squidcloudctl 1.2.0 → 3.0.0

package/dist/commands/files/upload.js

@@ -0,0 +1,57 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import chalk from 'chalk';
+import { apiGet } from '../../lib/api/client.js';
+import { uploadFile } from '../../lib/transfer.js';
+import { success, error as errMark } from '../../lib/output/brand.js';
+import { isJsonMode } from '../../lib/output/logger.js';
+export default async function filesUpload(...args) {
+    const strArgs = args.filter((a) => typeof a === 'string');
+    const opts = (args.find((a) => a && typeof a === 'object') || {});
+    if (strArgs.length === 0)
+        throw new Error('Usage: squidcloudctl files up <path> [more…] [--folder <id|name>]');
+    const resolved = [];
+    for (const p of strArgs) {
+        const abs = path.resolve(p);
+        if (!fs.existsSync(abs))
+            throw new Error(`Path not found: ${p}`);
+        if (fs.statSync(abs).isDirectory()) {
+            for (const f of fs.readdirSync(abs)) {
+                const fp = path.join(abs, f);
+                if (fs.statSync(fp).isFile())
+                    resolved.push(fp);
+            }
+        }
+        else
+            resolved.push(abs);
+    }
+    if (resolved.length === 0)
+        throw new Error('No files found to upload');
+    let folderId;
+    if (opts.folder) {
+        const res = await apiGet('/files?per_page=100');
+        const q = String(opts.folder).replace(/^#/, '');
+        const match = (res.folders || []).find((f) => f.name === q || f.id.startsWith(q));
+        if (!match)
+            throw new Error(`Folder "${opts.folder}" not found. Run \`squidcloudctl folders ls\`.`);
+        folderId = match.id;
+    }
+    const uploaded = [];
+    let failed = 0;
+    for (const filePath of resolved) {
+        try {
+            const r = await uploadFile(filePath, { folderId, quiet: !!opts.quiet || isJsonMode() });
+            uploaded.push(r);
+            if (!isJsonMode() && !opts.quiet && resolved.length === 1)
+                console.log(`\n  ${success('uploaded')} ${chalk.bold(r.name)} → ${r.id}`);
+        }
+        catch (err) {
+            failed++;
+            console.error(`  ${errMark('failed')} ${path.basename(filePath)} — ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    if (isJsonMode())
+        console.log(JSON.stringify({ uploaded: uploaded.length, failed, files: uploaded }, null, 2));
+    else if (resolved.length > 1)
+        console.log(`\n  ${uploaded.length} uploaded${failed ? `, ${failed} failed` : ''}. Run \`files ls\` for numbers.\n`);
+}

package/dist/commands/forms/index.js

@@ -0,0 +1,2 @@
+export{a as formsSubmissions}from'../../chunk-ZGBTOZ7M.js';export{a as formsExport}from'../../chunk-K4UZNQFC.js';export{a as formsClear}from'../../chunk-H3FD4YYC.js';export{a as formsDelete}from'../../chunk-T6VFW2SW.js';export{a as formsEmbed}from'../../chunk-M6RN7Y3S.js';export{a as formsList}from'../../chunk-YBKX6Q3Q.js';export{a as formsCreate}from'../../chunk-QCDCTQU5.js';export{a as formsInfo}from'../../chunk-RREABTVT.js';//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/commands/forms/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/commands/fs/binary.js

@@ -0,0 +1,110 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+const here = path.dirname(fileURLToPath(import.meta.url));
+/** Universal install target — one name on every platform. */
+export const UNIVERSAL_BIN = path.join(os.homedir(), '.squidcloud', 'bin', 'squidfs');
+function releaseAssetName() {
+    const arch = process.arch === 'arm64' ? 'arm64' : process.arch === 'x64' ? 'amd64' : process.arch;
+    const platform = process.platform === 'darwin' ? 'darwin' : process.platform === 'win32' ? 'windows' : 'linux';
+    return `squidfs-${platform}-${arch}`;
+}
+/** Locate the squidfs binary without installing:
+    SQUIDFS_BIN → universal target → PATH → CLI dist/. */
+export function findSquidFsBinary() {
+    if (process.env.SQUIDFS_BIN && fs.existsSync(process.env.SQUIDFS_BIN))
+        return process.env.SQUIDFS_BIN;
+    if (fs.existsSync(UNIVERSAL_BIN)) {
+        try {
+            fs.accessSync(UNIVERSAL_BIN, fs.constants.X_OK);
+            return UNIVERSAL_BIN;
+        }
+        catch { }
+    }
+    for (const dir of (process.env.PATH || '').split(path.delimiter)) {
+        if (!dir)
+            continue;
+        const p = path.join(dir, 'squidfs');
+        try {
+            fs.accessSync(p, fs.constants.X_OK);
+            return p;
+        }
+        catch { }
+    }
+    const dist = path.resolve(here, '../../../dist', 'squidfs');
+    if (fs.existsSync(dist))
+        return dist;
+    return null;
+}
+/** Ensure the binary exists at the universal location. Provision order:
+    build from a local ~/squidfs checkout → copy from PATH → download the
+    official release asset. Idempotent; safe to call on every run. */
+export async function ensureSquidFsBinary(log) {
+    if (process.env.SQUIDFS_BIN && fs.existsSync(process.env.SQUIDFS_BIN))
+        return process.env.SQUIDFS_BIN;
+    if (fs.existsSync(UNIVERSAL_BIN)) {
+        try {
+            fs.accessSync(UNIVERSAL_BIN, fs.constants.X_OK);
+            return UNIVERSAL_BIN;
+        }
+        catch { }
+    }
+    fs.mkdirSync(path.dirname(UNIVERSAL_BIN), { recursive: true });
+    // 1. Local Go checkout — always current.
+    const localRepo = path.join(os.homedir(), 'squidfs');
+    if (fs.existsSync(path.join(localRepo, 'go.mod'))) {
+        try {
+            log('building squidfs from ~/squidfs …');
+            execSync(`go build -trimpath -ldflags "-s -w" -o "${UNIVERSAL_BIN}" ./cmd/squidfs`, { cwd: localRepo, stdio: 'pipe' });
+            fs.chmodSync(UNIVERSAL_BIN, 0o755);
+            log('installed → ~/.squidcloud/bin/squidfs');
+            return UNIVERSAL_BIN;
+        }
+        catch (err) {
+            log(`local build failed (${err instanceof Error ? err.message : String(err)}) — trying release download`);
+        }
+    }
+    // 2. Copy an existing binary already on PATH under any name.
+    for (const dir of (process.env.PATH || '').split(path.delimiter)) {
+        if (!dir)
+            continue;
+        const p = path.join(dir, 'squidfs');
+        if (fs.existsSync(p)) {
+            fs.copyFileSync(p, UNIVERSAL_BIN);
+            fs.chmodSync(UNIVERSAL_BIN, 0o755);
+            return UNIVERSAL_BIN;
+        }
+    }
+    // 3. Official release.
+    const res = await fetch(`https://github.com/NaveenSingh9999/squidfs/releases/latest/download/${releaseAssetName()}`);
+    if (!res.ok)
+        throw new Error(`Could not provision squidfs (${res.status}). Install it manually or set SQUIDFS_BIN.`);
+    fs.writeFileSync(UNIVERSAL_BIN, Buffer.from(await res.arrayBuffer()));
+    fs.chmodSync(UNIVERSAL_BIN, 0o755);
+    log('downloaded official squidfs → ~/.squidcloud/bin/squidfs');
+    return UNIVERSAL_BIN;
+}
+export const SQUIDFS_DIR = path.join(os.homedir(), '.squidcloud');
+export const PID_FILE = path.join(SQUIDFS_DIR, 'squidfs.pid');
+export function readSession() {
+    try {
+        const raw = JSON.parse(fs.readFileSync(PID_FILE, 'utf-8'));
+        try {
+            process.kill(raw.pid, 0);
+            return raw;
+        }
+        catch {
+            fs.rmSync(PID_FILE, { force: true });
+            return null;
+        }
+    }
+    catch {
+        return null;
+    }
+}
+export function writeSession(s) {
+    fs.mkdirSync(SQUIDFS_DIR, { recursive: true });
+    fs.writeFileSync(PID_FILE, JSON.stringify(s));
+}

package/dist/commands/fs/mount.js

@@ -0,0 +1,46 @@
+import { spawn } from 'node:child_process';
+import chalk from 'chalk';
+import { apiPost } from '../../lib/api/client.js';
+import { muted } from '../../lib/output/brand.js';
+import { ensureSquidFsBinary, writeSession } from './binary.js';
+/** Mint an API key for the SquidFS bridge (it authenticates cb_ keys). */
+async function ensureApiKey() {
+    if (process.env.SQUIDCLOUD_API_KEY)
+        return process.env.SQUIDCLOUD_API_KEY;
+    const created = await apiPost('/keys', {
+        name: `squidcloudctl-fs-${new Date().toISOString().slice(0, 10)}`,
+    });
+    const key = created?.key || created?.api_key || created?.data?.key;
+    if (!key)
+        throw new Error('Could not provision a storage key for SquidFS — create one in Settings → API Keys.');
+    return key;
+}
+export default async function fsMount(...args) {
+    const strArgs = args.filter((a) => typeof a === 'string');
+    const opts = (args.find((a) => a && typeof a === 'object') || {});
+    const bin = await ensureSquidFsBinary((m) => console.log(`  ${chalk.dim(m)}`));
+    const apiKey = await ensureApiKey();
+    const mountPoint = strArgs[0] || (opts.mount ? String(opts.mount) : '');
+    const argv = [bin];
+    if (!mountPoint || opts.webdav) {
+        argv.push('-webdav', '-port', String(opts.port || 8099));
+    }
+    else {
+        argv.push('-mount', mountPoint);
+    }
+    argv.push('-bridge', String(opts.bridge || 'https://aouqcwbdoyrccjcrhzzi.supabase.co/functions/v1/squidfs-bridge'));
+    console.log(`\n  ${chalk.bold('SquidFS')}  ${muted(mountPoint && !opts.webdav ? `mounting at ${mountPoint}` : `WebDAV → http://localhost:${opts.port || 8099}/`)}`);
+    console.log(`  ${muted('files stay encrypted end-to-end; edits sync back automatically. Ctrl+C to stop.')}\n`);
+    const child = spawn(argv[0], argv.slice(1), {
+        env: { ...process.env, SQUIDCLOUD_API_KEY: apiKey },
+        stdio: 'inherit',
+    });
+    writeSession({
+        pid: child.pid,
+        mode: mountPoint && !opts.webdav ? 'fuse' : 'webdav',
+        port: Number(opts.port || 8099),
+        mount: mountPoint || undefined,
+        started_at: Date.now(),
+    });
+    child.on('exit', (code) => process.exit(code ?? 0));
+}

package/dist/commands/fs/status.js

@@ -0,0 +1,18 @@
+import chalk from 'chalk';
+import { readSession } from './binary.js';
+export default async function fsStatus() {
+    const s = readSession();
+    console.log();
+    if (!s)
+        console.log(`  ${chalk.dim('no SquidFS session running')} — start one with \`squidcloudctl fs mount\``);
+    else {
+        console.log(`  pid     ${s.pid}`);
+        console.log(`  mode    ${s.mode}`);
+        if (s.port)
+            console.log(`  webdav  http://localhost:${s.port}/`);
+        if (s.mount)
+            console.log(`  mount   ${s.mount}`);
+        console.log(`  up      ${Math.round((Date.now() - s.started_at) / 1000)}s`);
+    }
+    console.log();
+}

package/dist/commands/fs/stop.js

@@ -0,0 +1,19 @@
+import { readSession, PID_FILE } from './binary.js';
+import fs from 'node:fs';
+import { success, warn as warnMark } from '../../lib/output/brand.js';
+export default async function fsStop() {
+    const s = readSession();
+    if (!s) {
+        console.log(`\n  ${warnMark('no session running')}\n`);
+        return;
+    }
+    try {
+        process.kill(s.pid, 'SIGTERM');
+    }
+    catch { }
+    try {
+        fs.rmSync(PID_FILE, { force: true });
+    }
+    catch { }
+    console.log(`\n  ${success(`stopped squidfs (pid ${s.pid})`)}\n`);
+}

package/dist/commands/fs/webdav.js

@@ -0,0 +1 @@
+export { default } from './mount.js';

package/dist/commands/health.js

@@ -0,0 +1,20 @@
+import { apiGet } from '../lib/api/client.js';
+import { success, error as errMark, muted } from '../lib/output/brand.js';
+import { isJsonMode } from '../lib/output/logger.js';
+export default async function health() {
+    try {
+        await apiGet('/health');
+        if (isJsonMode())
+            console.log(JSON.stringify({ status: 'ok' }, null, 2));
+        else
+            console.log(`\n  ${success('API healthy')}\n`);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (isJsonMode())
+            console.log(JSON.stringify({ status: 'down', error: msg }, null, 2));
+        else
+            console.log(`\n  ${errMark('API unreachable')} — ${muted(msg)}\n`);
+        process.exit(1);
+    }
+}

package/dist/commands/host/api.js

@@ -0,0 +1,186 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import chalk from 'chalk';
+import { renderBanner } from '../../lib/output/banner.js';
+import { success, muted, info } from '../../lib/output/brand.js';
+import { startHost } from '../../lib/host/server.js';
+import { apiPost, apiGet } from '../../lib/api/client.js';
+import { isJsonMode } from '../../lib/output/logger.js';
+export const HOST_PID_FILE = path.join(os.homedir(), '.squidcloud', 'host.pid');
+export function readHostPid() {
+    try {
+        const raw = JSON.parse(fs.readFileSync(HOST_PID_FILE, 'utf-8'));
+        try {
+            process.kill(raw.pid, 0);
+            return raw;
+        }
+        catch {
+            fs.rmSync(HOST_PID_FILE, { force: true });
+            return null;
+        }
+    }
+    catch {
+        return null;
+    }
+}
+export function writeHostPid(p) {
+    fs.mkdirSync(path.dirname(HOST_PID_FILE), { recursive: true });
+    fs.writeFileSync(HOST_PID_FILE, JSON.stringify(p));
+}
+const ENDPOINTS = [
+    ['GET', '/health', 'liveness + profile + redis stats'],
+    ['GET', '/v1/files?search=', 'list files (#numbered refs included)'],
+    ['GET', '/v1/files/:ref', 'metadata — ref = #n | id-prefix | name'],
+    ['POST', '/v1/files/:ref/rename', '{ "name": "new-name" }'],
+    ['DELETE', '/v1/files/:ref', 'move to trash'],
+    ['POST', '/v1/upload?filename=x', 'raw body bytes → res54 pipeline'],
+    ['GET', '/v1/download/:ref', 'streams decrypted plaintext'],
+    ['POST', '/v1/share', '{ file_ref | folder_id, expires_at?, max_downloads?, view_only? }'],
+    ['GET', '/v1/secrets', 'secret inventory'],
+    ['POST', '/v1/exec', '{ op: whoami | storage.search | stats }'],
+];
+/** Register this host as a dedicated HOST| api key so the dashboard can show
+    live state. The key doubles as the heartbeat credential (every authed
+    request bumps last_used_at server-side). */
+async function registerHostKey(port, profile, mode) {
+    const os = await import('node:os');
+    const crypto = await import('node:crypto');
+    const hostId = crypto.createHash('sha256').update(`${os.hostname()}:${port}`).digest('hex').slice(0, 16);
+    const created = await apiPost('/keys', {
+        name: `HOST|${hostId}|${os.hostname()}|${port}|${profile}|${mode}`,
+        scopes: ['*'],
+    });
+    const id = created?.key?.id;
+    const rawKey = created?.raw_key;
+    if (!id || !rawKey)
+        throw new Error('Could not register host key for dashboard visibility');
+    return { id, rawKey, hostId };
+}
+export default async function hostApi(...args) {
+    const opts = (args.find((a) => a && typeof a === 'object') || {});
+    // Commander camelCases dashed flags — accept both spellings.
+    const o = opts;
+    const pick = (dashed, camel) => o[dashed] ?? o[camel];
+    const a = {
+        port: Number(pick('port', 'port') || 8065),
+        'redis-port': Number(pick('redis-port', 'redisPort') || Number(pick('port', 'port') || 8065) + 1),
+        profile: String(pick('profile', 'profile') || 'standard'),
+        mode: String(pick('mode', 'mode') || 'open'),
+        'hmac-secret': pick('hmac-secret', 'hmacSecret') ? String(pick('hmac-secret', 'hmacSecret')) : undefined,
+        rps: pick('rps', 'rps') ? Number(pick('rps', 'rps')) : undefined,
+        'max-body': pick('max-body', 'maxBody') ? String(pick('max-body', 'maxBody')) : undefined,
+        'allow-ips': pick('allow-ips', 'allowIps') ?? undefined,
+        key: pick('key', 'key') ?? undefined,
+        quiet: !!pick('quiet', 'quiet'),
+    };
+    const existing = readHostPid();
+    if (existing) {
+        throw new Error(`A host is already running on :${existing.port} (pid ${existing.pid}). Stop it with \`squidcloudctl host stop\`.`);
+    }
+    if (!isJsonMode()) {
+        console.log(renderBanner({ tagline: false }));
+    }
+    let bootstrapKey = '';
+    const state = await startHost({
+        onBootstrapKey: (k) => { bootstrapKey = k; },
+        port: a.port,
+        redisPort: a['redis-port'],
+        profile: a.profile,
+        mode: a.mode || 'open',
+        hmacSecret: a['hmac-secret'],
+        quiet: a.quiet,
+    });
+    // Seed user-supplied extra keys.
+    const extraKeys = [];
+    if (Array.isArray(opts.key))
+        for (const _ of opts.key)
+            extraKeys.push(state.newKey().key);
+    else if (opts.key)
+        extraKeys.push(state.newKey().key);
+    writeHostPid({
+        pid: process.pid,
+        port: a.port,
+        redisPort: a['redis-port'],
+        mode: state.cfg.requireKey ? 'keyed' : 'open',
+        profile: state.cfg.profile,
+        started_at: Date.now(),
+    });
+    // Dashboard visibility: HOST| key + heartbeat loop.
+    let heartbeat = null;
+    let hostKeyId = '';
+    try {
+        const reg = await registerHostKey(a.port, state.cfg.profile, state.cfg.requireKey ? 'keyed' : 'open');
+        hostKeyId = reg.id;
+        let beats = 0;
+        const beat = async () => {
+            try {
+                await apiGet('/user/whoami', { headers: { 'X-SquidCloud-Key': reg.rawKey }, retries: 1 });
+                beats += 1;
+            }
+            catch { /* transient — next beat retries */ }
+        };
+        await beat();
+        heartbeat = setInterval(beat, 60_000);
+        if (!isJsonMode())
+            console.log(`  ${info('dashboard')}   visible under Settings → Developer → CLI devices`);
+    }
+    catch (err) {
+        if (!isJsonMode())
+            console.log(`  ${muted('dashboard sync skipped: ' + (err instanceof Error ? err.message : String(err)))}`);
+    }
+    if (isJsonMode()) {
+        console.log(JSON.stringify({
+            status: 'listening',
+            port: a.port,
+            redis_port: a['redis-port'],
+            profile: state.cfg.profile,
+            mode: state.cfg.requireKey ? 'keyed' : 'open',
+            bootstrap_key: bootstrapKey || undefined,
+        }, null, 2));
+    }
+    else {
+        console.log(`  ${success(`Local API host listening`)} ${chalk.bold(`http://127.0.0.1:${a.port}`)}`);
+        console.log(`  ${info('profile')}     ${state.cfg.profile} · mode=${state.cfg.requireKey ? 'keyed' : 'open'}${state.cfg.requireHmac ? ' · hmac=on' : ''}`);
+        console.log(`  ${info('micro-redis')}  127.0.0.1:${a['redis-port']}  ${muted('(PING/GET/SET/INCR/TTL/KEYS…)')}`);
+        console.log(`  ${info('limits')}      ${state.cfg.rpsPerKey} req/s/key · body ≤ ${Math.round(state.cfg.maxBodyBytes / 1048576)}MB · ips=${state.cfg.allowIps.join(',')}`);
+        console.log(`  ${info('audit')}       ${muted('~/.squidcloud/host-audit.log')}\n`);
+        if (bootstrapKey) {
+            console.log(`  ${chalk.bold.yellow('LOCAL KEY (shown once — store it now)')}`);
+            console.log(`  ${chalk.cyan(bootstrapKey)}\n`);
+        }
+        console.log(`  ${chalk.bold('Routes')}`);
+        for (const [m, p2, d] of ENDPOINTS) {
+            console.log(`   ${chalk.green(m.padEnd(7))} ${chalk.cyan(p2.padEnd(30))} ${muted(d)}`);
+        }
+        console.log(`\n  ${muted('Same engine as the CLI: numbered refs, res54 transfers, zero platform rate limits in between.')}`);
+        console.log(`  ${muted('Stop with `squidcloudctl host stop` or Ctrl+C.')}\n`);
+    }
+    const shutdown = (signal) => {
+        state.close();
+        if (heartbeat)
+            clearInterval(heartbeat);
+        // Best-effort: mark the HOST| key offline so the dashboard flips its dot.
+        if (hostKeyId) {
+            void (async () => {
+                try {
+                    const { apiPut } = await import('../../lib/api/client.js');
+                    const current = await apiGet(`/keys/${hostKeyId}`);
+                    if (current?.name && !current.name.endsWith(':OFFLINE')) {
+                        await apiPut(`/keys/${hostKeyId}`, { name: `${current.name}:OFFLINE` });
+                    }
+                }
+                catch { }
+            })();
+        }
+        try {
+            fs.rmSync(HOST_PID_FILE, { force: true });
+        }
+        catch { }
+        if (!isJsonMode())
+            console.log(`\n  ${muted(`host stopped (${signal})`)}`);
+        process.exit(0);
+    };
+    process.on('SIGINT', () => shutdown('SIGINT'));
+    process.on('SIGTERM', () => shutdown('SIGTERM'));
+}

package/dist/commands/host/keys.js

@@ -0,0 +1,63 @@
+import { generateApiKey } from '../../lib/host/security.js';
+import chalk from 'chalk';
+import { error as errMark } from '../../lib/output/brand.js';
+/** Keys live inside the running host's MicroRedis — this helper talks to it
+    over loopback so `keys add/list/revoke` work while the server is up. */
+async function redisCommand(...args) {
+    const pid = (await import('./api.js')).readHostPid();
+    if (!pid)
+        throw new Error('No host running — start one with `squidcloudctl host api`.');
+    const net = await import('node:net');
+    return new Promise((resolve, reject) => {
+        const socket = net.connect(pid.redisPort, '127.0.0.1', () => {
+            socket.write(`*${args.length}\r\n${args.map((a) => `$${Buffer.byteLength(a)}\r\n${a}`).join('\r\n')}\r\n`);
+        });
+        let data = '';
+        socket.on('data', (d) => {
+            data += d.toString();
+            setTimeout(() => { socket.end(); resolve(data); }, 40);
+        });
+        socket.on('error', reject);
+        setTimeout(() => reject(new Error('redis timeout')), 3000);
+    });
+}
+export async function hostKeysAdd() {
+    const k = generateApiKey();
+    await redisCommand('SET', `key:${k.hash}`, k.prefix);
+    console.log(`\n  ${chalk.bold.yellow('NEW LOCAL KEY (shown once)')}\n  ${chalk.cyan(k.key)}\n`);
+}
+export async function hostKeysList() {
+    const raw = await redisCommand('KEYS', 'key:*');
+    const count = Number(raw.split('\r\n')[0]?.slice(1) || 0);
+    const keys = [];
+    const lines = raw.split('\r\n');
+    for (let i = 0; i < lines.length; i++) {
+        if (lines[i].startsWith('$'))
+            keys.push(lines[i + 1] ?? '');
+    }
+    console.log(`\n  ${count} key(s)`);
+    for (const k of keys)
+        console.log(`   ${k.replace('key:', '').slice(0, 16)}…`);
+    console.log();
+}
+export async function hostKeysRevoke(...args) {
+    const prefix = args.filter((a) => typeof a === 'string')[0] || '';
+    if (!prefix)
+        throw new Error('Usage: squidcloudctl host keys revoke <key-prefix>');
+    const raw = await redisCommand('KEYS', 'key:*');
+    const lines = raw.split('\r\n');
+    let n = 0;
+    for (let i = 0; i < lines.length; i++) {
+        if (lines[i].startsWith('$')) {
+            const full = lines[i + 1] ?? '';
+            if (full.includes(prefix)) {
+                await redisCommand('DEL', full);
+                n++;
+            }
+        }
+    }
+    if (n === 0)
+        console.log(`\n  ${errMark(`no key matches "${prefix}"`)}\n`);
+    else
+        console.log(`\n  revoked ${n} key(s)\n`);
+}

package/dist/commands/host/status.js

@@ -0,0 +1,15 @@
+import chalk from 'chalk';
+import { readHostPid } from './api.js';
+export default async function hostStatus() {
+    const p = readHostPid();
+    console.log();
+    if (!p)
+        console.log(`  ${chalk.dim('no local API host running')} — start one with \`squidcloudctl host api\``);
+    else {
+        console.log(`  pid      ${p.pid}`);
+        console.log(`  api      http://127.0.0.1:${p.port}  (${p.mode}, ${p.profile})`);
+        console.log(`  redis    127.0.0.1:${p.redisPort}`);
+        console.log(`  uptime   ${Math.round((Date.now() - p.started_at) / 1000)}s`);
+    }
+    console.log();
+}

package/dist/commands/host/stop.js

@@ -0,0 +1,19 @@
+import fs from 'node:fs';
+import { readHostPid, HOST_PID_FILE } from './api.js';
+import { success, warn as warnMark } from '../../lib/output/brand.js';
+export default async function hostStop() {
+    const p = readHostPid();
+    if (!p) {
+        console.log(`\n  ${warnMark('no host running')}\n`);
+        return;
+    }
+    try {
+        process.kill(p.pid, 'SIGTERM');
+    }
+    catch { }
+    try {
+        fs.rmSync(HOST_PID_FILE, { force: true });
+    }
+    catch { }
+    console.log(`\n  ${success(`host stopped (pid ${p.pid})`)}\n`);
+}

package/dist/commands/logs/index.js

@@ -0,0 +1,2 @@
+export{a as logsTail}from'../../chunk-QLLHU2RS.js';export{a as logsSearch}from'../../chunk-5TYVWTHC.js';export{a as logsExport}from'../../chunk-BDUD2TSS.js';//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/commands/logs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/commands/monitor/index.js

@@ -0,0 +1,2 @@
+export{a as monitorPipelines}from'../../chunk-NJCALUUB.js';export{a as monitorStorage}from'../../chunk-3E23ZFCV.js';export{a as monitorAutomations}from'../../chunk-ZY4RVPTF.js';export{a as monitor}from'../../chunk-3XXAN3BP.js';export{a as monitorSites}from'../../chunk-KQE3YLI3.js';//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/commands/monitor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/commands/scripts/index.js

@@ -0,0 +1,2 @@
+export{a as scriptsDisable}from'../../chunk-3JD6INFN.js';export{a as scriptsDelete}from'../../chunk-KJIMUYAU.js';export{a as scriptsStatus}from'../../chunk-LDYPQMLZ.js';export{a as scriptsCancel}from'../../chunk-5XSOEZ7F.js';export{a as scriptsWatch}from'../../chunk-YRSMMECJ.js';export{a as scriptsList}from'../../chunk-E26CRSCS.js';export{a as scriptsRun}from'../../chunk-OPZJKTOV.js';export{a as scriptsLogs}from'../../chunk-SBNM6EQO.js';export{a as scriptsValidate}from'../../chunk-6LLJ6P3U.js';export{a as scriptsInit}from'../../chunk-QEG6LP5X.js';export{a as scriptsEnable}from'../../chunk-CRT5ANG2.js';//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/commands/scripts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/commands/secrets/list.js

@@ -0,0 +1,14 @@
+import { apiGet } from '../../lib/api/client.js';
+import { muted } from '../../lib/output/brand.js';
+import { isJsonMode } from '../../lib/output/logger.js';
+export async function secretsList() {
+    const res = await apiGet('/secrets');
+    const rows = res.secrets || res.data || [];
+    if (isJsonMode()) {
+        console.log(JSON.stringify({ count: rows.length, secrets: rows }, null, 2));
+        return;
+    }
+    console.log();
+    rows.forEach((s, i) => console.log(`  ${muted(`[${i + 1}]`)} ${s.name}  ${muted(s.id)}`));
+    console.log(`\n  ${rows.length} secret(s)\n`);
+}

package/dist/commands/secrets/secrets-create.js

@@ -0,0 +1,28 @@
+import { apiPost } from '../../lib/api/client.js';
+import { success } from '../../lib/output/brand.js';
+import { isJsonMode } from '../../lib/output/logger.js';
+function readStdinMaybe() {
+    if (process.stdin.isTTY)
+        return Promise.resolve(null);
+    return new Promise((resolve) => {
+        let data = '';
+        process.stdin.setEncoding('utf-8');
+        process.stdin.on('data', (c) => (data += c));
+        process.stdin.on('end', () => resolve(data));
+        setTimeout(() => resolve(data || null), 1500);
+    });
+}
+export default async function secretsCreate(...args) {
+    const parts = args.filter((a) => typeof a === 'string');
+    let name = parts[0];
+    let value = parts[1];
+    if (!value && !process.stdin.isTTY)
+        value = (await readStdinMaybe())?.trim() || undefined;
+    if (!name || !value)
+        throw new Error('Usage: squidcloudctl secrets create <name> <value>   (or pipe value on stdin)');
+    const res = await apiPost('/secrets', { name, value });
+    if (isJsonMode())
+        console.log(JSON.stringify({ name, id: res?.id }, null, 2));
+    else
+        console.log(`\n  ${success(`secret "${name}" stored`)}${res?.id ? ` — ${res.id}` : ''}\n`);
+}

package/dist/commands/secrets/secrets-delete.js

@@ -0,0 +1,9 @@
+import { apiDelete } from '../../lib/api/client.js';
+import { success } from '../../lib/output/brand.js';
+export default async function secretsDelete(...args) {
+    const id = args.filter((a) => typeof a === 'string')[0] || '';
+    if (!id)
+        throw new Error('Usage: squidcloudctl secrets delete <id>');
+    await apiDelete(`/secrets/${id}`);
+    console.log(`\n  ${success('secret deleted')}\n`);
+}

package/dist/commands/secrets/secrets-list.js

@@ -0,0 +1 @@
+export { secretsList as default } from './list.js';