@dayofweek/dcli 1.3.0 → 1.5.0

package/dist/credentials.js

@@ -0,0 +1,113 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { homedir, platform, userInfo } from "node:os";
+import { dirname, join } from "node:path";
+const SERVICE = "com.dayofweek.dcli";
+const ACCOUNT = "brain-device";
+export class ProtectedFileCredentialStore {
+    path;
+    constructor(path = join(homedir(), ".config", "dayofweek", "credentials.json")) {
+        this.path = path;
+    }
+    get() {
+        if (!existsSync(this.path))
+            return undefined;
+        if (platform() !== "win32" && (statSync(this.path).mode & 0o077) !== 0) {
+            throw new Error(`Credential file permissions are unsafe: ${this.path}`);
+        }
+        const value = JSON.parse(readFileSync(this.path, "utf8"));
+        return typeof value.deviceSecret === "string" ? value.deviceSecret : undefined;
+    }
+    set(secret) {
+        if (!/^dsk_[A-Za-z0-9_-]{20,160}$/.test(secret))
+            throw new Error("Refusing to store an invalid credential");
+        const directory = dirname(this.path);
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+        if (platform() !== "win32")
+            chmodSync(directory, 0o700);
+        writeFileSync(this.path, JSON.stringify({ deviceSecret: secret }), {
+            encoding: "utf8",
+            mode: 0o600,
+            flag: "w",
+        });
+        if (platform() !== "win32") {
+            chmodSync(this.path, 0o600);
+            if ((statSync(this.path).mode & 0o077) !== 0)
+                throw new Error("Could not secure credential file");
+        }
+        else {
+            const username = userInfo().username;
+            execFileSync("icacls", [this.path, "/inheritance:r", "/grant:r", `${username}:(R,W)`], {
+                stdio: "ignore",
+            });
+        }
+    }
+    delete() {
+        if (existsSync(this.path))
+            unlinkSync(this.path);
+    }
+}
+class MacKeychainCredentialStore {
+    get() {
+        try {
+            return execFileSync("security", ["find-generic-password", "-s", SERVICE, "-a", ACCOUNT, "-w"], {
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "ignore"],
+            }).trim() || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    set(secret) {
+        execFileSync("security", ["add-generic-password", "-U", "-s", SERVICE, "-a", ACCOUNT, "-w", secret], { stdio: "ignore" });
+    }
+    delete() {
+        try {
+            execFileSync("security", ["delete-generic-password", "-s", SERVICE, "-a", ACCOUNT], {
+                stdio: "ignore",
+            });
+        }
+        catch {
+            // Missing credential is already logged out.
+        }
+    }
+}
+class LinuxSecretServiceCredentialStore {
+    get() {
+        try {
+            return execFileSync("secret-tool", ["lookup", "service", SERVICE, "account", ACCOUNT], {
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "ignore"],
+            }).trim() || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    set(secret) {
+        execFileSync("secret-tool", ["store", "--label", "Day of Week device", "service", SERVICE, "account", ACCOUNT], { input: secret, stdio: ["pipe", "ignore", "ignore"] });
+    }
+    delete() {
+        try {
+            execFileSync("secret-tool", ["clear", "service", SERVICE, "account", ACCOUNT], { stdio: "ignore" });
+        }
+        catch {
+            // Missing credential is already logged out.
+        }
+    }
+}
+export function defaultCredentialStore() {
+    if (platform() === "darwin")
+        return new MacKeychainCredentialStore();
+    if (platform() === "linux") {
+        try {
+            execFileSync("secret-tool", ["--version"], { stdio: "ignore" });
+            return new LinuxSecretServiceCredentialStore();
+        }
+        catch {
+            return new ProtectedFileCredentialStore();
+        }
+    }
+    return new ProtectedFileCredentialStore();
+}

package/dist/skills.d.ts

@@ -0,0 +1,16 @@
+export type SkillBundle = {
+    name: string;
+    version: string;
+    hash?: string;
+    files: Array<{
+        path: string;
+        content: string;
+        sha256?: string;
+    }>;
+};
+export declare function validateSkillBundle(bundle: SkillBundle): SkillBundle;
+export declare function writeSkillBundle(input: SkillBundle, targetDir: string): {
+    written: number;
+    unchanged: number;
+    conflicts: string[];
+};

package/dist/skills.js

@@ -0,0 +1,77 @@
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+export function validateSkillBundle(bundle) {
+    if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(bundle.name) || !bundle.version.trim() || bundle.version.length > 64) {
+        throw new Error("Skill bundle metadata is invalid");
+    }
+    if (bundle.files.length === 0 || bundle.files.length > 64)
+        throw new Error("Skill bundle file count is invalid");
+    const paths = new Set();
+    const files = bundle.files.map((file) => {
+        const segments = file.path.split("/");
+        if (!file.path ||
+            file.path.startsWith("/") ||
+            file.path.includes("\\") ||
+            file.path.includes("\0") ||
+            segments.some((segment) => !segment || segment === "." || segment === "..") ||
+            paths.has(file.path) ||
+            Buffer.byteLength(file.content) > 1_000_000) {
+            throw new Error("Skill bundle contained an unsafe file");
+        }
+        paths.add(file.path);
+        const actual = sha256(file.content);
+        if (file.sha256 && file.sha256 !== actual)
+            throw new Error("Skill bundle file checksum mismatch");
+        return { ...file, sha256: actual };
+    });
+    const actualBundleHash = sha256(files.map((file) => `${file.path}\0${file.sha256}`).join("\0"));
+    if (bundle.hash && bundle.hash !== actualBundleHash)
+        throw new Error("Skill bundle manifest checksum mismatch");
+    return { ...bundle, hash: actualBundleHash, files };
+}
+export function writeSkillBundle(input, targetDir) {
+    const bundle = validateSkillBundle(input);
+    let filesWritten = 0;
+    let unchanged = 0;
+    const conflicts = [];
+    const metadataPath = join(targetDir, ".dayofweek-skill.json");
+    const previous = existsSync(metadataPath)
+        ? JSON.parse(readFileSync(metadataPath, "utf8"))
+        : undefined;
+    const hashes = {};
+    for (const file of bundle.files) {
+        const filePath = join(targetDir, file.path);
+        const nextHash = file.sha256;
+        hashes[file.path] = nextHash;
+        mkdirSync(dirname(filePath), { recursive: true });
+        if (existsSync(filePath)) {
+            const currentHash = sha256(readFileSync(filePath));
+            if (currentHash === nextHash) {
+                unchanged++;
+                continue;
+            }
+            if (previous?.files?.[file.path] !== currentHash) {
+                let suffix = 0;
+                let conflictPath = `${filePath}.new`;
+                while (existsSync(conflictPath) && suffix < 999) {
+                    suffix++;
+                    conflictPath = `${filePath}.new.${suffix}`;
+                }
+                if (existsSync(conflictPath))
+                    throw new Error("Too many unresolved skill update conflicts");
+                writeFileSync(conflictPath, file.content, { encoding: "utf8", flag: "wx" });
+                conflicts.push(suffix === 0 ? `${file.path}.new` : `${file.path}.new.${suffix}`);
+                continue;
+            }
+        }
+        writeFileSync(filePath, file.content, "utf-8");
+        filesWritten++;
+    }
+    mkdirSync(targetDir, { recursive: true });
+    writeFileSync(metadataPath, JSON.stringify({ name: bundle.name, version: bundle.version, hash: bundle.hash, files: hashes }, null, 2), "utf8");
+    return { written: filesWritten, unchanged, conflicts };
+}

package/dist/uri.d.ts

@@ -0,0 +1,9 @@
+export type BrainResource = {
+    version: 1;
+    areaId: string;
+    resourceType: "area" | "note" | "source";
+    resourceId?: string;
+};
+export declare function parseBrainResource(input: string): BrainResource;
+export declare function toBrainUri(resource: BrainResource): string;
+export declare function toBrainHttpsUrl(resource: BrainResource): string;

package/dist/uri.js

@@ -0,0 +1,72 @@
+const HTTPS_ORIGIN = "https://field.dayofweek.com";
+const HTTPS_PREFIX = "/app/brain/";
+const ID_PATTERN = /^[A-Za-z0-9_-]{2,128}$/;
+function assertId(value, label) {
+    if (!value || !ID_PATTERN.test(value)) {
+        throw new Error(`Invalid ${label}`);
+    }
+    return value;
+}
+function parseSegments(pathname) {
+    if (pathname.includes("%"))
+        throw new Error("Encoded brain URI paths are not supported");
+    const segments = pathname.split("/").filter(Boolean);
+    if (segments.length === 1) {
+        return {
+            areaId: assertId(segments[0], "area ID"),
+            resourceType: "area",
+        };
+    }
+    if (segments.length !== 3)
+        throw new Error("Unsupported brain URI form");
+    const areaId = assertId(segments[0], "area ID");
+    const resourceType = segments[1];
+    if (resourceType !== "note" && resourceType !== "source") {
+        throw new Error("Unsupported brain resource type");
+    }
+    return {
+        areaId,
+        resourceType,
+        resourceId: assertId(segments[2], `${resourceType} ID`),
+    };
+}
+export function parseBrainResource(input) {
+    if (input.length > 512)
+        throw new Error("Brain URI is too long");
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch {
+        throw new Error("Invalid brain URI");
+    }
+    if (url.username || url.password || url.search || url.hash) {
+        throw new Error("Brain URIs cannot contain credentials, queries, or fragments");
+    }
+    let pathname;
+    if (url.protocol === "dayofweek:") {
+        if (url.hostname !== "brain" || url.port)
+            throw new Error("Invalid brain URI authority");
+        pathname = url.pathname;
+    }
+    else if (url.protocol === "https:") {
+        if (url.origin !== HTTPS_ORIGIN || !url.pathname.startsWith(HTTPS_PREFIX)) {
+            throw new Error("Unsupported Day of Week deeplink");
+        }
+        pathname = url.pathname.slice(HTTPS_PREFIX.length - 1);
+    }
+    else {
+        throw new Error("Unsupported brain URI protocol");
+    }
+    return { version: 1, ...parseSegments(pathname) };
+}
+export function toBrainUri(resource) {
+    const areaId = assertId(resource.areaId, "area ID");
+    if (resource.resourceType === "area")
+        return `dayofweek://brain/${areaId}`;
+    const resourceId = assertId(resource.resourceId, `${resource.resourceType} ID`);
+    return `dayofweek://brain/${areaId}/${resource.resourceType}/${resourceId}`;
+}
+export function toBrainHttpsUrl(resource) {
+    return `${HTTPS_ORIGIN}/app/brain/${toBrainUri(resource).slice("dayofweek://brain/".length)}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dayofweek/dcli",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "CLI for the Day of Week AgTech platform — read data and submit proposals for review",
   "license": "MIT",
   "type": "module",
@@ -16,6 +16,10 @@
   "scripts": {
     "build": "tsc",
     "dev": "tsx src/bin/dcli.ts",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "standalone:build": "node scripts/build-standalone.mjs",
+    "standalone:smoke": "node scripts/smoke-standalone.mjs",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
@@ -23,9 +27,12 @@
     "open": "^11.0.0"
   },
   "devDependencies": {
+    "@types/node": "^22.0.0",
+    "esbuild": "^0.25.0",
+    "postject": "^1.0.0-alpha.6",
     "tsx": "^4.21.0",
     "typescript": "^5.9.0",
-    "@types/node": "^22.0.0"
+    "vitest": "^4.0.0"
   },
   "publishConfig": {
     "access": "public"