@leverstack/arcq 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Leverstack LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,361 @@
+# arcq
+
+[![CI](https://github.com/jameseaster/arcq/actions/workflows/lint-and-test.yml/badge.svg)](https://github.com/jameseaster/arcq/actions/workflows/lint-and-test.yml)
+[![npm version](https://img.shields.io/npm/v/%40leverstack%2Farcq)](https://www.npmjs.com/package/@leverstack/arcq)
+
+A fast CLI for querying ArcGIS feature services, designed to be driven by both humans and coding agents.
+
+## Why arcq
+
+ArcGIS REST is awkward to drive from a terminal or a script: query strings are fiddly, failures hide inside HTTP-200 response bodies, and discovering what layers and fields exist usually means clicking through a services directory. arcq is built to be scripted and, in particular, to be safe for a coding agent to run unattended:
+
+- **Strict exit-code contract.** `0` success (an empty `[]` result is success, not an error), `1` error, `2` token invalid or expired. An agent can branch on the exit code instead of parsing prose.
+- **JSON-only stdout.** Query results are the only thing on stdout, so `arcq query ... | jq` always works. The human-readable query summary goes to stderr.
+- **Loud errors.** ArcGIS reports failures (a malformed `where` clause, an expired token) inside HTTP-200 bodies; arcq inspects every response and exits non-zero, so a `[]` you see is trustworthy.
+- **Non-interactive discovery.** `arcq layers --names`, `arcq active`, `arcq fields`, and `arcq list` expose the catalog and schema without the fzf picker, so an agent can find its way around a server on its own.
+- **One-command setup for a whole server.** `arcq refresh && arcq sync` indexes every service in your config and turns each layer into a named shortcut.
+
+## Installation
+
+**Prerequisites**
+
+- [Node.js](https://nodejs.org/) **18 or newer**
+- [`fzf`](https://github.com/junegunn/fzf) - only needed for the interactive `arcq use` picker
+
+Install globally from npm:
+
+```bash
+npm install -g @leverstack/arcq
+```
+
+`arcq` is now on your PATH (the package is scoped; the command is still `arcq`).
+
+### From source
+
+```bash
+git clone https://github.com/jameseaster/arcq.git
+cd arcq
+npm install          # installs deps AND compiles TypeScript -> dist/ (via the "prepare" script)
+npm install -g .     # put `arcq` on your PATH (also recompiles dist/ automatically)
+```
+
+You do **not** need to create any symlink by hand; `npm install -g .` (or `npm link` below) does that for you.
+
+> **arcq is written in TypeScript and runs from compiled output in `dist/`.** The
+> `npm run build` step (`tsc`) is wired into npm's `prepare` lifecycle, so it runs
+> automatically on `npm install`, `npm install -g .`, and `npm link` - you normally
+> never invoke it directly. The one exception is development (see below): after
+> editing any `.ts` source you must rebuild for the global command to pick it up.
+
+**Local development**
+
+Link the working tree instead of installing a copy:
+
+```bash
+npm link             # also runs the build via "prepare"
+```
+
+Because the linked `arcq` runs the compiled `dist/`, **rebuild after editing source**:
+
+```bash
+npm run build        # recompile dist/ so the global `arcq` reflects your changes
+```
+
+Handy scripts:
+
+```bash
+npm run build        # compile TypeScript -> dist/
+npm run typecheck    # type-check source + tests without emitting
+npm test             # run the test suite
+npm run lint         # lint
+```
+
+## Using arcq with coding agents
+
+The repo ships a ready-made [Agent Skill](skills/arcq/SKILL.md) covering discovery, the quoting rule, output shaping, the exit-code contract, and TLS behavior. For Claude Code, install it with:
+
+```bash
+cp -r skills/arcq ~/.claude/skills/
+```
+
+(Any agent that reads markdown instructions can use the same file.)
+
+Prefer something lighter? Drop this into your agent's instructions (e.g. a `CLAUDE.md`) to teach it the workflow:
+
+```markdown
+## Querying ArcGIS with arcq
+
+- Discover configured layers: `arcq layers --names`
+- Inspect a layer's schema: `arcq fields <layer>`
+- Query data: `arcq query <layer> "<where>" --quiet`
+- `where` is ArcGIS SQL; string literals need SINGLE quotes, so double-quote
+  the shell argument: `arcq query parcels "STATUS = 'ACTIVE'" --quiet`
+- Keep output small: `--limit <N>` caps rows, `--count` returns `{"count":N}`,
+  `--out-fields a,b,c` returns only those fields.
+- stdout is pure JSON (pipe to `jq`); the summary goes to stderr.
+- Exit codes: 0 = success (an empty `[]` is a valid answer), 1 = error,
+  2 = token invalid/expired (fix with `arcq token set <token>`).
+```
+
+## Security
+
+arcq **verifies TLS certificates by default.** Requests to a server with an untrusted or invalid certificate fail with a clear error naming the host.
+
+Some ArcGIS deployments (typically local or on-premises servers) use self-signed certificates. For those trusted hosts you can disable certificate verification, in order of precedence:
+
+1. the `--insecure` flag on any command: `arcq --insecure list my-service`
+2. the `ARCQ_INSECURE=1` environment variable
+3. `"insecure": true` at the top level of `~/.arcq.json`
+
+When insecure mode is active, arcq prints a single warning to stderr on every invocation:
+
+```
+[arcq] WARNING: TLS certificate verification is disabled
+```
+
+Verification is relaxed only for arcq's own requests (via a scoped `https.Agent`); it never sets `NODE_TLS_REJECT_UNAUTHORIZED` process-wide. Only use insecure mode against trusted hosts on trusted networks.
+
+Two more hardening details:
+
+- The auth token is stored at `~/.arcq-token` with file mode `600` (owner read/write only).
+- Requests are sent as HTTP `POST` with form-encoded bodies, so the token is never placed in a URL query string where it would land in server or proxy access logs.
+
+## Configuration
+
+arcq reads a JSON config file from `~/.arcq.json` by default. Override the path with the `ARCQ_CONFIG` environment variable.
+
+```json
+{
+  "services": {
+    "my-service": "https://example.com/arcgis/rest/services/MyService/FeatureServer"
+  },
+  "layers": {
+    "parcels": "https://example.com/arcgis/rest/services/MyService/FeatureServer/0"
+  }
+}
+```
+
+- **`services`** - named shortcuts used by `arcq list` and `arcq refresh`
+- **`layers`** - named shortcuts used by `arcq query <layer>`
+- **`insecure`** - optional; set to `true` to disable TLS verification (see [Security](#security))
+
+`services` and `layers` both accept a raw URL in place of a name.
+
+## Authentication
+
+```bash
+arcq token set <token>  # save a token to ~/.arcq-token (mode 600)
+arcq token show  # print the stored token
+```
+
+If a token is stored it is sent with every request. Unauthenticated services work without one. The token is sent in the request body, not the URL.
+
+## Commands
+
+### `arcq services add <name> <url>`
+
+Add a named service to the config. Creates `~/.arcq.json` if it doesn't exist yet.
+
+```bash
+arcq services add my-service https://example.com/arcgis/rest/services/MyService/FeatureServer
+```
+
+### `arcq refresh`
+
+Fetches the layer/table catalog for every service in the config and writes it to `~/.arcq-cache.json`. Run this once after updating the config, and again whenever services change.
+
+```bash
+arcq refresh
+```
+
+### `arcq use [name]`
+
+Selects the _active layer_ (saved to `~/.arcq-context.json`), used by subsequent `arcq query` and `arcq fields` calls.
+
+With no argument, opens an interactive [fzf](https://github.com/junegunn/fzf) picker over the cached catalog (requires `fzf` on your `PATH`):
+
+```bash
+arcq use
+# [arcq] active layer set → Parcels
+```
+
+With a name, selects non-interactively. The name is resolved in this order, first match wins:
+
+1. a config layer key (`my-service-parcels`)
+2. a cached `service:id` pair (`my-service:0`)
+3. an exact cached layer name (`Parcels`) - if the same name exists in multiple services, arcq errors and lists the qualified candidates
+
+```bash
+arcq use my-service-parcels
+arcq use my-service:0
+arcq use Parcels
+```
+
+An unknown name exits 1 with closest-match suggestions.
+
+### `arcq active`
+
+Prints the active layer and its URL, or a `no active layer` line if none is set (exit 0 either way - absence is a valid answer).
+
+```bash
+arcq active
+# my-service:0 → Parcels
+# https://example.com/arcgis/rest/services/MyService/FeatureServer/0
+```
+
+### `arcq fields [layer]`
+
+Prints a layer's field metadata as a JSON array of `{name, type, alias, length}`. Defaults to the active layer; accepts a config layer name or raw URL.
+
+```bash
+arcq fields
+arcq fields my-service-parcels
+# [
+#   { "name": "OBJECTID", "type": "esriFieldTypeOID", "alias": "OBJECTID" },
+#   { "name": "STATUS", "type": "esriFieldTypeString", "alias": "Status", "length": 50 },
+#   ...
+# ]
+```
+
+### `arcq query`
+
+Query a layer and print feature attributes as a JSON array. Results are automatically paginated (1000 records per page).
+
+```bash
+# Query the active layer
+arcq query "1=1"
+arcq query "AREA > 1000"
+
+# Query a named layer from config
+arcq query parcels "1=1"
+
+# Query a raw layer URL
+arcq query https://example.com/.../FeatureServer/0 "STATUS = 'ACTIVE'"
+
+# Shorthand - layer name or URL as the first argument
+arcq parcels "1=1"
+```
+
+Output is a JSON array of attribute objects:
+
+```json
+[
+  { "OBJECTID": 1, "AREA": 2048, "STATUS": "ACTIVE" },
+  ...
+]
+```
+
+A layer argument must be a config layer name or contain `://` to be treated as a raw URL - an unknown name exits 1 with closest-match suggestions instead of being sent as a URL. ArcGIS string literals use **single quotes** (double-quote the shell argument): `"STATUS = 'ACTIVE'"` works, `"STATUS = \"ACTIVE\""` is an ArcGIS syntax error and exits 1.
+
+#### Query flags
+
+```bash
+arcq query --out-fields OBJECTID,STATUS "1=1"   # return only the listed fields
+arcq query --limit 50 "1=1"                     # stop after 50 rows
+arcq query --count "1=1"                        # print {"count":N} only
+arcq query --order-by "NAME DESC" "1=1"         # sort server-side
+```
+
+`--count` makes a single `returnCountOnly` request; `--out-fields` and `--limit` are ignored when combined with it.
+
+#### Global flags
+
+`--insecure` is valid on any command and disables TLS certificate verification for arcq's own requests (see [Security](#security)).
+
+#### Query summary
+
+By default `arcq query` prints a short summary of what it queried to **stderr** - the resolved layer, the `where` clause, and the exact endpoint:
+
+```
+────────────────────────────────────────────────────────
+layer:    my-service:0 → Parcels
+where:    STATUS = 'ACTIVE'
+endpoint: https://example.com/.../FeatureServer/0/query
+────────────────────────────────────────────────────────
+```
+
+Because it goes to stderr, it never contaminates the JSON on stdout - `arcq query "1=1" | jq` works unchanged. Pass `-q` / `--quiet` to suppress it (useful in scripts):
+
+```bash
+arcq query "1=1" --quiet      # JSON only, no summary
+```
+
+### `arcq sync`
+
+Fetches the layer/table catalog for every service in the config and rewrites the `layers` section of `~/.arcq.json` with auto-generated keys in the form `servicename-layername` (lowercase, hyphenated). Existing `layers` entries are overwritten.
+
+```bash
+arcq sync
+# [arcq] syncing my-service...
+# [arcq] config layers updated
+```
+
+After syncing you can query any layer by its generated name:
+
+```bash
+arcq query my-service-parcels "1=1"
+```
+
+### `arcq layers`
+
+List all named layers currently in the config.
+
+```bash
+arcq layers
+# my-service-parcels → https://example.com/.../FeatureServer/0
+# my-service-roads   → https://example.com/.../FeatureServer/1
+
+arcq layers --names
+# my-service-parcels
+# my-service-roads
+```
+
+### `arcq list <service>`
+
+List all layers and tables in a service, showing their IDs and names.
+
+```bash
+arcq list my-service
+# 0 → Parcels
+# 1 → Addresses
+# 2 → Boundaries
+
+# Or use a raw URL
+arcq list https://example.com/arcgis/rest/services/MyService/FeatureServer
+```
+
+### `arcq version`
+
+Print the arcq version (also `--version` / `-V`).
+
+## Exit codes
+
+| Code | Meaning                                                                            |
+| ---- | ---------------------------------------------------------------------------------- |
+| 0    | success - an empty `[]` result is a real answer, not an error                      |
+| 1    | error: bad where clause, unknown layer, no active layer, server or request failure |
+| 2    | token invalid or expired - run `arcq token set`                                    |
+
+Errors print `error: <message>` to stderr. ArcGIS reports failures inside HTTP-200 response bodies; arcq surfaces those as errors instead of printing `[]`.
+
+## Typical workflow
+
+```bash
+# 1. Add services to ~/.arcq.json
+# 2. Populate the fzf cache and named layer shortcuts
+arcq refresh && arcq sync
+
+# 3a. Pick a layer interactively
+arcq use
+
+# 3b. Or query a named layer directly
+arcq query my-service-parcels "STATUS = 'ACTIVE'" | jq '.[0]'
+```
+
+## Contributing
+
+Bug reports and pull requests are welcome - see [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## License
+
+[MIT](LICENSE)

package/dist/bin/arcq.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/arcq.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { run } from '../index.js';
+import { ArcqError } from '../lib/errors.js';
+try {
+    await run(process.argv.slice(2));
+}
+catch (err) {
+    console.error(`error: ${err instanceof Error ? err.message : String(err)}`);
+    process.exitCode = err instanceof ArcqError ? err.exitCode : 1;
+}
+//# sourceMappingURL=arcq.js.map

package/dist/bin/arcq.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arcq.js","sourceRoot":"","sources":["../../bin/arcq.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,IAAI,CAAC;IACH,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5E,OAAO,CAAC,QAAQ,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export declare function resolveInsecure(args: string[]): {
+    insecure: boolean;
+    args: string[];
+};
+export declare function run(rawArgs: string[]): Promise<void>;

package/dist/index.js

@@ -0,0 +1,85 @@
+import tokenCmd from './lib/token-cmd.js';
+import listCmd from './lib/list-cmd.js';
+import layersCmd from './lib/layers-cmd.js';
+import servicesCmd from './lib/services-cmd.js';
+import queryCmd from './lib/query-cmd.js';
+import fieldsCmd from './lib/fields-cmd.js';
+import refreshCmd from './lib/refresh-cmd.js';
+import syncCmd from './lib/sync-cmd.js';
+import interactiveCmd from './lib/interactive-cmd.js';
+import activeCmd from './lib/active-cmd.js';
+import helpCmd from './lib/help-cmd.js';
+import versionCmd from './lib/version-cmd.js';
+import { loadConfig } from './lib/config-core.js';
+import { setInsecureTls } from './lib/tls-core.js';
+import { ArcqError } from './lib/errors.js';
+// Query flags that may legally appear before the where clause in the
+// `arcq -q "1=1"` shorthand; everything else dash-prefixed is an error here.
+const QUERY_PASSTHROUGH_FLAGS = ['-q', '--quiet', '-v', '--verbose'];
+// `--insecure` is a top-level flag valid for every command. It is resolved
+// and stripped here so it never reaches a command's own flag parser or gets
+// swallowed as a layer name or where clause. Precedence (highest first): the
+// flag, then ARCQ_INSECURE=1, then "insecure": true in the config. Returns
+// the remaining args with any --insecure occurrences removed.
+export function resolveInsecure(args) {
+    const flag = args.includes('--insecure');
+    const env = process.env.ARCQ_INSECURE;
+    const envOn = env === '1' || env?.toLowerCase() === 'true';
+    let configOn = false;
+    try {
+        configOn = loadConfig().insecure === true;
+    }
+    catch {
+        // A malformed config is surfaced by the command that loads it; the TLS
+        // decision defaults to secure here.
+    }
+    return {
+        insecure: flag || envOn || configOn,
+        args: args.filter((a) => a !== '--insecure'),
+    };
+}
+export async function run(rawArgs) {
+    const { insecure, args } = resolveInsecure(rawArgs);
+    setInsecureTls(insecure);
+    if (insecure) {
+        // One warning per invocation, always on stderr, regardless of --quiet.
+        console.error('[arcq] WARNING: TLS certificate verification is disabled');
+    }
+    const command = args[0];
+    if (!command || command === '--help' || command === '-h') {
+        return helpCmd();
+    }
+    if (command === '--version' || command === '-V' || command === 'version') {
+        return versionCmd();
+    }
+    switch (command) {
+        case 'refresh':
+            return refreshCmd();
+        case 'sync':
+            return syncCmd();
+        case 'use':
+            return interactiveCmd(args.slice(1));
+        case 'active':
+            return activeCmd();
+        case 'query':
+            return queryCmd(args.slice(1));
+        case 'fields':
+            return fieldsCmd(args.slice(1));
+        case 'list':
+            return listCmd(args.slice(1));
+        case 'layers':
+            return layersCmd(args.slice(1));
+        case 'token':
+            return tokenCmd(args.slice(1));
+        case 'services':
+            return servicesCmd(args.slice(1));
+        default:
+            if (command.startsWith('-') &&
+                !QUERY_PASSTHROUGH_FLAGS.includes(command)) {
+                throw new ArcqError(`unknown flag '${command}' - run: arcq --help`);
+            }
+            // fallback: treat as query shorthand
+            return queryCmd(args);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,oBAAoB,CAAC;AAC1C,OAAO,OAAO,MAAM,mBAAmB,CAAC;AACxC,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,WAAW,MAAM,uBAAuB,CAAC;AAChD,OAAO,QAAQ,MAAM,oBAAoB,CAAC;AAC1C,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,UAAU,MAAM,sBAAsB,CAAC;AAC9C,OAAO,OAAO,MAAM,mBAAmB,CAAC;AACxC,OAAO,cAAc,MAAM,0BAA0B,CAAC;AACtD,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,OAAO,MAAM,mBAAmB,CAAC;AACxC,OAAO,UAAU,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,qEAAqE;AACrE,6EAA6E;AAC7E,MAAM,uBAAuB,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;AAErE,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,IAAc;IAI5C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAEzC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,GAAG,KAAK,GAAG,IAAI,GAAG,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;IAE3D,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,UAAU,EAAE,CAAC,QAAQ,KAAK,IAAI,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,oCAAoC;IACtC,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,IAAI,IAAI,KAAK,IAAI,QAAQ;QACnC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAiB;IACzC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,QAAQ,EAAE,CAAC;QACb,uEAAuE;QACvE,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAExB,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACzD,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACzE,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IAED,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,SAAS;YACZ,OAAO,UAAU,EAAE,CAAC;QAEtB,KAAK,MAAM;YACT,OAAO,OAAO,EAAE,CAAC;QAEnB,KAAK,KAAK;YACR,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvC,KAAK,QAAQ;YACX,OAAO,SAAS,EAAE,CAAC;QAErB,KAAK,OAAO;YACV,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjC,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAElC,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAEhC,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAElC,KAAK,OAAO;YACV,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjC,KAAK,UAAU;YACb,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpC;YACE,IACE,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gBACvB,CAAC,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAC1C,CAAC;gBACD,MAAM,IAAI,SAAS,CAAC,iBAAiB,OAAO,sBAAsB,CAAC,CAAC;YACtE,CAAC;YACD,qCAAqC;YACrC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/lib/active-cmd.d.ts

@@ -0,0 +1 @@
+export default function activeCmd(): void;

package/dist/lib/active-cmd.js

@@ -0,0 +1,16 @@
+import { loadContext } from './context-core.js';
+// Prints the active layer. No context is a valid answer for this command,
+// so it stays informational: stdout, exit 0.
+export default function activeCmd() {
+    const ctx = loadContext();
+    if (!ctx) {
+        console.log('no active layer - run: arcq use <name>');
+        return;
+    }
+    const label = ctx.name && ctx.service != null && ctx.layerId != null
+        ? `${ctx.service}:${ctx.layerId} → ${ctx.name}`
+        : ctx.name || ctx.url;
+    console.log(label);
+    console.log(ctx.url);
+}
+//# sourceMappingURL=active-cmd.js.map

package/dist/lib/active-cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-cmd.js","sourceRoot":"","sources":["../../lib/active-cmd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,0EAA0E;AAC1E,6CAA6C;AAC7C,MAAM,CAAC,OAAO,UAAU,SAAS;IAC/B,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAE1B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GACT,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI;QACpD,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE;QAC/C,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC;IAE1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/dist/lib/arcgis-core.d.ts

@@ -0,0 +1,5 @@
+import type { CatalogLayer, LayerField, QueryParams, QueryResponse } from './types.js';
+export declare function validateToken(layerUrl: string, token: string | null): Promise<void>;
+export declare function fetchServiceCatalog(serviceUrl: string, token: string | null): Promise<CatalogLayer[]>;
+export declare function fetchLayerMetadata(layerUrl: string, token: string | null): Promise<LayerField[]>;
+export declare function queryLayer(layerUrl: string, params: QueryParams): Promise<QueryResponse>;

package/dist/lib/arcgis-core.js

@@ -0,0 +1,89 @@
+import axios from 'axios';
+import { ArcqError, tokenError } from './errors.js';
+import { getHttpsAgent, tlsErrorMessage } from './tls-core.js';
+// ArcGIS reports failures inside a 200 response body; surface them loudly.
+function throwArcGisError(error) {
+    if (error.code === 498 || error.code === 499) {
+        throw tokenError();
+    }
+    throw new ArcqError(error.code != null
+        ? `ArcGIS error ${error.code}: ${error.message}`
+        : error.message);
+}
+// Params go in a form-encoded POST body rather than the URL query string, so
+// the token never lands in server/proxy access logs. Null/undefined values
+// are omitted rather than serialized as "null"/"undefined".
+function formBody(params) {
+    const body = new URLSearchParams();
+    for (const [key, value] of Object.entries(params)) {
+        if (value === null || value === undefined)
+            continue;
+        body.append(key, String(value));
+    }
+    return body;
+}
+async function postForm(url, params) {
+    const agent = getHttpsAgent();
+    try {
+        const res = await axios.post(url, formBody(params), {
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            ...(agent ? { httpsAgent: agent } : {}),
+        });
+        return res.data;
+    }
+    catch (error) {
+        const tlsMessage = tlsErrorMessage(error, url);
+        throw tlsMessage ? new ArcqError(tlsMessage) : error;
+    }
+}
+export async function validateToken(layerUrl, token) {
+    const data = await postForm(layerUrl, {
+        f: 'json',
+        token,
+    });
+    if (data.error) {
+        throwArcGisError(data.error);
+    }
+}
+export async function fetchServiceCatalog(serviceUrl, token) {
+    const data = await postForm(serviceUrl, {
+        f: 'json',
+        token,
+    });
+    if (data.error) {
+        throwArcGisError(data.error);
+    }
+    const layers = data.layers || [];
+    const tables = data.tables || [];
+    return [...layers, ...tables].map((l) => ({
+        id: l.id,
+        name: l.name,
+        type: l.type || 'layer',
+        url: `${serviceUrl}/${l.id}`,
+    }));
+}
+export async function fetchLayerMetadata(layerUrl, token) {
+    const data = await postForm(layerUrl, {
+        f: 'json',
+        token,
+    });
+    if (data.error) {
+        throwArcGisError(data.error);
+    }
+    return (data.fields ?? []).map((f) => {
+        const field = { name: f.name, type: f.type };
+        if (f.alias != null)
+            field.alias = f.alias;
+        if (f.length != null)
+            field.length = f.length;
+        return field;
+    });
+}
+export async function queryLayer(layerUrl, params) {
+    const data = await postForm(`${layerUrl}/query`, params);
+    if (data.error) {
+        throwArcGisError(data.error);
+    }
+    return data;
+}
+//# sourceMappingURL=arcgis-core.js.map

package/dist/lib/arcgis-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arcgis-core.js","sourceRoot":"","sources":["../../lib/arcgis-core.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAY/D,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,KAAkB;IAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;QAC7C,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,SAAS,CACjB,KAAK,CAAC,IAAI,IAAI,IAAI;QAChB,CAAC,CAAC,gBAAgB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;QAChD,CAAC,CAAC,KAAK,CAAC,OAAO,CAClB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,4DAA4D;AAC5D,SAAS,QAAQ,CAAC,MAA+B;IAC/C,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACpD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,MAA+B;IAE/B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAI,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE;YACrD,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,UAAU,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,KAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAmB,QAAQ,EAAE;QACtD,CAAC,EAAE,MAAM;QACT,KAAK;KACN,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,KAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAyB,UAAU,EAAE;QAC9D,CAAC,EAAE,MAAM;QACT,KAAK;KACN,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAEjC,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,OAAO;QACvB,GAAG,EAAE,GAAG,UAAU,IAAI,CAAC,CAAC,EAAE,EAAE;KAC7B,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,KAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAwB,QAAQ,EAAE;QAC3D,CAAC,EAAE,MAAM;QACT,KAAK;KACN,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACnC,MAAM,KAAK,GAAe,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI;YAAE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAC3C,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI;YAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,QAAgB,EAChB,MAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAgB,GAAG,QAAQ,QAAQ,EAAE,MAAM,CAAC,CAAC;IAExE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/cache-core.d.ts

@@ -0,0 +1,4 @@
+import type { Cache } from './types.js';
+export declare const CACHE_PATH: string;
+export declare function loadCache(): Cache;
+export declare function saveCache(cache: Cache): void;

package/dist/lib/cache-core.js

@@ -0,0 +1,13 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+export const CACHE_PATH = path.join(os.homedir(), '.arcq-cache.json');
+export function loadCache() {
+    if (!fs.existsSync(CACHE_PATH))
+        return {};
+    return JSON.parse(fs.readFileSync(CACHE_PATH, 'utf-8'));
+}
+export function saveCache(cache) {
+    fs.writeFileSync(CACHE_PATH, JSON.stringify(cache, null, 2));
+}
+//# sourceMappingURL=cache-core.js.map

package/dist/lib/cache-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-core.js","sourceRoot":"","sources":["../../lib/cache-core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAGxB,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAEtE,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAU,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAY;IACpC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/lib/config-core.d.ts

@@ -0,0 +1,4 @@
+import type { Config } from './types.js';
+export declare function resolveConfigPath(): string;
+export declare function loadConfig(): Config;
+export declare function saveConfig(config: Config): void;