@affix-io/cli 1.2.4

package/README.md

@@ -0,0 +1,48 @@
+# AffixIO CLI
+
+Terminal client for AffixIO verification API with hub browser login.
+
+## Install
+
+```bash
+curl -fsSL https://www.affix-io.com/cli/install.sh | bash
+```
+
+npm (when published):
+
+```bash
+npm install -g @affix-io/cli
+```
+
+## Usage
+
+```bash
+affix login          # hub browser activation
+affix                # interactive mode
+
+affix qr <text|url>  # generate QR (works offline; Merkle needs login)
+affix barcode <data> # generate barcode (works offline)
+affix codes          # list local vault
+affix open <id>      # open stored file
+affix rm <id>        # remove from vault
+
+affix health         # requires login or AFFIX_API_KEY
+affix circuits
+affix prove --circuit yesno
+affix verify <proof> --circuit yesno
+```
+
+Set `AFFIX_API_KEY` (and optional `AFFIX_API_BASE`) to use API commands without browser login.
+
+Credentials: `~/.affix/credentials.json`  
+Code vault: `~/.affix/codes/`
+
+## Development
+
+```bash
+npm install
+npm run build
+npm run test:smoke
+AFFIX_API_KEY=… npm run test:smoke
+npm run pack:dist
+```

package/certs/sectigo-r36.pem

@@ -0,0 +1,36 @@
+-----BEGIN CERTIFICATE-----
+MIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBf
+MQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQD
+Ey1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYw
+HhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEY
+MBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1Ymxp
+YyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0B
+AQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7Yeq
+RPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH
+12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAja
+EMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTm
+M64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv
+38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HB
+pXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn
+2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFN
+xx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hk
+lfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycw
+DgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYI
+KwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEw
+VAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdv
+UHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUH
+AQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3Rp
+Z29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUF
+BzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEA
+YtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8
+ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+d
+q1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OF
+h2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH
+5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD
+4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOd
+unQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536
+WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l
+7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzW
+r8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvh
+JEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=
+-----END CERTIFICATE-----

package/dist/api.d.ts

@@ -0,0 +1,11 @@
+import type { AffixCredentials } from "./config.js";
+export declare class AffixApi {
+    private readonly creds;
+    constructor(creds: AffixCredentials);
+    private request;
+    health(): Promise<unknown>;
+    circuits(): Promise<unknown>;
+    authCheck(): Promise<unknown>;
+    prove(circuitId: string, body: Record<string, unknown>): Promise<unknown>;
+    verify(circuitId: string, proof: string): Promise<unknown>;
+}

package/dist/api.js

@@ -0,0 +1,49 @@
+import { requestJson } from "./http.js";
+export class AffixApi {
+    creds;
+    constructor(creds) {
+        this.creds = creds;
+    }
+    async request(path, init) {
+        const base = this.creds.api_base.replace(/\/$/, "");
+        const res = await requestJson(`${base}${path}`, {
+            method: init?.method ?? "GET",
+            headers: {
+                Authorization: `Bearer ${this.creds.api_key}`,
+                "Content-Type": "application/json",
+                Accept: "application/json",
+            },
+            body: init?.body,
+            timeoutMs: 120_000,
+        });
+        const data = await res.json();
+        if (!res.ok) {
+            const msg = data.message ??
+                data.error ??
+                `API error ${res.status}`;
+            throw new Error(msg);
+        }
+        return data;
+    }
+    health() {
+        return this.request("/api/health");
+    }
+    circuits() {
+        return this.request("/v1/circuits");
+    }
+    authCheck() {
+        return this.request("/v1/auth/check");
+    }
+    prove(circuitId, body) {
+        return this.request(`/v1/circuits/${encodeURIComponent(circuitId)}/prove`, {
+            method: "POST",
+            body: JSON.stringify(body),
+        });
+    }
+    verify(circuitId, proof) {
+        return this.request(`/v1/circuits/${encodeURIComponent(circuitId)}/verify`, {
+            method: "POST",
+            body: JSON.stringify({ proof }),
+        });
+    }
+}

package/dist/auth.d.ts

@@ -0,0 +1,17 @@
+import { type AffixCredentials } from "./config.js";
+export interface DeviceAuthStart {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    expires_in: number;
+    interval: number;
+}
+export interface DeviceTokenResponse {
+    status: "pending" | "approved" | "expired" | "denied";
+    api_key?: string;
+    email?: string;
+    message?: string;
+}
+export declare function startDeviceAuth(hubBase?: string): Promise<DeviceAuthStart>;
+export declare function pollDeviceToken(hubBase: string, deviceCode: string): Promise<DeviceTokenResponse>;
+export declare function loginViaHub(hubBase?: string): Promise<AffixCredentials>;

package/dist/auth.js

@@ -0,0 +1,93 @@
+import { execSync } from "node:child_process";
+import { hostname, platform } from "node:os";
+import { DEFAULT_API_BASE, DEFAULT_HUB_BASE, saveCredentials, } from "./config.js";
+import { requestJson } from "./http.js";
+function cliApi(siteBase, path) {
+    const base = siteBase.replace(/\/$/, "");
+    return `${base}/cli/api/cli${path}`;
+}
+export async function startDeviceAuth(hubBase = DEFAULT_HUB_BASE) {
+    const res = await requestJson(cliApi(hubBase, "/device"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        body: JSON.stringify({
+            client_name: "affix-cli",
+            hostname: hostname(),
+            platform: platform(),
+        }),
+    });
+    const err = await res.json();
+    if (!res.ok) {
+        throw new Error(err.message ?? `Device auth failed (${res.status})`);
+    }
+    return err;
+}
+export async function pollDeviceToken(hubBase, deviceCode) {
+    const res = await requestJson(cliApi(hubBase, "/token"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        body: JSON.stringify({ device_code: deviceCode }),
+    });
+    const err = await res.json();
+    if (!res.ok) {
+        throw new Error(err.message ?? `Token poll failed (${res.status})`);
+    }
+    return err;
+}
+function openBrowser(url) {
+    const cmds = {
+        darwin: `open "${url}"`,
+        win32: `start "" "${url}"`,
+        linux: `xdg-open "${url}"`,
+    };
+    const cmd = cmds[platform()];
+    if (!cmd)
+        return;
+    try {
+        execSync(cmd, { stdio: "ignore" });
+    }
+    catch {
+        /* browser open is best-effort */
+    }
+}
+export async function loginViaHub(hubBase = DEFAULT_HUB_BASE) {
+    const device = await startDeviceAuth(hubBase);
+    const uri = device.verification_uri;
+    process.stderr.write("\n");
+    process.stderr.write("  AffixIO CLI activation\n");
+    process.stderr.write("  ──────────────────────\n\n");
+    process.stderr.write(`  Open ${uri}\n`);
+    process.stderr.write(`  Enter code: ${device.user_code}\n\n`);
+    process.stderr.write("  Waiting for sign-in at affix-io.com/cli/verify…\n");
+    openBrowser(uri);
+    const deadline = Date.now() + device.expires_in * 1000;
+    const intervalMs = Math.max(device.interval, 2) * 1000;
+    while (Date.now() < deadline) {
+        await sleep(intervalMs);
+        const token = await pollDeviceToken(hubBase, device.device_code);
+        if (token.status === "approved" && token.api_key && token.email) {
+            const creds = {
+                api_key: token.api_key,
+                email: token.email,
+                api_base: DEFAULT_API_BASE,
+                hub_base: hubBase,
+                activated_at: new Date().toISOString(),
+                client_name: "affix-cli",
+            };
+            saveCredentials(creds);
+            process.stderr.write(`\n  Activated as ${token.email}\n\n`);
+            return creds;
+        }
+        if (token.status === "expired" || token.status === "denied") {
+            const msg = token.message ?? `Activation ${token.status}`;
+            if (msg.includes("not found") || msg.includes("Unknown device")) {
+                throw new Error("Device session expired. Run affix login again and approve promptly.");
+            }
+            throw new Error(msg);
+        }
+    }
+    throw new Error("Activation timed out. Run affix login and try again.");
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/dist/codes.d.ts

@@ -0,0 +1,31 @@
+import type { AffixCredentials } from "./config.js";
+import { type CodeFormat, type StoredCode } from "./store.js";
+export interface GenerateOptions {
+    label?: string;
+    format?: CodeFormat;
+    symbology?: string;
+    both?: boolean;
+    maxUses?: number;
+    location?: string;
+    out?: string;
+    event?: string;
+    holder?: string;
+    seat?: string;
+    tier?: string;
+    /** Use Affix short redirect link (/q/…) instead of encoding the URL directly */
+    shortLink?: boolean;
+}
+export declare function generateQr(creds: AffixCredentials, content: string, opts?: GenerateOptions): Promise<StoredCode>;
+export declare function generateBarcode(creds: AffixCredentials, content: string, opts?: GenerateOptions): Promise<StoredCode>;
+export declare function generateTicketCode(creds: AffixCredentials, fields: Record<string, unknown>, opts?: GenerateOptions): Promise<StoredCode>;
+export declare function scanCode(creds: AffixCredentials, target: string, opts?: {
+    event?: string;
+    entryPoint?: string;
+    id?: string;
+}): Promise<Record<string, unknown>>;
+export declare function printCodeEntry(entry: StoredCode): void;
+export declare function printCodesList(): void;
+export declare function showCode(id: string): void;
+export declare function removeCode(id: string): void;
+export declare function openCode(id: string): void;
+export declare function listSymbologies(creds: AffixCredentials): Promise<string[]>;

package/dist/codes.js

@@ -0,0 +1,321 @@
+import { execSync } from "node:child_process";
+import { platform } from "node:os";
+import { fetchBarcodeSymbologies, generateBarcodeMerkle, generateQrMerkle, performCliScan, } from "./site-api.js";
+import { DEFAULT_SYMBOLOGIES, renderBarcodePng, renderBarcodeSvg, renderQrPng, renderQrSvg, } from "./generate-local.js";
+import { deleteStoredCode, getStoredCode, listStoredCodes, newCodeId, saveStoredCode, updateScanCounts, vaultSummary, writeCodeFile, } from "./store.js";
+function defaultLabel(content) {
+    const trimmed = content.trim();
+    if (trimmed.length <= 48)
+        return trimmed;
+    return trimmed.slice(0, 45) + "…";
+}
+function requireAuth(creds) {
+    if (!creds.api_key) {
+        throw new Error("Sign in required for Merkle-backed codes. Run: affix login");
+    }
+}
+function parseMaxUses(opts) {
+    if (opts.maxUses == null)
+        return undefined;
+    const n = Number(opts.maxUses);
+    if (!Number.isFinite(n) || n < 1) {
+        throw new Error("Scans must be a positive integer.");
+    }
+    return Math.floor(n);
+}
+function extractScansFromPayload(data) {
+    const payload = data.payload;
+    const controls = payload?.controls;
+    const link = data.link;
+    const linkControls = link?.meta?.controls;
+    const total = linkControls?.maxUses ??
+        controls?.maxUses ??
+        payload?.maxUses ??
+        null;
+    const remaining = payload?.usesRemaining ??
+        (total != null ? total : null);
+    return { total, remaining };
+}
+function merkleMeta(data) {
+    return {
+        source: "merkle",
+        mode: data.mode,
+        proofDigest: data.proofDigest,
+        merkle_leaf_hash: data.merkle_leaf_hash,
+        merkle_root: data.merkle_root,
+        merkle_proof: data.merkle_proof,
+        merkle: data.merkle,
+        token: data.token,
+        link: data.link,
+        url: data.url,
+        payload: data.payload,
+    };
+}
+async function persistFromApi(creds, kind, data, opts, content, symbology) {
+    const id = newCodeId();
+    const asset = kind === "qr"
+        ? data.qr
+        : data.barcode;
+    if (!asset?.svg) {
+        throw new Error("API did not return SVG output.");
+    }
+    const writeOpts = { location: opts.location, out: opts.out };
+    const svgWrite = writeCodeFile(id, "svg", asset.svg, writeOpts);
+    const files = { svg: svgWrite.path };
+    const wantPng = opts.both || opts.format === "png";
+    if (wantPng) {
+        const pngBody = kind === "qr"
+            ? await renderQrPng(content)
+            : await renderBarcodePng(symbology ?? "code128", content);
+        files.png = writeCodeFile(id, "png", pngBody, writeOpts).path;
+    }
+    const scans = extractScansFromPayload(data);
+    const entry = {
+        id,
+        kind,
+        label: opts.label || defaultLabel(content),
+        content,
+        symbology,
+        format: "svg",
+        created_at: new Date().toISOString(),
+        output_location: svgWrite.locationName,
+        output_path: svgWrite.locationPath,
+        scans_total: scans.total,
+        scans_remaining: scans.remaining,
+        files,
+        meta: merkleMeta(data),
+    };
+    return saveStoredCode(entry);
+}
+function buildQrBody(content, opts) {
+    const maxUses = parseMaxUses(opts);
+    if (maxUses != null) {
+        if (!opts.event) {
+            throw new Error("Scans require ticket mode. Use --event <slug> or: affix qr ticket --event <slug> --scans N");
+        }
+        return {
+            event: opts.event,
+            holder: opts.holder,
+            seat: opts.seat,
+            tier: opts.tier,
+            maxUses,
+        };
+    }
+    if (/^https?:\/\//i.test(content)) {
+        if (opts.shortLink) {
+            return { url: content };
+        }
+        return { data: content };
+    }
+    return { data: content };
+}
+function buildBarcodeBody(content, opts) {
+    const symbology = opts.symbology ?? "code128";
+    const maxUses = parseMaxUses(opts);
+    if (maxUses != null) {
+        if (!opts.event) {
+            throw new Error("Scans require ticket mode. Use --event <slug> --scans N");
+        }
+        return {
+            event: opts.event,
+            holder: opts.holder,
+            seat: opts.seat,
+            tier: opts.tier,
+            maxUses,
+            symbology,
+        };
+    }
+    return { data: content, symbology };
+}
+async function persistLocal(kind, content, opts, symbology) {
+    const id = newCodeId();
+    const writeOpts = { location: opts.location, out: opts.out };
+    const svg = kind === "qr"
+        ? await renderQrSvg(content)
+        : await renderBarcodeSvg(symbology ?? "code128", content);
+    const svgWrite = writeCodeFile(id, "svg", svg, writeOpts);
+    const files = { svg: svgWrite.path };
+    const wantPng = opts.both || opts.format === "png";
+    if (wantPng) {
+        const pngBody = kind === "qr"
+            ? await renderQrPng(content)
+            : await renderBarcodePng(symbology ?? "code128", content);
+        const pngWrite = writeCodeFile(id, "png", pngBody, writeOpts);
+        files.png = pngWrite.path;
+    }
+    const entry = {
+        id,
+        kind,
+        label: opts.label || defaultLabel(content),
+        content,
+        symbology: kind === "barcode" ? symbology ?? "code128" : undefined,
+        format: files.png ? "png" : "svg",
+        created_at: new Date().toISOString(),
+        output_location: svgWrite.locationName,
+        output_path: svgWrite.locationPath,
+        scans_total: null,
+        scans_remaining: null,
+        files,
+        meta: { source: "local", offline: true },
+    };
+    saveStoredCode(entry);
+    return entry;
+}
+export async function generateQr(creds, content, opts = {}) {
+    const needsMerkle = Boolean(opts.maxUses || opts.shortLink || opts.event);
+    if (!creds.api_key) {
+        if (needsMerkle) {
+            requireAuth(creds);
+        }
+        return persistLocal("qr", content, opts);
+    }
+    const body = buildQrBody(content, opts);
+    const data = await generateQrMerkle(creds, body);
+    const resolvedContent = String(data.content ?? content);
+    return persistFromApi(creds, "qr", data, opts, resolvedContent);
+}
+export async function generateBarcode(creds, content, opts = {}) {
+    const symbology = opts.symbology ?? "code128";
+    const needsMerkle = Boolean(opts.maxUses || opts.event);
+    if (!creds.api_key) {
+        if (needsMerkle) {
+            requireAuth(creds);
+        }
+        return persistLocal("barcode", content, { ...opts, symbology }, symbology);
+    }
+    const body = buildBarcodeBody(content, opts);
+    const data = await generateBarcodeMerkle(creds, body);
+    const resolvedContent = String(data.content ?? content);
+    return persistFromApi(creds, "barcode", data, { ...opts, symbology }, resolvedContent, symbology);
+}
+export async function generateTicketCode(creds, fields, opts = {}) {
+    requireAuth(creds);
+    const body = { ...fields };
+    if (opts.maxUses != null)
+        body.maxUses = parseMaxUses(opts);
+    const data = await generateQrMerkle(creds, body);
+    const content = String(data.content ?? fields.event ?? "ticket");
+    return persistFromApi(creds, "qr", data, { ...opts, label: opts.label || `ticket:${String(fields.event ?? content)}` }, content);
+}
+export async function scanCode(creds, target, opts = {}) {
+    requireAuth(creds);
+    const entry = opts.id ? getStoredCode(opts.id) : null;
+    const meta = entry?.meta ?? {};
+    const link = meta.link;
+    const body = {
+        event: opts.event,
+        entryPoint: opts.entryPoint,
+    };
+    if (link?.code) {
+        body.code = link.code;
+    }
+    else if (meta.token) {
+        body.token = meta.token;
+    }
+    else if (/^[a-f0-9]{8,}$/i.test(target)) {
+        body.code = target;
+    }
+    else if (target.length >= 16) {
+        body.token = target;
+    }
+    else {
+        body.data = target;
+    }
+    const result = await performCliScan(creds, body);
+    if (entry) {
+        const remaining = result.usesRemaining ??
+            result.verification?.usesRemaining ??
+            null;
+        const total = result.maxUses ??
+            entry.scans_total ??
+            null;
+        updateScanCounts(entry.id, remaining, total);
+        entry.meta = {
+            ...entry.meta,
+            last_scan: {
+                scan_id: result.scan_id,
+                admitted: result.admitted,
+                decision: result.decision,
+                merkle_leaf_hash: result.merkle_leaf_hash,
+                merkle_root: result.merkle_root,
+                at: new Date().toISOString(),
+            },
+        };
+        saveStoredCode(entry);
+    }
+    return result;
+}
+export function printCodeEntry(entry) {
+    console.log(JSON.stringify({
+        id: entry.id,
+        kind: entry.kind,
+        label: entry.label,
+        content: entry.content,
+        symbology: entry.symbology,
+        created_at: entry.created_at,
+        output_location: entry.output_location,
+        output_path: entry.output_path,
+        scans_total: entry.scans_total,
+        scans_remaining: entry.scans_remaining,
+        files: entry.files,
+        meta: entry.meta,
+    }, null, 2));
+}
+export function printCodesList() {
+    const summary = vaultSummary();
+    const items = listStoredCodes();
+    console.log(`Vault index: ${summary.dir} (${summary.total} items, ${summary.qr} QR, ${summary.barcode} barcodes)\n`);
+    if (!items.length) {
+        console.log("No codes stored yet. Try: affix qr <text>  or  affix barcode <data>");
+        return;
+    }
+    for (const item of items) {
+        const path = item.files.svg || item.files.png || "—";
+        const sym = item.symbology ? ` · ${item.symbology}` : "";
+        const loc = item.output_location ? ` · @${item.output_location}` : "";
+        const scans = item.scans_total != null
+            ? ` · ${item.scans_remaining ?? "?"} / ${item.scans_total} scans`
+            : "";
+        console.log(`${item.id}  ${item.kind}${sym}${loc}${scans}  ${item.label}`);
+        console.log(`         ${path}`);
+    }
+}
+export function showCode(id) {
+    const entry = getStoredCode(id);
+    if (!entry) {
+        throw new Error(`No code matching "${id}" in local vault.`);
+    }
+    printCodeEntry(entry);
+}
+export function removeCode(id) {
+    if (!deleteStoredCode(id)) {
+        throw new Error(`No code matching "${id}" in local vault.`);
+    }
+    console.log(`Removed ${id} from local vault.`);
+}
+export function openCode(id) {
+    const entry = getStoredCode(id);
+    if (!entry)
+        throw new Error(`No code matching "${id}" in local vault.`);
+    const filePath = entry.files.svg || entry.files.png;
+    if (!filePath)
+        throw new Error("No file on disk for this entry.");
+    const cmds = {
+        darwin: `open "${filePath}"`,
+        win32: `start "" "${filePath}"`,
+        linux: `xdg-open "${filePath}"`,
+    };
+    const cmd = cmds[platform()];
+    if (!cmd) {
+        console.log(filePath);
+        return;
+    }
+    execSync(cmd, { stdio: "ignore" });
+    console.log(`Opened ${filePath}`);
+}
+export async function listSymbologies(creds) {
+    if (!creds.api_key) {
+        return [...DEFAULT_SYMBOLOGIES];
+    }
+    return fetchBarcodeSymbologies(creds);
+}

package/dist/commands-core.d.ts

@@ -0,0 +1,11 @@
+import { AffixApi } from "./api.js";
+import { type AffixCredentials } from "./config.js";
+export declare function ensureAuth(force?: boolean): Promise<AffixCredentials>;
+export declare function runLogin(): Promise<void>;
+export declare function runLogout(): void;
+export declare function runWhoami(creds: AffixCredentials): void;
+export declare function runHealth(api: AffixApi): Promise<void>;
+export declare function runCircuits(api: AffixApi): Promise<void>;
+export declare function runAuthCheck(api: AffixApi): Promise<void>;
+export declare function runProve(api: AffixApi, circuitId: string): Promise<void>;
+export declare function runVerify(api: AffixApi, circuitId: string, proof: string): Promise<void>;

package/dist/commands-core.js

@@ -0,0 +1,55 @@
+import { randomBytes } from "node:crypto";
+import { loginViaHub } from "./auth.js";
+import { clearCredentials, credentialsPath, loadCredentials, } from "./config.js";
+export async function ensureAuth(force = false) {
+    if (!force) {
+        const existing = loadCredentials();
+        if (existing)
+            return existing;
+    }
+    return loginViaHub();
+}
+export async function runLogin() {
+    await loginViaHub();
+    console.log("Signed in. Credentials stored at", credentialsPath());
+}
+export function runLogout() {
+    clearCredentials();
+    console.log("Signed out. Local credentials removed.");
+}
+export function runWhoami(creds) {
+    console.log(JSON.stringify({ email: creds.email, api_base: creds.api_base, activated_at: creds.activated_at }, null, 2));
+}
+export async function runHealth(api) {
+    console.log(JSON.stringify(await api.health(), null, 2));
+}
+export async function runCircuits(api) {
+    console.log(JSON.stringify(await api.circuits(), null, 2));
+}
+export async function runAuthCheck(api) {
+    console.log(JSON.stringify(await api.authCheck(), null, 2));
+}
+export async function runProve(api, circuitId) {
+    const now = Math.floor(Date.now() / 1000);
+    const field = () => "0x" + randomBytes(31).toString("hex");
+    const body = {
+        credential: {
+            schema_id: "cli_demo_v1",
+            issuer_id: "cli",
+            issuer_pubkey_hash: field(),
+            credential_id: field(),
+            claim_value: "local_resident",
+            valid_from: now - 86400,
+            valid_until: now + 31536000,
+            fields: { region: "cli" },
+        },
+        context: {
+            region_hash: "cli",
+            as_of_timestamp: now,
+        },
+    };
+    console.log(JSON.stringify(await api.prove(circuitId, body), null, 2));
+}
+export async function runVerify(api, circuitId, proof) {
+    console.log(JSON.stringify(await api.verify(circuitId, proof), null, 2));
+}

package/dist/commands.d.ts

@@ -0,0 +1,2 @@
+export { ensureAuth, runLogin, runLogout, runWhoami, runHealth, runCircuits, runAuthCheck, runProve, runVerify, } from "./commands-core.js";
+export declare function printUsage(): void;