@dayofweek/dcli 1.3.0 → 1.4.0

package/dist/client.d.ts

@@ -4,7 +4,9 @@
  */
 export declare class ApiError extends Error {
     status: number;
-    constructor(status: number, message: string);
+    code?: string | undefined;
+    requestId?: string | undefined;
+    constructor(status: number, message: string, code?: string | undefined, requestId?: string | undefined);
 }
 export declare class DayOfWeekClient {
     private baseUrl;
@@ -28,6 +30,75 @@ export declare class DayOfWeekClient {
     revokeDevice(deviceId: string): Promise<{
         success: boolean;
     }>;
+    revokeCurrentDevice(): Promise<{
+        revoked: true;
+    }>;
+    brainBootstrap(): Promise<{
+        authenticated: true;
+        scopes: string[];
+        entitled: boolean;
+        areas: BrainArea[];
+        defaultAreaId?: string;
+    }>;
+    listBrainAreas(): Promise<BrainArea[]>;
+    companyBrainStatus(): Promise<{
+        eligible: boolean;
+        canEnsure: boolean;
+        entityName?: string;
+        existingArea: BrainArea | null;
+    }>;
+    ensureCompanyBrain(): Promise<BrainArea>;
+    resolveBrain(uri: string): Promise<BrainResolvedResource>;
+    getBrainNote(id: string): Promise<BrainNote>;
+    getBrainSource(id: string): Promise<BrainSource>;
+    uploadBrainSource(input: {
+        areaId: string;
+        path: string;
+        mimeType: string;
+        isMeeting: boolean;
+        consentAcknowledged: boolean;
+    }): Promise<{
+        sourceId: string;
+        uri: string;
+        httpsUrl: string;
+        filename: string;
+        byteSize: number;
+        sha256: string;
+        scanState: "pending" | "clean";
+        processingState: string;
+    }>;
+    downloadBrainSource(input: {
+        sourceId: string;
+        outputPath: string;
+        expectedSha256?: string;
+        overwrite?: boolean;
+    }): Promise<{
+        outputPath: string;
+        byteSize: number;
+        sha256: string;
+    }>;
+    searchBrain(query: string, options?: {
+        areaId?: string;
+        limit?: number;
+    }): Promise<unknown>;
+    shareBrainNote(input: {
+        areaId: string;
+        title: string;
+        markdown: string;
+        sourceName?: string;
+        intent: "interactive" | "autonomous";
+    }): Promise<BrainNote>;
+    updateBrainNote(id: string, input: {
+        title?: string;
+        markdown: string;
+        expectedVersion: number;
+    }): Promise<BrainNote>;
+    archiveBrainNote(id: string, expectedVersion: number): Promise<BrainNote>;
+    restoreBrainNote(id: string, expectedVersion: number): Promise<BrainNote>;
+    listBrainAudit(areaId: string, options?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<unknown>;
     listEntities(opts?: {
         type?: string;
         parent?: string;
@@ -58,6 +129,7 @@ export declare class DayOfWeekClient {
     getProposal(proposalId: string): Promise<any>;
     submitProposal(proposal: Record<string, unknown>): Promise<any>;
     submitBatch(batch: {
+        org?: string;
         batchLabel: string;
         sourceAgent?: string;
         proposals: any[];
@@ -82,16 +154,83 @@ export declare class DayOfWeekClient {
         truncated: boolean;
         total: number;
     }>;
-    getSkillBundle(): Promise<{
+    getSkillBundle(name?: string): Promise<{
         name: string;
         version: string;
+        hash?: string;
         files: Array<{
             path: string;
             content: string;
+            sha256?: string;
         }>;
     }>;
+    listSkillBundles(): Promise<Array<{
+        name: string;
+        version: string;
+        hash: string;
+    }>>;
     getSchema(): Promise<any>;
     private get;
     private post;
+    private patch;
     private delete;
+    private request;
 }
+export type BrainArea = {
+    id: string;
+    name: string;
+    kind: "company" | "project";
+    role: "owner" | "editor" | "viewer";
+    canWrite: boolean;
+    canManage: boolean;
+    uri: string;
+    httpsUrl: string;
+    updatedAt: number;
+};
+export type BrainNote = {
+    id: string;
+    areaId: string;
+    areaName: string;
+    title: string;
+    markdown: string;
+    status: string;
+    version: number;
+    hash?: string;
+    sourceId?: string;
+    sourceUri?: string;
+    uri: string;
+    httpsUrl: string;
+    createdAt: number;
+    updatedAt: number;
+};
+export type BrainSource = {
+    id: string;
+    areaId: string;
+    areaName: string;
+    kind: "text" | "audio" | "file";
+    filename?: string;
+    mimeType?: string;
+    byteSize?: number;
+    sha256?: string;
+    scanState?: "pending" | "clean" | "quarantined" | "failed";
+    processingState: string;
+    rawText?: string;
+    extractedText?: string;
+    transcript?: string;
+    isMeeting: boolean;
+    derivedNoteUri?: string;
+    canDownload: boolean;
+    uri: string;
+    httpsUrl: string;
+    uploadedAt: number;
+};
+export type BrainResolvedResource = {
+    resourceType: "area";
+    area: BrainArea;
+} | {
+    resourceType: "note";
+    note: BrainNote;
+} | {
+    resourceType: "source";
+    source: BrainSource;
+};

package/dist/client.js

@@ -2,12 +2,21 @@
  * HTTP client for the Day of Week platform REST API.
  * All calls go through the proxy at field.dayofweek.com/app/api/dcli.
  */
+import { createHash, randomUUID } from "node:crypto";
+import { createReadStream, createWriteStream, existsSync, fsyncSync, linkSync, openSync, closeSync, renameSync, statSync, unlinkSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
 const DEFAULT_BASE_URL = "https://field.dayofweek.com/app/api/dcli";
 export class ApiError extends Error {
     status;
-    constructor(status, message) {
+    code;
+    requestId;
+    constructor(status, message, code, requestId) {
         super(message);
         this.status = status;
+        this.code = code;
+        this.requestId = requestId;
         this.name = "ApiError";
     }
 }
@@ -31,6 +40,145 @@ export class DayOfWeekClient {
     async revokeDevice(deviceId) {
         return this.delete(`/auth/devices/${deviceId}`);
     }
+    async revokeCurrentDevice() {
+        return this.delete("/auth/current-device");
+    }
+    // ── Shared brain ─────────────────────────────────────────────────────────
+    async brainBootstrap() {
+        return this.get("/brain/bootstrap");
+    }
+    async listBrainAreas() {
+        return this.get("/brain/areas");
+    }
+    async companyBrainStatus() {
+        return this.get("/brain/company-area");
+    }
+    async ensureCompanyBrain() {
+        return this.post("/brain/company-area", {});
+    }
+    async resolveBrain(uri) {
+        return this.get(`/brain/resolve?uri=${encodeURIComponent(uri)}`);
+    }
+    async getBrainNote(id) {
+        return this.get(`/brain/notes/${encodeURIComponent(id)}`);
+    }
+    async getBrainSource(id) {
+        return this.get(`/brain/sources/${encodeURIComponent(id)}`);
+    }
+    async uploadBrainSource(input) {
+        const info = statSync(input.path);
+        if (!info.isFile())
+            throw new Error("Upload path is not a regular file");
+        const sha256 = await hashFile(input.path);
+        const idempotencyKey = `up_${createHash("sha256")
+            .update(`${input.areaId}:${sha256}:${input.isMeeting}`)
+            .digest("base64url")}`;
+        const session = await this.post("/brain/source-uploads", {
+            areaId: input.areaId,
+            filename: basename(input.path),
+            mimeType: input.mimeType,
+            byteSize: info.size,
+            sha256,
+            isMeeting: input.isMeeting,
+            consentAcknowledged: input.consentAcknowledged,
+            idempotencyKey,
+        });
+        const upload = await fetch(session.uploadUrl, {
+            method: "POST",
+            headers: { "Content-Type": input.mimeType },
+            body: createReadStream(input.path),
+            duplex: "half",
+        });
+        if (!upload.ok)
+            throw new ApiError(upload.status, "Source byte upload failed", "network_error");
+        const stored = await upload.json();
+        if (!stored.storageId)
+            throw new Error("Upload did not return a storage ID");
+        const completed = await this.post(`/brain/source-uploads/${encodeURIComponent(session.uploadId)}/complete`, {
+            storageId: stored.storageId,
+        });
+        if (completed.sha256 !== sha256)
+            throw new Error("Server checksum does not match the uploaded file");
+        return completed;
+    }
+    async downloadBrainSource(input) {
+        if (!input.overwrite && existsSync(input.outputPath))
+            throw new Error("Output already exists; use --overwrite");
+        const response = await fetch(`${this.baseUrl}/brain/sources/${encodeURIComponent(input.sourceId)}/download`, {
+            headers: { Authorization: `Bearer ${this.token}` },
+        });
+        if (!response.ok)
+            throw await apiErrorFromResponse(response);
+        if (!response.body)
+            throw new Error("Download response had no body");
+        const expected = response.headers.get("x-dayofweek-sha256") ?? input.expectedSha256;
+        if (!expected || !/^[a-f0-9]{64}$/.test(expected))
+            throw new Error("Download response omitted its checksum");
+        const tempPath = join(dirname(input.outputPath), `.${basename(input.outputPath)}.dcli-${randomUUID()}.tmp`);
+        const hash = createHash("sha256");
+        let byteSize = 0;
+        const hasher = new Transform({
+            transform(chunk, _encoding, callback) {
+                hash.update(chunk);
+                byteSize += chunk.length;
+                callback(null, chunk);
+            },
+        });
+        try {
+            await pipeline(Readable.fromWeb(response.body), hasher, createWriteStream(tempPath, { flags: "wx", mode: 0o600 }));
+            const descriptor = openSync(tempPath, "r");
+            try {
+                fsyncSync(descriptor);
+            }
+            finally {
+                closeSync(descriptor);
+            }
+            const actual = hash.digest("hex");
+            if (actual !== expected || (input.expectedSha256 && actual !== input.expectedSha256)) {
+                throw new Error("Downloaded source checksum mismatch");
+            }
+            if (input.overwrite) {
+                renameSync(tempPath, input.outputPath);
+            }
+            else {
+                linkSync(tempPath, input.outputPath);
+                unlinkSync(tempPath);
+            }
+            return { outputPath: input.outputPath, byteSize, sha256: actual };
+        }
+        catch (error) {
+            if (existsSync(tempPath))
+                unlinkSync(tempPath);
+            throw error;
+        }
+    }
+    async searchBrain(query, options) {
+        return this.post("/brain/search", {
+            query,
+            areaId: options?.areaId,
+            limit: options?.limit,
+        });
+    }
+    async shareBrainNote(input) {
+        return this.post("/brain/notes", input);
+    }
+    async updateBrainNote(id, input) {
+        return this.patch(`/brain/notes/${encodeURIComponent(id)}`, input);
+    }
+    async archiveBrainNote(id, expectedVersion) {
+        return this.delete(`/brain/notes/${encodeURIComponent(id)}?expectedVersion=${expectedVersion}`);
+    }
+    async restoreBrainNote(id, expectedVersion) {
+        return this.post(`/brain/notes/${encodeURIComponent(id)}/restore`, { expectedVersion });
+    }
+    async listBrainAudit(areaId, options) {
+        const query = new URLSearchParams({ areaId });
+        if (options?.cursor)
+            query.set("cursor", options.cursor);
+        if (options?.limit)
+            query.set("limit", String(options.limit));
+        return this.get(`/brain/audit?${query}`);
+    }
     // ── Read ──────────────────────────────────────────────────────────────────
     async listEntities(opts) {
         const params = new URLSearchParams();
@@ -132,8 +280,11 @@ export class DayOfWeekClient {
         return this.get(`/admin/proposals${qs ? `?${qs}` : ""}`);
     }
     // ── Skill ─────────────────────────────────────────────────────────────────
-    async getSkillBundle() {
-        return this.get("/skill");
+    async getSkillBundle(name) {
+        return this.get(`/skill${name ? `?name=${encodeURIComponent(name)}` : ""}`);
+    }
+    async listSkillBundles() {
+        return this.get("/skill?list=1");
     }
     // ── Schema ────────────────────────────────────────────────────────────────
     async getSchema() {
@@ -141,55 +292,46 @@ export class DayOfWeekClient {
     }
     // ── HTTP helpers ──────────────────────────────────────────────────────────
     async get(path) {
-        const res = await fetch(`${this.baseUrl}${path}`, {
-            headers: { Authorization: `Bearer ${this.token}` },
-        });
-        if (!res.ok) {
-            const body = await res.text();
-            try {
-                const json = JSON.parse(body);
-                throw new ApiError(res.status, json.error ?? body);
-            }
-            catch (e) {
-                if (e instanceof ApiError)
-                    throw e;
-                throw new ApiError(res.status, body);
-            }
-        }
-        return res.json();
+        return this.request(path, { method: "GET" });
     }
     async post(path, body) {
+        return this.request(path, { method: "POST", body: JSON.stringify(body) });
+    }
+    async patch(path, body) {
+        return this.request(path, { method: "PATCH", body: JSON.stringify(body) });
+    }
+    async delete(path) {
+        return this.request(path, { method: "DELETE" });
+    }
+    async request(path, init) {
         const res = await fetch(`${this.baseUrl}${path}`, {
-            method: "POST",
+            ...init,
             headers: {
                 Authorization: `Bearer ${this.token}`,
-                "Content-Type": "application/json",
+                ...(init.body ? { "Content-Type": "application/json" } : {}),
+                ...init.headers,
             },
-            body: JSON.stringify(body),
         });
-        if (!res.ok) {
-            const text = await res.text();
-            try {
-                const json = JSON.parse(text);
-                throw new ApiError(res.status, json.error ?? text);
-            }
-            catch (e) {
-                if (e instanceof ApiError)
-                    throw e;
-                throw new ApiError(res.status, text);
-            }
-        }
+        if (!res.ok)
+            throw await apiErrorFromResponse(res);
         return res.json();
     }
-    async delete(path) {
-        const res = await fetch(`${this.baseUrl}${path}`, {
-            method: "DELETE",
-            headers: { Authorization: `Bearer ${this.token}` },
-        });
-        if (!res.ok) {
-            const text = await res.text();
-            throw new ApiError(res.status, text);
-        }
-        return res.json();
+}
+async function hashFile(path) {
+    const hash = createHash("sha256");
+    for await (const chunk of createReadStream(path))
+        hash.update(chunk);
+    return hash.digest("hex");
+}
+async function apiErrorFromResponse(response) {
+    const body = await response.text();
+    try {
+        const json = JSON.parse(body);
+        if (typeof json.error === "string")
+            return new ApiError(response.status, json.error);
+        return new ApiError(response.status, json.error?.message ?? `Request failed (${response.status})`, json.error?.code, json.error?.requestId);
+    }
+    catch {
+        return new ApiError(response.status, `Request failed (${response.status})`);
     }
 }

package/dist/config.d.ts

@@ -1,3 +1,4 @@
+import { type CredentialStore } from "./credentials.js";
 export interface DcliConfig {
     authToken?: string;
     apiUrl?: string;
@@ -13,5 +14,7 @@ export interface DcliConfig {
 }
 export declare function loadConfig(): DcliConfig;
 export declare function saveConfig(updates: Partial<DcliConfig>): void;
-export declare function getToken(): string;
+export declare function getToken(store?: CredentialStore): string;
+export declare function saveCredential(secret: string, store?: CredentialStore): void;
+export declare function deleteCredential(store?: CredentialStore): void;
 export declare function getApiUrl(): string;

package/dist/config.js

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
+import { defaultCredentialStore } from "./credentials.js";
 const CONFIG_DIR = join(homedir(), ".config", "dayofweek");
 const CONFIG_FILE = join(CONFIG_DIR, "dcli.json");
 export function loadConfig() {
@@ -15,22 +16,39 @@ export function loadConfig() {
     return {};
 }
 export function saveConfig(updates) {
-    mkdirSync(CONFIG_DIR, { recursive: true });
+    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
     const existing = loadConfig();
     const merged = { ...existing, ...updates };
-    writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2), "utf-8");
+    writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2), { encoding: "utf-8", mode: 0o600 });
 }
-export function getToken() {
+export function getToken(store = defaultCredentialStore()) {
+    const config = loadConfig();
+    const storedToken = store.get();
     const token = process.env.DCLI_AUTH_TOKEN ??
         process.env.DCLI_TOKEN ??
-        loadConfig().authToken;
+        storedToken ??
+        config.authToken;
+    // One-way migration of the old plaintext config. The legacy key is removed
+    // immediately after the protected store accepts it.
+    if (!storedToken && config.authToken && token === config.authToken) {
+        store.set(config.authToken);
+        saveConfig({ authToken: undefined });
+    }
     if (!token) {
-        console.error("No auth token found.");
-        console.error("Set DCLI_AUTH_TOKEN or run: dcli auth login");
-        process.exit(1);
+        throw new Error("No credential found. Run: dcli auth login");
     }
     return token;
 }
+export function saveCredential(secret, store = defaultCredentialStore()) {
+    store.set(secret);
+    if (loadConfig().authToken)
+        saveConfig({ authToken: undefined });
+}
+export function deleteCredential(store = defaultCredentialStore()) {
+    store.delete();
+    if (loadConfig().authToken)
+        saveConfig({ authToken: undefined });
+}
 export function getApiUrl() {
     return (process.env.DCLI_API_URL ??
         loadConfig().apiUrl ??

package/dist/credentials.d.ts

@@ -0,0 +1,13 @@
+export interface CredentialStore {
+    get(): string | undefined;
+    set(secret: string): void;
+    delete(): void;
+}
+export declare class ProtectedFileCredentialStore implements CredentialStore {
+    readonly path: string;
+    constructor(path?: string);
+    get(): string | undefined;
+    set(secret: string): void;
+    delete(): void;
+}
+export declare function defaultCredentialStore(): CredentialStore;

package/dist/credentials.js

@@ -0,0 +1,113 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { homedir, platform, userInfo } from "node:os";
+import { dirname, join } from "node:path";
+const SERVICE = "com.dayofweek.dcli";
+const ACCOUNT = "brain-device";
+export class ProtectedFileCredentialStore {
+    path;
+    constructor(path = join(homedir(), ".config", "dayofweek", "credentials.json")) {
+        this.path = path;
+    }
+    get() {
+        if (!existsSync(this.path))
+            return undefined;
+        if (platform() !== "win32" && (statSync(this.path).mode & 0o077) !== 0) {
+            throw new Error(`Credential file permissions are unsafe: ${this.path}`);
+        }
+        const value = JSON.parse(readFileSync(this.path, "utf8"));
+        return typeof value.deviceSecret === "string" ? value.deviceSecret : undefined;
+    }
+    set(secret) {
+        if (!/^dsk_[A-Za-z0-9_-]{20,160}$/.test(secret))
+            throw new Error("Refusing to store an invalid credential");
+        const directory = dirname(this.path);
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+        if (platform() !== "win32")
+            chmodSync(directory, 0o700);
+        writeFileSync(this.path, JSON.stringify({ deviceSecret: secret }), {
+            encoding: "utf8",
+            mode: 0o600,
+            flag: "w",
+        });
+        if (platform() !== "win32") {
+            chmodSync(this.path, 0o600);
+            if ((statSync(this.path).mode & 0o077) !== 0)
+                throw new Error("Could not secure credential file");
+        }
+        else {
+            const username = userInfo().username;
+            execFileSync("icacls", [this.path, "/inheritance:r", "/grant:r", `${username}:(R,W)`], {
+                stdio: "ignore",
+            });
+        }
+    }
+    delete() {
+        if (existsSync(this.path))
+            unlinkSync(this.path);
+    }
+}
+class MacKeychainCredentialStore {
+    get() {
+        try {
+            return execFileSync("security", ["find-generic-password", "-s", SERVICE, "-a", ACCOUNT, "-w"], {
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "ignore"],
+            }).trim() || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    set(secret) {
+        execFileSync("security", ["add-generic-password", "-U", "-s", SERVICE, "-a", ACCOUNT, "-w", secret], { stdio: "ignore" });
+    }
+    delete() {
+        try {
+            execFileSync("security", ["delete-generic-password", "-s", SERVICE, "-a", ACCOUNT], {
+                stdio: "ignore",
+            });
+        }
+        catch {
+            // Missing credential is already logged out.
+        }
+    }
+}
+class LinuxSecretServiceCredentialStore {
+    get() {
+        try {
+            return execFileSync("secret-tool", ["lookup", "service", SERVICE, "account", ACCOUNT], {
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "ignore"],
+            }).trim() || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    set(secret) {
+        execFileSync("secret-tool", ["store", "--label", "Day of Week device", "service", SERVICE, "account", ACCOUNT], { input: secret, stdio: ["pipe", "ignore", "ignore"] });
+    }
+    delete() {
+        try {
+            execFileSync("secret-tool", ["clear", "service", SERVICE, "account", ACCOUNT], { stdio: "ignore" });
+        }
+        catch {
+            // Missing credential is already logged out.
+        }
+    }
+}
+export function defaultCredentialStore() {
+    if (platform() === "darwin")
+        return new MacKeychainCredentialStore();
+    if (platform() === "linux") {
+        try {
+            execFileSync("secret-tool", ["--version"], { stdio: "ignore" });
+            return new LinuxSecretServiceCredentialStore();
+        }
+        catch {
+            return new ProtectedFileCredentialStore();
+        }
+    }
+    return new ProtectedFileCredentialStore();
+}

package/dist/skills.d.ts

@@ -0,0 +1,16 @@
+export type SkillBundle = {
+    name: string;
+    version: string;
+    hash?: string;
+    files: Array<{
+        path: string;
+        content: string;
+        sha256?: string;
+    }>;
+};
+export declare function validateSkillBundle(bundle: SkillBundle): SkillBundle;
+export declare function writeSkillBundle(input: SkillBundle, targetDir: string): {
+    written: number;
+    unchanged: number;
+    conflicts: string[];
+};