@whatcha/cli 0.0.0-stage → 0.3.0

package/dist/lib/image-upload.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PUBLIC_SQUARE_GROUP_ID = exports.MAX_UPLOAD_BYTES = void 0;
+exports.sniffImageType = sniffImageType;
+exports.readImageFile = readImageFile;
+exports.uploadImage = uploadImage;
+exports.wikiImageRef = wikiImageRef;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const errors_1 = require("../errors");
+/**
+ * Local image files to media assets, for `whatcha wiki write --image/--cover`
+ * and `whatcha wiki cover` (#1667). `readImageFile` also checks the file
+ * `whatcha profile-add --avatar` sends (#1699).
+ *
+ * The upload is the app's own three steps -- `POST /uploads` (into the
+ * page's group), PUT the bytes to the signed URL, `POST /uploads/:id/complete`
+ * -- so the server applies the same limits it applies to an entry's photos.
+ * The checks here are those same limits, made before anything is sent, so a
+ * wrong file is a clear message instead of a half-done upload:
+ *
+ * - at most 40 MB (the API's UPLOAD_LIMITS.maxFileBytes);
+ * - a JPEG, PNG, WebP, GIF or AVIF image -- the image types the API accepts,
+ *   and a wiki page shows nothing else. The type is read from the file's
+ *   first bytes, the way the server resolves it; the extension only fills in
+ *   for an AVIF variant the magic-number check does not recognise.
+ */
+exports.MAX_UPLOAD_BYTES = 40 * 1024 * 1024;
+/** Public Square's group: where the public wiki's images are uploaded. */
+exports.PUBLIC_SQUARE_GROUP_ID = "00000000-0000-0000-0000-0000000000aa";
+const BY_EXTENSION = {
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".png": "image/png",
+    ".webp": "image/webp",
+    ".gif": "image/gif",
+    ".avif": "image/avif",
+};
+function ascii(bytes, start, end) {
+    return String.fromCharCode(...bytes.subarray(start, end));
+}
+/** The image type the bytes are, or null. Mirrors the API's core/media/image-type.ts. */
+function sniffImageType(bytes) {
+    if (bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff)
+        return "image/jpeg";
+    if (bytes.length >= 8 && bytes[0] === 0x89 && ascii(bytes, 1, 4) === "PNG" && bytes[4] === 0x0d && bytes[5] === 0x0a) {
+        return "image/png";
+    }
+    if (bytes.length >= 6 && (ascii(bytes, 0, 6) === "GIF87a" || ascii(bytes, 0, 6) === "GIF89a"))
+        return "image/gif";
+    if (bytes.length >= 12 && ascii(bytes, 0, 4) === "RIFF" && ascii(bytes, 8, 12) === "WEBP")
+        return "image/webp";
+    if (bytes.length >= 16 && ascii(bytes, 4, 8) === "ftyp") {
+        const box = Math.min(((bytes[0] << 24) | (bytes[1] << 16) | (bytes[2] << 8) | bytes[3]) >>> 0, bytes.length, 64);
+        const brands = [ascii(bytes, 8, 12)];
+        for (let i = 16; i + 4 <= box; i += 4)
+            brands.push(ascii(bytes, i, i + 4));
+        if (brands.includes("avif") || brands.includes("avis"))
+            return "image/avif";
+    }
+    return null;
+}
+function megabytes(n) {
+    return `${(n / (1024 * 1024)).toFixed(1)} MB`;
+}
+/** Reads and checks one image file. Throws CliUsageError with the reason when it cannot be uploaded. */
+async function readImageFile(path) {
+    let size;
+    try {
+        const info = await (0, promises_1.stat)(path);
+        if (!info.isFile())
+            throw new errors_1.CliUsageError(`${path} is not a file.`);
+        size = info.size;
+    }
+    catch (err) {
+        if (err instanceof errors_1.CliUsageError)
+            throw err;
+        throw new errors_1.CliUsageError(`Cannot read ${path}: ${err.code ?? err.message}`);
+    }
+    // Before reading it: a 2 GB video passed by mistake should not be loaded to find out.
+    if (size > exports.MAX_UPLOAD_BYTES) {
+        throw new errors_1.CliUsageError(`${path} is ${megabytes(size)}; an upload is at most ${exports.MAX_UPLOAD_BYTES / (1024 * 1024)} MB.`);
+    }
+    if (size === 0)
+        throw new errors_1.CliUsageError(`${path} is empty.`);
+    const handle = await (0, promises_1.open)(path, "r");
+    let bytes;
+    try {
+        bytes = new Uint8Array(await handle.readFile());
+    }
+    finally {
+        await handle.close();
+    }
+    if (bytes.length > exports.MAX_UPLOAD_BYTES) {
+        throw new errors_1.CliUsageError(`${path} is ${megabytes(bytes.length)}; an upload is at most ${exports.MAX_UPLOAD_BYTES / (1024 * 1024)} MB.`);
+    }
+    const byExtension = BY_EXTENSION[(0, node_path_1.extname)(path).toLowerCase()];
+    const sniffed = sniffImageType(bytes);
+    // An ISO-BMFF file (ftyp box) named .avif whose brands this check does not list.
+    const contentType = sniffed ?? (byExtension === "image/avif" && ascii(bytes, 4, 8) === "ftyp" ? byExtension : null);
+    if (!contentType) {
+        throw new errors_1.CliUsageError(`${path} is not a JPEG, PNG, WebP, GIF or AVIF image; nothing else can be shown.`);
+    }
+    return { path, fileName: (0, node_path_1.basename)(path), contentType, bytes };
+}
+/** `POST /uploads` -> PUT to the signed URL -> `POST /uploads/:id/complete`. The new media asset's id. */
+async function uploadImage(client, groupId, image) {
+    const ticket = await client.post("/uploads", {
+        fileName: image.fileName,
+        contentType: image.contentType,
+        size: image.bytes.length,
+        groupId,
+    });
+    await client.putBytes(ticket.uploadUrl, ticket.headers ?? { "Content-Type": image.contentType }, image.bytes);
+    await client.post(`/uploads/${ticket.mediaAssetId}/complete`);
+    return ticket.mediaAssetId;
+}
+/**
+ * `![alt](media:<id>)`, the wiki's image reference. The alt text is the file
+ * name; a `]` or line break in it would end the reference early.
+ */
+function wikiImageRef(alt, mediaAssetId) {
+    const clean = alt.replace(/[[\]\r\n]+/g, " ").replace(/\s+/g, " ").trim();
+    return `![${clean}](media:${mediaAssetId})`;
+}
+//# sourceMappingURL=image-upload.js.map

package/dist/lib/image-upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-upload.js","sourceRoot":"","sources":["../../src/lib/image-upload.ts"],"names":[],"mappings":";;;AAmDA,wCAcC;AAOD,sCAkCC;AAGD,kCAUC;AAMD,oCAGC;AAhID,+CAA8C;AAC9C,yCAA8C;AAC9C,sCAA0C;AAG1C;;;;;;;;;;;;;;;;GAgBG;AAEU,QAAA,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,0EAA0E;AAC7D,QAAA,sBAAsB,GAAG,sCAAsC,CAAC;AAI7E,MAAM,YAAY,GAA8B;IAC9C,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;CACtB,CAAC;AASF,SAAS,KAAK,CAAC,KAAiB,EAAE,KAAa,EAAE,GAAW;IAC1D,OAAO,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,yFAAyF;AACzF,SAAgB,cAAc,CAAC,KAAiB;IAC9C,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC;IAC1G,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrH,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,WAAW,CAAC;IAClH,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC;IAC/G,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjH,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACrC,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,YAAY,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAChD,CAAC;AAED,wGAAwG;AACjG,KAAK,UAAU,aAAa,CAAC,IAAY;IAC9C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAA,eAAI,EAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,sBAAa,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC;QACtE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAa;YAAE,MAAM,GAAG,CAAC;QAC5C,MAAM,IAAI,sBAAa,CAAC,eAAe,IAAI,KAAM,GAA6B,CAAC,IAAI,IAAK,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,sFAAsF;IACtF,IAAI,IAAI,GAAG,wBAAgB,EAAE,CAAC;QAC5B,MAAM,IAAI,sBAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC,IAAI,CAAC,0BAA0B,wBAAgB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAG,MAAM,IAAA,eAAI,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClD,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,wBAAgB,EAAE,CAAC;QACpC,MAAM,IAAI,sBAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,wBAAgB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACjI,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,iFAAiF;IACjF,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,YAAY,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpH,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,sBAAa,CAAC,GAAG,IAAI,0EAA0E,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAA,oBAAQ,EAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAChE,CAAC;AAED,0GAA0G;AACnG,KAAK,UAAU,WAAW,CAAC,MAAqB,EAAE,OAAe,EAAE,KAAiB;IACzF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAgF,UAAU,EAAE;QAC1H,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;QACxB,OAAO;KACR,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9G,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,YAAY,WAAW,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,YAAY,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAAC,GAAW,EAAE,YAAoB;IAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1E,OAAO,KAAK,KAAK,WAAW,YAAY,GAAG,CAAC;AAC9C,CAAC"}

package/dist/lib/jwt.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeJwtPayloadUnsafe = decodeJwtPayloadUnsafe;
+/**
+ * Reads the payload of a JWT without verifying its signature -- fine here
+ * because we never trust this for authorization (the server does that on
+ * every request), only to show a human "signed in as ...". Used for the
+ * `--token`/`WHATCHA_TOKEN` escape hatch (issue #1428): `POST /auth/refresh`
+ * returns only `accessToken`/`expiresIn`/`refreshToken`, no user object, so
+ * this is the only way to get an email/id to display after that path.
+ */
+function decodeJwtPayloadUnsafe(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return null;
+    try {
+        const json = Buffer.from(parts[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+        const parsed = JSON.parse(json);
+        return typeof parsed === "object" && parsed !== null ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=jwt.js.map

package/dist/lib/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/lib/jwt.ts"],"names":[],"mappings":";;AAQA,wDAUC;AAlBD;;;;;;;GAOG;AACH,SAAgB,sBAAsB,CAAC,KAAa;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpG,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/output.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printJson = printJson;
+exports.printLine = printLine;
+exports.printErrorLine = printErrorLine;
+/**
+ * The `--json` contract (see README.md): every command prints exactly one
+ * JSON object to stdout on success, `{"ok": true, ...command-specific
+ * fields}`, and `{"ok": false, "error": {"code", "message"}}` on failure --
+ * always to stdout, even for an error, so a script doing `whatcha ... --json
+ * | jq` gets parseable JSON either way instead of having to also capture
+ * stderr. Human-mode output goes to stdout on success and stderr on
+ * failure, and is not meant to be parsed by anything.
+ *
+ * Never pass an access/refresh token or a password through this -- see
+ * README.md's "--json contract" section. Nothing in src/commands builds a
+ * JSON payload from a StoredSession or a LoginResult directly; they pick
+ * the fields by hand.
+ */
+function printJson(value) {
+    process.stdout.write(JSON.stringify(value) + "\n");
+}
+function printLine(text) {
+    process.stdout.write(text + "\n");
+}
+function printErrorLine(text) {
+    process.stderr.write(text + "\n");
+}
+//# sourceMappingURL=output.js.map

package/dist/lib/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":";;AAcA,8BAEC;AAED,8BAEC;AAED,wCAEC;AAxBD;;;;;;;;;;;;;GAaG;AACH,SAAgB,SAAS,CAAC,KAA8B;IACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAgB,SAAS,CAAC,IAAY;IACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,SAAgB,cAAc,CAAC,IAAY;IACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;AACpC,CAAC"}

package/dist/lib/personal-access-token.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WHERE_KEYS_ARE_ISSUED = exports.PERSONAL_ACCESS_TOKEN_PREFIX = void 0;
+exports.looksLikePersonalAccessToken = looksLikePersonalAccessToken;
+exports.isWellFormedPersonalAccessToken = isWellFormedPersonalAccessToken;
+exports.translateKeyError = translateKeyError;
+const errors_1 = require("../errors");
+/**
+ * Personal access keys (#1469, server side in PR #1550; CLI side #1663).
+ *
+ * The server tells a key from a Supabase session JWT by this literal prefix
+ * alone (apps/api/src/modules/account/auth/access-tokens.ts,
+ * `looksLikeAccessToken`), and so does the CLI: a key is sent as-is as the
+ * Bearer credential, never refreshed, and never exchanged for anything.
+ */
+exports.PERSONAL_ACCESS_TOKEN_PREFIX = "whatcha_pat_";
+/** `whatcha_pat_<24 hex>_<64 hex>` -- the server's own WIRE_FORM. */
+const WIRE_FORM = /^whatcha_pat_[0-9a-f]{24}_[0-9a-f]{64}$/;
+function looksLikePersonalAccessToken(raw) {
+    return raw.trim().startsWith(exports.PERSONAL_ACCESS_TOKEN_PREFIX);
+}
+function isWellFormedPersonalAccessToken(raw) {
+    return WIRE_FORM.test(raw.trim());
+}
+exports.WHERE_KEYS_ARE_ISSUED = "Profile → Connected apps and keys";
+/**
+ * A key's refusals, said in terms of the key.
+ *
+ * The API answers a revoked key exactly like one that never existed -- 401
+ * UNAUTHENTICATED, "Invalid access token." -- on purpose (revocation deletes
+ * the row; acceptAccessToken). For a session that means "sign in again"; for
+ * a key the only fix is a new key, so a script gets a code it can branch on
+ * instead of the generic one. Expiry (TOKEN_EXPIRED) likewise.
+ */
+function translateKeyError(err) {
+    if (!(err instanceof errors_1.ApiError))
+        return err;
+    if (err.status === 401 && err.code === "TOKEN_EXPIRED") {
+        return new errors_1.ApiError(401, "KEY_EXPIRED", `This personal access key has expired. Issue a new one in ${exports.WHERE_KEYS_ARE_ISSUED}, then run \`whatcha login --key <key>\`.`);
+    }
+    if (err.status === 401) {
+        return new errors_1.ApiError(401, "KEY_REVOKED", `This personal access key was revoked or is not valid. Issue a new one in ${exports.WHERE_KEYS_ARE_ISSUED}, then run \`whatcha login --key <key>\`.`);
+    }
+    return err;
+}
+//# sourceMappingURL=personal-access-token.js.map

package/dist/lib/personal-access-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"personal-access-token.js","sourceRoot":"","sources":["../../src/lib/personal-access-token.ts"],"names":[],"mappings":";;;AAeA,oEAEC;AAED,0EAEC;AAaD,8CAiBC;AAnDD,sCAAqC;AAErC;;;;;;;GAOG;AACU,QAAA,4BAA4B,GAAG,cAAc,CAAC;AAE3D,qEAAqE;AACrE,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAE5D,SAAgB,4BAA4B,CAAC,GAAW;IACtD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,oCAA4B,CAAC,CAAC;AAC7D,CAAC;AAED,SAAgB,+BAA+B,CAAC,GAAW;IACzD,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AACpC,CAAC;AAEY,QAAA,qBAAqB,GAAG,mCAAmC,CAAC;AAEzE;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,GAAY;IAC5C,IAAI,CAAC,CAAC,GAAG,YAAY,iBAAQ,CAAC;QAAE,OAAO,GAAG,CAAC;IAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACvD,OAAO,IAAI,iBAAQ,CACjB,GAAG,EACH,aAAa,EACb,4DAA4D,6BAAqB,2CAA2C,CAC7H,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,IAAI,iBAAQ,CACjB,GAAG,EACH,aAAa,EACb,4EAA4E,6BAAqB,2CAA2C,CAC7I,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/lib/profile-family.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findProfile = findProfile;
+exports.bearerClients = bearerClients;
+exports.clientAsProfile = clientAsProfile;
+const http_client_1 = require("../http-client");
+/** A profile of this login by @handle (the `@` optional, case-insensitive) or id. */
+function findProfile(profiles, target) {
+    const wanted = target.replace(/^@/, "").toLowerCase();
+    return profiles.find((p) => p.id === target || (p.username ?? "").toLowerCase() === wanted);
+}
+function bearerClients(baseUrl) {
+    return (accessToken) => new http_client_1.FetchWhatchaClient(baseUrl, async () => `Bearer ${accessToken}`);
+}
+/**
+ * A client that IS one of this login's sub-profiles, for the rest of one
+ * command -- the session `whatcha switch` would save, used and dropped
+ * instead. Some things only a profile can do for itself (set its own
+ * avatar, accept an invite into a group), and the saved session must not
+ * change under a command that was not asked to switch.
+ *
+ * The API reaches only sub-profiles of the caller's own family, never the
+ * account itself; its refusal is passed on as it came.
+ */
+async function clientAsProfile(client, profileId, forToken) {
+    const issued = await client.post(`/me/profiles/${profileId}/session`, {});
+    return forToken(issued.accessToken);
+}
+//# sourceMappingURL=profile-family.js.map

package/dist/lib/profile-family.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-family.js","sourceRoot":"","sources":["../../src/lib/profile-family.ts"],"names":[],"mappings":";;AA+BA,kCAGC;AAKD,sCAEC;AAYD,0CAOC;AA5DD,gDAAwE;AA8BxE,qFAAqF;AACrF,SAAgB,WAAW,CAAC,QAA6B,EAAE,MAAc;IACvE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;AAC9F,CAAC;AAKD,SAAgB,aAAa,CAAC,OAAe;IAC3C,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,gCAAkB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU,WAAW,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,eAAe,CACnC,MAAqB,EACrB,SAAiB,EACjB,QAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiB,gBAAgB,SAAS,UAAU,EAAE,EAAE,CAAC,CAAC;IAC1F,OAAO,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC"}

package/dist/lib/publication.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.publicDiaryUrl = publicDiaryUrl;
+exports.publicDiaryIds = publicDiaryIds;
+/**
+ * Whether anybody, signed in or not, can read a diary -- and where (#1701).
+ *
+ * Publishing belongs to the group, not the diary: `PUT /groups/:id/publication`
+ * (owner only; the app's "Publish" card on a group's page) makes a shared
+ * group public, and with it every diary in it that the group's members can
+ * read. A diary kept to its creator (`visibility: "private"`) stays private
+ * inside a published group. That is the API's own test (PUBLIC_SCOPE in
+ * public-square-repository.ts), read here from what the app reads: the
+ * group's `isPublic` from `GET /groups`, the diary's `visibility` from
+ * `GET /diaries/:id`.
+ */
+/** The web page a published diary is read at: the site's origin, which is the API's (`/api/v1` hangs off it). */
+function publicDiaryUrl(apiBaseUrl, diaryId) {
+    return `${new URL(apiBaseUrl).origin}/diaries/${diaryId}`;
+}
+async function publishedGroupIds(client) {
+    const ids = new Set();
+    let cursor;
+    for (;;) {
+        const page = await client.getPage("/groups", { limit: "50", cursor });
+        for (const g of page.items)
+            if (g.isPublic)
+                ids.add(g.id);
+        if (!page.hasNext || !page.nextCursor)
+            break;
+        cursor = page.nextCursor;
+    }
+    return ids;
+}
+/**
+ * The ids of the diaries among `diaries` that are public. One `GET /groups`
+ * walk, plus one `GET /diaries/:id` per diary in a published group only --
+ * a shelf with nothing published costs a single extra call.
+ */
+async function publicDiaryIds(client, diaries) {
+    const published = new Set();
+    const shared = diaries.filter((d) => d.groupType !== "personal");
+    if (shared.length === 0)
+        return published;
+    const groups = await publishedGroupIds(client);
+    for (const d of shared) {
+        if (!groups.has(d.groupId))
+            continue;
+        const detail = await client.get(`/diaries/${d.id}`);
+        if (detail.visibility === "group")
+            published.add(d.id);
+    }
+    return published;
+}
+//# sourceMappingURL=publication.js.map

package/dist/lib/publication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publication.js","sourceRoot":"","sources":["../../src/lib/publication.ts"],"names":[],"mappings":";;AAiBA,wCAEC;AAwBD,wCAWC;AAnDD;;;;;;;;;;;GAWG;AAEH,iHAAiH;AACjH,SAAgB,cAAc,CAAC,UAAkB,EAAE,OAAe;IAChE,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,YAAY,OAAO,EAAE,CAAC;AAC5D,CAAC;AAOD,KAAK,UAAU,iBAAiB,CAAC,MAAqB;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,MAA0B,CAAC;IAC/B,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAgB,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,CAAC,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM;QAC7C,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAAC,MAAqB,EAAE,OAAgB;IAC1E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAsC,YAAY,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzF,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/types.js

@@ -0,0 +1,6 @@
+"use strict";
+// Wire shapes this CLI actually touches, trimmed from apps/api/openapi.yaml.
+// Not the whole API -- just the fields the four commands read or send. Keep
+// these in sync with openapi.yaml by hand; there is no codegen step here.
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E"}

package/package.json

@@ -1,6 +1,48 @@
 {
   "name": "@whatcha/cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.3.0",
+  "description": "Official command-line client for what-are-you-do-ing (whatareyoudo.ing) -- login (password or personal access key), list diaries, write and read entries, switch profiles, read and write the Experience Wiki, with images.",
+  "license": "Apache-2.0",
+  "homepage": "https://whatareyoudo.ing/cli",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/what-are-you-do-ing/whatcha.git",
+    "directory": "apps/cli"
+  },
+  "bugs": {
+    "url": "https://github.com/what-are-you-do-ing/whatcha/issues"
+  },
+  "keywords": [
+    "whatcha",
+    "diary",
+    "journal",
+    "cli",
+    "whatareyoudo"
+  ],
+  "bin": {
+    "whatcha": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "node node_modules/typescript/bin/tsc",
+    "typecheck": "node node_modules/typescript/bin/tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepublishOnly": "npm run build"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.5.2",
+    "vitest": "^4.1.10"
+  }
+}