arkaos 4.26.0 → 4.28.0

package/departments/marketing/tools/clis/wistia.js

@@ -0,0 +1,301 @@
+#!/usr/bin/env node
+
+const API_KEY = process.env.WISTIA_API_KEY
+const BASE_URL = 'https://api.wistia.com/v1'
+
+if (!API_KEY) {
+  console.error(JSON.stringify({ error: 'WISTIA_API_KEY environment variable required' }))
+  process.exit(1)
+}
+
+async function api(method, path, body) {
+  const auth = 'Basic ' + Buffer.from(`${API_KEY}:`).toString('base64')
+  if (args['dry-run']) {
+    return { _dry_run: true, method, url: `${BASE_URL}${path}`, headers: { 'Authorization': '***', 'Content-Type': 'application/json', 'Accept': 'application/json' }, body: body || undefined }
+  }
+  const res = await fetch(`${BASE_URL}${path}`, {
+    method,
+    headers: {
+      'Authorization': auth,
+      'Content-Type': 'application/json',
+      'Accept': 'application/json',
+    },
+    body: body ? JSON.stringify(body) : undefined,
+  })
+  const text = await res.text()
+  try {
+    return JSON.parse(text)
+  } catch {
+    return { status: res.status, body: text }
+  }
+}
+
+function parseArgs(args) {
+  const result = { _: [] }
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]
+    if (arg.startsWith('--')) {
+      const key = arg.slice(2)
+      const next = args[i + 1]
+      if (next && !next.startsWith('--')) {
+        result[key] = next
+        i++
+      } else {
+        result[key] = true
+      }
+    } else {
+      result._.push(arg)
+    }
+  }
+  return result
+}
+
+const args = parseArgs(process.argv.slice(2))
+const [cmd, sub, ...rest] = args._
+const page = args.page ? Number(args.page) : 1
+const perPage = args['per-page'] ? Number(args['per-page']) : 25
+
+async function main() {
+  let result
+
+  switch (cmd) {
+    case 'projects':
+      switch (sub) {
+        case 'list':
+          result = await api('GET', `/projects.json?page=${page}&per_page=${perPage}`)
+          break
+        case 'get': {
+          const id = args.id
+          if (!id) { result = { error: '--id required (project hashed ID)' }; break }
+          result = await api('GET', `/projects/${id}.json`)
+          break
+        }
+        case 'create': {
+          const name = args.name
+          if (!name) { result = { error: '--name required' }; break }
+          const body = { name }
+          if (args.public) body.public = true
+          result = await api('POST', '/projects.json', body)
+          break
+        }
+        case 'update': {
+          const id = args.id
+          if (!id) { result = { error: '--id required (project hashed ID)' }; break }
+          const body = {}
+          if (args.name) body.name = args.name
+          result = await api('PUT', `/projects/${id}.json`, body)
+          break
+        }
+        case 'delete': {
+          const id = args.id
+          if (!id) { result = { error: '--id required (project hashed ID)' }; break }
+          result = await api('DELETE', `/projects/${id}.json`)
+          break
+        }
+        default:
+          result = { error: 'Unknown projects subcommand. Use: list, get, create, update, delete' }
+      }
+      break
+
+    case 'medias':
+      switch (sub) {
+        case 'list': {
+          const params = new URLSearchParams({ page: String(page), per_page: String(perPage) })
+          if (args.project) params.set('project_id', args.project)
+          if (args.name) params.set('name', args.name)
+          if (args.type) params.set('type', args.type)
+          result = await api('GET', `/medias.json?${params.toString()}`)
+          break
+        }
+        case 'get': {
+          const id = args.id
+          if (!id) { result = { error: '--id required (media hashed ID)' }; break }
+          result = await api('GET', `/medias/${id}.json`)
+          break
+        }
+        case 'update': {
+          const id = args.id
+          if (!id) { result = { error: '--id required (media hashed ID)' }; break }
+          const body = {}
+          if (args.name) body.name = args.name
+          if (args.description) body.description = args.description
+          result = await api('PUT', `/medias/${id}.json`, body)
+          break
+        }
+        case 'delete': {
+          const id = args.id
+          if (!id) { result = { error: '--id required (media hashed ID)' }; break }
+          result = await api('DELETE', `/medias/${id}.json`)
+          break
+        }
+        case 'copy': {
+          const id = args.id
+          if (!id) { result = { error: '--id required (media hashed ID)' }; break }
+          const body = {}
+          if (args['target-project']) body.project_id = args['target-project']
+          result = await api('POST', `/medias/${id}/copy.json`, body)
+          break
+        }
+        case 'stats': {
+          const id = args.id
+          if (!id) { result = { error: '--id required (media hashed ID)' }; break }
+          result = await api('GET', `/medias/${id}/stats.json`)
+          break
+        }
+        default:
+          result = { error: 'Unknown medias subcommand. Use: list, get, update, delete, copy, stats' }
+      }
+      break
+
+    case 'stats':
+      switch (sub) {
+        case 'account':
+          result = await api('GET', '/stats/account.json')
+          break
+        case 'project': {
+          const id = args.id
+          if (!id) { result = { error: '--id required (project hashed ID)' }; break }
+          result = await api('GET', `/stats/projects/${id}.json`)
+          break
+        }
+        case 'media': {
+          const id = args.id
+          if (!id) { result = { error: '--id required (media hashed ID)' }; break }
+          result = await api('GET', `/stats/medias/${id}.json`)
+          break
+        }
+        case 'media-by-date': {
+          const id = args.id
+          if (!id) { result = { error: '--id required (media hashed ID)' }; break }
+          const params = new URLSearchParams()
+          if (args.start) params.set('start_date', args.start)
+          if (args.end) params.set('end_date', args.end)
+          const qs = params.toString() ? `?${params.toString()}` : ''
+          result = await api('GET', `/stats/medias/${id}/by_date.json${qs}`)
+          break
+        }
+        case 'engagement': {
+          const id = args.id
+          if (!id) { result = { error: '--id required (media hashed ID)' }; break }
+          result = await api('GET', `/stats/medias/${id}/engagement.json`)
+          break
+        }
+        case 'visitors': {
+          const params = new URLSearchParams({ page: String(page), per_page: String(perPage) })
+          if (args.search) params.set('search', args.search)
+          result = await api('GET', `/stats/visitors.json?${params.toString()}`)
+          break
+        }
+        case 'visitor': {
+          const key = args.key
+          if (!key) { result = { error: '--key required (visitor key)' }; break }
+          result = await api('GET', `/stats/visitors/${key}.json`)
+          break
+        }
+        case 'events': {
+          const params = new URLSearchParams({ page: String(page), per_page: String(perPage) })
+          if (args['media-id']) params.set('media_id', args['media-id'])
+          result = await api('GET', `/stats/events.json?${params.toString()}`)
+          break
+        }
+        default:
+          result = { error: 'Unknown stats subcommand. Use: account, project, media, media-by-date, engagement, visitors, visitor, events' }
+      }
+      break
+
+    case 'account':
+      result = await api('GET', '/account.json')
+      break
+
+    case 'captions':
+      switch (sub) {
+        case 'list': {
+          const id = args.id
+          if (!id) { result = { error: '--id required (media hashed ID)' }; break }
+          result = await api('GET', `/medias/${id}/captions.json`)
+          break
+        }
+        case 'create': {
+          const id = args.id
+          const language = args.language
+          if (!id) { result = { error: '--id required (media hashed ID)' }; break }
+          if (!language) { result = { error: '--language required (e.g. eng)' }; break }
+          const body = { language }
+          if (args['srt-file']) {
+            // Dynamic import: this tree lives under a "type": "module"
+            // package, so the upstream require() form does not resolve here.
+            const fs = await import('node:fs')
+            const path = await import('node:path')
+            // Agent-invoked CLI: a prompt-injected --srt-file must not be
+            // able to read a secret and POST it as caption text. Defence:
+            //  1. realpathSync so a symlink cannot point somewhere else —
+            //     path.resolve is lexical and does NOT follow links.
+            //  2. confine the real, link-resolved path to the real cwd.
+            //  3. allowlist the extension of the RESOLVED path — checking
+            //     the argument alone is defeated by an in-cwd .srt symlink
+            //     that resolves to an in-cwd secret; both the name AND the
+            //     final target must be a caption file.
+            //  4. reject hard links (see below) — realpath does not resolve
+            //     them, so they need their own check.
+            const isCaption = (p) => /\.(srt|vtt)$/i.test(p)
+            if (!isCaption(args['srt-file'])) {
+              result = { error: '--srt-file must be a .srt or .vtt caption file' }
+              break
+            }
+            let real
+            try {
+              real = fs.realpathSync(path.resolve(args['srt-file']))
+            } catch {
+              result = { error: '--srt-file not found or unreadable' }
+              break
+            }
+            const root = fs.realpathSync(process.cwd()) + path.sep
+            if (!(real + path.sep).startsWith(root)) {
+              result = { error: '--srt-file must point inside the current working directory' }
+              break
+            }
+            if (!isCaption(real)) {
+              result = { error: '--srt-file must resolve to a .srt or .vtt caption file' }
+              break
+            }
+            //  4. reject hard links: they share an inode with the target
+            //     but realpath does NOT resolve them, so a .srt hard link
+            //     to an in-cwd secret would slip past checks 1-3. A plain
+            //     caption file has nlink === 1; rejecting nlink > 1 also
+            //     refuses a legit but hard-linked .srt (conservative, but
+            //     hard-linked caption files are not a real workflow).
+            if (fs.lstatSync(real).nlink > 1) {
+              result = { error: '--srt-file must not be a hard link' }
+              break
+            }
+            body.caption_file = fs.readFileSync(real, 'utf8')
+          }
+          result = await api('POST', `/medias/${id}/captions.json`, body)
+          break
+        }
+        default:
+          result = { error: 'Unknown captions subcommand. Use: list, create' }
+      }
+      break
+
+    default:
+      result = {
+        error: 'Unknown command',
+        usage: {
+          projects: 'projects [list | get --id <id> | create --name <name> | update --id <id> --name <name> | delete --id <id>]',
+          medias: 'medias [list [--project <id>] | get --id <id> | update --id <id> --name <name> | delete --id <id> | copy --id <id> [--target-project <id>] | stats --id <id>]',
+          stats: 'stats [account | project --id <id> | media --id <id> | media-by-date --id <id> [--start <date> --end <date>] | engagement --id <id> | visitors | visitor --key <key> | events [--media-id <id>]]',
+          account: 'account',
+          captions: 'captions [list --id <media-id> | create --id <media-id> --language <lang>]',
+          options: '--page <n> --per-page <n>',
+        }
+      }
+  }
+
+  console.log(JSON.stringify(result, null, 2))
+}
+
+main().catch(err => {
+  console.error(JSON.stringify({ error: err.message }))
+  process.exit(1)
+})

package/departments/marketing/tools/clis/zapier.js

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+
+const API_KEY = process.env.ZAPIER_API_KEY
+const BASE_URL = 'https://api.zapier.com/v1'
+
+if (!API_KEY) {
+  console.error(JSON.stringify({ error: 'ZAPIER_API_KEY environment variable required' }))
+  process.exit(1)
+}
+
+async function api(method, path, body) {
+  if (args['dry-run']) {
+    return { _dry_run: true, method, url: `${BASE_URL}${path}`, headers: { 'X-API-Key': '***', 'Content-Type': 'application/json' }, body: body || undefined }
+  }
+  const res = await fetch(`${BASE_URL}${path}`, {
+    method,
+    headers: {
+      'X-API-Key': API_KEY,
+      'Content-Type': 'application/json',
+    },
+    body: body ? JSON.stringify(body) : undefined,
+  })
+  const text = await res.text()
+  try {
+    return JSON.parse(text)
+  } catch {
+    return { status: res.status, body: text }
+  }
+}
+
+async function webhookPost(url, data) {
+  if (args['dry-run']) {
+    return { _dry_run: true, method: 'POST', url, headers: { 'Content-Type': 'application/json' }, body: data || undefined }
+  }
+  const res = await fetch(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(data),
+  })
+  const text = await res.text()
+  try {
+    return JSON.parse(text)
+  } catch {
+    return { status: res.status, body: text }
+  }
+}
+
+function parseArgs(args) {
+  const result = { _: [] }
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]
+    if (arg.startsWith('--')) {
+      const key = arg.slice(2)
+      const next = args[i + 1]
+      if (next && !next.startsWith('--')) {
+        result[key] = next
+        i++
+      } else {
+        result[key] = true
+      }
+    } else {
+      result._.push(arg)
+    }
+  }
+  return result
+}
+
+const args = parseArgs(process.argv.slice(2))
+const [cmd, sub, ...rest] = args._
+
+async function main() {
+  let result
+
+  switch (cmd) {
+    case 'zaps':
+      switch (sub) {
+        case 'list':
+          result = await api('GET', '/zaps')
+          break
+        case 'get': {
+          if (!args.id) { result = { error: '--id required' }; break }
+          result = await api('GET', `/zaps/${args.id}`)
+          break
+        }
+        case 'on': {
+          if (!args.id) { result = { error: '--id required' }; break }
+          result = await api('POST', `/zaps/${args.id}/on`)
+          break
+        }
+        case 'off': {
+          if (!args.id) { result = { error: '--id required' }; break }
+          result = await api('POST', `/zaps/${args.id}/off`)
+          break
+        }
+        default:
+          result = { error: 'Unknown zaps subcommand. Use: list, get, on, off' }
+      }
+      break
+
+    case 'tasks':
+      switch (sub) {
+        case 'list': {
+          if (!args['zap-id']) { result = { error: '--zap-id required' }; break }
+          result = await api('GET', `/zaps/${args['zap-id']}/tasks`)
+          break
+        }
+        default:
+          result = { error: 'Unknown tasks subcommand. Use: list' }
+      }
+      break
+
+    case 'profile':
+      switch (sub) {
+        case 'me':
+          result = await api('GET', '/profiles/me')
+          break
+        default:
+          result = { error: 'Unknown profile subcommand. Use: me' }
+      }
+      break
+
+    case 'hooks':
+      switch (sub) {
+        case 'send': {
+          // Sends a POST to a Zapier webhook catch hook URL (e.g. https://hooks.zapier.com/hooks/catch/...)
+          // SECURITY: unlike every other CLI here, the destination host is
+          // caller-controlled — this sends arbitrary --data to ANY https URL.
+          // Review the URL before invoking from an agent context.
+          if (!args.url) { result = { error: '--url required' }; break }
+          if (!args.url.startsWith('https://')) { result = { error: '--url must use https://' }; break }
+          if (!args.data) { result = { error: '--data required (JSON string)' }; break }
+          let data
+          try {
+            data = JSON.parse(args.data)
+          } catch {
+            result = { error: 'Invalid JSON for --data' }
+            break
+          }
+          result = await webhookPost(args.url, data)
+          break
+        }
+        default:
+          result = { error: 'Unknown hooks subcommand. Use: send' }
+      }
+      break
+
+    default:
+      result = {
+        error: 'Unknown command',
+        usage: {
+          zaps: 'zaps [list|get|on|off] [--id <zap_id>]',
+          tasks: 'tasks [list] --zap-id <zap_id>',
+          profile: 'profile [me]',
+          hooks: 'hooks [send] --url <webhook_url> --data <json>',
+        },
+      }
+  }
+
+  console.log(JSON.stringify(result, null, 2))
+}
+
+main().catch(err => {
+  console.error(JSON.stringify({ error: err.message }))
+  process.exit(1)
+})

package/departments/marketing/tools/clis/zoominfo.js

@@ -0,0 +1,223 @@
+#!/usr/bin/env node
+
+const BASE_URL = 'https://api.zoominfo.com'
+
+let ACCESS_TOKEN = process.env.ZOOMINFO_ACCESS_TOKEN
+
+if (!ACCESS_TOKEN && !process.env.ZOOMINFO_USERNAME) {
+  console.error(JSON.stringify({ error: 'ZOOMINFO_ACCESS_TOKEN or ZOOMINFO_USERNAME + ZOOMINFO_PRIVATE_KEY environment variables required' }))
+  process.exit(1)
+}
+
+async function authenticate() {
+  if (ACCESS_TOKEN) return ACCESS_TOKEN
+  const username = process.env.ZOOMINFO_USERNAME
+  const password = process.env.ZOOMINFO_PRIVATE_KEY
+  if (!username || !password) {
+    throw new Error('ZOOMINFO_USERNAME and ZOOMINFO_PRIVATE_KEY required for authentication')
+  }
+  const res = await fetch(`${BASE_URL}/authenticate`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ username, password }),
+  })
+  const text = await res.text()
+  if (!res.ok) {
+    throw new Error(`Authentication failed (${res.status}): ${text}`)
+  }
+  try {
+    const data = JSON.parse(text)
+    if (!data.jwt) throw new Error('No JWT in response')
+    ACCESS_TOKEN = data.jwt
+    return ACCESS_TOKEN
+  } catch (e) {
+    if (e.message === 'No JWT in response') throw e
+    throw new Error(`Authentication failed: ${text}`)
+  }
+}
+
+async function api(method, path, body) {
+  if (args['dry-run']) {
+    return { _dry_run: true, method, url: `${BASE_URL}${path}`, headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ***' }, body }
+  }
+  const token = await authenticate()
+  const res = await fetch(`${BASE_URL}${path}`, {
+    method,
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${token}`,
+    },
+    body: body ? JSON.stringify(body) : undefined,
+  })
+  const text = await res.text()
+  try {
+    return JSON.parse(text)
+  } catch {
+    return { status: res.status, body: text }
+  }
+}
+
+function parseArgs(args) {
+  const result = { _: [] }
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]
+    if (arg.startsWith('--')) {
+      const key = arg.slice(2)
+      const next = args[i + 1]
+      if (next && !next.startsWith('--')) {
+        result[key] = next
+        i++
+      } else {
+        result[key] = true
+      }
+    } else {
+      result._.push(arg)
+    }
+  }
+  return result
+}
+
+const args = parseArgs(process.argv.slice(2))
+const [cmd, sub, ...rest] = args._
+
+async function main() {
+  let result
+  const page = args.page ? Number(args.page) : 1
+  const perPage = args['per-page'] ? Number(args['per-page']) : 25
+
+  switch (cmd) {
+    case 'auth': {
+      if (args['dry-run']) {
+        result = { _dry_run: true, action: 'authenticate', url: `${BASE_URL}/authenticate`, jwt: '***' }
+        break
+      }
+      const token = await authenticate()
+      if (args['show-token']) {
+        result = { jwt: token }
+      } else {
+        const masked = token.length > 12
+          ? token.slice(0, 6) + '…' + token.slice(-6)
+          : '***'
+        result = { jwt: masked, hint: 'Use --show-token to reveal full JWT' }
+      }
+      break
+    }
+
+    case 'contacts':
+      switch (sub) {
+        case 'search': {
+          const body = { rpp: perPage, page }
+          if (args['job-title']) body.jobTitle = [args['job-title']]
+          if (args.company) body.companyName = [args.company]
+          if (args.location) body.locationSearchType = 'PersonLocation', body.personLocationCity = [args.location]
+          if (args.seniority) body.managementLevel = [args.seniority]
+          if (args.department) body.department = [args.department]
+          result = await api('POST', '/search/contact', body)
+          break
+        }
+        case 'enrich': {
+          const body = {}
+          if (args.email) body.matchEmail = [args.email]
+          if (args['person-id']) body.personId = [args['person-id']]
+          if (!args.email && !args['person-id']) {
+            result = { error: '--email or --person-id required' }
+            break
+          }
+          result = await api('POST', '/enrich/contact', body)
+          break
+        }
+        default:
+          result = { error: 'Unknown contacts subcommand. Use: search, enrich' }
+      }
+      break
+
+    case 'companies':
+      switch (sub) {
+        case 'search': {
+          const body = { rpp: perPage, page }
+          if (args.name) body.companyName = [args.name]
+          if (args.industry) body.industry = [args.industry]
+          if (args['revenue-min']) body.revenueMin = Number(args['revenue-min'])
+          if (args['revenue-max']) body.revenueMax = Number(args['revenue-max'])
+          if (args['employees-min']) body.employeeCountMin = Number(args['employees-min'])
+          if (args['employees-max']) body.employeeCountMax = Number(args['employees-max'])
+          result = await api('POST', '/search/company', body)
+          break
+        }
+        case 'enrich': {
+          const body = {}
+          if (args.domain) body.matchCompanyWebsite = [args.domain]
+          if (args['company-id']) body.companyId = [args['company-id']]
+          if (!args.domain && !args['company-id']) {
+            result = { error: '--domain or --company-id required' }
+            break
+          }
+          result = await api('POST', '/enrich/company', body)
+          break
+        }
+        default:
+          result = { error: 'Unknown companies subcommand. Use: search, enrich' }
+      }
+      break
+
+    case 'intent':
+      switch (sub) {
+        case 'search': {
+          if (!args.topic) {
+            result = { error: '--topic required' }
+            break
+          }
+          const body = { topicId: [args.topic] }
+          if (args['company-id']) body.companyId = [args['company-id']]
+          result = await api('POST', '/lookup/intent', body)
+          break
+        }
+        default:
+          result = { error: 'Unknown intent subcommand. Use: search' }
+      }
+      break
+
+    case 'scoops':
+      switch (sub) {
+        case 'search': {
+          const body = { rpp: perPage, page }
+          if (args['company-id']) body.companyId = [args['company-id']]
+          if (args.topic) body.topicId = [args.topic]
+          result = await api('POST', '/lookup/scoops', body)
+          break
+        }
+        default:
+          result = { error: 'Unknown scoops subcommand. Use: search' }
+      }
+      break
+
+    default:
+      result = {
+        error: 'Unknown command',
+        usage: {
+          auth: 'auth [--show-token] — authenticate and get JWT token (masked by default)',
+          contacts: {
+            search: 'contacts search [--job-title <t>] [--company <c>] [--location <l>] [--seniority <s>] [--department <d>] [--page <n>]',
+            enrich: 'contacts enrich --email <email> | --person-id <id>',
+          },
+          companies: {
+            search: 'companies search [--name <n>] [--industry <i>] [--revenue-min <n>] [--employees-min <n>] [--page <n>]',
+            enrich: 'companies enrich --domain <domain> | --company-id <id>',
+          },
+          intent: {
+            search: 'intent search --topic <topic> [--company-id <id>]',
+          },
+          scoops: {
+            search: 'scoops search [--company-id <id>] [--topic <topic>] [--page <n>]',
+          },
+        }
+      }
+  }
+
+  console.log(JSON.stringify(result, null, 2))
+}
+
+main().catch(err => {
+  console.error(JSON.stringify({ error: err.message }))
+  process.exit(1)
+})