@yuchaocheng/yusijia 0.1.0-beta.1

package/README.md

@@ -0,0 +1,194 @@
+# Family CLI
+
+Standalone compiled ESM CLI and bundled `family-content` Skill for macOS arm64/x64,
+Node >=20.20.2. Uses Node built-ins, public `exifr` and `zod`. No database or website
+source dependency. Photo scans use bounded macOS `sips` width/height probes in
+addition to byte-format validation. Directory and explicit-file scans do not require `unzip`; zip
+scans require `/usr/bin/unzip` and fail clearly when unavailable.
+
+## Installation
+
+The package is `@yuchaocheng/yusijia`. This is a beta release for acceptance testing,
+not a stable release. The hosted website's new Agent API is not yet released;
+use an explicitly supplied compatible development site for this beta. Installing
+the beta does not deploy a website or automatically switch the default site.
+
+```sh
+npm install --global @yuchaocheng/yusijia@beta --registry=https://registry.npmjs.org/
+yusijia --help
+yusijia skills install
+```
+
+Read the installed `family-content` Skill in your Agent. Beta versions of
+`yusijia update` stay on the `beta` tag; stable versions use `latest`. Updates never
+fall back between channels. No stable `latest` tag is published with this beta.
+
+Build and test a local tarball (not a release):
+
+```sh
+pnpm -C family-cli build
+npm pack ./family-cli --pack-destination ./family-cli
+npm install --global /absolute/path/yuchaocheng-yusijia-0.1.0-beta.1.tgz
+yusijia --help
+yusijia skills install
+```
+
+No sudo is used by this CLI. A local install also works through its
+`node_modules/.bin/yusijia`. After release, global update explicitly uses public
+npm and invokes the newly installed CLI to synchronize registered Skills. Local
+installations must use their original install method. Modified/unknown Skills are
+never overwritten; a CLI-only update with Skill conflicts is reported as partial.
+Host discovery of the installed Skill still needs acceptance in the chosen Agent.
+
+## Authorization And Reads
+
+```sh
+yusijia auth login
+yusijia auth status --json
+yusijia photos list --limit 30 --json
+yusijia photos get --id <photo-id> --include-url --json
+yusijia albums get --id <album-id> --json
+yusijia timeline list --cursor <opaque-cursor> --json
+yusijia diary get --id <diary-id> --json
+yusijia auth logout
+```
+
+Photo URLs are absent by default. Only explicit `photos get --include-url` asks for
+and displays a short-lived signed image URL. Do not broadly print, share, or persist
+these URLs in plans, progress or long-lived documents.
+
+Default site: `https://yusijia.me`. `--site` accepts an HTTPS origin or explicit
+development loopback HTTP origin. Credentials are origin-isolated in
+`~/.config/yusijia/credentials.json`: plaintext, directory 0700/file 0600, owner and
+symlink checks and atomic writes. This is not encryption and does not protect from
+same-user processes, root or copied files. Login uses a five-minute loopback PKCE
+callback; valid credentials last 30 days and are not silently replaced. Passwords,
+codes, tokens, signed upload forms and server diagnostics are not printed. Failed
+logout keeps the local credential and explicitly does not claim server revocation.
+If `/me` explicitly reports an invalid or expired credential, login opens a fresh
+authorization flow and replaces the file only after successful exchange. Network
+errors and account/permission refusals leave the credential unchanged.
+
+## Prepare And Confirm
+
+```sh
+yusijia photos scan --input /absolute/photos --out ./scan.json
+yusijia photos scan --files /absolute/a.jpg --files /absolute/b.png --out ./scan.json
+yusijia photos import --input ./scan.json --out ./plan.json
+yusijia plan show --plan ./plan.json --json
+# Only after the user confirms the displayed site, account and all content:
+yusijia execute --plan ./plan.json --confirm-hash <planHash> --json
+yusijia photos resume --plan ./plan.json --confirm-hash <same-planHash> --json
+```
+
+Only supplied paths are scanned. JPEG/PNG/WebP, 15 MiB/file and 200 candidates;
+duplicates are folded with deterministic metadata/name preference. Unsupported,
+damaged, oversized and directory symlink files are reported. Explicitly supplied
+material paths are resolved with `realpath`, including macOS `/tmp` and `/var`
+aliases; directory walking never follows child symlinks. HEIC requires prior conversion.
+Grouping is metadata/rules only, not visual interpretation. Historical photos
+without hashes cannot be fully deduplicated. Zip entries are validated before
+bounded stdout extraction to 0700 task directories and 0600 hashed file names.
+Unsafe names, duplicate paths and symlink entries reject the archive. Scan output
+reports the staging directory; retain it for pending uploads and remove it manually
+when no longer needed. No caller-supplied directory is recursively deleted.
+
+Plans/scans/progress are 0600; choose an existing owner-writable, non-group-writable
+parent directory. Scan diagnostics and local file paths never enter the manifest
+sent to the site. Explicit file sets use `sourceType: DIRECTORY` and local
+`inputKind: FILES`. Unused legacy suggestions and arbitrary metadata are rejected.
+
+`photos import` defaults to an explicitly previewed new-photo expectation for each
+selected image. To confirm reuse supply `--expectations expectations.json`, keyed
+by localCandidateId with `{ "mode": "reuse", "photoId": "...", "version": "..." }`
+(or `{ "mode": "create" }`). Existing photos are not silently overwritten or
+restored. Conflicting duplicate metadata requires a fresh preview.
+
+## Independent Content Plans
+
+All business commands generate plans, never write directly. `--input` is a JSON
+business payload; edit commands take `--id` and use a read-only query to capture the
+current version unless `--expected-version` is supplied. Every generated plan is
+shown before confirmation.
+
+| Commands | Payload |
+| --- | --- |
+| `albums create/update` | `{ "name": "Family", "description": "..." }` (update fields optional) |
+| `albums add/remove` | Repeat `--photo-id`; only associations change |
+| `timeline create/update` | `{ "date": "2026-09-30", "title": "...", "description": "...", "photoIds": [] }` (max 3 photos) |
+| `diary create` | `{ "blocks": [{ "type": "paragraph", "text": "..." }], "status": "DRAFT" }`; `--text` also supported |
+| `diary edit` | `{ "edits": [{ "type": "replaceText", "blockId": "...", "text": "..." }] }` or `{ "type": "append", "blocks": [...] }` edits |
+| `diary publish` | Generates explicit `status: PUBLISHED`; does not flatten existing rich content |
+| `photos cancel` | `--id <batch-id>`; already published photos remain |
+
+New diary blocks support paragraph/heading/bulletListItem/numberedListItem and
+optional `id`; only headings allow `level` 1..3. At most 500 blocks and 100000 text
+characters. Server edits preserve untargeted rich content; unsupported edits fail
+without overwriting it. Saving a draft is a write and requires confirmation too.
+
+Combine actions using `plan --input draft.json --out plan.json`. Draft shape:
+
+```json
+{
+  "items": [
+    { "operationId": "11111111-1111-4111-8111-111111111111", "action": "albums.create", "payload": { "name": "Family" } },
+    { "operationId": "22222222-2222-4222-8222-222222222222", "action": "albums.update", "target": { "ref": "11111111-1111-4111-8111-111111111111", "field": "id" }, "expectedVersion": { "ref": "11111111-1111-4111-8111-111111111111", "field": "version" }, "payload": { "description": "Shared moments" } }
+  ]
+}
+```
+
+Typed actions are `albums.create/update/photos`, `timeline.create/update`,
+`diary.create/edit/publish`, `photos.import/cancel`. References may point only to
+prior successful actions: fields `id`, `version`, or
+`{ "ref": "<import-operation-uuid>", "field": "photoId", "localCandidateId": "<candidate-id>" }`
+for a selected photo returned by a prior import. Such references let the same
+confirmed plan import photos and associate them with an album without a second
+confirmation. Photos import includes a local `files` map
+and `expectations` map outside its HTTP `payload: {manifest}`. At most 500 plan
+items and 2 MiB serialized UTF-8 bytes per HTTP request; never auto-split a plan.
+
+For `albums.photos` in a combined plan, both `payload.add` and `payload.remove`
+are required, including an empty array for the unused direction. For example:
+`{ "add": ["<photo-id>"], "remove": [] }`. Set `target` to the album ID and
+`expectedVersion` to its version, or use references to a prior album action.
+Standalone `albums add/remove` commands generate these fields for you.
+
+## Recovery And Protocol
+
+Canonical sorted-key JSON SHA-256 binds the complete plan to origin and userId.
+`plan --previous old.json --input revised.json --out new.json` assigns new IDs to
+changed unsent actions. Successful/uncertain actions cannot be edited in place;
+resolve them with the original ID, then propose new updates. Source bytes are
+rechecked before uploading. Server independently enforces live permissions and
+target versions; a hash flag is not proof of actual human intent.
+
+Execution preserves per-item outcomes in origin/account-scoped private progress.
+Unknown and failed requests remain frozen there. Successful entries retain their
+operation IDs, fingerprints, request hashes and result references, not request
+bodies; readable legacy entries are compacted on the next execution. Private JSON
+reads and writes share a 32 MiB UTF-8 limit, including formatting and the final
+newline. A pending request that would exceed it is rejected before remote writing,
+without deleting earlier operation IDs or replacing the existing readable file.
+An uncertain write is queried at
+`GET /api/agent/v1/operations/:operationId`; 404 permits only identical same-ID
+replay, not a claim of rollback. Dependent failures are skipped; independent actions
+continue. Partial/unknown/error results exit nonzero. No cross-content rollback is
+claimed and no formal objects are deleted as compensation.
+
+API root `/api/agent/v1`; success `{ok:true,data}` and error
+`{ok:false,error:{code,message,retryable}}`. `/meta` is checked before authenticated
+requests. Writes carry `Idempotency-Key`, edits also `If-Match`. Authentication is
+Bearer only and no redirects are followed. Website timeouts 30s; OSS POST 120s.
+OSS receives only signed fields and final multipart file, never the website token.
+Upload forms never enter progress or output. Real browser/OSS acceptance remains
+separate from mocked tests and isolated package installation.
+
+## Development Checks
+
+```sh
+pnpm -C family-cli test
+pnpm -C family-cli typecheck
+pnpm -C family-cli lint
+pnpm -C family-cli build
+pnpm -C family-cli test:package
+```

package/dist/auth.d.ts

@@ -0,0 +1,24 @@
+import { ApiClient } from './http.js';
+import { CredentialStore } from './storage.js';
+export declare function createCallback(timeout?: number): Promise<{
+    state: string;
+    verifier: string;
+    challenge: string;
+    redirectUri: string;
+    result: Promise<{
+        code: string;
+    }>;
+    cancel: () => void;
+}>;
+export declare function login(api: ApiClient, store?: CredentialStore, browser?: (url: string) => Promise<void>): Promise<Record<string, unknown>>;
+export declare function status(api: ApiClient): Promise<{
+    id: string;
+    email: string;
+    name: string | null;
+    role: "FAMILY" | "ADMIN";
+    expiresAt: string;
+}>;
+export declare function logout(api: ApiClient, store?: CredentialStore): Promise<{
+    revoked: boolean;
+    localRemoved: boolean;
+}>;

package/dist/auth.js

@@ -0,0 +1,115 @@
+import { createServer } from 'node:http';
+import { randomBytes, createHash, timingSafeEqual } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { z } from 'zod';
+import { CliError } from './core.js';
+import { meSchema, userSchema } from './http.js';
+import { CredentialStore } from './storage.js';
+export async function createCallback(timeout = 300000) {
+    const state = randomBytes(32).toString('base64url');
+    const verifier = randomBytes(32).toString('base64url');
+    const challenge = createHash('sha256').update(verifier).digest('base64url');
+    let finish;
+    let fail;
+    const result = new Promise((resolve, reject) => { finish = resolve; fail = reject; });
+    // Attach a handler immediately; browser startup can outlive a denial/timeout.
+    void result.catch(() => { });
+    let done = false;
+    const server = createServer((req, res) => {
+        res.setHeader('Cache-Control', 'no-store');
+        res.setHeader('Referrer-Policy', 'no-referrer');
+        res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+        const u = new URL(req.url ?? '/', 'http://127.0.0.1');
+        if (u.pathname !== '/callback') {
+            res.writeHead(404).end('Not found');
+            return;
+        }
+        const supplied = u.searchParams.get('state') ?? '';
+        const keys = [...u.searchParams.keys()];
+        const valid = req.method === 'GET' && keys.length === 2 && new Set(keys).size === 2 && keys.every(k => ['state', 'code', 'error'].includes(k)) && Buffer.byteLength(supplied) === Buffer.byteLength(state) && timingSafeEqual(Buffer.from(supplied), Buffer.from(state)) && !!(u.searchParams.get('code') || u.searchParams.get('error'));
+        if (!valid || done) {
+            res.writeHead(400).end('Invalid callback');
+            return;
+        }
+        done = true;
+        res.end('Authorization finished. You may close this window.');
+        close();
+        if (u.searchParams.has('error'))
+            fail(new CliError('AUTH_DENIED'));
+        else
+            finish({ code: u.searchParams.get('code') });
+    });
+    let timer;
+    function close() { if (timer)
+        clearTimeout(timer); server.close(); server.closeIdleConnections(); }
+    await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+    const address = server.address();
+    if (!address || typeof address === 'string')
+        throw new CliError('INTERNAL_ERROR');
+    timer = setTimeout(() => { done = true; fail(new CliError('AUTH_TIMEOUT')); close(); }, timeout);
+    return { state, verifier, challenge, redirectUri: `http://127.0.0.1:${address.port}/callback`, result, cancel: () => { done = true; fail(new CliError('AUTH_DENIED')); close(); } };
+}
+const openBrowser = async (url) => { await promisify(execFile)('/usr/bin/open', [url]); };
+export async function login(api, store = new CredentialStore(), browser = openBrowser) {
+    const old = await store.get(api.origin);
+    if (old && Date.parse(old.expiresAt) > Date.now()) {
+        api.token = old.token;
+        try {
+            return await api.request('/me');
+        }
+        catch (e) {
+            if (!(e instanceof CliError) || e.status === 403 || !['INVALID_CREDENTIAL', 'CREDENTIAL_EXPIRED'].includes(e.code))
+                throw e;
+            // Keep the old file until the new authorization has been exchanged and saved.
+            api.token = undefined;
+        }
+    }
+    await api.negotiate();
+    const c = await createCallback();
+    const url = new URL('/agent/authorize', api.origin);
+    url.search = new URLSearchParams({ state: c.state, challenge: c.challenge, redirectUri: c.redirectUri }).toString();
+    try {
+        try {
+            await browser(url.href);
+        }
+        catch {
+            throw new CliError('BROWSER_FAILED');
+        }
+        const { code } = await c.result;
+        const data = z.object({ token: z.string().min(1), expiresAt: z.iso.datetime(), user: userSchema }).parse(await api.request('/auth/exchange', { method: 'POST', anonymous: true, body: { code, verifier: c.verifier, redirectUri: c.redirectUri } }));
+        api.token = data.token;
+        try {
+            await store.set(api.origin, { token: data.token, expiresAt: data.expiresAt, userId: data.user.id });
+        }
+        catch {
+            try {
+                await api.request('/auth/revoke', { method: 'POST', body: {} });
+            }
+            catch {
+                throw new CliError('REVOCATION_FAILED');
+            }
+            throw new CliError('SAVE_FAILED');
+        }
+        return { ...data.user, expiresAt: data.expiresAt };
+    }
+    finally {
+        c.cancel();
+    }
+}
+export async function status(api) { return meSchema.parse(await api.request('/me')); }
+export async function logout(api, store = new CredentialStore()) {
+    const credential = await store.get(api.origin);
+    if (!credential)
+        return { revoked: true, localRemoved: true };
+    api.token = credential.token;
+    try {
+        await api.request('/auth/revoke', { method: 'POST', body: {} });
+    }
+    catch (e) {
+        if (!(e instanceof CliError && ['CREDENTIAL_EXPIRED', 'INVALID_CREDENTIAL'].includes(e.code)))
+            throw new CliError('REVOCATION_FAILED');
+    }
+    await store.remove(api.origin);
+    return { revoked: true, localRemoved: true };
+}

package/dist/cli.d.ts

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+type Output = (value: unknown) => void;
+export declare function contentReadPath(resource: string, id: string, includeUrl?: boolean): string;
+export declare function runCli(argv: string[], output?: Output): Promise<number>;
+export {};

package/dist/cli.js

@@ -0,0 +1,210 @@
+#!/usr/bin/env node
+import { parseArgs } from 'node:util';
+import { randomUUID } from 'node:crypto';
+import { realpathSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { z } from 'zod';
+import { CliError, DEFAULT_SITE, normalizeSite, publicOutput, safeError, sha256, VERSION } from './core.js';
+import { ApiClient, compatibleVersion } from './http.js';
+import { login, logout, status } from './auth.js';
+import { CredentialStore, configDir, privateDirectory, readInputJson, readPrivateJson, writePrivateJson } from './storage.js';
+import { buildPlan, planSchema, revisePlan, textBlocks } from './plan.js';
+import { executePlan, progressSchema } from './execute.js';
+import { scan } from './scan.js';
+import { installSkill, updatePackage, updateSkills } from './skills.js';
+const help = {
+    command: 'yusijia', version: VERSION, platform: 'macOS arm64/x64, Node >=20.20.2',
+    commands: [
+        'auth login|status|logout [--site <origin>] [--json]',
+        'photos|albums|timeline|diary list [--limit 30] [--cursor <cursor>] [--json]',
+        'photos|albums|timeline|diary get --id <id> [--json] (photos only: --include-url)',
+        'photos scan --input <directory-or-zip> | --files <file> (repeatable) --out <scan.json>',
+        'photos import --input <scan.json> [--expectations <json>] --out <plan.json>',
+        'photos resume --plan <plan.json> --confirm-hash <hash>',
+        'photos cancel --id <batch-id> --out <plan.json>',
+        'albums create|update --input <payload.json> [--id <id>] --out <plan.json>',
+        'albums add|remove --id <id> --photo-id <id> (repeatable) --out <plan.json>',
+        'timeline create|update --input <payload.json> [--id <id>] --out <plan.json>',
+        'diary create --text <text> --out <plan.json> | --input <payload.json>',
+        'diary edit --id <id> --input <edits.json> --out <plan.json>',
+        'diary publish --id <id> --out <plan.json>',
+        'plan --input <draft.json> --out <plan.json> [--previous <old-plan.json>]',
+        'plan show --plan <plan.json>',
+        'execute --plan <plan.json> --confirm-hash <hash>',
+        'operations get --id <operation-uuid>',
+        'skills install [--dir <exact-skill-directory>] | skills update',
+        'update (public npm, global installation; beta stays on beta, stable uses latest)',
+    ],
+    note: 'Content commands generate private local plans only. Execute requires confirmation of the current plan hash. --site selects a credential-isolated origin; default https://yusijia.me. See package README for typed actions and prior-result references.',
+};
+export function contentReadPath(resource, id, includeUrl = false) {
+    if (!['photos', 'albums', 'milestones', 'diaries'].includes(resource) || includeUrl && resource !== 'photos')
+        throw new CliError('INVALID_INPUT');
+    return `/${resource}/${encodeURIComponent(id)}${includeUrl ? '?includeUrl=true' : ''}`;
+}
+export async function runCli(argv, output = value => process.stdout.write(`${JSON.stringify(value, null, argv.includes('--json') ? undefined : 2)}\n`)) {
+    try {
+        let args;
+        try {
+            args = parseArgs({ args: argv, allowPositionals: true, strict: true, options: {
+                    help: { type: 'boolean', short: 'h' }, version: { type: 'boolean' }, json: { type: 'boolean' },
+                    site: { type: 'string' }, input: { type: 'string' }, out: { type: 'string' }, plan: { type: 'string' },
+                    'confirm-hash': { type: 'string' }, previous: { type: 'string' }, id: { type: 'string' },
+                    'expected-version': { type: 'string' }, limit: { type: 'string' }, cursor: { type: 'string' },
+                    files: { type: 'string', multiple: true }, 'photo-id': { type: 'string', multiple: true },
+                    text: { type: 'string' }, dir: { type: 'string' }, expectations: { type: 'string' },
+                    'include-url': { type: 'boolean' },
+                } });
+        }
+        catch {
+            throw new CliError('INVALID_INPUT');
+        }
+        const [command, subcommand, ...extra] = args.positionals;
+        const options = args.values;
+        const str = (name) => typeof options[name] === 'string' ? options[name] : undefined;
+        const required = (name) => { const v = str(name); if (!v)
+            throw new CliError('INVALID_INPUT'); return v; };
+        const respond = (data, ok = true) => { output({ ok, data: publicOutput(data, command === 'photos' && subcommand === 'get' && options['include-url'] === true) }); return ok ? 0 : 1; };
+        if (options.version) {
+            output({ version: VERSION });
+            return 0;
+        }
+        if (options.help || !command) {
+            output(help);
+            return 0;
+        }
+        if (extra.length || process.platform !== 'darwin' || !['arm64', 'x64'].includes(process.arch) || !compatibleVersion(process.versions.node, '>=20.20.2'))
+            throw new CliError('INVALID_INPUT');
+        if (options['include-url'] && !(command === 'photos' && subcommand === 'get'))
+            throw new CliError('INVALID_INPUT');
+        if (command === 'skills') {
+            if (subcommand === 'install')
+                return respond(await installSkill(str('dir')));
+            if (subcommand === 'update') {
+                const result = await updateSkills();
+                return respond(result, result.ok);
+            }
+            throw new CliError('INVALID_INPUT');
+        }
+        if (command === 'update' && !subcommand) {
+            const result = await updatePackage();
+            return respond(result, result.ok !== false);
+        }
+        if (command === 'photos' && subcommand === 'scan') {
+            const result = await scan({ input: str('input'), files: options.files });
+            await writePrivateJson(resolve(required('out')), result);
+            return respond(result);
+        }
+        if (command === 'plan' && subcommand === 'show') {
+            const plan = planSchema.parse(await readPrivateJson(resolve(required('plan'))));
+            const { planHash, ...core } = plan;
+            if (buildPlan(core).planHash !== planHash)
+                throw new CliError('CONFIRMATION_REQUIRED');
+            return respond(plan);
+        }
+        if (!['auth', 'photos', 'albums', 'timeline', 'diary', 'plan', 'execute', 'operations'].includes(command))
+            throw new CliError('INVALID_INPUT');
+        let loadedPlan;
+        if (command === 'execute' || command === 'photos' && subcommand === 'resume')
+            loadedPlan = planSchema.parse(await readPrivateJson(resolve(required('plan'))));
+        const origin = normalizeSite(str('site') ?? loadedPlan?.origin ?? DEFAULT_SITE);
+        const store = new CredentialStore();
+        const credential = await store.get(origin);
+        const api = new ApiClient(origin, credential?.token);
+        if (command === 'auth') {
+            if (subcommand === 'login')
+                return respond(await login(api, store));
+            if (subcommand === 'status')
+                return respond(await status(api));
+            if (subcommand === 'logout')
+                return respond(await logout(api, store));
+            throw new CliError('INVALID_INPUT');
+        }
+        if (command === 'operations' && subcommand === 'get')
+            return respond(await api.request(`/operations/${z.uuid().parse(required('id'))}`));
+        const resources = { photos: 'photos', albums: 'albums', timeline: 'milestones', diary: 'diaries' };
+        if (resources[command] && ['list', 'get'].includes(subcommand)) {
+            if (subcommand === 'get')
+                return respond(await api.request(contentReadPath(resources[command], required('id'), options['include-url'] === true)));
+            const limit = z.number().int().min(1).max(100).parse(Number(str('limit') ?? 30));
+            const cursor = str('cursor');
+            if (cursor && cursor.length > 512)
+                throw new CliError('INVALID_INPUT');
+            const query = new URLSearchParams({ limit: String(limit), ...(cursor ? { cursor } : {}) });
+            return respond(await api.request(`/${resources[command]}?${query}`));
+        }
+        const user = await status(api);
+        const identity = { origin, userId: user.id };
+        const stateDir = join(configDir(), 'operations');
+        await privateDirectory(stateDir);
+        const progressFile = join(stateDir, `${sha256(`${origin}:${user.id}`)}.json`);
+        let previousProgress;
+        try {
+            previousProgress = await readPrivateJson(progressFile);
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+        if (loadedPlan) {
+            const result = await executePlan(loadedPlan, required('confirm-hash'), identity, api, previousProgress, p => writePrivateJson(progressFile, p));
+            return respond({ items: result.items }, result.ok);
+        }
+        let plan;
+        if (command === 'plan' && !subcommand) {
+            const draft = z.object({ schemaVersion: z.literal(1).optional(), origin: z.string().optional(), userId: z.string().optional(), items: z.array(z.json()) }).strict().parse(await readInputJson(required('input')));
+            if ((draft.origin && normalizeSite(draft.origin) !== origin) || (draft.userId && draft.userId !== user.id))
+                throw new CliError('CONFIRMATION_REQUIRED');
+            const data = { ...draft, ...identity };
+            if (str('previous')) {
+                const previous = planSchema.parse(await readPrivateJson(required('previous')));
+                const sent = new Set(previousProgress ? Object.keys(progressSchema.parse(previousProgress).entries) : []);
+                plan = revisePlan(previous, data, sent);
+            }
+            else
+                plan = buildPlan(data);
+        }
+        else {
+            const operationId = randomUUID();
+            let action;
+            if (command === 'photos' && subcommand === 'import') {
+                const scan = z.object({ manifest: z.json(), files: z.record(z.string(), z.string()) }).passthrough().parse(await readPrivateJson(required('input')));
+                const candidates = z.object({ candidates: z.array(z.object({ localCandidateId: z.string(), status: z.string() })) }).parse(scan.manifest).candidates;
+                const expectations = str('expectations') ? await readInputJson(required('expectations')) : Object.fromEntries(candidates.filter(c => c.status === 'SELECTED').map(c => [c.localCandidateId, { mode: 'create' }]));
+                action = { operationId, action: 'photos.import', payload: { manifest: scan.manifest }, files: scan.files, expectations };
+            }
+            else if (command === 'photos' && subcommand === 'cancel')
+                action = { operationId, action: 'photos.cancel', target: required('id'), payload: {} };
+            else {
+                const supported = command === 'albums' ? ['create', 'update', 'add', 'remove'] : command === 'timeline' ? ['create', 'update'] : command === 'diary' ? ['create', 'edit', 'publish'] : [];
+                if (!supported.includes(subcommand))
+                    throw new CliError('INVALID_INPUT');
+                let payload;
+                if (command === 'albums' && ['add', 'remove'].includes(subcommand))
+                    payload = { add: subcommand === 'add' ? options['photo-id'] ?? [] : [], remove: subcommand === 'remove' ? options['photo-id'] ?? [] : [] };
+                else if (command === 'diary' && subcommand === 'publish')
+                    payload = { status: 'PUBLISHED' };
+                else if (command === 'diary' && subcommand === 'create' && str('text'))
+                    payload = { blocks: textBlocks(required('text')), status: 'DRAFT' };
+                else
+                    payload = await readInputJson(required('input'));
+                action = { operationId, action: `${command}.${command === 'albums' && ['add', 'remove'].includes(subcommand) ? 'photos' : subcommand}`, payload };
+                if (subcommand !== 'create') {
+                    action.target = required('id');
+                    action.expectedVersion = str('expected-version') ?? z.object({ version: z.string() }).parse(await api.request(`/${resources[command]}/${encodeURIComponent(required('id'))}`)).version;
+                }
+            }
+            plan = buildPlan({ ...identity, items: [action] });
+        }
+        await writePrivateJson(resolve(required('out')), plan);
+        return respond({ ...plan, account: { id: user.id, email: user.email, name: user.name, role: user.role } });
+    }
+    catch (e) {
+        const error = safeError(e instanceof z.ZodError || e instanceof SyntaxError ? new CliError('INVALID_INPUT') : e);
+        output({ ok: false, error });
+        return 1;
+    }
+}
+if (process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url))
+    process.exitCode = await runCli(process.argv.slice(2));

package/dist/core.d.ts

@@ -0,0 +1,24 @@
+export declare const VERSION: string;
+export declare const LIMITS: {
+    maxRequestBytes: number;
+    maxCandidates: number;
+    maxActions: number;
+    maxFileBytes: number;
+};
+export declare const DEFAULT_SITE = "https://yusijia.me";
+export declare class CliError extends Error {
+    code: string;
+    retryable: boolean;
+    status?: number | undefined;
+    constructor(code: string, retryable?: boolean, status?: number | undefined);
+}
+export declare function safeError(error: unknown): {
+    code: string;
+    message: string;
+    retryable: boolean;
+};
+export declare function normalizeSite(site?: string): string;
+export declare function sha256(value: string | Buffer): string;
+export declare function canonicalJson(value: unknown): string;
+export declare function checkBytes(value: unknown, max?: number): string;
+export declare function publicOutput(value: unknown, allowImageUrls?: boolean, parentKey?: string): unknown;