@dayofweek/dcli 1.2.0 → 1.4.0

package/dist/client.d.ts

@@ -4,7 +4,9 @@
  */
 export declare class ApiError extends Error {
     status: number;
-    constructor(status: number, message: string);
+    code?: string | undefined;
+    requestId?: string | undefined;
+    constructor(status: number, message: string, code?: string | undefined, requestId?: string | undefined);
 }
 export declare class DayOfWeekClient {
     private baseUrl;
@@ -13,6 +15,7 @@ export declare class DayOfWeekClient {
     checkAuth(): Promise<{
         status: string;
         authenticated: boolean;
+        isAdmin?: boolean;
     }>;
     listDevices(): Promise<Array<{
         _id: string;
@@ -27,6 +30,75 @@ export declare class DayOfWeekClient {
     revokeDevice(deviceId: string): Promise<{
         success: boolean;
     }>;
+    revokeCurrentDevice(): Promise<{
+        revoked: true;
+    }>;
+    brainBootstrap(): Promise<{
+        authenticated: true;
+        scopes: string[];
+        entitled: boolean;
+        areas: BrainArea[];
+        defaultAreaId?: string;
+    }>;
+    listBrainAreas(): Promise<BrainArea[]>;
+    companyBrainStatus(): Promise<{
+        eligible: boolean;
+        canEnsure: boolean;
+        entityName?: string;
+        existingArea: BrainArea | null;
+    }>;
+    ensureCompanyBrain(): Promise<BrainArea>;
+    resolveBrain(uri: string): Promise<BrainResolvedResource>;
+    getBrainNote(id: string): Promise<BrainNote>;
+    getBrainSource(id: string): Promise<BrainSource>;
+    uploadBrainSource(input: {
+        areaId: string;
+        path: string;
+        mimeType: string;
+        isMeeting: boolean;
+        consentAcknowledged: boolean;
+    }): Promise<{
+        sourceId: string;
+        uri: string;
+        httpsUrl: string;
+        filename: string;
+        byteSize: number;
+        sha256: string;
+        scanState: "pending" | "clean";
+        processingState: string;
+    }>;
+    downloadBrainSource(input: {
+        sourceId: string;
+        outputPath: string;
+        expectedSha256?: string;
+        overwrite?: boolean;
+    }): Promise<{
+        outputPath: string;
+        byteSize: number;
+        sha256: string;
+    }>;
+    searchBrain(query: string, options?: {
+        areaId?: string;
+        limit?: number;
+    }): Promise<unknown>;
+    shareBrainNote(input: {
+        areaId: string;
+        title: string;
+        markdown: string;
+        sourceName?: string;
+        intent: "interactive" | "autonomous";
+    }): Promise<BrainNote>;
+    updateBrainNote(id: string, input: {
+        title?: string;
+        markdown: string;
+        expectedVersion: number;
+    }): Promise<BrainNote>;
+    archiveBrainNote(id: string, expectedVersion: number): Promise<BrainNote>;
+    restoreBrainNote(id: string, expectedVersion: number): Promise<BrainNote>;
+    listBrainAudit(areaId: string, options?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<unknown>;
     listEntities(opts?: {
         type?: string;
         parent?: string;
@@ -57,20 +129,108 @@ export declare class DayOfWeekClient {
     getProposal(proposalId: string): Promise<any>;
     submitProposal(proposal: Record<string, unknown>): Promise<any>;
     submitBatch(batch: {
+        org?: string;
         batchLabel: string;
         sourceAgent?: string;
         proposals: any[];
     }): Promise<any>;
-    getSkillBundle(): Promise<{
+    adminListEntities(opts?: {
+        org?: string;
+        type?: string;
+        missingLocation?: boolean;
+        search?: string;
+        limit?: number;
+    }): Promise<{
+        results: any[];
+        truncated: boolean;
+        total: number;
+    }>;
+    adminListProposals(opts?: {
+        status?: string;
+        sourceAgent?: string;
+        limit?: number;
+    }): Promise<{
+        results: any[];
+        truncated: boolean;
+        total: number;
+    }>;
+    getSkillBundle(name?: string): Promise<{
         name: string;
         version: string;
+        hash?: string;
         files: Array<{
             path: string;
             content: string;
+            sha256?: string;
         }>;
     }>;
+    listSkillBundles(): Promise<Array<{
+        name: string;
+        version: string;
+        hash: string;
+    }>>;
     getSchema(): Promise<any>;
     private get;
     private post;
+    private patch;
     private delete;
+    private request;
 }
+export type BrainArea = {
+    id: string;
+    name: string;
+    kind: "company" | "project";
+    role: "owner" | "editor" | "viewer";
+    canWrite: boolean;
+    canManage: boolean;
+    uri: string;
+    httpsUrl: string;
+    updatedAt: number;
+};
+export type BrainNote = {
+    id: string;
+    areaId: string;
+    areaName: string;
+    title: string;
+    markdown: string;
+    status: string;
+    version: number;
+    hash?: string;
+    sourceId?: string;
+    sourceUri?: string;
+    uri: string;
+    httpsUrl: string;
+    createdAt: number;
+    updatedAt: number;
+};
+export type BrainSource = {
+    id: string;
+    areaId: string;
+    areaName: string;
+    kind: "text" | "audio" | "file";
+    filename?: string;
+    mimeType?: string;
+    byteSize?: number;
+    sha256?: string;
+    scanState?: "pending" | "clean" | "quarantined" | "failed";
+    processingState: string;
+    rawText?: string;
+    extractedText?: string;
+    transcript?: string;
+    isMeeting: boolean;
+    derivedNoteUri?: string;
+    canDownload: boolean;
+    uri: string;
+    httpsUrl: string;
+    uploadedAt: number;
+};
+export type BrainResolvedResource = {
+    resourceType: "area";
+    area: BrainArea;
+} | {
+    resourceType: "note";
+    note: BrainNote;
+} | {
+    resourceType: "source";
+    source: BrainSource;
+};

package/dist/client.js

@@ -2,12 +2,21 @@
  * HTTP client for the Day of Week platform REST API.
  * All calls go through the proxy at field.dayofweek.com/app/api/dcli.
  */
+import { createHash, randomUUID } from "node:crypto";
+import { createReadStream, createWriteStream, existsSync, fsyncSync, linkSync, openSync, closeSync, renameSync, statSync, unlinkSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
 const DEFAULT_BASE_URL = "https://field.dayofweek.com/app/api/dcli";
 export class ApiError extends Error {
     status;
-    constructor(status, message) {
+    code;
+    requestId;
+    constructor(status, message, code, requestId) {
         super(message);
         this.status = status;
+        this.code = code;
+        this.requestId = requestId;
         this.name = "ApiError";
     }
 }
@@ -31,6 +40,145 @@ export class DayOfWeekClient {
     async revokeDevice(deviceId) {
         return this.delete(`/auth/devices/${deviceId}`);
     }
+    async revokeCurrentDevice() {
+        return this.delete("/auth/current-device");
+    }
+    // ── Shared brain ─────────────────────────────────────────────────────────
+    async brainBootstrap() {
+        return this.get("/brain/bootstrap");
+    }
+    async listBrainAreas() {
+        return this.get("/brain/areas");
+    }
+    async companyBrainStatus() {
+        return this.get("/brain/company-area");
+    }
+    async ensureCompanyBrain() {
+        return this.post("/brain/company-area", {});
+    }
+    async resolveBrain(uri) {
+        return this.get(`/brain/resolve?uri=${encodeURIComponent(uri)}`);
+    }
+    async getBrainNote(id) {
+        return this.get(`/brain/notes/${encodeURIComponent(id)}`);
+    }
+    async getBrainSource(id) {
+        return this.get(`/brain/sources/${encodeURIComponent(id)}`);
+    }
+    async uploadBrainSource(input) {
+        const info = statSync(input.path);
+        if (!info.isFile())
+            throw new Error("Upload path is not a regular file");
+        const sha256 = await hashFile(input.path);
+        const idempotencyKey = `up_${createHash("sha256")
+            .update(`${input.areaId}:${sha256}:${input.isMeeting}`)
+            .digest("base64url")}`;
+        const session = await this.post("/brain/source-uploads", {
+            areaId: input.areaId,
+            filename: basename(input.path),
+            mimeType: input.mimeType,
+            byteSize: info.size,
+            sha256,
+            isMeeting: input.isMeeting,
+            consentAcknowledged: input.consentAcknowledged,
+            idempotencyKey,
+        });
+        const upload = await fetch(session.uploadUrl, {
+            method: "POST",
+            headers: { "Content-Type": input.mimeType },
+            body: createReadStream(input.path),
+            duplex: "half",
+        });
+        if (!upload.ok)
+            throw new ApiError(upload.status, "Source byte upload failed", "network_error");
+        const stored = await upload.json();
+        if (!stored.storageId)
+            throw new Error("Upload did not return a storage ID");
+        const completed = await this.post(`/brain/source-uploads/${encodeURIComponent(session.uploadId)}/complete`, {
+            storageId: stored.storageId,
+        });
+        if (completed.sha256 !== sha256)
+            throw new Error("Server checksum does not match the uploaded file");
+        return completed;
+    }
+    async downloadBrainSource(input) {
+        if (!input.overwrite && existsSync(input.outputPath))
+            throw new Error("Output already exists; use --overwrite");
+        const response = await fetch(`${this.baseUrl}/brain/sources/${encodeURIComponent(input.sourceId)}/download`, {
+            headers: { Authorization: `Bearer ${this.token}` },
+        });
+        if (!response.ok)
+            throw await apiErrorFromResponse(response);
+        if (!response.body)
+            throw new Error("Download response had no body");
+        const expected = response.headers.get("x-dayofweek-sha256") ?? input.expectedSha256;
+        if (!expected || !/^[a-f0-9]{64}$/.test(expected))
+            throw new Error("Download response omitted its checksum");
+        const tempPath = join(dirname(input.outputPath), `.${basename(input.outputPath)}.dcli-${randomUUID()}.tmp`);
+        const hash = createHash("sha256");
+        let byteSize = 0;
+        const hasher = new Transform({
+            transform(chunk, _encoding, callback) {
+                hash.update(chunk);
+                byteSize += chunk.length;
+                callback(null, chunk);
+            },
+        });
+        try {
+            await pipeline(Readable.fromWeb(response.body), hasher, createWriteStream(tempPath, { flags: "wx", mode: 0o600 }));
+            const descriptor = openSync(tempPath, "r");
+            try {
+                fsyncSync(descriptor);
+            }
+            finally {
+                closeSync(descriptor);
+            }
+            const actual = hash.digest("hex");
+            if (actual !== expected || (input.expectedSha256 && actual !== input.expectedSha256)) {
+                throw new Error("Downloaded source checksum mismatch");
+            }
+            if (input.overwrite) {
+                renameSync(tempPath, input.outputPath);
+            }
+            else {
+                linkSync(tempPath, input.outputPath);
+                unlinkSync(tempPath);
+            }
+            return { outputPath: input.outputPath, byteSize, sha256: actual };
+        }
+        catch (error) {
+            if (existsSync(tempPath))
+                unlinkSync(tempPath);
+            throw error;
+        }
+    }
+    async searchBrain(query, options) {
+        return this.post("/brain/search", {
+            query,
+            areaId: options?.areaId,
+            limit: options?.limit,
+        });
+    }
+    async shareBrainNote(input) {
+        return this.post("/brain/notes", input);
+    }
+    async updateBrainNote(id, input) {
+        return this.patch(`/brain/notes/${encodeURIComponent(id)}`, input);
+    }
+    async archiveBrainNote(id, expectedVersion) {
+        return this.delete(`/brain/notes/${encodeURIComponent(id)}?expectedVersion=${expectedVersion}`);
+    }
+    async restoreBrainNote(id, expectedVersion) {
+        return this.post(`/brain/notes/${encodeURIComponent(id)}/restore`, { expectedVersion });
+    }
+    async listBrainAudit(areaId, options) {
+        const query = new URLSearchParams({ areaId });
+        if (options?.cursor)
+            query.set("cursor", options.cursor);
+        if (options?.limit)
+            query.set("limit", String(options.limit));
+        return this.get(`/brain/audit?${query}`);
+    }
     // ── Read ──────────────────────────────────────────────────────────────────
     async listEntities(opts) {
         const params = new URLSearchParams();
@@ -103,9 +251,40 @@ export class DayOfWeekClient {
     async submitBatch(batch) {
         return this.post("/proposals/batch", batch);
     }
+    // ── Admin (cross-org) ─────────────────────────────────────────────────────
+    // These endpoints reject non-admin tokens with 401 "Admin access required".
+    async adminListEntities(opts) {
+        const params = new URLSearchParams();
+        if (opts?.org)
+            params.set("org", opts.org);
+        if (opts?.type)
+            params.set("type", opts.type);
+        if (opts?.missingLocation)
+            params.set("missing-location", "1");
+        if (opts?.search)
+            params.set("search", opts.search);
+        if (opts?.limit)
+            params.set("limit", String(opts.limit));
+        const qs = params.toString();
+        return this.get(`/admin/entities${qs ? `?${qs}` : ""}`);
+    }
+    async adminListProposals(opts) {
+        const params = new URLSearchParams();
+        if (opts?.status)
+            params.set("status", opts.status);
+        if (opts?.sourceAgent)
+            params.set("source-agent", opts.sourceAgent);
+        if (opts?.limit)
+            params.set("limit", String(opts.limit));
+        const qs = params.toString();
+        return this.get(`/admin/proposals${qs ? `?${qs}` : ""}`);
+    }
     // ── Skill ─────────────────────────────────────────────────────────────────
-    async getSkillBundle() {
-        return this.get("/skill");
+    async getSkillBundle(name) {
+        return this.get(`/skill${name ? `?name=${encodeURIComponent(name)}` : ""}`);
+    }
+    async listSkillBundles() {
+        return this.get("/skill?list=1");
     }
     // ── Schema ────────────────────────────────────────────────────────────────
     async getSchema() {
@@ -113,55 +292,46 @@ export class DayOfWeekClient {
     }
     // ── HTTP helpers ──────────────────────────────────────────────────────────
     async get(path) {
-        const res = await fetch(`${this.baseUrl}${path}`, {
-            headers: { Authorization: `Bearer ${this.token}` },
-        });
-        if (!res.ok) {
-            const body = await res.text();
-            try {
-                const json = JSON.parse(body);
-                throw new ApiError(res.status, json.error ?? body);
-            }
-            catch (e) {
-                if (e instanceof ApiError)
-                    throw e;
-                throw new ApiError(res.status, body);
-            }
-        }
-        return res.json();
+        return this.request(path, { method: "GET" });
     }
     async post(path, body) {
+        return this.request(path, { method: "POST", body: JSON.stringify(body) });
+    }
+    async patch(path, body) {
+        return this.request(path, { method: "PATCH", body: JSON.stringify(body) });
+    }
+    async delete(path) {
+        return this.request(path, { method: "DELETE" });
+    }
+    async request(path, init) {
         const res = await fetch(`${this.baseUrl}${path}`, {
-            method: "POST",
+            ...init,
             headers: {
                 Authorization: `Bearer ${this.token}`,
-                "Content-Type": "application/json",
+                ...(init.body ? { "Content-Type": "application/json" } : {}),
+                ...init.headers,
             },
-            body: JSON.stringify(body),
         });
-        if (!res.ok) {
-            const text = await res.text();
-            try {
-                const json = JSON.parse(text);
-                throw new ApiError(res.status, json.error ?? text);
-            }
-            catch (e) {
-                if (e instanceof ApiError)
-                    throw e;
-                throw new ApiError(res.status, text);
-            }
-        }
+        if (!res.ok)
+            throw await apiErrorFromResponse(res);
         return res.json();
     }
-    async delete(path) {
-        const res = await fetch(`${this.baseUrl}${path}`, {
-            method: "DELETE",
-            headers: { Authorization: `Bearer ${this.token}` },
-        });
-        if (!res.ok) {
-            const text = await res.text();
-            throw new ApiError(res.status, text);
-        }
-        return res.json();
+}
+async function hashFile(path) {
+    const hash = createHash("sha256");
+    for await (const chunk of createReadStream(path))
+        hash.update(chunk);
+    return hash.digest("hex");
+}
+async function apiErrorFromResponse(response) {
+    const body = await response.text();
+    try {
+        const json = JSON.parse(body);
+        if (typeof json.error === "string")
+            return new ApiError(response.status, json.error);
+        return new ApiError(response.status, json.error?.message ?? `Request failed (${response.status})`, json.error?.code, json.error?.requestId);
+    }
+    catch {
+        return new ApiError(response.status, `Request failed (${response.status})`);
     }
 }

package/dist/config.d.ts

@@ -1,8 +1,20 @@
+import { type CredentialStore } from "./credentials.js";
 export interface DcliConfig {
     authToken?: string;
     apiUrl?: string;
+    /**
+     * Cached admin status from the last `dcli auth status` call. Used to
+     * decide locally whether to expose admin-only subcommands in `--help`.
+     * Refreshed automatically when `dcli auth status` or `dcli auth login`
+     * runs; admin commands are hidden when this is unset or false.
+     */
+    isAdmin?: boolean;
+    /** Unix-ms timestamp of the last isAdmin refresh. */
+    roleCachedAt?: number;
 }
 export declare function loadConfig(): DcliConfig;
 export declare function saveConfig(updates: Partial<DcliConfig>): void;
-export declare function getToken(): string;
+export declare function getToken(store?: CredentialStore): string;
+export declare function saveCredential(secret: string, store?: CredentialStore): void;
+export declare function deleteCredential(store?: CredentialStore): void;
 export declare function getApiUrl(): string;

package/dist/config.js

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
+import { defaultCredentialStore } from "./credentials.js";
 const CONFIG_DIR = join(homedir(), ".config", "dayofweek");
 const CONFIG_FILE = join(CONFIG_DIR, "dcli.json");
 export function loadConfig() {
@@ -15,22 +16,39 @@ export function loadConfig() {
     return {};
 }
 export function saveConfig(updates) {
-    mkdirSync(CONFIG_DIR, { recursive: true });
+    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
     const existing = loadConfig();
     const merged = { ...existing, ...updates };
-    writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2), "utf-8");
+    writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2), { encoding: "utf-8", mode: 0o600 });
 }
-export function getToken() {
+export function getToken(store = defaultCredentialStore()) {
+    const config = loadConfig();
+    const storedToken = store.get();
     const token = process.env.DCLI_AUTH_TOKEN ??
         process.env.DCLI_TOKEN ??
-        loadConfig().authToken;
+        storedToken ??
+        config.authToken;
+    // One-way migration of the old plaintext config. The legacy key is removed
+    // immediately after the protected store accepts it.
+    if (!storedToken && config.authToken && token === config.authToken) {
+        store.set(config.authToken);
+        saveConfig({ authToken: undefined });
+    }
     if (!token) {
-        console.error("No auth token found.");
-        console.error("Set DCLI_AUTH_TOKEN or run: dcli auth login");
-        process.exit(1);
+        throw new Error("No credential found. Run: dcli auth login");
     }
     return token;
 }
+export function saveCredential(secret, store = defaultCredentialStore()) {
+    store.set(secret);
+    if (loadConfig().authToken)
+        saveConfig({ authToken: undefined });
+}
+export function deleteCredential(store = defaultCredentialStore()) {
+    store.delete();
+    if (loadConfig().authToken)
+        saveConfig({ authToken: undefined });
+}
 export function getApiUrl() {
     return (process.env.DCLI_API_URL ??
         loadConfig().apiUrl ??

package/dist/credentials.d.ts

@@ -0,0 +1,13 @@
+export interface CredentialStore {
+    get(): string | undefined;
+    set(secret: string): void;
+    delete(): void;
+}
+export declare class ProtectedFileCredentialStore implements CredentialStore {
+    readonly path: string;
+    constructor(path?: string);
+    get(): string | undefined;
+    set(secret: string): void;
+    delete(): void;
+}
+export declare function defaultCredentialStore(): CredentialStore;