@codesam/healthsync-cli 1.0.0

package/README.md

@@ -0,0 +1,25 @@
+# HealthSync CLI
+
+HealthSync CLI lets a signed-in iOS user authorize one macOS or Linux terminal
+to read that user's complete HealthSync history.
+
+```bash
+npm install -g @healthsync/cli
+healthsync login
+healthsync auth status
+healthsync health get
+healthsync health get --from 2026-07-01 --to 2026-07-18
+healthsync health export --all --output ./health-data
+healthsync logout
+```
+
+`health get` returns JSON on stdout and defaults to today's data. The terminal
+authorization expires after seven days without any successful authenticated
+CLI request. `logout` revokes the terminal server-side and then removes the
+local credential.
+
+On macOS the device credential is stored in Keychain. On Linux it is stored at
+`~/.config/healthsync/credentials.json` with mode `0600`.
+
+The production server defaults to `https://xiaoyan.life`. Set
+`HEALTHSYNC_SERVER_URL` or pass `--server` to `login` for development.

package/dist/api.d.ts

@@ -0,0 +1,29 @@
+import { cliTokenSignaturePayload } from './crypto.js';
+import type { AuthStatusResponse, HealthDataResponse, LoginExchangeResponse, LoginRequestResponse, StoredCredentials } from './types.js';
+export declare class ApiError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+export declare class NetworkError extends Error {
+    readonly cause?: unknown | undefined;
+    constructor(message: string, cause?: unknown | undefined);
+}
+export declare function isTerminalAuthError(error: unknown): error is ApiError;
+export declare class HealthSyncApi {
+    readonly serverUrl: string;
+    constructor(serverUrl: string);
+    private request;
+    createLoginRequest(input: {
+        deviceName: string;
+        platform: 'macos' | 'linux';
+        publicKey: string;
+        verifierChallenge: string;
+    }): Promise<LoginRequestResponse>;
+    exchangeLoginRequest(requestId: string, verifier: string): Promise<LoginExchangeResponse>;
+    private createAccessToken;
+    authStatus(credentials: StoredCredentials): Promise<AuthStatusResponse>;
+    logout(credentials: StoredCredentials): Promise<void>;
+    getHealth(credentials: StoredCredentials, query: URLSearchParams): Promise<HealthDataResponse>;
+}
+export { cliTokenSignaturePayload };

package/dist/api.js

@@ -0,0 +1,131 @@
+import { cliTokenSignaturePayload, signTokenChallenge, } from './crypto.js';
+export class ApiError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'ApiError';
+    }
+}
+export class NetworkError extends Error {
+    cause;
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = 'NetworkError';
+    }
+}
+const TERMINAL_AUTH_ERROR_CODES = new Set([
+    'ACCOUNT_DISABLED',
+    'CLI_NOT_AUTHENTICATED',
+    'DEVICE_AUTH_EXPIRED',
+    'DEVICE_NOT_FOUND',
+    'DEVICE_REVOKED',
+    'INVALID_CLI_TOKEN',
+    'INVALID_DEVICE_SIGNATURE',
+    'INVALID_TOKEN_CHALLENGE',
+]);
+export function isTerminalAuthError(error) {
+    return error instanceof ApiError && TERMINAL_AUTH_ERROR_CODES.has(error.code);
+}
+function normalizeServerUrl(value) {
+    return value.replace(/\/+$/, '');
+}
+export class HealthSyncApi {
+    serverUrl;
+    constructor(serverUrl) {
+        this.serverUrl = normalizeServerUrl(serverUrl);
+    }
+    async request(path, init = {}, accessToken) {
+        const headers = new Headers(init.headers);
+        headers.set('Accept', 'application/json');
+        if (init.body) {
+            headers.set('Content-Type', 'application/json');
+        }
+        if (accessToken) {
+            headers.set('Authorization', `Bearer ${accessToken}`);
+        }
+        let response;
+        try {
+            response = await fetch(`${this.serverUrl}${path}`, {
+                ...init,
+                headers,
+                signal: AbortSignal.timeout(30_000),
+            });
+        }
+        catch (error) {
+            throw new NetworkError('Unable to reach the HealthSync server', error);
+        }
+        const text = await response.text();
+        let body = {};
+        if (text) {
+            try {
+                body = JSON.parse(text);
+            }
+            catch {
+                body = { error: text };
+            }
+        }
+        if (!response.ok) {
+            const errorBody = body;
+            throw new ApiError(response.status, errorBody.code ?? `HTTP_${response.status}`, errorBody.error ?? `HealthSync server returned HTTP ${response.status}`);
+        }
+        return body;
+    }
+    createLoginRequest(input) {
+        return this.request('/api/cli/auth/requests', {
+            method: 'POST',
+            body: JSON.stringify({
+                device_name: input.deviceName,
+                platform: input.platform,
+                public_key: input.publicKey,
+                verifier_challenge: input.verifierChallenge,
+            }),
+        });
+    }
+    exchangeLoginRequest(requestId, verifier) {
+        return this.request(`/api/cli/auth/requests/${encodeURIComponent(requestId)}/exchange`, {
+            method: 'POST',
+            body: JSON.stringify({ verifier }),
+        });
+    }
+    async createAccessToken(credentials) {
+        const challenge = await this.request('/api/cli/auth/token-challenges', {
+            method: 'POST',
+            body: JSON.stringify({ device_id: credentials.deviceId }),
+        });
+        const signature = signTokenChallenge({
+            privateKey: credentials.privateKey,
+            deviceId: credentials.deviceId,
+            challengeId: challenge.challenge_id,
+            nonce: challenge.nonce,
+        });
+        const token = await this.request('/api/cli/auth/token', {
+            method: 'POST',
+            body: JSON.stringify({
+                device_id: credentials.deviceId,
+                challenge_id: challenge.challenge_id,
+                nonce: challenge.nonce,
+                signature,
+            }),
+        });
+        return token.access_token;
+    }
+    async authStatus(credentials) {
+        const token = await this.createAccessToken(credentials);
+        return this.request('/api/cli/auth/status', {}, token);
+    }
+    async logout(credentials) {
+        const token = await this.createAccessToken(credentials);
+        await this.request('/api/cli/auth/logout', { method: 'POST' }, token);
+    }
+    async getHealth(credentials, query) {
+        const token = await this.createAccessToken(credentials);
+        const suffix = query.size > 0 ? `?${query.toString()}` : '';
+        return this.request(`/api/cli/health${suffix}`, {}, token);
+    }
+}
+export { cliTokenSignaturePayload };
+//# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAWrB,MAAM,OAAO,QAAS,SAAQ,KAAK;IAEf;IACA;IAFlB,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAI5B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,KAAK;IACQ;IAA7C,YAAY,OAAe,EAAkB,KAAe;QAC1D,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,UAAK,GAAL,KAAK,CAAU;QAE1D,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,kBAAkB;IAClB,uBAAuB;IACvB,qBAAqB;IACrB,kBAAkB;IAClB,gBAAgB;IAChB,mBAAmB;IACnB,0BAA0B;IAC1B,yBAAyB;CAC1B,CAAC,CAAC;AAEH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,KAAK,YAAY,QAAQ,IAAI,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,OAAO,aAAa;IACf,SAAS,CAAS;IAE3B,YAAY,SAAiB;QAC3B,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,IAAY,EACZ,OAAoB,EAAE,EACtB,WAAoB;QAEpB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,WAAW,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,EAAE;gBACjD,GAAG,IAAI;gBACP,OAAO;gBACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,YAAY,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,GAAY,EAAE,CAAC;QACvB,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACzB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,IAAyC,CAAC;YAC5D,MAAM,IAAI,QAAQ,CAChB,QAAQ,CAAC,MAAM,EACf,SAAS,CAAC,IAAI,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAC3C,SAAS,CAAC,KAAK,IAAI,mCAAmC,QAAQ,CAAC,MAAM,EAAE,CACxE,CAAC;QACJ,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;IAED,kBAAkB,CAAC,KAKlB;QACC,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,WAAW,EAAE,KAAK,CAAC,UAAU;gBAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,kBAAkB,EAAE,KAAK,CAAC,iBAAiB;aAC5C,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,oBAAoB,CAAC,SAAiB,EAAE,QAAgB;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,0BAA0B,kBAAkB,CAAC,SAAS,CAAC,WAAW,EAAE;YACtF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,WAA8B;QAC5D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAClC,gCAAgC,EAChC;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;SAC1D,CACF,CAAC;QACF,MAAM,SAAS,GAAG,kBAAkB,CAAC;YACnC,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,WAAW,EAAE,SAAS,CAAC,YAAY;YACnC,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAgB,qBAAqB,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,WAAW,CAAC,QAAQ;gBAC/B,YAAY,EAAE,SAAS,CAAC,YAAY;gBACpC,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,SAAS;aACV,CAAC;SACH,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,YAAY,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,WAA8B;QAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,SAAS,CACb,WAA8B,EAC9B,KAAsB;QAEtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,OAAO,EAAE,wBAAwB,EAAE,CAAC"}

package/dist/commands.d.ts

@@ -0,0 +1,17 @@
+export declare const DEFAULT_SERVER_URL = "https://xiaoyan.life";
+export declare class CommandError extends Error {
+    readonly code: string;
+    readonly exitCode: number;
+    constructor(code: string, message: string, exitCode?: number);
+}
+export interface ParsedOptions {
+    values: Map<string, string>;
+    flags: Set<string>;
+}
+export declare function parseOptions(args: string[]): ParsedOptions;
+export declare function loginCommand(args: string[]): Promise<void>;
+export declare function authStatusCommand(): Promise<void>;
+export declare function logoutCommand(): Promise<void>;
+export declare function healthGetCommand(args: string[]): Promise<void>;
+export declare function healthExportCommand(args: string[]): Promise<void>;
+export declare function helpText(): string;

package/dist/commands.js

@@ -0,0 +1,222 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import qrcode from 'qrcode-terminal';
+import { HealthSyncApi, isTerminalAuthError, } from './api.js';
+import { createTerminalKeyPair, createVerifier, sha256Hex, } from './crypto.js';
+import { deleteCredentials, loadCredentials, saveCredentials, } from './credentials.js';
+export const DEFAULT_SERVER_URL = 'https://xiaoyan.life';
+export class CommandError extends Error {
+    code;
+    exitCode;
+    constructor(code, message, exitCode = 3) {
+        super(message);
+        this.code = code;
+        this.exitCode = exitCode;
+        this.name = 'CommandError';
+    }
+}
+export function parseOptions(args) {
+    const values = new Map();
+    const flags = new Set();
+    for (let index = 0; index < args.length; index += 1) {
+        const argument = args[index];
+        if (!argument.startsWith('--')) {
+            throw new CommandError('UNEXPECTED_ARGUMENT', `Unexpected argument: ${argument}`);
+        }
+        const key = argument.slice(2);
+        const next = args[index + 1];
+        if (!next || next.startsWith('--')) {
+            flags.add(key);
+            continue;
+        }
+        values.set(key, next);
+        index += 1;
+    }
+    return { values, flags };
+}
+function supportedPlatform() {
+    if (process.platform === 'darwin')
+        return 'macos';
+    if (process.platform === 'linux')
+        return 'linux';
+    throw new CommandError('UNSUPPORTED_PLATFORM', 'HealthSync CLI currently supports macOS and Linux only');
+}
+function sleep(milliseconds) {
+    return new Promise(resolve => setTimeout(resolve, milliseconds));
+}
+function statusLine(message) {
+    process.stderr.write(`${message}\n`);
+}
+function requireCredentials() {
+    const credentials = loadCredentials();
+    if (!credentials) {
+        throw new CommandError('NOT_AUTHENTICATED', 'HealthSync CLI is not logged in. Run `healthsync login`.', 1);
+    }
+    return credentials;
+}
+export async function loginCommand(args) {
+    const options = parseOptions(args);
+    const platform = supportedPlatform();
+    const serverUrl = options.values.get('server')
+        ?? process.env.HEALTHSYNC_SERVER_URL
+        ?? DEFAULT_SERVER_URL;
+    const existing = loadCredentials();
+    const keyPair = existing && existing.serverUrl === serverUrl
+        ? { publicKey: existing.publicKey, privateKey: existing.privateKey }
+        : createTerminalKeyPair();
+    const deviceName = options.values.get('name') ?? os.hostname();
+    const verifier = createVerifier();
+    const api = new HealthSyncApi(serverUrl);
+    const request = await api.createLoginRequest({
+        deviceName,
+        platform,
+        publicKey: keyPair.publicKey,
+        verifierChallenge: sha256Hex(verifier),
+    });
+    statusLine('请打开 HealthSync App，点击首页右上角的扫码按钮：');
+    qrcode.generate(request.qr_payload, { small: true }, code => {
+        process.stdout.write(`${code}\n`);
+    });
+    statusLine(`二维码将在 ${new Date(request.expires_at).toLocaleTimeString()} 失效，正在等待授权…`);
+    const expiresAt = new Date(request.expires_at).getTime();
+    while (Date.now() < expiresAt) {
+        const result = await api.exchangeLoginRequest(request.request_id, verifier);
+        if (result.status === 'approved') {
+            saveCredentials({
+                version: 1,
+                serverUrl: api.serverUrl,
+                deviceId: result.device.id,
+                deviceName: result.device.name,
+                platform,
+                fingerprint: result.device.fingerprint,
+                publicKey: keyPair.publicKey,
+                privateKey: keyPair.privateKey,
+                authorizedAt: new Date().toISOString(),
+                user: result.user,
+            });
+            process.stdout.write(`${JSON.stringify({
+                authenticated: true,
+                user: result.user,
+                device: result.device,
+            }, null, 2)}\n`);
+            return;
+        }
+        await sleep(request.poll_interval_seconds * 1_000);
+    }
+    throw new CommandError('LOGIN_REQUEST_EXPIRED', 'The QR code expired. Run `healthsync login` to try again.', 1);
+}
+export async function authStatusCommand() {
+    const credentials = loadCredentials();
+    if (!credentials) {
+        process.stdout.write(`${JSON.stringify({
+            authenticated: false,
+            reason: 'not_logged_in',
+        }, null, 2)}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    const api = new HealthSyncApi(credentials.serverUrl);
+    const status = await api.authStatus(credentials);
+    process.stdout.write(`${JSON.stringify(status, null, 2)}\n`);
+}
+export async function logoutCommand() {
+    const credentials = requireCredentials();
+    const api = new HealthSyncApi(credentials.serverUrl);
+    let alreadyInvalid = false;
+    try {
+        await api.logout(credentials);
+    }
+    catch (error) {
+        if (!isTerminalAuthError(error)) {
+            throw error;
+        }
+        alreadyInvalid = true;
+    }
+    deleteCredentials();
+    process.stdout.write(`${JSON.stringify({
+        authenticated: false,
+        revoked: true,
+        already_invalid: alreadyInvalid,
+        local_credentials_deleted: true,
+    }, null, 2)}\n`);
+}
+function healthQueryFromOptions(options) {
+    const date = options.values.get('date');
+    const from = options.values.get('from');
+    const to = options.values.get('to');
+    const all = options.flags.has('all');
+    const datePattern = /^\d{4}-\d{2}-\d{2}$/;
+    if (all && (date || from || to)) {
+        throw new CommandError('INVALID_DATE_RANGE', '--all cannot be combined with date options');
+    }
+    for (const [label, value] of [['date', date], ['from', from], ['to', to]]) {
+        if (value && !datePattern.test(value)) {
+            throw new CommandError('INVALID_DATE', `--${label} must use YYYY-MM-DD`);
+        }
+    }
+    if (date && (from || to)) {
+        throw new CommandError('INVALID_DATE_RANGE', '--date cannot be combined with --from or --to');
+    }
+    if (from && to && from > to) {
+        throw new CommandError('INVALID_DATE_RANGE', '--from must not be after --to');
+    }
+    const query = new URLSearchParams();
+    if (date)
+        query.set('date', date);
+    if (from)
+        query.set('from', from);
+    if (to)
+        query.set('to', to);
+    if (all)
+        query.set('all', 'true');
+    return query;
+}
+async function fetchHealth(options) {
+    const credentials = requireCredentials();
+    const api = new HealthSyncApi(credentials.serverUrl);
+    return api.getHealth(credentials, healthQueryFromOptions(options));
+}
+export async function healthGetCommand(args) {
+    const result = await fetchHealth(parseOptions(args));
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+}
+export async function healthExportCommand(args) {
+    const options = parseOptions(args);
+    const output = options.values.get('output');
+    if (!output) {
+        throw new CommandError('OUTPUT_REQUIRED', 'health export requires --output <directory>');
+    }
+    const result = await fetchHealth(options);
+    const userDirectory = path.resolve(output, result.user.username);
+    fs.mkdirSync(userDirectory, { recursive: true, mode: 0o700 });
+    fs.chmodSync(userDirectory, 0o700);
+    for (const day of result.days) {
+        const filePath = path.join(userDirectory, `${day.date}.json`);
+        fs.writeFileSync(filePath, `${JSON.stringify(day, null, 2)}\n`, {
+            encoding: 'utf8',
+            mode: 0o600,
+        });
+        fs.chmodSync(filePath, 0o600);
+    }
+    process.stdout.write(`${JSON.stringify({
+        exported: result.count,
+        output: userDirectory,
+        user: result.user,
+        last_synced_at: result.last_synced_at,
+    }, null, 2)}\n`);
+}
+export function helpText() {
+    return `HealthSync CLI
+
+Usage:
+  healthsync login [--name <terminal-name>] [--server <url>]
+  healthsync auth status
+  healthsync logout
+  healthsync health get [--date YYYY-MM-DD | --from YYYY-MM-DD --to YYYY-MM-DD | --all]
+  healthsync health export --output <directory> [date options]
+
+Data commands write JSON to stdout. Diagnostics and login guidance use stderr.
+`;
+}
+//# sourceMappingURL=commands.js.map

package/dist/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,EACL,aAAa,EACb,mBAAmB,GACpB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,SAAS,GACV,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAO1B,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAEzD,MAAM,OAAO,YAAa,SAAQ,KAAK;IAEnB;IAEA;IAHlB,YACkB,IAAY,EAC5B,OAAe,EACC,WAAW,CAAC;QAE5B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAQ;QAEZ,aAAQ,GAAR,QAAQ,CAAI;QAG5B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAOD,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,wBAAwB,QAAQ,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtB,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACjD,MAAM,IAAI,YAAY,CACpB,sBAAsB,EACtB,wDAAwD,CACzD,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,YAAoB;IACjC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,mBAAmB,EACnB,0DAA0D,EAC1D,CAAC,CACF,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;WACzC,OAAO,CAAC,GAAG,CAAC,qBAAqB;WACjC,kBAAkB,CAAC;IACxB,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;QAC1D,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE;QACpE,CAAC,CAAC,qBAAqB,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC;QAC3C,UAAU;QACV,QAAQ;QACR,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,iBAAiB,EAAE,SAAS,CAAC,QAAQ,CAAC;KACvC,CAAC,CAAC;IAEH,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAC/C,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,EAAE;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,UAAU,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;IAEpF,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;IACzD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,oBAAoB,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,eAAe,CAAC;gBACd,OAAO,EAAE,CAAC;gBACV,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;gBAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;gBAC9B,QAAQ;gBACR,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW;gBACtC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACtC,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBACrC,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,CAAC,qBAAqB,GAAG,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,IAAI,YAAY,CACpB,uBAAuB,EACvB,2DAA2D,EAC3D,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YACrC,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,eAAe;SACxB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,iBAAiB,EAAE,CAAC;IACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,IAAI;QACb,eAAe,EAAE,cAAc;QAC/B,yBAAyB,EAAE,IAAI;KAChC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAsB;IACpD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,qBAAqB,CAAC;IAE1C,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,4CAA4C,CAAC,CAAC;IAC7F,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAU,EAAE,CAAC;QACnF,IAAI,KAAK,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,KAAK,KAAK,sBAAsB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,+CAA+C,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,+BAA+B,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,IAAI,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClC,IAAI,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClC,IAAI,EAAE;QAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5B,IAAI,GAAG;QAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAsB;IAC/C,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAc;IACnD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAc;IACtD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAEnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;QAC9D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAC9D,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,QAAQ,EAAE,MAAM,CAAC,KAAK;QACtB,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,OAAO;;;;;;;;;;CAUR,CAAC;AACF,CAAC"}

package/dist/commands.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands.test.js

@@ -0,0 +1,40 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { CommandError, parseOptions } from './commands.js';
+import { ApiError, isTerminalAuthError, } from './api.js';
+import { cliTokenSignaturePayload, createTerminalKeyPair, signTokenChallenge, } from './crypto.js';
+import { createPublicKey, verify } from 'node:crypto';
+test('parseOptions separates flags from values', () => {
+    const options = parseOptions([
+        '--from', '2026-07-01',
+        '--to', '2026-07-18',
+        '--all',
+    ]);
+    assert.equal(options.values.get('from'), '2026-07-01');
+    assert.equal(options.values.get('to'), '2026-07-18');
+    assert.equal(options.flags.has('all'), true);
+});
+test('parseOptions rejects positional input', () => {
+    assert.throws(() => parseOptions(['today']), (error) => error instanceof CommandError && error.code === 'UNEXPECTED_ARGUMENT');
+});
+test('authorization failures are reported as logged-out state', () => {
+    assert.equal(isTerminalAuthError(new ApiError(401, 'DEVICE_AUTH_EXPIRED', 'expired')), true);
+    assert.equal(isTerminalAuthError(new ApiError(500, 'INTERNAL_ERROR', 'failed')), false);
+});
+test('terminal signature proves possession of the stored Ed25519 private key', () => {
+    const keyPair = createTerminalKeyPair();
+    const input = {
+        privateKey: keyPair.privateKey,
+        deviceId: 'device-id',
+        challengeId: 'challenge-id',
+        nonce: 'nonce',
+    };
+    const signature = signTokenChallenge(input);
+    const publicKey = createPublicKey({
+        key: Buffer.from(keyPair.publicKey, 'base64'),
+        format: 'der',
+        type: 'spki',
+    });
+    assert.equal(verify(null, Buffer.from(cliTokenSignaturePayload(input.deviceId, input.challengeId, input.nonce)), publicKey, Buffer.from(signature, 'base64')), true);
+});
+//# sourceMappingURL=commands.test.js.map

package/dist/commands.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.test.js","sourceRoot":"","sources":["../src/commands.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,QAAQ,EACR,mBAAmB,GACpB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAEtD,IAAI,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACpD,MAAM,OAAO,GAAG,YAAY,CAAC;QAC3B,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,YAAY;QACpB,OAAO;KACR,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACjD,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,EAC7B,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,CAC1F,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,MAAM,CAAC,KAAK,CACV,mBAAmB,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,qBAAqB,EAAE,SAAS,CAAC,CAAC,EACxE,IAAI,CACL,CAAC;IACF,MAAM,CAAC,KAAK,CACV,mBAAmB,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC,EAClE,KAAK,CACN,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG;QACZ,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,WAAW;QACrB,WAAW,EAAE,cAAc;QAC3B,KAAK,EAAE,OAAO;KACf,CAAC;IACF,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,eAAe,CAAC;QAChC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC;QAC7C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CACV,MAAM,CACJ,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EACrF,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CACjC,EACD,IAAI,CACL,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/credentials.d.ts

@@ -0,0 +1,4 @@
+import type { StoredCredentials } from './types.js';
+export declare function loadCredentials(): StoredCredentials | null;
+export declare function saveCredentials(credentials: StoredCredentials): void;
+export declare function deleteCredentials(): void;

package/dist/credentials.js

@@ -0,0 +1,128 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+const KEYCHAIN_SERVICE = 'life.xiaoyan.healthsync.cli';
+const CONFIG_DIRECTORY = path.join(os.homedir(), '.config', 'healthsync');
+const CREDENTIALS_PATH = path.join(CONFIG_DIRECTORY, 'credentials.json');
+function parseCredentials(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed.version !== 1
+            || !parsed.deviceId
+            || !parsed.privateKey
+            || !parsed.publicKey
+            || !parsed.serverUrl
+            || !parsed.user?.id) {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function keychainAccount() {
+    return os.userInfo().username;
+}
+function loadFromMacKeychain() {
+    try {
+        const raw = execFileSync('security', [
+            'find-generic-password',
+            '-a', keychainAccount(),
+            '-s', KEYCHAIN_SERVICE,
+            '-w',
+        ], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+        return parseCredentials(raw);
+    }
+    catch {
+        return null;
+    }
+}
+function saveToMacKeychain(credentials) {
+    execFileSync('security', [
+        'add-generic-password',
+        '-U',
+        '-a', keychainAccount(),
+        '-s', KEYCHAIN_SERVICE,
+        '-w', JSON.stringify(credentials),
+    ], {
+        stdio: ['ignore', 'ignore', 'pipe'],
+    });
+}
+function deleteFromMacKeychain() {
+    try {
+        execFileSync('security', [
+            'delete-generic-password',
+            '-a', keychainAccount(),
+            '-s', KEYCHAIN_SERVICE,
+        ], {
+            stdio: ['ignore', 'ignore', 'ignore'],
+        });
+    }
+    catch {
+        // Deleting an already absent credential is idempotent.
+    }
+}
+function loadFromLinuxFile() {
+    try {
+        return parseCredentials(fs.readFileSync(CREDENTIALS_PATH, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function saveToLinuxFile(credentials) {
+    fs.mkdirSync(CONFIG_DIRECTORY, { recursive: true, mode: 0o700 });
+    fs.chmodSync(CONFIG_DIRECTORY, 0o700);
+    fs.writeFileSync(CREDENTIALS_PATH, JSON.stringify(credentials, null, 2), {
+        encoding: 'utf8',
+        mode: 0o600,
+    });
+    fs.chmodSync(CREDENTIALS_PATH, 0o600);
+}
+function deleteFromLinuxFile() {
+    try {
+        fs.unlinkSync(CREDENTIALS_PATH);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            throw error;
+        }
+    }
+}
+export function loadCredentials() {
+    if (process.platform === 'darwin') {
+        return loadFromMacKeychain();
+    }
+    if (process.platform === 'linux') {
+        return loadFromLinuxFile();
+    }
+    return null;
+}
+export function saveCredentials(credentials) {
+    if (process.platform === 'darwin') {
+        saveToMacKeychain(credentials);
+        return;
+    }
+    if (process.platform === 'linux') {
+        saveToLinuxFile(credentials);
+        return;
+    }
+    throw new Error(`Unsupported platform: ${process.platform}`);
+}
+export function deleteCredentials() {
+    if (process.platform === 'darwin') {
+        deleteFromMacKeychain();
+        return;
+    }
+    if (process.platform === 'linux') {
+        deleteFromLinuxFile();
+        return;
+    }
+    throw new Error(`Unsupported platform: ${process.platform}`);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAC1E,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;AAEzE,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;QACpD,IACE,MAAM,CAAC,OAAO,KAAK,CAAC;eACjB,CAAC,MAAM,CAAC,QAAQ;eAChB,CAAC,MAAM,CAAC,UAAU;eAClB,CAAC,MAAM,CAAC,SAAS;eACjB,CAAC,MAAM,CAAC,SAAS;eACjB,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EACnB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC;AAChC,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE;YACnC,uBAAuB;YACvB,IAAI,EAAE,eAAe,EAAE;YACvB,IAAI,EAAE,gBAAgB;YACtB,IAAI;SACL,EAAE;YACD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,WAA8B;IACvD,YAAY,CAAC,UAAU,EAAE;QACvB,sBAAsB;QACtB,IAAI;QACJ,IAAI,EAAE,eAAe,EAAE;QACvB,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;KAClC,EAAE;QACD,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;KACpC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB;IAC5B,IAAI,CAAC;QACH,YAAY,CAAC,UAAU,EAAE;YACvB,yBAAyB;YACzB,IAAI,EAAE,eAAe,EAAE;YACvB,IAAI,EAAE,gBAAgB;SACvB,EAAE;YACD,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,WAA8B;IACrD,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACtC,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACvE,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,iBAAiB,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,WAA8B;IAC5D,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC/B,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,qBAAqB,EAAE,CAAC;QACxB,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,mBAAmB,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC/D,CAAC"}

package/dist/crypto.d.ts

@@ -0,0 +1,13 @@
+export declare function sha256Hex(value: string | Buffer): string;
+export declare function createVerifier(): string;
+export declare function createTerminalKeyPair(): {
+    publicKey: string;
+    privateKey: string;
+};
+export declare function cliTokenSignaturePayload(deviceId: string, challengeId: string, nonce: string): string;
+export declare function signTokenChallenge(input: {
+    privateKey: string;
+    deviceId: string;
+    challengeId: string;
+    nonce: string;
+}): string;

package/dist/crypto.js

@@ -0,0 +1,26 @@
+import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, sign, } from 'node:crypto';
+export function sha256Hex(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+export function createVerifier() {
+    return randomBytes(32).toString('base64url');
+}
+export function createTerminalKeyPair() {
+    const { publicKey, privateKey } = generateKeyPairSync('ed25519');
+    return {
+        publicKey: publicKey.export({ format: 'der', type: 'spki' }).toString('base64'),
+        privateKey: privateKey.export({ format: 'der', type: 'pkcs8' }).toString('base64'),
+    };
+}
+export function cliTokenSignaturePayload(deviceId, challengeId, nonce) {
+    return ['healthsync-cli-token', 'v1', deviceId, challengeId, nonce].join('\n');
+}
+export function signTokenChallenge(input) {
+    const privateKey = createPrivateKey({
+        key: Buffer.from(input.privateKey, 'base64'),
+        format: 'der',
+        type: 'pkcs8',
+    });
+    return sign(null, Buffer.from(cliTokenSignaturePayload(input.deviceId, input.challengeId, input.nonce)), privateKey).toString('base64');
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,IAAI,GACL,MAAM,aAAa,CAAC;AAErB,MAAM,UAAU,SAAS,CAAC,KAAsB;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,qBAAqB;IAInC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/E,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACnF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,WAAmB,EACnB,KAAa;IAEb,OAAO,CAAC,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAKlC;IACC,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC;QAC5C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,OAAO,IAAI,CACT,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EACrF,UAAU,CACX,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+import { ApiError, isTerminalAuthError, NetworkError, } from './api.js';
+import { authStatusCommand, CommandError, healthExportCommand, healthGetCommand, helpText, loginCommand, logoutCommand, } from './commands.js';
+async function main(args) {
+    const [command, subcommand, ...rest] = args;
+    if (!command || command === 'help' || command === '--help' || command === '-h') {
+        process.stdout.write(helpText());
+        return;
+    }
+    if (command === 'login') {
+        await loginCommand([subcommand, ...rest].filter(Boolean));
+        return;
+    }
+    if (command === 'logout') {
+        if (subcommand) {
+            throw new CommandError('UNEXPECTED_ARGUMENT', `Unexpected argument: ${subcommand}`);
+        }
+        await logoutCommand();
+        return;
+    }
+    if ((command === 'auth' && subcommand === 'status') || command === 'status') {
+        await authStatusCommand();
+        return;
+    }
+    if (command === 'health' && subcommand === 'get') {
+        await healthGetCommand(rest);
+        return;
+    }
+    if (command === 'health' && subcommand === 'export') {
+        await healthExportCommand(rest);
+        return;
+    }
+    throw new CommandError('UNKNOWN_COMMAND', `Unknown command: ${[command, subcommand].filter(Boolean).join(' ')}`);
+}
+main(process.argv.slice(2)).catch(error => {
+    if (error instanceof ApiError) {
+        process.stderr.write(`${JSON.stringify({
+            error: {
+                code: error.code,
+                message: error.message,
+            },
+            authenticated: isTerminalAuthError(error) ? false : undefined,
+        })}\n`);
+        process.exitCode = isTerminalAuthError(error) ? 1 : 3;
+        return;
+    }
+    if (error instanceof NetworkError) {
+        process.stderr.write(`${JSON.stringify({
+            error: {
+                code: 'NETWORK_ERROR',
+                message: error.message,
+            },
+            authenticated: 'unknown',
+        })}\n`);
+        process.exitCode = 2;
+        return;
+    }
+    if (error instanceof CommandError) {
+        process.stderr.write(`${JSON.stringify({
+            error: {
+                code: error.code,
+                message: error.message,
+            },
+        })}\n`);
+        process.exitCode = error.exitCode;
+        return;
+    }
+    process.stderr.write(`${JSON.stringify({
+        error: {
+            code: 'INTERNAL_ERROR',
+            message: error instanceof Error ? error.message : 'Unknown error',
+        },
+    })}\n`);
+    process.exitCode = 3;
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,YAAY,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,QAAQ,EACR,YAAY,EACZ,aAAa,GACd,MAAM,eAAe,CAAC;AAEvB,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5C,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,YAAY,CAAC,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,wBAAwB,UAAU,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,aAAa,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,OAAO,KAAK,MAAM,IAAI,UAAU,KAAK,QAAQ,CAAC,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5E,MAAM,iBAAiB,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;QACjD,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACnH,CAAC;AAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;IACxC,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YACrC,KAAK,EAAE;gBACL,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB;YACD,aAAa,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC9D,CAAC,IAAI,CAAC,CAAC;QACR,OAAO,CAAC,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YACrC,KAAK,EAAE;gBACL,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB;YACD,aAAa,EAAE,SAAS;SACzB,CAAC,IAAI,CAAC,CAAC;QACR,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YACrC,KAAK,EAAE;gBACL,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB;SACF,CAAC,IAAI,CAAC,CAAC;QACR,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAClC,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,KAAK,EAAE;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAClE;KACF,CAAC,IAAI,CAAC,CAAC;IACR,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,78 @@
+export type SupportedPlatform = 'macos' | 'linux';
+export interface StoredCredentials {
+    version: 1;
+    serverUrl: string;
+    deviceId: string;
+    deviceName: string;
+    platform: SupportedPlatform;
+    fingerprint: string;
+    publicKey: string;
+    privateKey: string;
+    authorizedAt: string;
+    user: {
+        id: string;
+        username: string;
+    };
+}
+export interface LoginRequestResponse {
+    request_id: string;
+    qr_payload: string;
+    expires_at: string;
+    poll_interval_seconds: number;
+}
+export type LoginExchangeResponse = {
+    status: 'pending';
+} | {
+    status: 'approved';
+    device: {
+        id: string;
+        name: string;
+        platform: SupportedPlatform;
+        fingerprint: string;
+    };
+    user: {
+        id: string;
+        username: string;
+    };
+};
+export interface TokenChallengeResponse {
+    challenge_id: string;
+    nonce: string;
+    expires_at: string;
+}
+export interface TokenResponse {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+}
+export interface AuthStatusResponse {
+    authenticated: true;
+    user: {
+        id: string;
+        username: string;
+    };
+    device: {
+        id: string;
+        name: string;
+        platform: SupportedPlatform;
+        fingerprint: string;
+        expires_at: string;
+    };
+}
+export interface HealthDataResponse {
+    schema_version: number;
+    user: {
+        id: string;
+        username: string;
+    };
+    range: {
+        from: string | null;
+        to: string | null;
+        all: boolean;
+    };
+    last_synced_at: string | null;
+    count: number;
+    days: Array<Record<string, unknown> & {
+        date: string;
+    }>;
+}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "@codesam/healthsync-cli",
+  "version": "1.0.0",
+  "description": "Device-authorized CLI for reading HealthSync records",
+  "type": "module",
+  "bin": {
+    "healthsync": "dist/index.js"
+  },
+  "main": "dist/index.js",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx src/index.ts",
+    "test": "node --import tsx --test src/*.test.ts"
+  },
+  "dependencies": {
+    "qrcode-terminal": "^0.12.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.9.0",
+    "@types/qrcode-terminal": "^0.12.2",
+    "tsx": "^4.19.2",
+    "typescript": "^5.6.3"
+  }
+}