slingdrop 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sansa Group AB
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,60 @@
-# Temporary Holding Version
+# slingdrop
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Send anything from your terminal and get a link. Files, whole folders, or piped output. The link, a QR code and a copy on your clipboard come back in seconds.
+
+```bash
+npx slingdrop deck.pdf
+```
+
+Requires Node 20 or later.
+
+## Without an account
+
+```bash
+npx slingdrop deck.pdf                       # public link, lasts 24 hours
+npx slingdrop screenshot.png --passcode 4821
+cat build.log | npx slingdrop --name build.log
+```
+
+## Signed in
+
+Sign in once and links last longer. You also get Vault (end-to-end encryption), private drops and your drop list.
+
+```bash
+npm i -g slingdrop
+slingdrop login                              # opens your browser
+slingdrop ./dist --expires 30d               # a whole folder
+slingdrop contract.pdf --vault               # encrypted on this machine
+slingdrop review.mp4 --private ana@studio.com,sam@client.com --approval
+slingdrop ls
+slingdrop rm <id>                            # Trash; add --forever to delete now
+slingdrop request "Brand assets"             # a link others can upload to
+```
+
+`sling` works as a short alias. Run `slingdrop --help` for every option.
+
+## File hosting
+
+Host images, fonts and other assets for your app on stable CDN URLs. Included in every plan (Free: 1 GB, 10 GB bandwidth a month).
+
+```bash
+slingdrop host ./public/assets --space acme          # prints a URL per file
+slingdrop host ./dist/assets --prefix v42 --immutable # cache hashed files for a year
+slingdrop host ./public/assets --json > assets.json   # {path: url} manifest
+slingdrop host ls | rm <path> | spaces | usage
+```
+
+Files are served from `https://cdn.slingdropcontent.my/<space>/<path>`. Add `?w=400&format=auto` to an image URL to resize it.
+
+## Scripts and CI
+
+```bash
+SLINGDROP_API_KEY=sd_... slingdrop report.pdf --json
+# {"id":"...","url":"https://slingdrop.my/d/...","expiresAt":"..."}
+```
+
+Create API keys in Settings → Developer at [slingdrop.my](https://slingdrop.my). The docs are at [slingdrop.my/developers](https://slingdrop.my/developers).
+
+## License
+
+MIT © Sansavision

package/dist/cli.js

@@ -0,0 +1,645 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { openAsBlob } from "fs";
+import { mkdir, readFile, readdir, stat, writeFile, rm } from "fs/promises";
+import { homedir, hostname } from "os";
+import { basename, join, relative } from "path";
+import { spawn } from "child_process";
+import QRCode from "qrcode";
+
+// ../sdk/dist/index.js
+var VAULT_CHUNK = 8 * 1024 * 1024;
+var VAULT_OVERHEAD = 28;
+var META_INDEX = 4294967295;
+var enc = new TextEncoder();
+var dec = new TextDecoder();
+function toB64url(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function aad(index) {
+  const b = new Uint8Array(4);
+  new DataView(b.buffer).setUint32(0, index >>> 0);
+  return b;
+}
+async function generateVaultKey() {
+  return await crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt", "decrypt"]);
+}
+async function exportVaultKey(key) {
+  return toB64url(new Uint8Array(await crypto.subtle.exportKey("raw", key)));
+}
+async function encryptChunk(key, plaintext, index) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ct = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: aad(index) }, key, plaintext));
+  const out = new Uint8Array(12 + ct.length);
+  out.set(iv, 0);
+  out.set(ct, 12);
+  return out;
+}
+async function encryptText(key, text) {
+  return toB64url(await encryptChunk(key, enc.encode(text), META_INDEX));
+}
+function encryptedSize(plainSize) {
+  const chunks = Math.max(1, Math.ceil(plainSize / VAULT_CHUNK));
+  return plainSize + chunks * VAULT_OVERHEAD;
+}
+var SINGLE_PUT_MAX = 95 * 1024 ** 2;
+var enc2 = (path) => path.replace(/^\/+/, "").split("/").map(encodeURIComponent).join("/");
+function hostingApi(request) {
+  return {
+    spaces: () => request("/hosting/spaces").then((r) => r.data),
+    /** Creates a space with this name (or your default space when omitted). */
+    createSpace: (slug) => request("/hosting/spaces", { method: "POST", body: JSON.stringify({ slug }) }).then((r) => r.data),
+    deleteSpace: (space) => request(`/hosting/spaces/${space}`, { method: "DELETE" }),
+    usage: () => request("/hosting/usage").then((r) => r.data),
+    list: (space, opts = {}) => {
+      const q = new URLSearchParams(Object.entries(opts).filter(([, v]) => v !== void 0).map(([k, v]) => [k, String(v)]));
+      return request(`/hosting/${space}/objects${q.size ? `?${q}` : ""}`);
+    },
+    /**
+     * Uploads a file and returns its public URL. The space is created if the name is free. Files over
+     * 95 MB are sent in parts automatically. `immutable` caches the URL for a year: use it for
+     * content-hashed file names.
+     */
+    put: async (space, path, data, opts = {}) => {
+      const blob = data instanceof Blob ? data : new Blob([data]);
+      const type = opts.contentType ?? blob.type ?? "";
+      if (blob.size <= SINGLE_PUT_MAX) {
+        const r = await request(`/hosting/${space}/objects/${enc2(path)}${opts.immutable ? "?immutable=1" : ""}`, {
+          method: "PUT",
+          body: blob,
+          headers: { "content-type": type || "application/octet-stream" }
+        });
+        opts.onProgress?.(blob.size, blob.size);
+        return r.data;
+      }
+      const start = await request(`/hosting/${space}/multipart`, {
+        method: "POST",
+        body: JSON.stringify({ path, size: blob.size, contentType: type || void 0, immutable: opts.immutable })
+      });
+      const parts = [];
+      let loaded = 0;
+      const queue = Array.from({ length: start.parts }, (_, i) => i);
+      await Promise.all(
+        Array.from({ length: Math.min(3, start.parts) }, async () => {
+          for (let i = queue.shift(); i !== void 0; i = queue.shift()) {
+            const slice = blob.slice(i * start.partSize, (i + 1) * start.partSize);
+            parts.push(
+              await request(`/hosting/${space}/multipart/parts/${i + 1}`, {
+                method: "PUT",
+                body: slice,
+                headers: { "content-type": "application/octet-stream", "x-upload-token": start.token }
+              })
+            );
+            loaded += slice.size;
+            opts.onProgress?.(loaded, blob.size);
+          }
+        })
+      );
+      return request(`/hosting/${space}/multipart/complete`, { method: "POST", body: JSON.stringify({ token: start.token, parts }) }).then((r) => r.data);
+    },
+    delete: (space, path) => request(`/hosting/${space}/objects/${enc2(path)}`, { method: "DELETE" }),
+    /**
+     * A short-lived URL your own users can PUT one file to, straight from their browser. Limit it to a
+     * type ("image/*") and size. The response tells you the public URL the file will have.
+     */
+    createUploadUrl: (space, opts = {}) => request(`/hosting/${space}/upload-urls`, { method: "POST", body: JSON.stringify(opts) })
+  };
+}
+function reviewsApi(request) {
+  return {
+    /** Marks an uploaded drop as a review by your agent and notifies you. */
+    start: (dropId, opts = {}) => request(`/drops/${dropId}/review`, { method: "POST", body: JSON.stringify(opts) }).then((r) => r.data),
+    /** The current state. With `wait` (seconds, up to 60) it waits for new feedback after `since`. */
+    feedback: (dropId, opts = {}) => {
+      const q = new URLSearchParams();
+      if (opts.since) q.set("since", opts.since);
+      if (opts.wait) q.set("wait", String(Math.min(60, Math.max(0, Math.round(opts.wait)))));
+      return request(`/drops/${dropId}/feedback${q.size ? `?${q}` : ""}`).then((r) => r.data);
+    },
+    /** After uploading a new version with `drops.addVersion`, records the round and resolves what it addressed. */
+    round: (dropId, opts = {}) => request(`/drops/${dropId}/rounds`, { method: "POST", body: JSON.stringify(opts) }).then((r) => r.data),
+    reply: (dropId, commentId, text) => request(`/drops/${dropId}/comments/${commentId}/replies`, { method: "POST", body: JSON.stringify({ text }) }).then((r) => r.data),
+    resolve: (dropId, commentId, resolved = true) => request(`/drops/${dropId}/comments/${commentId}/resolve`, { method: "POST", body: JSON.stringify({ resolved }) }),
+    approvals: (dropId) => request(`/drops/${dropId}/approvals`).then((r) => r.data)
+  };
+}
+var SlingdropError = class extends Error {
+  constructor(message, status, code) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "SlingdropError";
+  }
+  status;
+  code;
+};
+var Slingdrop = class {
+  baseUrl;
+  apiKey;
+  bearer;
+  fetchImpl;
+  constructor(opts = {}) {
+    this.apiKey = opts.apiKey;
+    this.bearer = opts.bearer;
+    this.baseUrl = (opts.baseUrl ?? "https://slingdrop.my").replace(/\/$/, "");
+    this.fetchImpl = opts.fetch ?? ((input, init) => fetch(input, init));
+  }
+  /** Low-level request against /api/v1. */
+  async request(path, init = {}) {
+    const res = await this.fetchImpl(`${this.baseUrl}/api/v1${path}`, {
+      ...init,
+      headers: { "content-type": "application/json", authorization: `Bearer ${this.apiKey ?? this.bearer ?? ""}`, ...init.headers }
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) throw new SlingdropError(data.error ?? `Request failed (${res.status})`, res.status, data.code);
+    return data;
+  }
+  /** True when no API key or session is set: only anonymous `drops.create` is available. */
+  get anonymous() {
+    return !this.apiKey && !this.bearer;
+  }
+  me() {
+    return this.request("/me");
+  }
+  drops = {
+    list: (status = "active") => this.request(`/drops?status=${status}`).then((r) => r.data),
+    get: (id) => this.request(`/drops/${id}`).then((r) => r.data),
+    update: (id, patch) => this.request(`/drops/${id}`, { method: "PATCH", body: JSON.stringify(patch) }).then((r) => r.data),
+    revoke: (id) => this.request(`/drops/${id}/revoke`, { method: "POST" }),
+    /** Moves the drop to Trash (restorable for 30 days), or deletes it right away with `{ forever: true }`. */
+    delete: (id, opts = {}) => this.request(`/drops/${id}${opts.forever ? "?forever=1" : ""}`, { method: "DELETE" }),
+    analytics: (id, days = 30) => this.request(`/drops/${id}/analytics?days=${days}`).then((r) => r.data),
+    comments: (id) => this.request(`/drops/${id}/comments`).then((r) => r.data),
+    /** Creates a drop and uploads every file. The link is usable as soon as this resolves. */
+    create: async (files, opts = {}) => {
+      if (files.length === 0) throw new SlingdropError("Add at least one file.", 400);
+      const key = opts.vault ? await generateVaultKey() : null;
+      const manifest = await Promise.all(
+        files.map(async (f) => {
+          const type = f.type || f.data.type || "application/octet-stream";
+          if (!key) return { name: f.name, size: f.data.size, type, relativePath: f.name.includes("/") ? f.name : void 0 };
+          return { name: await encryptText(key, JSON.stringify({ name: f.name, type })), size: encryptedSize(f.data.size), type: "application/octet-stream" };
+        })
+      );
+      const create = this.anonymous ? (init) => this.publicRequest("/drops", init) : (init) => this.request("/drops", init);
+      const created = await create({
+        method: "POST",
+        signal: opts.signal,
+        body: JSON.stringify({
+          title: key && opts.title ? await encryptText(key, opts.title) : opts.title,
+          visibility: opts.recipients?.length ? "private" : opts.passcode && !key ? "passcode" : "public",
+          encryption: key ? "vault" : "none",
+          passcode: key ? void 0 : opts.passcode,
+          recipients: (opts.recipients ?? []).map((email) => ({ email, role: "viewer" })),
+          allowDownload: opts.allowDownload ?? true,
+          purpose: opts.purpose ?? "share",
+          allowComment: opts.allowComment ?? opts.purpose === "feedback",
+          allowEdit: opts.allowEdit ?? false,
+          requireApproval: opts.requireApproval ?? false,
+          expiry: opts.expiry ?? (this.anonymous ? "24h" : opts.purpose === "feedback" ? "7d" : "forever"),
+          vaultKeyCheck: key ? await encryptText(key, "slingdrop-vault") : void 0,
+          organizationId: opts.organizationId,
+          files: manifest
+        })
+      });
+      const total = manifest.reduce((n, f) => n + f.size, 0);
+      const loaded = /* @__PURE__ */ new Map();
+      const report = () => opts.onProgress?.([...loaded.values()].reduce((a, b) => a + b, 0), total);
+      for (let i = 0; i < created.files.length; i++) {
+        await this.upload(created.files[i], files[i].data, key, (n) => {
+          loaded.set(created.files[i].id, n);
+          report();
+        }, opts.signal);
+      }
+      const shareUrl = key ? `${created.drop.url}#k=${await exportVaultKey(key)}` : created.drop.url;
+      return { drop: created.drop, shareUrl, ownerKey: created.ownerKey };
+    },
+    /** Publishes a new version behind the same link. */
+    addVersion: async (id, files, note) => {
+      const manifest = files.map((f) => ({ name: f.name, size: f.data.size, type: f.type || f.data.type || "application/octet-stream" }));
+      const created = await this.request(`/drops/${id}/versions`, { method: "POST", body: JSON.stringify({ note, files: manifest }) });
+      for (let i = 0; i < created.files.length; i++) await this.upload(created.files[i], files[i].data, null, () => {
+      });
+      return created.version;
+    }
+  };
+  requests = {
+    list: () => this.request("/requests").then((r) => r.data),
+    create: (input) => this.request("/requests", { method: "POST", body: JSON.stringify(input) })
+  };
+  /** Review loops: send work for review, read comments and the decision, send new versions. */
+  reviews = reviewsApi((path, init) => this.request(path, init));
+  /** Developer file hosting: stable public URLs for app assets and your users' uploads. */
+  hosting = hostingApi((path, init) => this.request(path, init));
+  webhooks = {
+    list: () => this.request("/webhooks"),
+    create: (url, events) => this.request("/webhooks", { method: "POST", body: JSON.stringify({ url, events }) }),
+    delete: (id) => this.request(`/webhooks/${id}`, { method: "DELETE" }),
+    deliveries: (id) => this.request(`/webhooks/${id}/deliveries`).then((r) => r.data)
+  };
+  async publicRequest(path, init = {}) {
+    const res = await this.fetchImpl(`${this.baseUrl}/api${path}`, { ...init, headers: { "content-type": "application/json", ...init.headers } });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) throw new SlingdropError(data.error ?? `Request failed (${res.status})`, res.status, data.code);
+    return data;
+  }
+  async put(url, token, body, signal) {
+    for (let attempt = 0; ; attempt++) {
+      try {
+        const res = await this.fetchImpl(url, { method: "PUT", headers: { "x-upload-token": token }, body, signal });
+        if (res.ok) return res;
+        if (res.status < 500 && res.status !== 429) throw new SlingdropError((await res.json().catch(() => ({}))).error ?? "Upload failed", res.status);
+      } catch (err) {
+        if (err instanceof SlingdropError || signal?.aborted || attempt >= 6) throw err;
+      }
+      await new Promise((r) => setTimeout(r, Math.min(15e3, 500 * 2 ** attempt)));
+    }
+  }
+  async upload(plan, data, key, onLoaded, signal) {
+    const base = `${this.baseUrl}/api/uploads/${plan.id}`;
+    if (plan.mode === "single") {
+      let body = data;
+      if (key) {
+        const parts2 = [];
+        for (let i = 0, n = Math.max(1, Math.ceil(data.size / VAULT_CHUNK)); i < n; i++) parts2.push(await encryptChunk(key, new Uint8Array(await data.slice(i * VAULT_CHUNK, (i + 1) * VAULT_CHUNK).arrayBuffer()), i));
+        body = new Blob(parts2);
+      }
+      await this.put(base, plan.token, body, signal);
+      onLoaded(body instanceof Blob ? body.size : body.byteLength);
+      return;
+    }
+    const chunk = key ? VAULT_CHUNK : plan.partSize;
+    const count = Math.max(1, Math.ceil(data.size / chunk));
+    const parts = [];
+    let done = 0;
+    const queue = Array.from({ length: count }, (_, i) => i);
+    await Promise.all(
+      Array.from({ length: Math.min(4, count) }, async () => {
+        for (let i = queue.shift(); i !== void 0; i = queue.shift()) {
+          const slice = data.slice(i * chunk, (i + 1) * chunk);
+          const body = key ? await encryptChunk(key, new Uint8Array(await slice.arrayBuffer()), i) : slice;
+          const res2 = await this.put(`${base}/parts/${i + 1}`, plan.token, body, signal);
+          parts.push(await res2.json());
+          done += body instanceof Blob ? body.size : body.byteLength;
+          onLoaded(done);
+        }
+      })
+    );
+    const res = await this.fetchImpl(`${base}/complete`, { method: "POST", headers: { "content-type": "application/json", "x-upload-token": plan.token }, body: JSON.stringify({ parts }), signal });
+    if (!res.ok) throw new SlingdropError("Couldn't finish the upload", res.status);
+  }
+};
+
+// src/cli.ts
+var VERSION = "1.0.0";
+var CONFIG_DIR = join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "slingdrop");
+var CONFIG = join(CONFIG_DIR, "config.json");
+var c = {
+  bold: (s) => `\x1B[1m${s}\x1B[22m`,
+  dim: (s) => `\x1B[2m${s}\x1B[22m`,
+  green: (s) => `\x1B[32m${s}\x1B[39m`,
+  cyan: (s) => `\x1B[36m${s}\x1B[39m`,
+  red: (s) => `\x1B[31m${s}\x1B[39m`
+};
+async function loadConfig() {
+  try {
+    return JSON.parse(await readFile(CONFIG, "utf8"));
+  } catch {
+    return {};
+  }
+}
+async function saveConfig(cfg) {
+  await mkdir(CONFIG_DIR, { recursive: true });
+  await writeFile(CONFIG, JSON.stringify(cfg, null, 2), { mode: 384 });
+}
+function anonymousOrClient(cfg) {
+  const apiKey = process.env.SLINGDROP_API_KEY ?? cfg.apiKey;
+  return new Slingdrop({ apiKey, baseUrl: process.env.SLINGDROP_URL ?? cfg.baseUrl });
+}
+function client(cfg) {
+  const apiKey = process.env.SLINGDROP_API_KEY ?? cfg.apiKey;
+  if (!apiKey) {
+    console.error(`Not signed in. Run ${c.bold("slingdrop login")} or set SLINGDROP_API_KEY.`);
+    process.exit(1);
+  }
+  return new Slingdrop({ apiKey, baseUrl: process.env.SLINGDROP_URL ?? cfg.baseUrl });
+}
+function parseArgs(argv) {
+  const flags = {};
+  const positional = [];
+  const aliases = { t: "title", p: "passcode", e: "expires", n: "name", h: "help", v: "version", j: "json" };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a.startsWith("--no-")) flags[a.slice(5)] = false;
+    else if (a.startsWith("--")) {
+      const [k, v] = a.slice(2).split("=", 2);
+      const next = argv[i + 1];
+      flags[k] = v ?? (next && !next.startsWith("-") && ["title", "passcode", "expires", "private", "name", "url", "space", "prefix"].includes(k) ? (i++, next) : true);
+    } else if (a.startsWith("-") && a.length > 1) {
+      const k = aliases[a.slice(1)] ?? a.slice(1);
+      const next = argv[i + 1];
+      flags[k] = next && !next.startsWith("-") && ["title", "passcode", "expires", "name"].includes(k) ? (i++, next) : true;
+    } else positional.push(a);
+  }
+  return { flags, positional };
+}
+var HELP = `${c.bold("slingdrop")} ${c.dim(`v${VERSION}`)} \u2014 send anything, get a link.
+
+${c.bold("Usage")}
+  slingdrop <files or folders\u2026> [options]
+  cat build.log | slingdrop --name build.log
+
+${c.bold("Options")}
+  -t, --title <text>       Title for the drop
+  -p, --passcode <code>    Protect with a passcode (4\u201312 characters)
+      --feedback           Ask for comments and approval (default: just share)
+  -e, --expires <when>     1h, 24h, 7d, 30d, 90d, forever, burn
+                           (default: kept until you delete it when signed in,
+                           7 days for feedback, 24 hours signed out)
+      --private <emails>   Only these people (comma-separated) can open it
+      --vault              End-to-end encrypt on this machine
+      --edit               Let recipients edit docs and notes
+      --approval           Ask recipients to approve
+      --no-download        View only
+      --no-qr              Don't print a QR code
+  -j, --json               Print JSON (for scripts)
+
+${c.bold("Commands")}
+  login                    Sign in with your browser
+  logout                   Forget this machine's key
+  whoami                   Show the signed-in account
+  ls                       List your active drops
+  open <id|url>            Open a drop in your browser
+  revoke <id>              Turn off a drop's link
+  rm <id> [--forever]      Move a drop to Trash (or delete it now)
+  request <title>          Create a file request link
+
+${c.bold("File hosting")} ${c.dim("(stable CDN links for your app)")}
+  host <files or folders\u2026> Upload and print public URLs
+      --space <name>       Space to upload to (created if free; default: yours)
+      --prefix <path>      Put files under this path, e.g. v2/
+      --immutable          Cache for a year (use with hashed file names)
+  host ls [--prefix p]     List hosted files
+  host rm <path\u2026>          Delete hosted files
+  host spaces              List your spaces
+  host usage               Storage, bandwidth and resizes this month
+`;
+function openUrl(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+}
+async function copy(text) {
+  const cmd = process.platform === "darwin" ? ["pbcopy"] : process.platform === "win32" ? ["clip"] : ["xclip", "-selection", "clipboard"];
+  await new Promise((resolve) => {
+    try {
+      const p = spawn(cmd[0], cmd.slice(1), { stdio: ["pipe", "ignore", "ignore"] });
+      p.on("error", () => resolve());
+      p.on("close", () => resolve());
+      p.stdin.end(text);
+    } catch {
+      resolve();
+    }
+  });
+}
+async function collect(paths) {
+  const out = [];
+  async function walk(path, root) {
+    const s = await stat(path);
+    if (s.isDirectory()) {
+      for (const entry of await readdir(path)) {
+        if (entry === ".DS_Store" || entry === ".git" || entry === "node_modules") continue;
+        await walk(join(path, entry), root ?? path);
+      }
+    } else if (s.isFile()) {
+      const name = root ? join(basename(root), relative(root, path)).split("\\").join("/") : basename(path);
+      out.push({ name, data: await openAsBlob(path) });
+    }
+  }
+  for (const p of paths) await walk(p, null);
+  return out;
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+function bar(loaded, total) {
+  const width = 28;
+  const pct = total ? loaded / total : 1;
+  const filled = Math.round(pct * width);
+  process.stderr.write(`\r  ${c.cyan("\u2588".repeat(filled))}${c.dim("\u2591".repeat(width - filled))} ${Math.round(pct * 100)}%`);
+}
+async function login(cfg, baseUrl) {
+  const codeRes = await fetch(`${baseUrl}/api/auth/device/code`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ client_id: "slingdrop-cli", scope: "openid" }) });
+  if (!codeRes.ok) throw new Error(`Couldn't start sign-in (${codeRes.status})`);
+  const code = await codeRes.json();
+  const verify = code.verification_uri_complete ?? `${baseUrl}${code.verification_uri}`;
+  const verifyUrl = verify.startsWith("http") ? verify : `${baseUrl}${verify}`;
+  console.log(`
+  Your code: ${c.bold(code.user_code)}
+  Opening ${c.cyan(verifyUrl)} \u2026
+`);
+  openUrl(verifyUrl);
+  let interval = (code.interval ?? 5) * 1e3;
+  for (; ; ) {
+    await new Promise((r) => setTimeout(r, interval));
+    const res = await fetch(`${baseUrl}/api/auth/device/token`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code: code.device_code, client_id: "slingdrop-cli" })
+    });
+    const data = await res.json();
+    if (data.access_token) {
+      const keyRes = await fetch(`${baseUrl}/api/me/api-keys`, { method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${data.access_token}` }, body: JSON.stringify({ name: `CLI on ${hostname()}` }) });
+      const key = await keyRes.json();
+      if (!key.key) throw new Error(key.error ?? "Couldn't create an API key");
+      const me = await new Slingdrop({ apiKey: key.key, baseUrl }).me();
+      await saveConfig({ ...cfg, apiKey: key.key, baseUrl, email: me.email });
+      console.log(`  ${c.green("\u2713")} Signed in as ${c.bold(me.email)}`);
+      return;
+    }
+    if (data.error === "slow_down") interval += 2e3;
+    else if (data.error && data.error !== "authorization_pending") throw new Error(data.error === "expired_token" ? "The code expired. Run slingdrop login again." : data.error);
+  }
+}
+async function collectForHosting(paths, prefix) {
+  const out = [];
+  const base = prefix.replace(/^\/+|\/+$/g, "");
+  async function walk(path, root) {
+    const s = await stat(path);
+    if (s.isDirectory()) {
+      for (const entry of await readdir(path)) {
+        if (entry === ".DS_Store" || entry === ".git" || entry === "node_modules") continue;
+        await walk(join(path, entry), root ?? path);
+      }
+    } else if (s.isFile()) {
+      const rel = (root ? relative(root, path) : basename(path)).split("\\").join("/");
+      out.push({ path: base ? `${base}/${rel}` : rel, data: await openAsBlob(path) });
+    }
+  }
+  for (const p of paths) await walk(p, null);
+  return out;
+}
+async function host(sd, args, flags) {
+  const [sub, ...rest] = args;
+  const spaceFlag = typeof flags.space === "string" ? flags.space : void 0;
+  const space = async () => (await sd.hosting.createSpace(spaceFlag)).slug;
+  const mb = (n) => n >= 1024 ** 3 ? `${+(n / 1024 ** 3).toFixed(1)} GB` : n >= 1024 ** 2 ? `${+(n / 1024 ** 2).toFixed(1)} MB` : `${Math.max(1, Math.round(n / 1024))} KB`;
+  if (sub === "spaces") {
+    const spaces = await sd.hosting.spaces();
+    if (flags.json) return console.log(JSON.stringify(spaces, null, 2));
+    if (!spaces.length) return console.log(c.dim("No spaces yet. Run slingdrop host <files> to create one."));
+    for (const s of spaces) console.log(`${c.bold(s.slug)}  ${c.cyan(s.url)}  ${c.dim(`${s.objectCount} files \xB7 ${mb(s.bytesStored)}${s.status === "suspended" ? " \xB7 suspended" : ""}`)}`);
+    return;
+  }
+  if (sub === "usage") {
+    const u = await sd.hosting.usage();
+    if (flags.json) return console.log(JSON.stringify(u, null, 2));
+    const of = (used, limit, fmt = mb) => `${fmt(used)}${limit ? ` of ${fmt(limit)}` : ""}`;
+    console.log(`Storage     ${of(u.storage.used, u.storage.limit)}${u.storage.sharedWithPlan ? c.dim(" (counts towards your plan storage)") : ""}`);
+    console.log(`Bandwidth   ${of(u.bandwidth.used, u.bandwidth.limit)}${u.bandwidth.sharedWithDrops ? c.dim(" (shared with drops)") : ""} ${c.dim(`in ${u.month}`)}`);
+    console.log(`Resizes     ${of(u.transforms.used, u.transforms.limit, (n) => n.toLocaleString())}`);
+    console.log(`Largest file ${mb(u.maxFileBytes)}`);
+    return;
+  }
+  if (sub === "ls") {
+    const name2 = await space();
+    let after;
+    const all = [];
+    do {
+      const page = await sd.hosting.list(name2, { prefix: typeof flags.prefix === "string" ? flags.prefix : void 0, after, limit: 1e3 });
+      all.push(...page.objects);
+      after = page.next ?? void 0;
+    } while (after);
+    if (flags.json) return console.log(JSON.stringify(all, null, 2));
+    if (!all.length) return console.log(c.dim(`No files in ${name2}.`));
+    for (const o of all) console.log(`${c.cyan(o.url)}  ${c.dim(mb(o.size))}`);
+    return;
+  }
+  if (sub === "rm") {
+    if (!rest.length) throw new Error("Name the paths to delete, e.g. slingdrop host rm img/logo.png");
+    const name2 = await space();
+    for (const p of rest) {
+      await sd.hosting.delete(name2, p);
+      console.log(`${c.green("\u2713")} Deleted ${p}`);
+    }
+    return;
+  }
+  const inputs = sub ? [sub, ...rest] : [];
+  if (!inputs.length) throw new Error("Name files or folders to host, e.g. slingdrop host ./public/assets");
+  const files = await collectForHosting(inputs, typeof flags.prefix === "string" ? flags.prefix : "");
+  if (!files.length) throw new Error("Nothing to upload.");
+  const name = await space();
+  const total = files.reduce((n, f) => n + f.data.size, 0);
+  if (!flags.json) console.error(`  Hosting ${files.length} file${files.length === 1 ? "" : "s"} in ${c.bold(name)} ${c.dim(`(${mb(total)})`)}`);
+  const manifest = {};
+  const failures = [];
+  let done = 0;
+  const queue = [...files];
+  await Promise.all(
+    Array.from({ length: Math.min(4, queue.length) }, async () => {
+      for (let f = queue.shift(); f; f = queue.shift()) {
+        try {
+          const o = await sd.hosting.put(name, f.path, f.data, { immutable: flags.immutable === true });
+          manifest[f.path] = o.url;
+          if (!flags.json) console.error(`  ${c.green("\u2713")} ${o.url}`);
+        } catch (err) {
+          failures.push(f.path);
+          console.error(`  ${c.red("\u2717")} ${f.path}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        done++;
+        if (!flags.json && files.length > 8 && done % 10 === 0) console.error(c.dim(`  ${done}/${files.length}`));
+      }
+    })
+  );
+  if (flags.json) console.log(JSON.stringify(manifest, null, 2));
+  else {
+    const first = Object.values(manifest)[0];
+    if (first && files.length === 1) await copy(first);
+    console.error(`
+  ${c.green("\u2713")} ${Object.keys(manifest).length} hosted${failures.length ? `, ${c.red(`${failures.length} failed`)}` : ""}${first && files.length === 1 ? c.dim(" (URL copied)") : ""}`);
+  }
+  if (failures.length) process.exitCode = 1;
+}
+async function main() {
+  const { flags, positional } = parseArgs(process.argv.slice(2));
+  const cfg = await loadConfig();
+  const baseUrl = String(flags.url ?? process.env.SLINGDROP_URL ?? cfg.baseUrl ?? "https://slingdrop.my");
+  const [cmd, ...rest] = positional;
+  if (flags.version) return console.log(VERSION);
+  if (flags.help || !cmd && process.stdin.isTTY) return console.log(HELP);
+  switch (cmd) {
+    case "login":
+      return login(cfg, baseUrl);
+    case "logout":
+      await rm(CONFIG, { force: true });
+      return console.log("Signed out on this machine. Revoke the key in Settings \u2192 Developer if needed.");
+    case "whoami": {
+      const me = await client(cfg).me();
+      return console.log(`${me.email} ${c.dim(`(${me.plan} plan)`)}`);
+    }
+    case "ls": {
+      const drops = await client(cfg).drops.list();
+      if (flags.json) return console.log(JSON.stringify(drops, null, 2));
+      if (!drops.length) return console.log(c.dim("No active drops."));
+      for (const d of drops) console.log(`${c.dim(d.id)}  ${d.title || "Untitled"}  ${c.cyan(d.url)}  ${c.dim(`${d.viewCount} views`)}`);
+      return;
+    }
+    case "open":
+      return openUrl(rest[0]?.startsWith("http") ? rest[0] : `${baseUrl}/d/${rest[0]}`);
+    case "revoke":
+      await client(cfg).drops.revoke(rest[0]);
+      return console.log(`${c.green("\u2713")} Link turned off`);
+    case "rm":
+      const r = await client(cfg).drops.delete(rest[0], { forever: !!flags.forever });
+      return console.log(`${c.green("\u2713")} ${r.trashed ? "Moved to Trash (restore within 30 days)" : "Deleted"}`);
+    case "request": {
+      const r2 = await client(cfg).requests.create({ title: rest.join(" ") || "Files" });
+      await copy(r2.url);
+      return console.log(`${c.green("\u2713")} Request link copied: ${c.cyan(r2.url)}`);
+    }
+    case "host":
+      return host(client(cfg), rest, flags);
+  }
+  let files;
+  if (positional.length) files = await collect(positional);
+  else {
+    const data = await readStdin();
+    files = [{ name: String(flags.name ?? "stdin.txt"), data: new Blob([new Uint8Array(data)]) }];
+  }
+  if (!files.length) throw new Error("Nothing to send.");
+  const total = files.reduce((n, f) => n + f.data.size, 0);
+  const sd = anonymousOrClient(cfg);
+  if (!flags.json) {
+    console.error(`  Slinging ${files.length} file${files.length === 1 ? "" : "s"} ${c.dim(`(${(total / 1024 / 1024).toFixed(1)} MB)`)}`);
+    if (sd.anonymous) console.error(c.dim(`  Not signed in: the link lasts up to 24 hours. Run ${c.bold("slingdrop login")} to keep files, use Vault and send private drops.`));
+  }
+  const result = await sd.drops.create(files, {
+    title: flags.title,
+    passcode: flags.passcode,
+    purpose: flags.feedback === true || flags.approval === true ? "feedback" : "share",
+    expiry: flags.expires,
+    recipients: typeof flags.private === "string" ? flags.private.split(",").map((s) => s.trim()) : void 0,
+    vault: flags.vault === true,
+    allowEdit: flags.edit === true,
+    requireApproval: flags.approval === true,
+    allowDownload: flags.download !== false,
+    onProgress: flags.json ? void 0 : bar
+  });
+  if (flags.json) return console.log(JSON.stringify({ id: result.drop.id, url: result.shareUrl, expiresAt: result.drop.expiresAt }));
+  process.stderr.write("\n");
+  await copy(result.shareUrl);
+  console.log(`
+  ${c.green("\u2713")} ${c.bold(result.shareUrl)} ${c.dim("(copied)")}`);
+  if (flags.qr !== false && process.stdout.isTTY) console.log(await QRCode.toString(result.shareUrl, { type: "terminal", small: true }));
+}
+main().catch((err) => {
+  console.error(`
+${c.red("\u2717")} ${err instanceof SlingdropError || err instanceof Error ? err.message : String(err)}`);
+  if (err instanceof SlingdropError && (err.code === "login_required" || err.code === "plan_required") && !process.env.SLINGDROP_API_KEY) console.error(c.dim(`  Run ${c.bold("slingdrop login")} to sign in.`));
+  process.exit(1);
+});

package/package.json

@@ -1,6 +1,51 @@
 {
   "name": "slingdrop",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "1.0.0",
+  "description": "Send files, folders or piped output from your terminal and get a Slingdrop link, QR code and clipboard copy.",
+  "keywords": [
+    "slingdrop",
+    "file-sharing",
+    "share",
+    "upload",
+    "cli",
+    "transfer",
+    "link",
+    "qr"
+  ],
+  "homepage": "https://slingdrop.my/developers",
+  "bugs": {
+    "email": "support@slingdrop.my"
+  },
+  "author": "Sansavision",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "slingdrop": "./dist/cli.js",
+    "sling": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "qrcode": "^1.5.4"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.5",
+    "@types/qrcode": "^1.5.5",
+    "tsup": "^9.0.0",
+    "typescript": "^6.0.3",
+    "@slingdrop/sdk": "1.0.0"
+  },
+  "scripts": {
+    "build": "tsup src/cli.ts --format esm --clean --target node20",
+    "typecheck": "tsc --noEmit"
+  }
 }