@blod-nm/1kuan-act-01-cli 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,69 @@
-# Temporary Holding Version
+# @blod-nm/1kuan-act-01-cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Internal operations CLI: invoke preset database functions through a gateway. Zero dependencies, MCP (stdio) support, single-file executable.
+
+## Install
+
+```bash
+npm i -g @blod-nm/1kuan-act-01-cli
+# or run without installing
+npx @blod-nm/1kuan-act-01-cli --help
+```
+
+Requires Node >= 18. Zero runtime dependencies.
+
+## Configuration
+
+```bash
+act-01 config set envId <env-id>
+echo "secret" | act-01 config set apiKey --stdin
+act-01 config test
+```
+
+Stored at `~/.config/act-01/config.json` (0600, atomic write). `apiKey` can also come from the `ACT01_API_KEY` environment variable. Never pass it as a CLI argument.
+
+No local config? Generate a transfer string with the bundled [config helper](./config-helper.html) (runs locally in the browser), then:
+
+```bash
+act-01 config import "act01w.v1.xxxx"   # prompts for the passphrase used at generation
+```
+
+Transfer strings are AES-256-GCM encrypted; the passphrase never travels with the string.
+
+## Operations
+
+```bash
+act-01 create --mode random --total 10000 --count 50 --per-user 2 --min 100 --max 500
+```
+
+- Amounts are integer units, no conversion
+- Pre-flight balance check runs before execution; insufficient balance is rejected locally
+- Interactive confirm card lists every parameter before the atomic database function call
+- `--dry-run` prints the function call without executing; `--json` for machine output
+
+## MCP (AI client integration)
+
+```bash
+act-01 mcp
+# register with a client, e.g.
+claude mcp add act-01 -- act-01 mcp
+```
+
+Exposes tools for the operations above. Side-effecting tools are subject to client-side approval; secrets never enter the tool context.
+
+## Security model
+
+- The API key equals database admin: stored 0600, env var / stdin / encrypted transfer string only — never as a CLI argument
+- Record lifecycle is TTL-driven; global invalidation = rotate the credentials
+- Failed pre-flight or database checks exit non-zero with a human-readable reason and hint
+
+## Package an executable (optional)
+
+```bash
+bun run build:bin        # single-file for current platform
+bun run build:bin:all    # linux/darwin/windows
+```
+
+## License
+
+MIT

package/bin/act-01.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { main } from '../src/main.js'
+
+// 标记"真命令行直跑":向导式补齐只在这种场景出现
+// (测试/程序内调用 main() 时不设,缺参一律走确定性报错)
+process.env.ACT01_CLI_INVOKED = '1'
+
+process.exit(await main(process.argv.slice(2)))

package/config-helper.html

@@ -0,0 +1,220 @@
+<!doctype html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>act-01 配置串生成器</title>
+<style>
+  :root { color-scheme: light dark; }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0; padding: 24px;
+    font: 15px/1.65 -apple-system, 'PingFang SC', 'Microsoft YaHei', system-ui, sans-serif;
+    background: light-dark(#f6f4ef, #17151f); color: light-dark(#262233, #e8e5f0);
+    font-variant-numeric: tabular-nums; -webkit-font-smoothing: antialiased;
+  }
+  .wrap { max-width: 640px; margin: 0 auto; display: grid; gap: 20px; }
+  h1 { font-size: 20px; margin: 0 0 4px; letter-spacing: -0.01em; }
+  .sub { color: light-dark(#7a7490, #9a94b0); font-size: 13px; margin: 0; }
+  .card {
+    border: 2px solid light-dark(#413a5e, #cbc5e0); border-radius: 16px;
+    padding: 20px; background: light-dark(#fffdf8, #201d2b);
+    box-shadow: 5px 5px 0 light-dark(#413a5e, #0c0a12);
+  }
+  .card h2 { font-size: 15px; margin: 0 0 12px; }
+  label { display: block; font-size: 13px; font-weight: 600; margin: 0 0 4px; }
+  label .opt { font-weight: 400; opacity: .65; }
+  input[type=text], input[type=password] {
+    width: 100%; padding: 9px 12px; font: inherit; font-size: 14px;
+    border: 2px solid light-dark(#413a5e, #cbc5e0); border-radius: 10px;
+    background: light-dark(#fff, #262233); color: inherit; margin-bottom: 12px;
+  }
+  input:focus { outline: 2px solid light-dark(#7c5cff, #a78bfa); outline-offset: 1px; }
+  button {
+    padding: 9px 18px; font: inherit; font-size: 14px; font-weight: 600;
+    border: 2px solid light-dark(#413a5e, #cbc5e0); border-radius: 999px;
+    background: light-dark(#7c5cff, #a78bfa); color: light-dark(#fff, #1a1526);
+    box-shadow: 3px 3px 0 light-dark(#413a5e, #0c0a12); cursor: pointer;
+    transition: transform 120ms cubic-bezier(0.34,1.56,0.64,1), box-shadow 120ms;
+  }
+  button:active { transform: translate(2px,2px); box-shadow: 1px 1px 0 light-dark(#413a5e, #0c0a12); }
+  button.ghost { background: transparent; color: inherit; }
+  .out {
+    font-family: ui-monospace, 'SF Mono', Menlo, monospace; font-size: 12px;
+    word-break: break-all; padding: 10px 12px; border-radius: 10px;
+    background: light-dark(#fff, #262233);
+    border: 2px solid light-dark(#413a5e, #cbc5e0); min-height: 42px; white-space: pre-wrap;
+  }
+  .row { display: flex; gap: 10px; align-items: center; }
+  .row input { flex: 1; margin-bottom: 0; }
+  .hint { font-size: 12px; opacity: .65; margin: 6px 0 0; }
+  .err { color: light-dark(#c2334d, #ff8fa3); font-size: 13px; margin: 8px 0 0; }
+  .ok { color: light-dark(#0a7d55, #4ade80); font-size: 13px; margin: 8px 0 0; }
+  code {
+    font-family: ui-monospace, Menlo, monospace; font-size: 12px;
+    background: light-dark(#efece3, #262233); padding: 2px 6px; border-radius: 6px;
+  }
+  .toggle { display: flex; gap: 14px; font-size: 13px; margin-bottom: 12px; }
+</style>
+</head>
+<body>
+<div class="wrap">
+  <header>
+    <h1>🔑 act-01 配置串生成器</h1>
+    <p class="sub">填入云开发原始配置 → 生成加密传递串。全本地计算,无网络请求,无任何存储。</p>
+  </header>
+
+  <div class="card">
+    <h2>① 填入原始配置</h2>
+    <label>envId(环境 ID)</label>
+    <input id="envId" type="text" placeholder="cloud1-xxxxxx" autocomplete="off">
+
+    <label>apiKey(腾讯云开发 API Key,需管理员权限)</label>
+    <input id="apiKey" type="password" placeholder="act- 开头或平台管理生成" autocomplete="off">
+
+    <label>口令 <span class="opt">— 加密用,导入端必须输入同一个;不含在配置串里</span></label>
+    <div class="row">
+      <input id="pass" type="password" placeholder="自己定一个,别用弱口令" autocomplete="new-password">
+      <button class="ghost" id="genPass">随机生成</button>
+    </div>
+
+    <div class="toggle">
+      <label style="margin:0;font-weight:400"><input type="radio" name="mode" value="enc" checked> 加密串(需口令解密,推荐)</label>
+      <label style="margin:0;font-weight:400"><input type="radio" name="mode" value="plain"> 明文串(便捷,可读)</label>
+    </div>
+
+    <button id="gen">生成配置串</button>
+    <p class="err" id="err" hidden></p>
+  </div>
+
+  <div class="card" id="outCard" hidden>
+    <h2>② 配置串(复制发出去)</h2>
+    <div class="out" id="out"></div>
+    <div class="row" style="margin-top:10px">
+      <button id="copy">复制</button>
+      <span class="hint" style="align-self:center">目标机器执行:<code>act-01 config import --stdin &lt; 串文件</code>(口令会提示输入)</span>
+    </div>
+  </div>
+
+  <div class="card">
+    <h2>③ 校验(可选)</h2>
+    <label>粘贴配置串</label>
+    <input id="vStr" type="text" autocomplete="off" class="mono-out">
+    <label>口令</label>
+    <input id="vPass" type="password" autocomplete="off">
+    <button class="ghost" id="verify">解密校验</button>
+    <p class="err" id="vErr" hidden></p>
+    <p class="ok" id="vOk" hidden></p>
+  </div>
+</div>
+
+<script>
+const $ = (id) => document.getElementById(id)
+const enc = new TextEncoder()
+
+function b64url(bytes) {
+  let bin = ''
+  for (const b of bytes) bin += String.fromCharCode(b)
+  return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
+}
+
+function b64urlDecode(text) {
+  const bin = atob(text.replace(/-/g, '+').replace(/_/g, '/'))
+  return Uint8Array.from(bin, (c) => c.charCodeAt(0))
+}
+
+async function deriveKey(pass, salt) {
+  const km = await crypto.subtle.importKey('raw', enc.encode(pass), 'PBKDF2', false, ['deriveKey'])
+  return crypto.subtle.deriveKey(
+    { name: 'PBKDF2', salt, iterations: 310_000, hash: 'SHA-256' },
+    km, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt'],
+  )
+}
+
+async function encryptWeb(obj, pass) {
+  const salt = crypto.getRandomValues(new Uint8Array(16))
+  const iv = crypto.getRandomValues(new Uint8Array(12))
+  const key = await deriveKey(pass, salt)
+  const ct = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, enc.encode(JSON.stringify(obj))))
+  const packed = new Uint8Array(salt.length + iv.length + ct.length)
+  packed.set(salt, 0); packed.set(iv, salt.length); packed.set(ct, salt.length + iv.length)
+  return 'act01w.v1.' + b64url(packed)
+}
+
+async function decryptWeb(str, pass) {
+  const body = str.trim()
+  const data = b64urlDecode(body.slice(body.indexOf('.') + 1))
+  if (data.length < 44) throw new Error('配置串过短或已损坏')
+  const salt = data.slice(0, 16)
+  const iv = data.slice(16, 28)
+  const rest = data.slice(28)
+  const key = await deriveKey(pass, salt)
+  const pt = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, rest.slice(0, rest.length - 16))
+  return JSON.parse(new TextDecoder().decode(pt))
+}
+
+function collect() {
+  const envId = $('envId').value.trim()
+  const apiKey = $('apiKey').value.trim()
+  const pass = $('pass').value
+  if (!envId) throw new Error('envId 未填写')
+  if (!apiKey) throw new Error('apiKey 未填写')
+  if ($('pass').value && pass.length < 8) throw new Error('口令至少 8 位')
+  return { config: { envId, apiKey }, pass }
+}
+
+function showErr(id, msg) {
+  const el = $(id); el.hidden = !msg; el.textContent = msg || ''
+}
+
+$('genPass').addEventListener('click', () => {
+  const bytes = crypto.getRandomValues(new Uint8Array(18))
+  let bin = ''; for (const b of bytes) bin += String.fromCharCode(b)
+  $('pass').value = btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
+})
+
+$('gen').addEventListener('click', async () => {
+  showErr('err', '')
+  $('outCard').hidden = true
+  try {
+    const { config, pass } = collect()
+    const mode = document.querySelector('input[name=mode]:checked').value
+    let out
+    if (mode === 'enc') {
+      if (!pass) throw new Error('加密模式需要口令')
+      out = await encryptWeb(config, pass)
+    } else {
+      out = 'act01plain.' + b64url(enc.encode(JSON.stringify(config)))
+    }
+    $('out').textContent = out
+    $('outCard').hidden = false
+  } catch (e) {
+    showErr('err', e.message)
+  }
+})
+
+$('copy').addEventListener('click', async () => {
+  await navigator.clipboard.writeText($('out').textContent)
+  $('copy').textContent = '已复制 ✓'
+  setTimeout(() => ($('copy').textContent = '复制'), 1200)
+})
+
+$('verify').addEventListener('click', async () => {
+  showErr('vErr', ''); $('vOk').hidden = true
+  try {
+    const str = $('vStr').value.trim()
+    const pass = $('vPass').value
+    let cfg
+    if (str.startsWith('act01w.v1.')) cfg = await decryptWeb(str, pass)
+    else if (str.startsWith('act01.v1.')) throw new Error('这是 CLI scrypt 格式串,请用 act-01 CLI 解')
+    else if (str.startsWith('act01plain.')) cfg = JSON.parse(atob(str.slice('act01plain.'.length).replace(/-/g,'+').replace(/_/g,'/')))
+    else throw new Error('无法识别的串格式')
+    $('vOk').hidden = false
+    $('vOk').textContent = `✓ 解密成功:envId=${cfg.envId},apiKey=${cfg.apiKey.slice(0, 6)}…(不回显全文)`
+  } catch (e) {
+    showErr('vErr', e.message)
+  }
+})
+</script>
+</body>
+</html>

package/package.json

@@ -1,6 +1,40 @@
 {
   "name": "@blod-nm/1kuan-act-01-cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Internal operations CLI: invoke preset database functions via a gateway. Zero dependencies, MCP (stdio) support.",
+  "license": "MIT",
+  "bin": {
+    "act-01": "bin/act-01.js"
+  },
+  "main": "./src/main.js",
+  "exports": {
+    ".": "./src/main.js"
+  },
+  "files": [
+    "bin",
+    "src",
+    "config-helper.html",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "bun test test/",
+    "build:js": "bun build --target=node --minify bin/act-01.js --outfile dist/act-01.js",
+    "build:bin": "bun build --compile --minify bin/act-01.js --outfile dist/act-01",
+    "build:bin:all": "bun run build:bin -- --target=bun-linux-x64 --outfile dist/act-01-linux-x64 && bun run build:bin -- --target=bun-linux-arm64 --outfile dist/act-01-linux-arm64 && bun run build:bin -- --target=bun-darwin-arm64 --outfile dist/act-01-darwin-arm64 && bun run build:bin -- --target=bun-darwin-x64 --outfile dist/act-01-darwin-x64 && bun run build:bin -- --target=bun-windows-x64 --outfile dist/act-01-windows-x64.exe",
+    "build": "bun run build:js && bun run build:bin",
+    "build:all": "bun run build:js && bun run build:bin:all"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "cli",
+    "mcp",
+    "internal"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  }
+}