tori.host 0.0.1 → 0.1.1

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Tori (tori.host)
+Copyright (c) 2026 Fortion Networks s.r.o.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,13 +1,109 @@
 # tori.host
 
-**Tell Tori. It's live.**
+Deploy static sites to [tori.host](https://tori.host). Nothing to install:
 
-This is a placeholder for the Tori CLI — the gate opens soon.
+```sh
+npx tori.host
+```
+
+## Signing in
+
+There is nothing to set up first. Run the deploy; if this machine has never
+signed in, a browser opens, you sign in (or sign up — they are the same click,
+auth here is a magic link), and the deploy carries on:
 
 ```sh
 npx tori.host
 ```
 
-For now it just says hello. Leave your email at [tori.host](https://tori.host) and you'll be first through the gate.
+What gets saved to `~/.config/tori/config.json` is an API token the sign-in
+mints, named after this machine — `CLI · macbook-vaclav`. It shows up in the
+Console under Settings → API tokens, and revoking it there stops this machine
+deploying, immediately and by itself.
 
-Hosted in Europe, by default.
+### On a machine with no browser
+
+Over SSH, in a container, or anywhere with no `DISPLAY`, the CLI does not try to
+open anything. It prints a short code and a URL instead; open the URL on any
+device you are signed in on, type the code, and the terminal carries on:
+
+```
+$ npx tori.host
+→ no browser here (this is an SSH session) — sign in from any other device
+  Open: https://my.tori.host/cli-auth
+  Code: PQXR-4K7M
+⠧ waiting for approval…
+```
+
+`--no-browser` picks that flow deliberately on a machine that does have a
+browser. `BROWSER=none` does the same through the environment.
+
+### In CI
+
+There is nobody there to approve anything, so `tori deploy` does not try: set
+`TORI_TOKEN` to a token minted in the Console (Settings → API tokens), and
+`TORI_API_URL` if you are not pointing at the default.
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `tori` / `tori deploy [dir]` | Deploy, signing in first if needed. Auto-detects `dist/`, `build/`, `out/`, or `_site/` (runs `npm run build` if needed), packs it, uploads, and waits until it's live. First deploy creates the app and writes its slug to `tori.json`. |
+| `tori login` | Sign in through the browser (or with a code) and save the token. |
+| `tori whoami` | Show the logged-in account and plan. |
+| `tori --version` / `--help` | The usual. |
+
+Example:
+
+```
+$ npx tori.host
+→ opening your browser to sign in…
+✓ signed in as you@somewhere.com
+  Saved as "CLI · macbook-vaclav" — revoke it any time in the console.
+→ created app plucky-wren
+⠹ uploading 8.4 MB / 30.0 MB  28%  1.1 MB/s  ETA 19s
+→ uploaded 30.0 MB in 27s (1.1 MB/s)
+✓ live: https://plucky-wren.tori.cloud
+```
+
+## Uploads
+
+The server holds the request open for the whole upload and only answers once the
+last byte has arrived, so on a slow uplink `tori deploy` can legitimately run for
+several minutes — a 100 MB artifact over 1 Mbit/s is about fourteen. The progress
+line is there so that wait is distinguishable from a hang; when stderr is a pipe
+(CI), progress is printed as periodic lines instead.
+
+Limits and timeouts, all matched to the server rather than guessed:
+
+| | |
+| --- | --- |
+| Largest artifact | 100 MB compressed (refused locally before the upload starts) |
+| Upload deadline | 20 minutes, the same as the API ingress and the server's build watchdog |
+| Stall detection | 2 minutes without the socket accepting a byte |
+| Wait for the build | 20 minutes; timing out here abandons the wait, it does not cancel the deploy |
+
+Environment overrides, mainly for tests: `TORI_UPLOAD_TIMEOUT_MS`,
+`TORI_UPLOAD_STALL_MS`, `TORI_DEPLOY_TIMEOUT_MS`, `TORI_LOGIN_TIMEOUT_MS`.
+
+**Known ceiling, server-side:** the API today closes any single request after
+five minutes (Node's `server.requestTimeout` default, not overridden), so an
+upload slower than roughly 2.8 Mbit/s at the 100 MB cap will be cut off with
+HTTP 408 no matter what the client does — [issue 48]. The CLI reports that as
+what it is rather than as a connection error, but it cannot work around it.
+
+[issue 48]: https://git.int.fortion.net/websites/tori/-/issues/48
+
+## Tests
+
+```sh
+npm test -w packages/cli
+```
+
+The suite drives the real binary as a child process against a mock control plane
+on a real socket. Two tests reproduce the five-minute ceiling at real speed and
+take five and a half minutes each, so they are opt-in:
+
+```sh
+TORI_SLOW_TESTS=1 npm test -w packages/cli
+```

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,40 @@
+<!-- Generated by packages/cli/scripts/gen-notices.ts. Do not edit by hand:
+     `npm run gen:notices -w packages/cli` rewrites it, and `npm test` fails
+     when it is stale. -->
+
+# Third-party notices
+
+`tori.host` ships a single bundled file, `dist/cli.js`. The code below is
+compiled into it, so its licence terms travel with this package.
+
+Dependencies that stay external — declared in `dependencies` and installed by
+npm alongside this package — are not listed here: npm installs them with their
+own licence files intact.
+
+## zod 3.25.76
+
+SPDX: MIT
+
+```
+MIT License
+
+Copyright (c) 2025 Colin McDonnell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```