@scrthq/runlog 0.0.37 → 0.0.38

package/dist/runlog.js

@@ -7368,9 +7368,9 @@ var require_dist = __commonJS({
 });
 
 // packages/cli/src/bin.ts
-var import_yaml3 = __toESM(require_dist(), 1);
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync, existsSync as existsSync2 } from "node:fs";
-import { basename, dirname, resolve as resolve2 } from "node:path";
+var import_yaml4 = __toESM(require_dist(), 1);
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2, existsSync as existsSync3 } from "node:fs";
+import { basename, dirname, resolve as resolve3 } from "node:path";
 import { createHash } from "node:crypto";
 
 // node_modules/zod/v4/classic/external.js
@@ -27813,6 +27813,11 @@ async function signPack(document, privateKey, signedBy) {
     ...signedBy ? { signedBy } : {}
   };
 }
+async function signBytes(bytes2, privateKey) {
+  const key = await crypto.subtle.importKey("pkcs8", fromBase64Url(privateKey), ALGORITHM, false, ["sign"]);
+  const value = await crypto.subtle.sign(SIGN, key, bytes2);
+  return toBase64Url(new Uint8Array(value));
+}
 async function derivePublicKey(privateKey) {
   const key = await crypto.subtle.importKey(
     "pkcs8",
@@ -28203,9 +28208,199 @@ function runFixtures(pack) {
 }
 
 // packages/cli/src/sign.ts
+var import_yaml3 = __toESM(require_dist(), 1);
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, chmodSync as chmodSync2 } from "node:fs";
+import { resolve as resolve2 } from "node:path";
+
+// packages/cli/src/account.ts
 var import_yaml2 = __toESM(require_dist(), 1);
-import { readFileSync, writeFileSync, existsSync, chmodSync } from "node:fs";
-import { resolve } from "node:path";
+import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { createInterface } from "node:readline";
+var DEFAULT_API = "https://runlog.scrthq.com/api";
+function configDir() {
+  const base = process.env["RUNLOG_CONFIG_DIR"] ?? (process.platform === "win32" ? join(process.env["APPDATA"] ?? join(homedir(), "AppData", "Roaming"), "runlog") : join(process.env["XDG_CONFIG_HOME"] ?? join(homedir(), ".config"), "runlog"));
+  return base;
+}
+var credentialsPath = () => join(configDir(), "credentials.json");
+function credentials() {
+  const fromEnv = process.env["RUNLOG_API_KEY"];
+  if (fromEnv) return { api: process.env["RUNLOG_API"] ?? DEFAULT_API, key: fromEnv, savedAt: "" };
+  try {
+    const raw = JSON.parse(readFileSync(credentialsPath(), "utf8"));
+    if (typeof raw.key !== "string" || typeof raw.api !== "string") return null;
+    return { api: raw.api, key: raw.key, savedAt: raw.savedAt ?? "" };
+  } catch {
+    return null;
+  }
+}
+async function ask(prompt, hidden = false) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+  return new Promise((done) => {
+    if (hidden) {
+      const out = process.stdout;
+      process.stdout.write(prompt);
+      const original = out.write.bind(out);
+      out.write = ((chunk, ...rest) => {
+        if (typeof chunk === "string" && chunk !== "\n" && chunk !== "\r\n") return true;
+        return original(chunk, ...rest);
+      });
+      rl.question("", (answer) => {
+        out.write = original;
+        process.stdout.write("\n");
+        rl.close();
+        done(answer.trim());
+      });
+    } else {
+      rl.question(prompt, (answer) => {
+        rl.close();
+        done(answer.trim());
+      });
+    }
+  });
+}
+async function api(method, path, body) {
+  const creds = credentials();
+  if (!creds) throw new Error("not signed in: run `runlog login` with a key from your profile page");
+  const response = await fetch(`${creds.api.replace(/\/$/, "")}${path}`, {
+    method,
+    headers: { authorization: `Bearer ${creds.key}`, ...body !== void 0 ? { "content-type": "application/json" } : {} },
+    ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+  });
+  const text = await response.text();
+  let parsed = null;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(`the API at ${creds.api} did not answer as expected (${response.status})`);
+  }
+  if (response.status === 401) throw new Error("that key is not accepted; make a new one on your profile page and `runlog login` again");
+  if (response.status >= 400) {
+    const said = parsed?.error;
+    throw new Error(said ?? `the API said ${response.status}`);
+  }
+  return parsed;
+}
+async function cmdLogin(args) {
+  const apiUrl = flag(args, "--api") ?? process.env["RUNLOG_API"] ?? DEFAULT_API;
+  console.log("Paste a command-line key from your profile page in Runlog. It is not shown as you type.");
+  const key = await ask("key: ", true);
+  if (!key.startsWith("rl_")) {
+    console.error("that does not look like a Runlog key; they begin with rl_");
+    return 1;
+  }
+  const dir = configDir();
+  mkdirSync(dir, { recursive: true });
+  const saved = { api: apiUrl, key, savedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  writeFileSync(credentialsPath(), `${JSON.stringify(saved, null, 2)}
+`, "utf8");
+  try {
+    chmodSync(credentialsPath(), 384);
+  } catch {
+  }
+  try {
+    const me = await api("GET", "/me");
+    const who = me.profile?.name ?? me.profile?.email ?? "you";
+    console.log(`signed in as ${who} at ${apiUrl}`);
+    return 0;
+  } catch (error61) {
+    unlinkSync(credentialsPath());
+    console.error(error61 instanceof Error ? error61.message : String(error61));
+    return 1;
+  }
+}
+function cmdLogout() {
+  if (existsSync(credentialsPath())) {
+    unlinkSync(credentialsPath());
+    console.log("signed out; the key is still valid until you revoke it on your profile page");
+  } else {
+    console.log("not signed in");
+  }
+  return 0;
+}
+async function cmdWhoami() {
+  try {
+    const me = await api("GET", "/me");
+    const claims = await api("GET", "/claims");
+    console.log(`${me.profile?.name ?? "(no name)"} <${me.profile?.email ?? "?"}>  ${me.sub}`);
+    console.log(claims.claims.length > 0 ? `claimed signing keys: ${claims.claims.map((c) => c.fingerprint).join(", ")}` : "no claimed signing keys yet: `runlog claim key.json`");
+    return 0;
+  } catch (error61) {
+    console.error(error61 instanceof Error ? error61.message : String(error61));
+    return 1;
+  }
+}
+function readKey(path) {
+  const key = JSON.parse(readFileSync(resolve(path), "utf8"));
+  if (!key.privateKey || !key.publicKey) throw new Error(`${path} is not a runlog signing key`);
+  return { publicKey: key.publicKey, privateKey: key.privateKey, fingerprint: key.fingerprint ?? "" };
+}
+async function cmdClaim(args) {
+  const keyPath = args.filter((a) => !a.startsWith("-"))[0];
+  if (!keyPath) {
+    console.error("usage: runlog claim key.json");
+    return 2;
+  }
+  try {
+    const key = readKey(keyPath);
+    const { nonce } = await api("POST", "/claims/nonce");
+    const signature = await signBytes(new TextEncoder().encode(nonce), key.privateKey);
+    const { claim: claim2 } = await api("POST", "/claims", { publicKey: key.publicKey, nonce, signature });
+    console.log(`claimed ${claim2.fingerprint}${claim2.name ? ` as ${claim2.name}` : ""}`);
+    console.log("packs signed with this key now show your name in the app");
+    return 0;
+  } catch (error61) {
+    console.error(error61 instanceof Error ? error61.message : String(error61));
+    return 1;
+  }
+}
+async function requireClaimed(publicKey) {
+  const fp = await fingerprint(publicKey);
+  const { claims } = await api("GET", "/claims");
+  if (!claims.some((c) => c.fingerprint === fp)) {
+    throw new Error(`this key (${fp}) is not claimed by your account: run \`runlog claim key.json\` first, so the app can name you`);
+  }
+}
+async function cmdPublish(args) {
+  const input2 = args.filter((a) => !a.startsWith("-"))[0];
+  if (!input2) {
+    console.error("usage: runlog publish <pack.yaml|pack.json>");
+    return 2;
+  }
+  try {
+    const path = resolve(input2);
+    const text = readFileSync(path, "utf8");
+    const format = detectFormat(path);
+    const doc = format === "json" ? JSON.parse(text) : import_yaml2.default.parse(text);
+    const id = String(doc["id"] ?? "");
+    if (!id) throw new Error("the pack has no id");
+    const { createHash: createHash2 } = await import("node:crypto");
+    const hash2 = createHash2("sha256").update(text).digest("hex").slice(0, 16);
+    const at = (/* @__PURE__ */ new Date()).toISOString();
+    await api("PUT", `/packs/${encodeURIComponent(id)}`, {
+      title: String(doc["title"] ?? id),
+      version: String(doc["version"] ?? ""),
+      format,
+      filename: input2.split(/[\\/]/).pop(),
+      importedAt: at,
+      updatedAt: at,
+      hash: hash2,
+      source: text
+    });
+    console.log(`published ${id} to your library; it reaches your devices on their next sync`);
+    return 0;
+  } catch (error61) {
+    console.error(error61 instanceof Error ? error61.message : String(error61));
+    return 1;
+  }
+}
+function flag(args, name) {
+  const at = args.indexOf(name);
+  return at === -1 ? void 0 : args[at + 1];
+}
+
+// packages/cli/src/sign.ts
 var RED = "\x1B[31m";
 var GREEN = "\x1B[32m";
 var YELLOW = "\x1B[33m";
@@ -28213,13 +28408,13 @@ var DIM = "\x1B[2m";
 var RESET = "\x1B[0m";
 var useColor = process.stdout.isTTY && !process.env.NO_COLOR;
 var paint = (code, text) => useColor ? `${code}${text}${RESET}` : text;
-function flag(args, name) {
+function flag2(args, name) {
   const at = args.indexOf(name);
   return at === -1 ? void 0 : args[at + 1];
 }
 async function cmdKeygen(args) {
-  const out = resolve(flag(args, "-o") ?? flag(args, "--out") ?? "runlog-key.json");
-  if (existsSync(out)) {
+  const out = resolve2(flag2(args, "-o") ?? flag2(args, "--out") ?? "runlog-key.json");
+  if (existsSync2(out)) {
     console.error(paint(RED, `refusing to overwrite ${out}`));
     console.error(paint(DIM, "  a signing key cannot be recovered; delete it yourself if you mean to"));
     return 1;
@@ -28232,10 +28427,10 @@ async function cmdKeygen(args) {
     fingerprint: await fingerprint(pair.publicKey),
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  writeFileSync(out, `${JSON.stringify(key, null, 2)}
+  writeFileSync2(out, `${JSON.stringify(key, null, 2)}
 `, "utf8");
   try {
-    chmodSync(out, 384);
+    chmodSync2(out, 384);
   } catch {
   }
   console.log(`wrote ${out}`);
@@ -28253,14 +28448,14 @@ async function cmdKeygen(args) {
 }
 async function cmdSign(args) {
   const input2 = args.filter((a) => !a.startsWith("-"))[0];
-  const keyPath = flag(args, "--key") ?? flag(args, "-k");
+  const keyPath = flag2(args, "--key") ?? flag2(args, "-k");
   if (!input2 || !keyPath) {
     console.error('usage: runlog sign <pack.yaml> --key runlog-key.json [--as "Your Name"]');
     return 2;
   }
   let key;
   try {
-    key = JSON.parse(readFileSync(resolve(keyPath), "utf8"));
+    key = JSON.parse(readFileSync2(resolve2(keyPath), "utf8"));
   } catch {
     console.error(paint(RED, `could not read the key at ${keyPath}`));
     return 1;
@@ -28269,16 +28464,22 @@ async function cmdSign(args) {
     console.error(paint(RED, `${keyPath} has no private key in it`));
     return 1;
   }
-  const path = resolve(input2);
-  const text = readFileSync(path, "utf8");
+  try {
+    await requireClaimed(key.publicKey);
+  } catch (error61) {
+    console.error(paint(RED, error61 instanceof Error ? error61.message : String(error61)));
+    return 1;
+  }
+  const path = resolve2(input2);
+  const text = readFileSync2(path, "utf8");
   const format = detectFormat(path);
-  const document = import_yaml2.default.parse(text);
-  const signature = await signPack(document, key.privateKey, flag(args, "--as"));
+  const document = import_yaml3.default.parse(text);
+  const signature = await signPack(document, key.privateKey, flag2(args, "--as"));
   const signed = { ...document, signature };
-  writeFileSync(
+  writeFileSync2(
     path,
     format === "json" ? `${JSON.stringify(signed, null, 2)}
-` : import_yaml2.default.stringify(signed, { lineWidth: 90 }),
+` : import_yaml3.default.stringify(signed, { lineWidth: 90 }),
     "utf8"
   );
   console.log(`${paint(GREEN, "signed")} ${input2}`);
@@ -28292,65 +28493,71 @@ async function cmdSign(args) {
 }
 async function cmdIssue(args) {
   const input2 = args.filter((a) => !a.startsWith("-"))[0];
-  const to = flag(args, "--to");
+  const to = flag2(args, "--to");
   if (!input2 || !to) {
     console.error(
       'usage: runlog issue <pack.yaml> --to "Buyer Name" [--ref order-123] [--key key.json] [-o out.yaml]'
     );
     return 2;
   }
-  const path = resolve(input2);
-  const text = readFileSync(path, "utf8");
+  const path = resolve2(input2);
+  const text = readFileSync2(path, "utf8");
   const format = detectFormat(path);
-  const document = import_yaml2.default.parse(text);
+  const document = import_yaml3.default.parse(text);
   const { signature: _old, ...base } = document;
   const stamped = {
     ...base,
     issue: {
       to,
-      ...flag(args, "--ref") ? { reference: flag(args, "--ref") } : {},
+      ...flag2(args, "--ref") ? { reference: flag2(args, "--ref") } : {},
       issuedAt: (/* @__PURE__ */ new Date()).toISOString()
     }
   };
-  const keyPath = flag(args, "--key") ?? flag(args, "-k");
+  const keyPath = flag2(args, "--key") ?? flag2(args, "-k");
   let fingerprintText = "";
   if (keyPath) {
     let key;
     try {
-      key = JSON.parse(readFileSync(resolve(keyPath), "utf8"));
+      key = JSON.parse(readFileSync2(resolve2(keyPath), "utf8"));
     } catch {
       console.error(paint(RED, `could not read the key at ${keyPath}`));
       return 1;
     }
-    stamped.signature = await signPack(stamped, key.privateKey, flag(args, "--as"));
+    try {
+      await requireClaimed(key.publicKey);
+    } catch (error61) {
+      console.error(paint(RED, error61 instanceof Error ? error61.message : String(error61)));
+      return 1;
+    }
+    stamped.signature = await signPack(stamped, key.privateKey, flag2(args, "--as"));
     fingerprintText = key.fingerprint;
   }
   const sealing = args.includes("--seal");
-  const licenseKey = sealing ? flag(args, "--license") ?? generateLicenseKey() : null;
+  const licenseKey = sealing ? flag2(args, "--license") ?? generateLicenseKey() : null;
   const extension = sealing ? "rlpack" : format;
-  const out = resolve(
-    flag(args, "-o") ?? flag(args, "--out") ?? defaultIssueName(document, to, extension)
+  const out = resolve2(
+    flag2(args, "-o") ?? flag2(args, "--out") ?? defaultIssueName(document, to, extension)
   );
-  if (existsSync(out)) {
+  if (existsSync2(out)) {
     console.error(paint(RED, `refusing to overwrite ${out}`));
     return 1;
   }
   if (licenseKey) {
     const bytes2 = await seal(stamped, licenseKey, {
-      ...flag(args, "--ref") ? { ref: flag(args, "--ref") } : {},
+      ...flag2(args, "--ref") ? { ref: flag2(args, "--ref") } : {},
       ...typeof stamped.title === "string" ? { title: stamped.title } : {}
     });
-    writeFileSync(out, bytes2);
+    writeFileSync2(out, bytes2);
   } else {
-    writeFileSync(
+    writeFileSync2(
       out,
       format === "json" ? `${JSON.stringify(stamped, null, 2)}
-` : import_yaml2.default.stringify(stamped, { lineWidth: 90 }),
+` : import_yaml3.default.stringify(stamped, { lineWidth: 90 }),
       "utf8"
     );
   }
   console.log(`${paint(GREEN, "issued")} ${out}`);
-  console.log(paint(DIM, `  to ${to}${flag(args, "--ref") ? ` \xB7 ref ${flag(args, "--ref")}` : ""}`));
+  console.log(paint(DIM, `  to ${to}${flag2(args, "--ref") ? ` \xB7 ref ${flag2(args, "--ref")}` : ""}`));
   if (keyPath) {
     console.log(paint(DIM, `  signed \xB7 fingerprint ${fingerprintText}`));
     console.log(
@@ -28440,12 +28647,12 @@ function printDiagnostics(diagnostics, file2) {
   console.error(`  ${parts.join(", ")} in ${file2}`);
 }
 function read(path) {
-  const abs = resolve2(path);
-  if (!existsSync2(abs)) {
+  const abs = resolve3(path);
+  if (!existsSync3(abs)) {
     console.error(paint2(RED2, `no such file: ${path}`));
     process.exit(2);
   }
-  const text = readFileSync2(abs, "utf8");
+  const text = readFileSync3(abs, "utf8");
   const result = loadPackText(text, detectFormat(abs));
   return { text, pack: result.pack, diagnostics: result.diagnostics };
 }
@@ -28476,7 +28683,7 @@ async function cmdValidate(args) {
       console.log(
         `${paint2(GREEN2, "ok")} ${paint2(BOLD, pack.title)} ${paint2(DIM2, `v${pack.version}`)} \u2014 ${tables} table${tables === 1 ? "" : "s"}, ${entries} entries, ${Object.keys(pack.modes).length} mode(s)` + (diagnostics.length ? paint2(YELLOW2, `, ${diagnostics.length} warning(s)`) : "")
       );
-      await reportSignature(import_yaml3.default.parse(readFileSync2(resolve2(file2), "utf8")));
+      await reportSignature(import_yaml4.default.parse(readFileSync3(resolve3(file2), "utf8")));
     }
   }
   return worst;
@@ -28501,9 +28708,9 @@ function cmdBundle(args) {
   const body = JSON.stringify(pack, null, 2);
   const hash2 = createHash("sha256").update(body).digest("hex").slice(0, 16);
   const bundled = { ...pack, bundledAt: (/* @__PURE__ */ new Date()).toISOString(), contentHash: hash2 };
-  const out = outIndex >= 0 && args[outIndex + 1] ? resolve2(args[outIndex + 1]) : resolve2(`${pack.id}-${pack.version}.pack.json`);
-  mkdirSync(dirname(out), { recursive: true });
-  writeFileSync2(out, `${JSON.stringify(bundled, null, 2)}
+  const out = outIndex >= 0 && args[outIndex + 1] ? resolve3(args[outIndex + 1]) : resolve3(`${pack.id}-${pack.version}.pack.json`);
+  mkdirSync2(dirname(out), { recursive: true });
+  writeFileSync3(out, `${JSON.stringify(bundled, null, 2)}
 `, "utf8");
   console.log(`${paint2(GREEN2, "bundled")} ${out} ${paint2(DIM2, `sha256:${hash2}`)}`);
   if (!pack.license.redistributable) {
@@ -28556,12 +28763,12 @@ function cmdTest(args) {
 }
 function cmdInit(args) {
   const name = args.filter((a) => !a.startsWith("-"))[0] ?? "my-pack";
-  const out = resolve2(`${name}.yaml`);
-  if (existsSync2(out)) {
+  const out = resolve3(`${name}.yaml`);
+  if (existsSync3(out)) {
     console.error(paint2(RED2, `refusing to overwrite ${out}`));
     return 1;
   }
-  writeFileSync2(out, SKELETON.replaceAll("__NAME__", name), "utf8");
+  writeFileSync3(out, SKELETON.replaceAll("__NAME__", name), "utf8");
   console.log(`${paint2(GREEN2, "created")} ${out}`);
   console.log(paint2(DIM2, `  next: runlog validate ${name}.yaml`));
   return 0;
@@ -28628,11 +28835,20 @@ usage:
   runlog issue    <pack> --to "Name"     stamp a copy with a buyer's name and sign it
                     [--seal]             \u2026and seal it, so it needs a license key to open
 
---strict makes warnings fail, which is what you want in CI.
+  runlog login    [--api URL]            paste a key from your profile page, once
+  runlog whoami                          who the command line is acting as
+  runlog claim    key.json               prove a signing key is yours; the app then names you
+  runlog publish  <pack>                 put a pack in your library, on every device
+  runlog logout                          forget the saved key
+
+--strict makes warnings fail, which is what you want in CI. In CI, set
+RUNLOG_API_KEY instead of running login.
 
 Signing proves authorship. It does not restrict copying and cannot: the app
 has to read every word of a pack to play it. What it gives you is that an
-altered copy can no longer claim to be yours.
+altered copy can no longer claim to be yours \u2014 and, once the key is claimed
+by your account, that the app names you beside it. sign and issue refuse a
+key that is not claimed.
 `;
 async function main(argv) {
   const [command, ...args] = argv;
@@ -28649,6 +28865,16 @@ async function main(argv) {
       return cmdSign(args);
     case "issue":
       return cmdIssue(args);
+    case "login":
+      return cmdLogin(args);
+    case "logout":
+      return cmdLogout();
+    case "whoami":
+      return cmdWhoami();
+    case "claim":
+      return cmdClaim(args);
+    case "publish":
+      return cmdPublish(args);
     case "init":
       return cmdInit(args);
     case "-h":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scrthq/runlog",
-  "version": "0.0.37",
+  "version": "0.0.38",
   "description": "Validate, lint, bundle and test Runlog rule packs.",
   "type": "module",
   "license": "MIT",