@mafdet/cli 0.3.0

package/dist/output/money.js

@@ -0,0 +1,35 @@
+/**
+ * Money never becomes a JavaScript number.
+ *
+ * The API speaks integer micro-USD as decimal strings, and 0.1 + 0.2 is the
+ * reason: a float round-trip can turn a balance into a number that does not
+ * match the invoice. Everything here is BigInt in, string out.
+ */
+const MICROS_PER_USD = 1000000n;
+export function parseMicroUsd(value) {
+    if (typeof value === "bigint")
+        return value;
+    const text = String(value).trim();
+    if (!/^-?\d+$/.test(text)) {
+        throw new TypeError(`not an integer micro-USD amount: ${text}`);
+    }
+    return BigInt(text);
+}
+/**
+ * Render micro-USD as dollars. `minimumFractionDigits` keeps small amounts
+ * readable ($0.00 is wrong for 1 µ$, so tiny values keep their precision).
+ */
+export function formatUsd(microUsd, options = {}) {
+    const micros = parseMicroUsd(microUsd);
+    const negative = micros < 0n;
+    const abs = negative ? -micros : micros;
+    const whole = abs / MICROS_PER_USD;
+    const fraction = (abs % MICROS_PER_USD).toString().padStart(6, "0");
+    const minDigits = options.minFractionDigits ?? 2;
+    // Trim trailing zeros but never below the minimum, and never to nothing:
+    // a sub-cent charge must stay visible rather than round to $0.00.
+    let digits = fraction.replace(/0+$/, "");
+    if (digits.length < minDigits)
+        digits = fraction.slice(0, minDigits);
+    return `${negative ? "-" : ""}$${whole}.${digits}`;
+}

package/dist/output/write-file.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Write a result file without ever destroying one silently.
+ *
+ * Two rules: an existing file is refused unless `--force`, and the write is
+ * atomic — a temp file in the same directory, then a rename. A crash or a full
+ * disk halfway through must not leave a truncated .wav where the old one was.
+ */
+export declare function writeOutputFile(path: string, bytes: Uint8Array | string, options?: {
+    force?: boolean;
+}): void;
+//# sourceMappingURL=write-file.d.ts.map

package/dist/output/write-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-file.d.ts","sourceRoot":"","sources":["../../src/output/write-file.ts"],"names":[],"mappings":"AAMA;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,UAAU,GAAG,MAAM,EAC1B,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,IAAI,CA4BN"}

package/dist/output/write-file.js

@@ -0,0 +1,38 @@
+import { existsSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { ExitCode } from "./exit-codes.js";
+import { ApiError } from "../api/errors.js";
+/**
+ * Write a result file without ever destroying one silently.
+ *
+ * Two rules: an existing file is refused unless `--force`, and the write is
+ * atomic — a temp file in the same directory, then a rename. A crash or a full
+ * disk halfway through must not leave a truncated .wav where the old one was.
+ */
+export function writeOutputFile(path, bytes, options = {}) {
+    if (existsSync(path) && !options.force) {
+        throw new ApiError({
+            kind: "request",
+            exitCode: ExitCode.Usage,
+            message: `${path} already exists - pass --force to overwrite it`,
+        });
+    }
+    const temp = join(dirname(path) || ".", `.mafdet-${process.pid}-${Date.now()}.tmp`);
+    try {
+        writeFileSync(temp, bytes);
+        renameSync(temp, path);
+    }
+    catch (error) {
+        try {
+            unlinkSync(temp);
+        }
+        catch {
+            // The temp file may never have been created; nothing to clean up.
+        }
+        throw new ApiError({
+            kind: "request",
+            exitCode: ExitCode.Usage,
+            message: `cannot write ${path}: ${error.message}`,
+        });
+    }
+}

package/dist/security/redact.d.ts

@@ -0,0 +1,16 @@
+export declare const REDACTED = "<redacted>";
+/** Redact anything credential-shaped in a single string. */
+export declare function redact(value: string): string;
+/**
+ * Redact recursively through anything printable — objects, arrays, Errors.
+ * Used for `--debug` dumps and for error reporting, where the shape of the
+ * value is not known in advance.
+ */
+export declare function redactDeep(value: unknown): unknown;
+/**
+ * How a key may be shown: enough to tell two keys apart, never enough to use
+ * one. Mafdet keys carry a meaningful prefix (`sk-mafdet-live-…`), so the
+ * environment is visible without exposing the secret.
+ */
+export declare function keyFingerprint(apiKey: string): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/security/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/security/redact.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,QAAQ,eAAe,CAAC;AAErC,4DAA4D;AAC5D,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAY5C;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAkBlD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAOrD"}

package/dist/security/redact.js

@@ -0,0 +1,61 @@
+// Every string that can reach a terminal, a log, an error or telemetry passes
+// through here first. Credentials leak through the boring paths — an exception
+// message, a --debug dump, a pasted bug report — so redaction lives at the
+// output boundary rather than at each call site that happens to remember.
+const API_KEY = /sk-[A-Za-z0-9_.-]{4,}/g;
+/** LiteLLM quotes the key's SHA-256 in 401 and 429 messages. */
+const KEY_HASH = /\b[0-9a-f]{32,}\b/g;
+const BEARER = /\b(?:Bearer|Authorization:)\s+\S+/gi;
+export const REDACTED = "<redacted>";
+/** Redact anything credential-shaped in a single string. */
+export function redact(value) {
+    return value
+        .replace(BEARER, "Bearer " + REDACTED)
+        .replace(API_KEY, (match, offset, whole) => 
+    // Idempotent: `sk-mafdet-live-<redacted>` is a fingerprint this module
+    // already produced, and eating its prefix would leave "<redacted>"
+    // twice — throwing away the environment the operator needs to see.
+    whole.slice(offset + match.length).startsWith(REDACTED)
+        ? match
+        : REDACTED)
+        .replace(KEY_HASH, REDACTED);
+}
+/**
+ * Redact recursively through anything printable — objects, arrays, Errors.
+ * Used for `--debug` dumps and for error reporting, where the shape of the
+ * value is not known in advance.
+ */
+export function redactDeep(value) {
+    if (typeof value === "string")
+        return redact(value);
+    if (Array.isArray(value))
+        return value.map(redactDeep);
+    if (value instanceof Error) {
+        const clone = new Error(redact(value.message));
+        clone.name = value.name;
+        if (value.stack)
+            clone.stack = redact(value.stack);
+        return clone;
+    }
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, inner]) => [
+            key,
+            redactDeep(inner),
+        ]));
+    }
+    return value;
+}
+/**
+ * How a key may be shown: enough to tell two keys apart, never enough to use
+ * one. Mafdet keys carry a meaningful prefix (`sk-mafdet-live-…`), so the
+ * environment is visible without exposing the secret.
+ */
+export function keyFingerprint(apiKey) {
+    const trimmed = apiKey.trim();
+    if (trimmed.length === 0)
+        return "<none>";
+    // Keep the scheme and environment segments, drop the secret one.
+    const parts = trimmed.split("-");
+    const head = parts.slice(0, 3).join("-");
+    return `${head}-${REDACTED}`;
+}

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@mafdet/cli",
+  "version": "0.3.0",
+  "description": "Mafdet AI command line — model calls, account queries, and a permissioned local agent.",
+  "type": "module",
+  "license": "MIT",
+  "author": "Mafdet AI",
+  "homepage": "https://www.mafdet.ai",
+  "bugs": {
+    "email": "support@mafdet.ai"
+  },
+  "keywords": [
+    "mafdet",
+    "cli",
+    "ai",
+    "llm",
+    "agent",
+    "openai-compatible"
+  ],
+  "bin": {
+    "mafdet": "dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "README.zh-CN.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "lint": "prettier --check \"src/**/*.ts\" \"test/**/*.mjs\" package.json tsconfig.json",
+    "test": "pnpm run build && node --test \"test/**/*.test.mjs\"",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  },
+  "dependencies": {
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "^20.19.0",
+    "typescript": "6.0.3"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}