squidcloudctl 1.3.0 → 3.0.1

package/dist/commands/fs/mount.js

@@ -0,0 +1,46 @@
+import { spawn } from 'node:child_process';
+import chalk from 'chalk';
+import { apiPost } from '../../lib/api/client.js';
+import { muted } from '../../lib/output/brand.js';
+import { ensureSquidFsBinary, writeSession } from './binary.js';
+/** Mint an API key for the SquidFS bridge (it authenticates cb_ keys). */
+async function ensureApiKey() {
+    if (process.env.SQUIDCLOUD_API_KEY)
+        return process.env.SQUIDCLOUD_API_KEY;
+    const created = await apiPost('/keys', {
+        name: `squidcloudctl-fs-${new Date().toISOString().slice(0, 10)}`,
+    });
+    const key = created?.key || created?.api_key || created?.data?.key;
+    if (!key)
+        throw new Error('Could not provision a storage key for SquidFS — create one in Settings → API Keys.');
+    return key;
+}
+export default async function fsMount(...args) {
+    const strArgs = args.filter((a) => typeof a === 'string');
+    const opts = (args.find((a) => a && typeof a === 'object') || {});
+    const bin = await ensureSquidFsBinary((m) => console.log(`  ${chalk.dim(m)}`));
+    const apiKey = await ensureApiKey();
+    const mountPoint = strArgs[0] || (opts.mount ? String(opts.mount) : '');
+    const argv = [bin];
+    if (!mountPoint || opts.webdav) {
+        argv.push('-webdav', '-port', String(opts.port || 8099));
+    }
+    else {
+        argv.push('-mount', mountPoint);
+    }
+    argv.push('-bridge', String(opts.bridge || 'https://aouqcwbdoyrccjcrhzzi.supabase.co/functions/v1/squidfs-bridge'));
+    console.log(`\n  ${chalk.bold('SquidFS')}  ${muted(mountPoint && !opts.webdav ? `mounting at ${mountPoint}` : `WebDAV → http://localhost:${opts.port || 8099}/`)}`);
+    console.log(`  ${muted('files stay encrypted end-to-end; edits sync back automatically. Ctrl+C to stop.')}\n`);
+    const child = spawn(argv[0], argv.slice(1), {
+        env: { ...process.env, SQUIDCLOUD_API_KEY: apiKey },
+        stdio: 'inherit',
+    });
+    writeSession({
+        pid: child.pid,
+        mode: mountPoint && !opts.webdav ? 'fuse' : 'webdav',
+        port: Number(opts.port || 8099),
+        mount: mountPoint || undefined,
+        started_at: Date.now(),
+    });
+    child.on('exit', (code) => process.exit(code ?? 0));
+}

package/dist/commands/fs/status.js

@@ -0,0 +1,18 @@
+import chalk from 'chalk';
+import { readSession } from './binary.js';
+export default async function fsStatus() {
+    const s = readSession();
+    console.log();
+    if (!s)
+        console.log(`  ${chalk.dim('no SquidFS session running')} — start one with \`squidcloudctl fs mount\``);
+    else {
+        console.log(`  pid     ${s.pid}`);
+        console.log(`  mode    ${s.mode}`);
+        if (s.port)
+            console.log(`  webdav  http://localhost:${s.port}/`);
+        if (s.mount)
+            console.log(`  mount   ${s.mount}`);
+        console.log(`  up      ${Math.round((Date.now() - s.started_at) / 1000)}s`);
+    }
+    console.log();
+}

package/dist/commands/fs/stop.js

@@ -0,0 +1,19 @@
+import { readSession, PID_FILE } from './binary.js';
+import fs from 'node:fs';
+import { success, warn as warnMark } from '../../lib/output/brand.js';
+export default async function fsStop() {
+    const s = readSession();
+    if (!s) {
+        console.log(`\n  ${warnMark('no session running')}\n`);
+        return;
+    }
+    try {
+        process.kill(s.pid, 'SIGTERM');
+    }
+    catch { }
+    try {
+        fs.rmSync(PID_FILE, { force: true });
+    }
+    catch { }
+    console.log(`\n  ${success(`stopped squidfs (pid ${s.pid})`)}\n`);
+}

package/dist/commands/fs/webdav.js

@@ -0,0 +1 @@
+export { default } from './mount.js';

package/dist/commands/health.js

@@ -0,0 +1,20 @@
+import { apiGet } from '../lib/api/client.js';
+import { success, error as errMark, muted } from '../lib/output/brand.js';
+import { isJsonMode } from '../lib/output/logger.js';
+export default async function health() {
+    try {
+        await apiGet('/health');
+        if (isJsonMode())
+            console.log(JSON.stringify({ status: 'ok' }, null, 2));
+        else
+            console.log(`\n  ${success('API healthy')}\n`);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (isJsonMode())
+            console.log(JSON.stringify({ status: 'down', error: msg }, null, 2));
+        else
+            console.log(`\n  ${errMark('API unreachable')} — ${muted(msg)}\n`);
+        process.exit(1);
+    }
+}

package/dist/commands/host/api.js

@@ -0,0 +1,186 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import chalk from 'chalk';
+import { renderBanner } from '../../lib/output/banner.js';
+import { success, muted, info } from '../../lib/output/brand.js';
+import { startHost } from '../../lib/host/server.js';
+import { apiPost, apiGet } from '../../lib/api/client.js';
+import { isJsonMode } from '../../lib/output/logger.js';
+export const HOST_PID_FILE = path.join(os.homedir(), '.squidcloud', 'host.pid');
+export function readHostPid() {
+    try {
+        const raw = JSON.parse(fs.readFileSync(HOST_PID_FILE, 'utf-8'));
+        try {
+            process.kill(raw.pid, 0);
+            return raw;
+        }
+        catch {
+            fs.rmSync(HOST_PID_FILE, { force: true });
+            return null;
+        }
+    }
+    catch {
+        return null;
+    }
+}
+export function writeHostPid(p) {
+    fs.mkdirSync(path.dirname(HOST_PID_FILE), { recursive: true });
+    fs.writeFileSync(HOST_PID_FILE, JSON.stringify(p));
+}
+const ENDPOINTS = [
+    ['GET', '/health', 'liveness + profile + redis stats'],
+    ['GET', '/v1/files?search=', 'list files (#numbered refs included)'],
+    ['GET', '/v1/files/:ref', 'metadata — ref = #n | id-prefix | name'],
+    ['POST', '/v1/files/:ref/rename', '{ "name": "new-name" }'],
+    ['DELETE', '/v1/files/:ref', 'move to trash'],
+    ['POST', '/v1/upload?filename=x', 'raw body bytes → res54 pipeline'],
+    ['GET', '/v1/download/:ref', 'streams decrypted plaintext'],
+    ['POST', '/v1/share', '{ file_ref | folder_id, expires_at?, max_downloads?, view_only? }'],
+    ['GET', '/v1/secrets', 'secret inventory'],
+    ['POST', '/v1/exec', '{ op: whoami | storage.search | stats }'],
+];
+/** Register this host as a dedicated HOST| api key so the dashboard can show
+    live state. The key doubles as the heartbeat credential (every authed
+    request bumps last_used_at server-side). */
+async function registerHostKey(port, profile, mode) {
+    const os = await import('node:os');
+    const crypto = await import('node:crypto');
+    const hostId = crypto.createHash('sha256').update(`${os.hostname()}:${port}`).digest('hex').slice(0, 16);
+    const created = await apiPost('/keys', {
+        name: `HOST|${hostId}|${os.hostname()}|${port}|${profile}|${mode}`,
+        scopes: ['*'],
+    });
+    const id = created?.key?.id;
+    const rawKey = created?.raw_key;
+    if (!id || !rawKey)
+        throw new Error('Could not register host key for dashboard visibility');
+    return { id, rawKey, hostId };
+}
+export default async function hostApi(...args) {
+    const opts = (args.find((a) => a && typeof a === 'object') || {});
+    // Commander camelCases dashed flags — accept both spellings.
+    const o = opts;
+    const pick = (dashed, camel) => o[dashed] ?? o[camel];
+    const a = {
+        port: Number(pick('port', 'port') || 8065),
+        'redis-port': Number(pick('redis-port', 'redisPort') || Number(pick('port', 'port') || 8065) + 1),
+        profile: String(pick('profile', 'profile') || 'standard'),
+        mode: String(pick('mode', 'mode') || 'open'),
+        'hmac-secret': pick('hmac-secret', 'hmacSecret') ? String(pick('hmac-secret', 'hmacSecret')) : undefined,
+        rps: pick('rps', 'rps') ? Number(pick('rps', 'rps')) : undefined,
+        'max-body': pick('max-body', 'maxBody') ? String(pick('max-body', 'maxBody')) : undefined,
+        'allow-ips': pick('allow-ips', 'allowIps') ?? undefined,
+        key: pick('key', 'key') ?? undefined,
+        quiet: !!pick('quiet', 'quiet'),
+    };
+    const existing = readHostPid();
+    if (existing) {
+        throw new Error(`A host is already running on :${existing.port} (pid ${existing.pid}). Stop it with \`squidcloudctl host stop\`.`);
+    }
+    if (!isJsonMode()) {
+        console.log(renderBanner({ tagline: false }));
+    }
+    let bootstrapKey = '';
+    const state = await startHost({
+        onBootstrapKey: (k) => { bootstrapKey = k; },
+        port: a.port,
+        redisPort: a['redis-port'],
+        profile: a.profile,
+        mode: a.mode || 'open',
+        hmacSecret: a['hmac-secret'],
+        quiet: a.quiet,
+    });
+    // Seed user-supplied extra keys.
+    const extraKeys = [];
+    if (Array.isArray(opts.key))
+        for (const _ of opts.key)
+            extraKeys.push(state.newKey().key);
+    else if (opts.key)
+        extraKeys.push(state.newKey().key);
+    writeHostPid({
+        pid: process.pid,
+        port: a.port,
+        redisPort: a['redis-port'],
+        mode: state.cfg.requireKey ? 'keyed' : 'open',
+        profile: state.cfg.profile,
+        started_at: Date.now(),
+    });
+    // Dashboard visibility: HOST| key + heartbeat loop.
+    let heartbeat = null;
+    let hostKeyId = '';
+    try {
+        const reg = await registerHostKey(a.port, state.cfg.profile, state.cfg.requireKey ? 'keyed' : 'open');
+        hostKeyId = reg.id;
+        let beats = 0;
+        const beat = async () => {
+            try {
+                await apiGet('/user/whoami', { headers: { 'X-SquidCloud-Key': reg.rawKey }, retries: 1 });
+                beats += 1;
+            }
+            catch { /* transient — next beat retries */ }
+        };
+        await beat();
+        heartbeat = setInterval(beat, 60_000);
+        if (!isJsonMode())
+            console.log(`  ${info('dashboard')}   visible under Settings → Developer → CLI devices`);
+    }
+    catch (err) {
+        if (!isJsonMode())
+            console.log(`  ${muted('dashboard sync skipped: ' + (err instanceof Error ? err.message : String(err)))}`);
+    }
+    if (isJsonMode()) {
+        console.log(JSON.stringify({
+            status: 'listening',
+            port: a.port,
+            redis_port: a['redis-port'],
+            profile: state.cfg.profile,
+            mode: state.cfg.requireKey ? 'keyed' : 'open',
+            bootstrap_key: bootstrapKey || undefined,
+        }, null, 2));
+    }
+    else {
+        console.log(`  ${success(`Local API host listening`)} ${chalk.bold(`http://127.0.0.1:${a.port}`)}`);
+        console.log(`  ${info('profile')}     ${state.cfg.profile} · mode=${state.cfg.requireKey ? 'keyed' : 'open'}${state.cfg.requireHmac ? ' · hmac=on' : ''}`);
+        console.log(`  ${info('micro-redis')}  127.0.0.1:${a['redis-port']}  ${muted('(PING/GET/SET/INCR/TTL/KEYS…)')}`);
+        console.log(`  ${info('limits')}      ${state.cfg.rpsPerKey} req/s/key · body ≤ ${Math.round(state.cfg.maxBodyBytes / 1048576)}MB · ips=${state.cfg.allowIps.join(',')}`);
+        console.log(`  ${info('audit')}       ${muted('~/.squidcloud/host-audit.log')}\n`);
+        if (bootstrapKey) {
+            console.log(`  ${chalk.bold.yellow('LOCAL KEY (shown once — store it now)')}`);
+            console.log(`  ${chalk.cyan(bootstrapKey)}\n`);
+        }
+        console.log(`  ${chalk.bold('Routes')}`);
+        for (const [m, p2, d] of ENDPOINTS) {
+            console.log(`   ${chalk.green(m.padEnd(7))} ${chalk.cyan(p2.padEnd(30))} ${muted(d)}`);
+        }
+        console.log(`\n  ${muted('Same engine as the CLI: numbered refs, res54 transfers, zero platform rate limits in between.')}`);
+        console.log(`  ${muted('Stop with `squidcloudctl host stop` or Ctrl+C.')}\n`);
+    }
+    const shutdown = (signal) => {
+        state.close();
+        if (heartbeat)
+            clearInterval(heartbeat);
+        // Best-effort: mark the HOST| key offline so the dashboard flips its dot.
+        if (hostKeyId) {
+            void (async () => {
+                try {
+                    const { apiPut } = await import('../../lib/api/client.js');
+                    const current = await apiGet(`/keys/${hostKeyId}`);
+                    if (current?.name && !current.name.endsWith(':OFFLINE')) {
+                        await apiPut(`/keys/${hostKeyId}`, { name: `${current.name}:OFFLINE` });
+                    }
+                }
+                catch { }
+            })();
+        }
+        try {
+            fs.rmSync(HOST_PID_FILE, { force: true });
+        }
+        catch { }
+        if (!isJsonMode())
+            console.log(`\n  ${muted(`host stopped (${signal})`)}`);
+        process.exit(0);
+    };
+    process.on('SIGINT', () => shutdown('SIGINT'));
+    process.on('SIGTERM', () => shutdown('SIGTERM'));
+}

package/dist/commands/host/keys.js

@@ -0,0 +1,63 @@
+import { generateApiKey } from '../../lib/host/security.js';
+import chalk from 'chalk';
+import { error as errMark } from '../../lib/output/brand.js';
+/** Keys live inside the running host's MicroRedis — this helper talks to it
+    over loopback so `keys add/list/revoke` work while the server is up. */
+async function redisCommand(...args) {
+    const pid = (await import('./api.js')).readHostPid();
+    if (!pid)
+        throw new Error('No host running — start one with `squidcloudctl host api`.');
+    const net = await import('node:net');
+    return new Promise((resolve, reject) => {
+        const socket = net.connect(pid.redisPort, '127.0.0.1', () => {
+            socket.write(`*${args.length}\r\n${args.map((a) => `$${Buffer.byteLength(a)}\r\n${a}`).join('\r\n')}\r\n`);
+        });
+        let data = '';
+        socket.on('data', (d) => {
+            data += d.toString();
+            setTimeout(() => { socket.end(); resolve(data); }, 40);
+        });
+        socket.on('error', reject);
+        setTimeout(() => reject(new Error('redis timeout')), 3000);
+    });
+}
+export async function hostKeysAdd() {
+    const k = generateApiKey();
+    await redisCommand('SET', `key:${k.hash}`, k.prefix);
+    console.log(`\n  ${chalk.bold.yellow('NEW LOCAL KEY (shown once)')}\n  ${chalk.cyan(k.key)}\n`);
+}
+export async function hostKeysList() {
+    const raw = await redisCommand('KEYS', 'key:*');
+    const count = Number(raw.split('\r\n')[0]?.slice(1) || 0);
+    const keys = [];
+    const lines = raw.split('\r\n');
+    for (let i = 0; i < lines.length; i++) {
+        if (lines[i].startsWith('$'))
+            keys.push(lines[i + 1] ?? '');
+    }
+    console.log(`\n  ${count} key(s)`);
+    for (const k of keys)
+        console.log(`   ${k.replace('key:', '').slice(0, 16)}…`);
+    console.log();
+}
+export async function hostKeysRevoke(...args) {
+    const prefix = args.filter((a) => typeof a === 'string')[0] || '';
+    if (!prefix)
+        throw new Error('Usage: squidcloudctl host keys revoke <key-prefix>');
+    const raw = await redisCommand('KEYS', 'key:*');
+    const lines = raw.split('\r\n');
+    let n = 0;
+    for (let i = 0; i < lines.length; i++) {
+        if (lines[i].startsWith('$')) {
+            const full = lines[i + 1] ?? '';
+            if (full.includes(prefix)) {
+                await redisCommand('DEL', full);
+                n++;
+            }
+        }
+    }
+    if (n === 0)
+        console.log(`\n  ${errMark(`no key matches "${prefix}"`)}\n`);
+    else
+        console.log(`\n  revoked ${n} key(s)\n`);
+}

package/dist/commands/host/status.js

@@ -0,0 +1,15 @@
+import chalk from 'chalk';
+import { readHostPid } from './api.js';
+export default async function hostStatus() {
+    const p = readHostPid();
+    console.log();
+    if (!p)
+        console.log(`  ${chalk.dim('no local API host running')} — start one with \`squidcloudctl host api\``);
+    else {
+        console.log(`  pid      ${p.pid}`);
+        console.log(`  api      http://127.0.0.1:${p.port}  (${p.mode}, ${p.profile})`);
+        console.log(`  redis    127.0.0.1:${p.redisPort}`);
+        console.log(`  uptime   ${Math.round((Date.now() - p.started_at) / 1000)}s`);
+    }
+    console.log();
+}

package/dist/commands/host/stop.js

@@ -0,0 +1,19 @@
+import fs from 'node:fs';
+import { readHostPid, HOST_PID_FILE } from './api.js';
+import { success, warn as warnMark } from '../../lib/output/brand.js';
+export default async function hostStop() {
+    const p = readHostPid();
+    if (!p) {
+        console.log(`\n  ${warnMark('no host running')}\n`);
+        return;
+    }
+    try {
+        process.kill(p.pid, 'SIGTERM');
+    }
+    catch { }
+    try {
+        fs.rmSync(HOST_PID_FILE, { force: true });
+    }
+    catch { }
+    console.log(`\n  ${success(`host stopped (pid ${p.pid})`)}\n`);
+}

package/dist/commands/logs/index.js

@@ -1,2 +1,2 @@
-export{a as logsTail}from'../../chunk-2MWPBWUD.js';export{a as logsSearch}from'../../chunk-SB7XE246.js';export{a as logsExport}from'../../chunk-IBYIEHIZ.js';import'../../chunk-YZWZNR6K.js';import'../../chunk-52WHEL73.js';import'../../chunk-BC3STHFS.js';import'../../chunk-OSI5H2T5.js';import'../../chunk-CFZZRV3Z.js';import'../../chunk-5TMR6Y7L.js';import'../../chunk-NDB6KXYI.js';import'../../chunk-IJ3JNWT6.js';import'../../chunk-BQGHHBGH.js';import'../../chunk-6VDGYAGT.js';//# sourceMappingURL=index.js.map
+export{a as logsTail}from'../../chunk-QLLHU2RS.js';export{a as logsSearch}from'../../chunk-5TYVWTHC.js';export{a as logsExport}from'../../chunk-BDUD2TSS.js';//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/commands/monitor/index.js

@@ -1,2 +1,2 @@
-export{a as monitor}from'../../chunk-PMRLA27Q.js';export{a as monitorSites}from'../../chunk-MNSBJ6HR.js';export{a as monitorPipelines}from'../../chunk-MCJLSHUC.js';export{a as monitorStorage}from'../../chunk-4VJET5IM.js';export{a as monitorAutomations}from'../../chunk-JLC5WGYQ.js';import'../../chunk-52WHEL73.js';import'../../chunk-BC3STHFS.js';import'../../chunk-OSI5H2T5.js';import'../../chunk-CFZZRV3Z.js';import'../../chunk-5TMR6Y7L.js';import'../../chunk-NDB6KXYI.js';import'../../chunk-IJ3JNWT6.js';import'../../chunk-BQGHHBGH.js';import'../../chunk-6VDGYAGT.js';//# sourceMappingURL=index.js.map
+export{a as monitorPipelines}from'../../chunk-NJCALUUB.js';export{a as monitorStorage}from'../../chunk-3E23ZFCV.js';export{a as monitorAutomations}from'../../chunk-ZY4RVPTF.js';export{a as monitor}from'../../chunk-3XXAN3BP.js';export{a as monitorSites}from'../../chunk-KQE3YLI3.js';//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/commands/scripts/index.js

@@ -1,2 +1,2 @@
-export{a as scriptsCancel}from'../../chunk-JTMKKTKL.js';export{a as scriptsWatch}from'../../chunk-VJNDCFHN.js';export{a as scriptsRun}from'../../chunk-E2QGSNDB.js';export{a as scriptsLogs}from'../../chunk-HTDV42AD.js';export{a as scriptsValidate}from'../../chunk-ZP2A2JZ2.js';export{a as scriptsInit}from'../../chunk-NQAQKZPN.js';export{a as scriptsEnable}from'../../chunk-RNCPG3CD.js';export{a as scriptsDisable}from'../../chunk-XTV6ABCU.js';export{a as scriptsDelete}from'../../chunk-UPZC233Y.js';export{a as scriptsStatus}from'../../chunk-5JPIAFB2.js';export{a as scriptsList}from'../../chunk-57X5IOZ5.js';import'../../chunk-YZWZNR6K.js';import'../../chunk-52WHEL73.js';import'../../chunk-BC3STHFS.js';import'../../chunk-OSI5H2T5.js';import'../../chunk-CFZZRV3Z.js';import'../../chunk-5TMR6Y7L.js';import'../../chunk-NDB6KXYI.js';import'../../chunk-IJ3JNWT6.js';import'../../chunk-BQGHHBGH.js';import'../../chunk-6VDGYAGT.js';//# sourceMappingURL=index.js.map
+export{a as scriptsDisable}from'../../chunk-3JD6INFN.js';export{a as scriptsDelete}from'../../chunk-KJIMUYAU.js';export{a as scriptsStatus}from'../../chunk-LDYPQMLZ.js';export{a as scriptsCancel}from'../../chunk-5XSOEZ7F.js';export{a as scriptsWatch}from'../../chunk-YRSMMECJ.js';export{a as scriptsList}from'../../chunk-E26CRSCS.js';export{a as scriptsRun}from'../../chunk-OPZJKTOV.js';export{a as scriptsLogs}from'../../chunk-SBNM6EQO.js';export{a as scriptsValidate}from'../../chunk-6LLJ6P3U.js';export{a as scriptsInit}from'../../chunk-QEG6LP5X.js';export{a as scriptsEnable}from'../../chunk-CRT5ANG2.js';//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/commands/secrets/list.js

@@ -0,0 +1,14 @@
+import { apiGet } from '../../lib/api/client.js';
+import { muted } from '../../lib/output/brand.js';
+import { isJsonMode } from '../../lib/output/logger.js';
+export async function secretsList() {
+    const res = await apiGet('/secrets');
+    const rows = res.secrets || res.data || [];
+    if (isJsonMode()) {
+        console.log(JSON.stringify({ count: rows.length, secrets: rows }, null, 2));
+        return;
+    }
+    console.log();
+    rows.forEach((s, i) => console.log(`  ${muted(`[${i + 1}]`)} ${s.name}  ${muted(s.id)}`));
+    console.log(`\n  ${rows.length} secret(s)\n`);
+}

package/dist/commands/secrets/secrets-create.js

@@ -0,0 +1,28 @@
+import { apiPost } from '../../lib/api/client.js';
+import { success } from '../../lib/output/brand.js';
+import { isJsonMode } from '../../lib/output/logger.js';
+function readStdinMaybe() {
+    if (process.stdin.isTTY)
+        return Promise.resolve(null);
+    return new Promise((resolve) => {
+        let data = '';
+        process.stdin.setEncoding('utf-8');
+        process.stdin.on('data', (c) => (data += c));
+        process.stdin.on('end', () => resolve(data));
+        setTimeout(() => resolve(data || null), 1500);
+    });
+}
+export default async function secretsCreate(...args) {
+    const parts = args.filter((a) => typeof a === 'string');
+    let name = parts[0];
+    let value = parts[1];
+    if (!value && !process.stdin.isTTY)
+        value = (await readStdinMaybe())?.trim() || undefined;
+    if (!name || !value)
+        throw new Error('Usage: squidcloudctl secrets create <name> <value>   (or pipe value on stdin)');
+    const res = await apiPost('/secrets', { name, value });
+    if (isJsonMode())
+        console.log(JSON.stringify({ name, id: res?.id }, null, 2));
+    else
+        console.log(`\n  ${success(`secret "${name}" stored`)}${res?.id ? ` — ${res.id}` : ''}\n`);
+}

package/dist/commands/secrets/secrets-delete.js

@@ -0,0 +1,9 @@
+import { apiDelete } from '../../lib/api/client.js';
+import { success } from '../../lib/output/brand.js';
+export default async function secretsDelete(...args) {
+    const id = args.filter((a) => typeof a === 'string')[0] || '';
+    if (!id)
+        throw new Error('Usage: squidcloudctl secrets delete <id>');
+    await apiDelete(`/secrets/${id}`);
+    console.log(`\n  ${success('secret deleted')}\n`);
+}

package/dist/commands/secrets/secrets-list.js

@@ -0,0 +1 @@
+export { secretsList as default } from './list.js';

package/dist/commands/secrets/secrets-rename.js

@@ -0,0 +1,9 @@
+import { apiPatch } from '../../lib/api/client.js';
+import { success } from '../../lib/output/brand.js';
+export default async function secretsRename(...args) {
+    const [id, name] = args.filter((a) => typeof a === 'string');
+    if (!id || !name)
+        throw new Error('Usage: squidcloudctl secrets rename <id> <new-name>');
+    await apiPatch(`/secrets/${id}/rename`, { name });
+    console.log(`\n  ${success(`renamed to ${name}`)}\n`);
+}

package/dist/commands/secrets/secrets-verify.js

@@ -0,0 +1,16 @@
+import { apiPost } from '../../lib/api/client.js';
+import { success, error as errMark } from '../../lib/output/brand.js';
+import { isJsonMode } from '../../lib/output/logger.js';
+export default async function secretsVerify(...args) {
+    const [name, value] = args.filter((a) => typeof a === 'string');
+    if (!name || !value)
+        throw new Error('Usage: squidcloudctl secrets verify <name> <value>');
+    const res = await apiPost(`/secrets/${encodeURIComponent(name)}/verify`, { value });
+    const ok = !!(res?.matches ?? res?.verified ?? res?.valid);
+    if (isJsonMode())
+        console.log(JSON.stringify({ match: ok }, null, 2));
+    else
+        console.log(`\n  ${ok ? success('value matches') : errMark('value does NOT match')}\n`);
+    if (!ok)
+        process.exit(1);
+}

package/dist/commands/share/create.js

@@ -0,0 +1,34 @@
+import chalk from 'chalk';
+import { apiPost } from '../../lib/api/client.js';
+import { resolveFileRef } from '../../lib/refs.js';
+import { success, muted } from '../../lib/output/brand.js';
+import { isJsonMode } from '../../lib/output/logger.js';
+export default async function shareCreate(...args) {
+    const strArgs = args.filter((a) => typeof a === 'string');
+    const opts = (args.find((a) => a && typeof a === 'object') || {});
+    if (strArgs.length === 0)
+        throw new Error('Usage: squidcloudctl share create <#n | id | name> [--expires 7d] [--max-downloads n] [--view-only]');
+    const body = {};
+    const { entry } = await resolveFileRef(strArgs[0]);
+    body.file_id = entry.id;
+    if (opts.expires) {
+        const m = String(opts.expires).match(/^(\d+)([dhm])$/);
+        body.expires_at = m
+            ? new Date(Date.now() + Number(m[1]) * (m[2] === 'd' ? 86400 : m[2] === 'h' ? 3600 : 60) * 1000).toISOString()
+            : new Date(String(opts.expires)).toISOString();
+    }
+    if (opts.maxDownloads !== undefined)
+        body.max_downloads = Number(opts.maxDownloads);
+    if (opts.viewOnly)
+        body.view_only = true;
+    const res = await apiPost('/shares', body);
+    if (isJsonMode()) {
+        console.log(JSON.stringify(res, null, 2));
+        return;
+    }
+    console.log(`\n  ${success('share ready')}`);
+    console.log(`  ${chalk.bold(res.share_url || '—')}`);
+    if (res.share_id)
+        console.log(`  ${muted(`share id: ${res.share_id}`)}`);
+    console.log();
+}

package/dist/commands/sign/index.js

@@ -1,2 +1,2 @@
-export{a as signCancel}from'../../chunk-LSYYM7EZ.js';export{a as signVerify}from'../../chunk-XWVREJPG.js';export{a as signDownload}from'../../chunk-NKEQVDH2.js';export{a as signRequest}from'../../chunk-A6WS3TOF.js';export{a as signStatus}from'../../chunk-T23UIAGN.js';export{a as signList}from'../../chunk-KQMBXJUL.js';import'../../chunk-YZWZNR6K.js';import'../../chunk-52WHEL73.js';import'../../chunk-BC3STHFS.js';import'../../chunk-OSI5H2T5.js';import'../../chunk-CFZZRV3Z.js';import'../../chunk-5TMR6Y7L.js';import'../../chunk-NDB6KXYI.js';import'../../chunk-IJ3JNWT6.js';import'../../chunk-BQGHHBGH.js';import'../../chunk-6VDGYAGT.js';//# sourceMappingURL=index.js.map
+export{a as signRequest}from'../../chunk-PGDN5F2F.js';export{a as signStatus}from'../../chunk-I3DVKNFK.js';export{a as signList}from'../../chunk-QF3NWEHO.js';export{a as signCancel}from'../../chunk-P42LDK4T.js';export{a as signVerify}from'../../chunk-NS5IBNC2.js';export{a as signDownload}from'../../chunk-BUG4O26P.js';//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/commands/sites/client.js

@@ -0,0 +1,20 @@
+import { SUPABASE_URL } from '../../lib/auth/constants.js';
+import { authToken, anonKey, sbToken } from '../../lib/auth/oauth-session.js';
+/** sites-api authenticates with the Supabase JWT — the CLI OAuth token is one. */
+export async function sitesApi(action, params = {}) {
+    const jwt = sbToken || authToken;
+    if (!jwt)
+        throw new Error('Not authenticated');
+    if (!sbToken) {
+        console.error('  note: re-run `squidcloudctl login` for full sites access (JWT session)');
+    }
+    const res = await fetch(`${SUPABASE_URL}/functions/v1/sites-api`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${jwt}`, ...(anonKey ? { apikey: anonKey } : {}) },
+        body: JSON.stringify({ action, ...params }),
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok)
+        throw new Error(String(data?.error || `HTTP ${res.status}`));
+    return data;
+}

package/dist/commands/sites/index.js

@@ -1,2 +1,2 @@
-export{a as sitesVisibility}from'../../chunk-H2WQ3ECX.js';export{a as sitesRename}from'../../chunk-XFLWSNBM.js';export{a as sitesRollback}from'../../chunk-ZBT5KBPZ.js';export{a as sitesDeploys}from'../../chunk-CJYNYLZF.js';export{a as sitesLogs}from'../../chunk-SAE75K6H.js';export{a as sitesAnalytics}from'../../chunk-HMBPN7ID.js';export{a as sitesPurge}from'../../chunk-OWUWBBTM.js';export{a as sitesList}from'../../chunk-N52M225G.js';export{a as sitesInfo}from'../../chunk-4N7AHGIY.js';export{a as sitesOpen}from'../../chunk-FBSVAPQ6.js';export{a as sitesUnpublish}from'../../chunk-XM4MU7IT.js';export{a as sitesDelete}from'../../chunk-RN4IKWVM.js';import'../../chunk-YZWZNR6K.js';import'../../chunk-52WHEL73.js';import'../../chunk-BC3STHFS.js';import'../../chunk-OSI5H2T5.js';import'../../chunk-CFZZRV3Z.js';import'../../chunk-5TMR6Y7L.js';import'../../chunk-NDB6KXYI.js';import'../../chunk-IJ3JNWT6.js';import'../../chunk-BQGHHBGH.js';import'../../chunk-6VDGYAGT.js';//# sourceMappingURL=index.js.map
+export{a as sitesAnalytics}from'../../chunk-E6UJ45WU.js';export{a as sitesPurge}from'../../chunk-GRZ7FAK4.js';export{a as sitesOpen}from'../../chunk-C7M6KZGB.js';export{a as sitesUnpublish}from'../../chunk-6IXURJIU.js';export{a as sitesDelete}from'../../chunk-WOMYFCVM.js';export{a as sitesVisibility}from'../../chunk-KLPKNHXU.js';export{a as sitesRename}from'../../chunk-X33BC54Z.js';export{a as sitesRollback}from'../../chunk-V3UZYH25.js';export{a as sitesDeploys}from'../../chunk-UYERZEPM.js';export{a as sitesLogs}from'../../chunk-EDD2NCQT.js';export{a as sitesList}from'../../chunk-J5MM66CO.js';export{a as sitesInfo}from'../../chunk-BDRSOUY3.js';//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/commands/sites/list.js

@@ -0,0 +1,18 @@
+import chalk from 'chalk';
+import { sitesApi } from './client.js';
+import { muted } from '../../lib/output/brand.js';
+import { isJsonMode } from '../../lib/output/logger.js';
+export default async function sitesList() {
+    const res = await sitesApi('list');
+    const pubs = res.publications || [];
+    if (isJsonMode()) {
+        console.log(JSON.stringify({ count: pubs.length, sites: pubs }, null, 2));
+        return;
+    }
+    console.log();
+    for (const p of pubs) {
+        const vis = p.is_public === false ? chalk.dim('[private]') : chalk.green('[public]');
+        console.log(`  ${chalk.cyan(p.slug.padEnd(24))} ${vis}  ${muted(p.url || p.site_url || '')}`);
+    }
+    console.log(`\n  ${pubs.length} site(s)\n`);
+}

package/dist/commands/sites/open.js

@@ -0,0 +1,12 @@
+import { sitesApi } from './client.js';
+import { openBrowser } from '../../lib/utils/open.js';
+export default async function sitesOpen(...args) {
+    const slug = args.filter((a) => typeof a === 'string')[0] || '';
+    if (!slug)
+        throw new Error('Usage: squidcloudctl sites open <slug>');
+    const res = await sitesApi('list');
+    const pub = (res.publications || []).find((p) => p.slug === slug);
+    const url = pub?.url || pub?.site_url || `https://squidcloud.vercel.app/s/${slug}`;
+    openBrowser(url);
+    console.log(`\n  opened ${url}\n`);
+}