are now deployed; `.git*` and `node_modules` stay excluded.
+- Personal access tokens: set `POCKETHOST_TOKEN`, or run `pockethost token set` / `pockethost login --token`. Deploys
+  need no password or SSH key, so CI works on fresh runners (previously a new runner generated a new deploy key that
+  didn't match the registered `PocketHost CLI` key).
+- New `pockethost token [set|clear|status]`. `info` shows the token in use. `logout` also removes a saved token.
+- `deploy --commit <sha>` and `-m/--message <note>` are recorded with each deploy (`$GITHUB_SHA` is used
+  automatically).
+- `--sftp` on `deploy` and `dev` keeps the previous SFTP sync.
+- PocketHost no longer runs `bun install` when `package.json`, `bun.lock(b)` or `patches/` change (over SFTP or the
+  deploy API). Those files are copied as-is, and an existing `node_modules` on the instance is left alone. Bundle npm
+  code your hooks need into `pb_hooks`.
+
 ## 3.0.0
 
 ### Major Changes

package/README.md

@@ -23,7 +23,8 @@ you rename them to `POCKETHOST_*`.
 ## Commands
 
 ```bash
-pockethost login
+pockethost login             # or: pockethost login --token
+pockethost token [set|clear|status]
 pockethost logout
 pockethost info          # alias: pockethost whoami
 pockethost list          # alias: pockethost ls
@@ -34,12 +35,14 @@ pockethost sftp [instance]
 pockethost logs [instance]
 ```
 
-- **`pockethost dev`**: watch local changes and sync over SFTP
-- **`pockethost deploy`**: one-shot SFTP sync
+- **`pockethost dev`**: watch local changes and deploy them
+- **`pockethost deploy`**: deploy once
+- **`pockethost token`**: save, clear, or check a personal access token
 - **`pockethost sftp`**: interactive SFTP session (uses system `sftp` when available)
 - **`pockethost logs`**: tail instance logs
 
-`dev` and `deploy` accept `-v/--verbose`, `-i/--include`, and `-e/--exclude`.
+`dev` and `deploy` accept `-v/--verbose`, `-i/--include`, `-e/--exclude`, and `--sftp` (sync over SFTP instead of
+HTTPS). `deploy` also takes `--commit <sha>` and `-m/--message <note>`.
 
 Default includes: `pb_*`, `package.json`, `bun.lock`, `bun.lockb`, `patches/**`.
 
@@ -64,9 +67,42 @@ This writes `.pockethostconfig`:
 Older project files (`.phioconfig`, `package.json` → `pockethost.instanceName`, `pockethost.json`) are migrated to
 `.pockethostconfig` automatically on first use.
 
-## Deploy key
+## How deploys work
 
-`pockethost dev` and `pockethost deploy` sync over **SFTP** (`ftp.pockethost.io:2222`) using an Ed25519 deploy key
+`deploy` and `dev` talk to the instance over HTTPS (`https://<instance>.pockethost.io/_ph/deploy/v1`):
+
+1. Send a manifest of `{ path: sha256 }` for the matched files.
+2. Upload only the files the server is missing, as one gzip bundle per ~32 MB.
+3. Commit: the server swaps the file set in atomically (stopping the instance when anything outside `pb_public`
+   changes) and starts the instance again.
+
+PocketHost doesn't install npm packages. `package.json`, `bun.lock(b)` and `patches/` are copied as plain files. Bundle
+any npm code your hooks need into `pb_hooks`.
+
+Only `pb_*` folders (never `pb_data`), `package.json`, `bun.lock(b)` and `patches/` are deployed. Files in those folders
+on the instance that aren't in your project are removed. `node_modules` and `.git*` are never touched.
+
+## Authentication
+
+`deploy` and `dev` use, in order:
+
+1. `POCKETHOST_TOKEN` (a personal access token, `ph_pat_…`)
+2. a token saved with `pockethost token set` (or `pockethost login --token`)
+3. your email/password login (`pockethost login`, or `POCKETHOST_USERNAME`/`POCKETHOST_PASSWORD`)
+
+Create tokens under Account → API Tokens in the dashboard. Deploy from GitHub Actions:
+
+```yaml
+- run: npx pockethost@latest deploy myapp-${{ github.ref_name }}
+  env:
+    POCKETHOST_TOKEN: ${{ secrets.POCKETHOST_TOKEN }}
+```
+
+Docs: https://pockethost.io/docs/deploy-from-ci
+
+## Deploy key (`--sftp` and `pockethost sftp`)
+
+`pockethost dev --sftp`, `pockethost deploy --sftp` and `pockethost sftp` use **SFTP** (`ftp.pockethost.io:2222`) using an Ed25519 deploy key
 stored under `POCKETHOST_HOME` (default `~/.config/pockethost/`). The CLI auto-registers a **`PocketHost CLI`** key
 under Account → Keys on first use (an existing **`Phio`** key from phio is reused). Run `pockethost info` to inspect
 key status.
@@ -77,6 +113,7 @@ Customer docs: https://pockethost.io/docs/cli
 
 | Variable | Purpose |
 | -------- | ------- |
+| `POCKETHOST_TOKEN` | Personal access token for `deploy`/`dev` (CI) |
 | `POCKETHOST_USERNAME` | Override saved email (non-interactive login) |
 | `POCKETHOST_PASSWORD` | Override saved password |
 | `POCKETHOST_INSTANCE_NAME` | Override linked instance name |

package/dist/cli.js

@@ -6448,7 +6448,7 @@ function useColor() {
 var program = new Command();
 
 // package.json
-var version = "3.0.0";
+var version = "3.1.0";
 
 // src/lib/projectRoot.ts
 import { existsSync as existsSync2 } from "fs";
@@ -6617,6 +6617,13 @@ var MOTHERSHIP_URL = (...paths) => {
   url.pathname = join(url.pathname, ...paths);
   return url.toString();
 };
+var INSTANCE_URL = (name) => {
+  const m = new URL(MOTHERSHIP_URL());
+  const apex = m.hostname.split(".").slice(1).join(".");
+  const host = name.includes(".") ? name : `${name}.${apex}`;
+  return `${m.protocol}//${host}${m.port ? `:${m.port}` : ""}`;
+};
+var TOKEN = () => envVar("TOKEN") ?? "";
 var USERNAME = () => envVar("USERNAME") ?? "";
 var PASSWORD = () => envVar("PASSWORD") ?? "";
 var INSTANCE_NAME = () => envVar("INSTANCE_NAME") ?? "";
@@ -19272,6 +19279,31 @@ var ensureLoggedIn = async () => {
   }
 };
 
+// src/lib/deployApi.ts
+import { execFileSync } from "child_process";
+import { lstatSync as lstatSync2 } from "fs";
+import { readFile } from "fs/promises";
+import { sep as sep2 } from "path";
+import { gzipSync } from "zlib";
+
+// src/lib/codeSet.ts
+var ROOT_CODE_FILES = ["package.json", "bun.lock", "bun.lockb"];
+var isCodePath = (p) => {
+  if (!p || p.startsWith("/") || p.includes("\\") || p.includes("\0"))
+    return false;
+  const segs = p.split("/");
+  if (segs.some((s2) => s2 === "" || s2 === "." || s2 === "..")) return false;
+  if (segs.some((s2) => s2 === "node_modules" || s2.startsWith(".git")))
+    return false;
+  const [first] = segs;
+  if (!first) return false;
+  if (segs.length === 1) {
+    return ROOT_CODE_FILES.includes(first) || first.startsWith("pb_") && first !== "pb_data";
+  }
+  if (first === "pb_data") return false;
+  return first.startsWith("pb_") || first === "patches";
+};
+
 // src/lib/deployIncludes.ts
 var DEFAULT_INCLUDES = [
   `pb_*`,
@@ -19290,6 +19322,267 @@ var shouldSyncFile = (file, include, exclude, match2) => {
   return isIncluded && !isExcluded;
 };
 
+// src/lib/deployBundle.ts
+import { createHash as createHash2 } from "crypto";
+var BUNDLE_MAGIC = Buffer.from("PHB1");
+var sha256 = (data) => createHash2("sha256").update(data).digest("hex");
+var encodeBundle = (entries) => {
+  const parts = [BUNDLE_MAGIC];
+  for (const data of entries) {
+    const len = Buffer.alloc(4);
+    len.writeUInt32BE(data.length);
+    parts.push(createHash2("sha256").update(data).digest(), len, data);
+  }
+  return Buffer.concat(parts);
+};
+var batchBySize = (items, maxBytes) => {
+  const batches = [];
+  let cur = [];
+  let curBytes = 0;
+  for (const item of items) {
+    if (cur.length > 0 && curBytes + item.size > maxBytes) {
+      batches.push(cur);
+      cur = [];
+      curBytes = 0;
+    }
+    cur.push(item);
+    curBytes += item.size;
+  }
+  if (cur.length > 0) batches.push(cur);
+  return batches;
+};
+
+// src/lib/token.ts
+var PAT_PREFIX = "ph_pat_";
+var PAT_RE = /^ph_pat_[a-z0-9]{15}_[0-9A-Za-z]{43}$/;
+var isPat = (v2) => PAT_RE.test(v2.trim());
+var maskToken = (token) => token.startsWith(PAT_PREFIX) ? `${PAT_PREFIX}\u2026${token.slice(-4)}` : "\u2026";
+var savedToken = () => config("token") || "";
+var resolveDeployCredential = async () => {
+  const env3 = TOKEN().trim();
+  if (env3) return { token: env3, kind: "pat", source: "POCKETHOST_TOKEN" };
+  const saved = savedToken().trim();
+  if (saved && !USERNAME())
+    return { token: saved, kind: "pat", source: "saved token" };
+  const client2 = await getClient();
+  if (client2.authStore.isValid && client2.authStore.token) {
+    const email = client2.authStore.record?.email || "login";
+    return { token: client2.authStore.token, kind: "login", source: email };
+  }
+  throw new Error(
+    `Not authenticated. Set POCKETHOST_TOKEN (create a token at https://app.pockethost.io/account/tokens), run 'pockethost token set', or run 'pockethost login'.`
+  );
+};
+var tokenWhoami = async (token) => {
+  const res = await fetch(MOTHERSHIP_URL("/api/pat/whoami"), {
+    headers: { Authorization: `Bearer ${token}` }
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    throw new Error(body.message || `Token check failed (HTTP ${res.status})`);
+  }
+  return body;
+};
+var describeToken = (w) => {
+  const scope = w.instances ? w.instances.map((i2) => i2.subdomain).join(", ") || "(no instances)" : "all instances";
+  const expires = w.expires ? `expires ${w.expires.slice(0, 10)}` : "no expiry";
+  return `"${w.label}" (${PAT_PREFIX}\u2026${w.hint}) for ${w.email}: ${w.scopes.join(", ")} on ${scope}, ${expires}`;
+};
+
+// src/lib/deployApi.ts
+var DEPLOY_API_PREFIX = "/_ph/deploy/v1";
+var UPLOAD_BATCH_BYTES = 32 * 1024 * 1024;
+var DeployApiError = class extends Error {
+  constructor(status, message, body = {}) {
+    super(message);
+    this.status = status;
+    this.body = body;
+  }
+  status;
+  body;
+};
+var collectLocalFiles = async (include, exclude, cwd = process.cwd()) => {
+  const matches = ts(include, {
+    ignore: mergeDeployExcludes(excludeDefaults, exclude),
+    cwd,
+    nodir: true,
+    // The server deletes code-set files missing from the manifest, so dotfiles (pb_public/.well-known/…) must ship.
+    dot: true
+  });
+  const files = [];
+  const skipped = [];
+  for (const raw of [...new Set(matches)].sort()) {
+    const path5 = raw.split(sep2).join("/");
+    const abs = `${cwd}/${path5}`;
+    const st2 = lstatSync2(abs);
+    if (!st2.isFile()) {
+      skipped.push(path5);
+      continue;
+    }
+    if (!isCodePath(path5)) {
+      skipped.push(path5);
+      continue;
+    }
+    files.push({ path: path5, size: st2.size, hash: sha256(await readFile(abs)) });
+  }
+  return { files, skipped };
+};
+var detectCommit = (cwd) => {
+  const fromEnv = process.env.GITHUB_SHA || process.env.CI_COMMIT_SHA;
+  if (fromEnv) return fromEnv;
+  try {
+    return execFileSync("git", ["rev-parse", "HEAD"], {
+      cwd,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).toString().trim();
+  } catch {
+    return "";
+  }
+};
+var detectSource = () => process.env.GITHUB_ACTIONS ? "github-actions" : process.env.CI ? "ci" : `cli/${version}`;
+var createDeployClient = (instanceName, cred) => {
+  const base = `${INSTANCE_URL(instanceName)}${DEPLOY_API_PREFIX}`;
+  const call = async (method, path5, body, raw) => {
+    let res;
+    try {
+      res = await fetch(`${base}${path5}`, {
+        method,
+        headers: {
+          Authorization: `Bearer ${cred.token}`,
+          "User-Agent": `pockethost-cli/${version}`,
+          ...raw ? { "Content-Type": "application/octet-stream" } : body !== void 0 ? { "Content-Type": "application/json" } : {}
+        },
+        body: raw ? new Uint8Array(raw) : body !== void 0 ? JSON.stringify(body) : void 0
+      });
+    } catch (e2) {
+      throw new DeployApiError(
+        0,
+        `Could not reach ${base}: ${e2.message}`
+      );
+    }
+    const text = await res.text();
+    let json = {};
+    try {
+      json = text ? JSON.parse(text) : {};
+    } catch {
+      json = { message: text.slice(0, 300) };
+    }
+    if (!res.ok) {
+      const msg = json.message || `HTTP ${res.status}`;
+      if (res.status === 401) {
+        throw new DeployApiError(
+          401,
+          `Authentication failed (${cred.source}): ${msg}`,
+          json
+        );
+      }
+      if (res.status === 404) {
+        throw new DeployApiError(
+          404,
+          `Instance '${instanceName}' not found, or ${cred.kind === "pat" ? "this token cannot access it" : "it is not yours"}.`,
+          json
+        );
+      }
+      throw new DeployApiError(res.status, msg, json);
+    }
+    return json;
+  };
+  return {
+    base,
+    whoami: () => call("GET", "/whoami"),
+    check: (files) => call("POST", "/check", { files }),
+    upload: (bundle) => call(
+      "POST",
+      "/blobs",
+      void 0,
+      bundle
+    ),
+    commit: (body) => call("POST", "/commit", body)
+  };
+};
+var deployViaApi = async (opts) => {
+  const log2 = opts.log ?? console.log;
+  const cwd = opts.cwd ?? process.cwd();
+  const cred = await resolveDeployCredential();
+  const client2 = createDeployClient(opts.instanceName, cred);
+  const { files, skipped } = await collectLocalFiles(
+    opts.include,
+    opts.exclude,
+    cwd
+  );
+  if (skipped.length > 0) {
+    log2(
+      `\u26A0\uFE0F  Skipping ${skipped.length} file(s) outside the deployable set (pb_* except pb_data, package.json, bun.lock(b), patches/)${opts.verbose ? `: ${skipped.join(", ")}` : ""}`
+    );
+  }
+  const manifest = Object.fromEntries(files.map((f) => [f.path, f.hash]));
+  const byHash = new Map(files.map((f) => [f.hash, f]));
+  log2(
+    `\u{1F69A} Deploying ${files.length} files to ${opts.instanceName} (${cred.kind === "pat" ? `token from ${cred.source}` : `login ${cred.source}`})`
+  );
+  let uploadedCount = 0;
+  let uploadedBytes = 0;
+  const upload = async (hashes) => {
+    const toSend = [...new Set(hashes)].map((h) => byHash.get(h)).filter((f) => !!f);
+    if (toSend.length === 0) return;
+    const bytes = toSend.reduce((n8, f) => n8 + f.size, 0);
+    log2(`\u2B06\uFE0F  Uploading ${toSend.length} file(s) (${prettyBytes(bytes)})`);
+    for (const batch of batchBySize(toSend, UPLOAD_BATCH_BYTES)) {
+      const buffers = await Promise.all(
+        batch.map((f) => readFile(`${cwd}/${f.path}`))
+      );
+      for (let i2 = 0; i2 < batch.length; i2++) {
+        if (sha256(buffers[i2]) !== batch[i2].hash) {
+          throw new Error(
+            `${batch[i2].path} changed during deploy; run it again`
+          );
+        }
+      }
+      await client2.upload(gzipSync(encodeBundle(buffers)));
+      if (opts.verbose) for (const f of batch) log2(`   ${f.path}`);
+    }
+    uploadedCount += toSend.length;
+    uploadedBytes += bytes;
+  };
+  const { missing } = await client2.check(manifest);
+  await upload(missing);
+  const commitBody = {
+    files: manifest,
+    commit: opts.commit ?? detectCommit(cwd),
+    message: opts.message ?? "",
+    source: detectSource(),
+    uploadedCount,
+    uploadedBytes
+  };
+  let result;
+  try {
+    result = await client2.commit(commitBody);
+  } catch (e2) {
+    if (e2 instanceof DeployApiError && e2.status === 409 && Array.isArray(e2.body.missing)) {
+      await upload(e2.body.missing);
+      result = await client2.commit({
+        ...commitBody,
+        uploadedCount,
+        uploadedBytes
+      });
+    } else {
+      throw e2;
+    }
+  }
+  if (opts.verbose) {
+    for (const p of result.written) log2(`   + ${p}`);
+    for (const p of result.deleted) log2(`   - ${p}`);
+  }
+  if (result.nothingChanged) {
+    log2(`\u2705 ${opts.instanceName} is up to date: no changes.`);
+    return result;
+  }
+  const summary = `${result.writtenCount} changed, ${result.deletedCount} deleted, ${result.unchanged} unchanged`;
+  const restart = result.restarted ? " Instance restarted." : result.startError ? ` Instance failed to start: ${result.startError} (check 'pockethost logs').` : "";
+  log2(`\u{1F680} Deployed ${result.deployId}: ${summary}.${restart}`);
+  return result;
+};
+
 // src/commands/DevCommand.ts
 var watchAndDeploy = async (instanceName, options2 = {
   include: DEFAULT_INCLUDES,
@@ -19302,20 +19595,27 @@ var watchAndDeploy = async (instanceName, options2 = {
     );
   }
   console.log(`Dev mode`);
-  await ensureLoggedIn();
-  const { include, exclude, verbose } = options2;
-  const instance = await (async () => {
-    try {
-      return await getInstanceBySubdomainCnameOrId(instanceName);
-    } catch (error2) {
-      throw new Error(`Instance ${instanceName} not found`);
+  const { include, exclude, verbose, sftp } = options2;
+  const subdomain = await (async () => {
+    if (sftp) {
+      await ensureLoggedIn();
+      try {
+        return (await getInstanceBySubdomainCnameOrId(instanceName)).subdomain;
+      } catch (error2) {
+        throw new Error(`Instance ${instanceName} not found`);
+      }
     }
+    const { instance } = await createDeployClient(
+      instanceName,
+      await resolveDeployCredential()
+    ).whoami();
+    return instanceName.includes(".") ? instanceName : instance.subdomain;
   })();
   const limiter = new import_bottleneck.default({ maxConcurrent: 1 });
   const upload = debounce(
     () => limiter.schedule(
-      () => deployMyCode(instance.subdomain, include, exclude, verbose).catch(
-        console.error
+      () => deployMyCode(subdomain, include, exclude, verbose, { sftp }).catch(
+        (e2) => console.error(`Deploy failed: ${e2.message ?? e2}`)
       )
     ),
     200
@@ -19337,7 +19637,26 @@ var watchAndDeploy = async (instanceName, options2 = {
   };
   watcher.on("add", handle).on("change", handle).on("unlink", handle);
 };
-async function deployMyCode(instanceName, include, exclude, verbose) {
+async function deployMyCode(instanceName, include, exclude, verbose, extra = {}) {
+  if (!instanceName) {
+    throw new Error(
+      `No instance name provided and none was found in ${PROJECT_CONFIG_FILE}. Use 'pockethost link <instance>'`
+    );
+  }
+  if (!extra.sftp) {
+    await deployViaApi({
+      instanceName,
+      include,
+      exclude,
+      verbose,
+      commit: extra.commit,
+      message: extra.message
+    });
+    return;
+  }
+  return deployMyCodeOverSftp(instanceName, include, exclude, verbose);
+}
+async function deployMyCodeOverSftp(instanceName, include, exclude, verbose) {
   await ensureLoggedIn();
   const client2 = await getClient();
   const { privateKeyPath } = await ensureDeployKey(client2);
@@ -19361,7 +19680,7 @@ async function deployMyCode(instanceName, include, exclude, verbose) {
   console.log("\u{1F680} Deploy done!");
 }
 var DevCommand = () => {
-  return new Command("dev").argument(`[instanceName]`, `Instance name`, savedInstanceName()).description(`Watch for local modifications and sync to remote`).option(`-v, --verbose`, `Verbose output`).option(
+  return new Command("dev").argument(`[instanceName]`, `Instance name`, savedInstanceName()).description(`Watch for local modifications and deploy them`).option(`-v, --verbose`, `Verbose output`).option(`--sftp`, `Sync over SFTP instead of the deploy API`).option(
     "-i, --include <include...>",
     "Files to include in the sync",
     (val, prev) => [...prev, ...val.split(",")],
@@ -19378,7 +19697,12 @@ var DevCommand = () => {
 
 // src/commands/DeployCommand.ts
 var DeployCommand = () => {
-  return new Command(`deploy`).argument(`[instanceName]`, `Instance name`, savedInstanceName()).description(`Deploy to remote`).option(`-v, --verbose`, `Verbose output`).option(
+  return new Command(`deploy`).argument(`[instanceName]`, `Instance name`, savedInstanceName()).description(
+    `Deploy pb_hooks, pb_migrations, pb_public and packages to an instance`
+  ).option(`-v, --verbose`, `Verbose output`).option(`--sftp`, `Sync over SFTP instead of the deploy API`).option(
+    `--commit <sha>`,
+    `Commit SHA to record (default: $GITHUB_SHA or git HEAD)`
+  ).option(`-m, --message <message>`, `Note to record with this deploy`).option(
     "-i, --include <include...>",
     "Files to include in the sync",
     (val, prev) => [...prev, ...val.split(",")],
@@ -19391,35 +19715,15 @@ var DeployCommand = () => {
     },
     DEFAULT_EXCLUDES
   ).action(async (instanceName, options2) => {
-    const { include, exclude, verbose } = options2;
-    await deployMyCode(instanceName, include, exclude, verbose);
+    const { include, exclude, verbose, sftp, commit, message } = options2;
+    await deployMyCode(instanceName, include, exclude, verbose, {
+      sftp,
+      commit,
+      message
+    });
   });
 };
 
-// src/commands/InfoCommand.ts
-var showInfo = async () => {
-  const auth = await resolveAuthStatus();
-  if (auth.state !== "authenticated") {
-    console.log(`Not logged in. Run 'pockethost login'.`);
-    return;
-  }
-  await ensureDeployKey(auth.client);
-  const status = await getDeployKeyStatus(auth.client);
-  console.log(`Config root: ${CLI_HOME()}`);
-  console.log(`Logged in as: ${auth.email}`);
-  console.log(`Instance: ${savedInstanceName() || "(not linked)"}`);
-  console.log(`Deploy key label: ${DEPLOY_KEY_LABEL}`);
-  console.log(`Deploy key private: ${status.privateKeyPath}`);
-  console.log(`Deploy key public: ${status.publicKeyPath}`);
-  console.log(`Deploy key fingerprint: ${status.fingerprint}`);
-  console.log(
-    `Deploy key remote: ${formatDeployKeyRemoteStatus(status.remote)}`
-  );
-};
-var InfoCommand = () => {
-  return new Command(`info`).alias(`whoami`).description(`Show login and config info`).action(showInfo);
-};
-
 // ../../node_modules/.pnpm/@inquirer+core@11.2.1_@types+node@20.19.43/node_modules/@inquirer/core/dist/lib/key.js
 var keybindings = ["emacs", "vim"];
 var keybindingLookup = new Set(keybindings);
@@ -21008,6 +21312,85 @@ var dist_default6 = createPrompt((config2, done) => {
   return `${lines}${cursorHide}`;
 });
 
+// src/commands/TokenCommand.ts
+var TOKENS_URL = "https://app.pockethost.io/account/tokens";
+var saveToken = async (raw) => {
+  const token = (raw ?? await dist_default5({
+    message: `Paste your PocketHost token (create one at ${TOKENS_URL})`,
+    mask: true
+  })).trim();
+  if (!isPat(token)) {
+    throw new Error(
+      `That doesn't look like a PocketHost token (expected ph_pat_\u2026). Create one at ${TOKENS_URL}`
+    );
+  }
+  const who = await tokenWhoami(token);
+  config("token", token);
+  console.log(`Saved token ${describeToken(who)}`);
+};
+var showTokenStatus = async () => {
+  const env3 = TOKEN();
+  const token = env3 || savedToken();
+  if (!token) {
+    console.log(
+      `No token. Set POCKETHOST_TOKEN or run 'pockethost token set'. Create one at ${TOKENS_URL}`
+    );
+    return;
+  }
+  console.log(
+    `Using ${maskToken(token)} from ${env3 ? "POCKETHOST_TOKEN" : "saved config"}`
+  );
+  try {
+    console.log(describeToken(await tokenWhoami(token)));
+  } catch (e2) {
+    console.log(`Token check failed: ${e2.message}`);
+    process.exitCode = 1;
+  }
+};
+var TokenCommand = () => new Command("token").description(`Manage the personal access token used for deploys`).addCommand(
+  new Command("set").argument("[token]", "Token (ph_pat_\u2026); prompts when omitted").description("Verify and save a token").action((token) => saveToken(token))
+).addCommand(
+  new Command("clear").description("Remove the saved token").action(() => {
+    config("token", "");
+    console.log("Saved token removed.");
+  })
+).addCommand(
+  new Command("status").description("Show which token is in use").action(showTokenStatus)
+).action(showTokenStatus);
+
+// src/commands/InfoCommand.ts
+var showInfo = async () => {
+  const token = TOKEN() || savedToken();
+  if (token) {
+    console.log(`Config root: ${CLI_HOME()}`);
+    console.log(`Instance: ${savedInstanceName() || "(not linked)"}`);
+    await showTokenStatus();
+    return;
+  }
+  const auth = await resolveAuthStatus();
+  if (auth.state !== "authenticated") {
+    console.log(
+      `Not logged in. Run 'pockethost login', or set POCKETHOST_TOKEN / run 'pockethost token set'.`
+    );
+    return;
+  }
+  await ensureDeployKey(auth.client);
+  const status = await getDeployKeyStatus(auth.client);
+  console.log(`Config root: ${CLI_HOME()}`);
+  console.log(`Logged in as: ${auth.email}`);
+  console.log(`Instance: ${savedInstanceName() || "(not linked)"}`);
+  console.log(`Deploy key label: ${DEPLOY_KEY_LABEL}`);
+  console.log(`Deploy key private: ${status.privateKeyPath}`);
+  console.log(`Deploy key public: ${status.publicKeyPath}`);
+  console.log(`Deploy key fingerprint: ${status.fingerprint}`);
+  console.log(
+    `Deploy key remote: ${formatDeployKeyRemoteStatus(status.remote)}`
+  );
+};
+var InfoCommand = () => {
+  return new Command(`info`).alias(`whoami`).description(`Show login and config info`).action(showInfo);
+};
+
 // src/commands/LinkCommand.ts
 var link = async (instanceName) => {
   saveInstanceName(instanceName);
@@ -21108,12 +21491,19 @@ var loginWithUserInput = async () => {
   }
   console.log(`Logged in!`);
 };
-var LoginCommand = () => new Command("login").description(`Log in to PocketHost`).helpOption(false).action(loginWithUserInput);
+var LoginCommand = () => new Command("login").description(`Log in to PocketHost (email/password, or --token)`).option(`--token [token]`, `Log in with a personal access token instead`).action(async (opts) => {
+  if (opts.token !== void 0) {
+    await saveToken(typeof opts.token === "string" ? opts.token : void 0);
+    return;
+  }
+  await loginWithUserInput();
+});
 
 // src/commands/LogoutCommand.ts
 var logout = async () => {
   config(`pb_auth`, "");
-  console.log(`Logged out!`);
+  config(`token`, "");
+  console.log(`Logged out! (saved login and token removed)`);
 };
 var LogoutCommand = () => new Command("logout").description(`Log out of PocketHost`).helpOption(false).action(logout);
 
@@ -21520,7 +21910,7 @@ var SftpCommand = () => {
 
 // src/cli.ts
 ensureProjectRoot();
-program.name(`pockethost`).version(version).description(`Deploy, sync, and tail logs for your PocketHost instances`).addCommand(LoginCommand()).addCommand(LogsCommand()).addCommand(DevCommand()).addCommand(ListCommand()).addCommand(LinkCommand()).addCommand(DeployCommand()).addCommand(SftpCommand()).addCommand(LogoutCommand()).addCommand(InfoCommand());
+program.name(`pockethost`).version(version).description(`Deploy, sync, and tail logs for your PocketHost instances`).addCommand(LoginCommand()).addCommand(TokenCommand()).addCommand(LogsCommand()).addCommand(DevCommand()).addCommand(ListCommand()).addCommand(LinkCommand()).addCommand(DeployCommand()).addCommand(SftpCommand()).addCommand(LogoutCommand()).addCommand(InfoCommand());
 program.exitOverride();
 program.parseAsync(process.argv).catch((err) => {
   if (err.code === "commander.helpDisplayed" || err.code === "commander.help" || err.code === "commander.version") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pockethost",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "description": "The PocketHost CLI: deploy, sync, and tail logs for your PocketHost instances",
   "repository": {
     "type": "git",
@@ -25,6 +25,15 @@
   "engines": {
     "node": ">=20"
   },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "check:types": "tsc --noEmit",
+    "dev": "node --import tsx ./src/cli.ts",
+    "start": "node --import tsx ./src/cli.ts",
+    "test": "vitest run",
+    "prepublishOnly": "pnpm check:types && pnpm test",
+    "prepack": "pnpm build"
+  },
   "files": [
     "dist",
     "CHANGELOG.md",
@@ -58,12 +67,5 @@
     "semi": false,
     "singleQuote": true,
     "trailingComma": "es5"
-  },
-  "scripts": {
-    "build": "node scripts/build.mjs",
-    "check:types": "tsc --noEmit",
-    "dev": "node --import tsx ./src/cli.ts",
-    "start": "node --import tsx ./src/cli.ts",
-    "test": "vitest run"
   }
-}
+}

package/LICENSE.md

@@ -1,16 +0,0 @@
-The MIT License (MIT)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software
-and associated documentation files (the "Software"), to deal in the Software without restriction,
-including without limitation the rights to use, copy, modify, merge, publish, distribute,
-sublicense, and/or sell copies of the Software, and to permit persons to whom the Software
-is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or
-substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING
-BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.