ds-01 1.0.4 → 1.0.5

package/dist/commands/add.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkDpC,eAAO,MAAM,GAAG,SAqIZ,CAAC"}
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgEpC,eAAO,MAAM,GAAG,SAkRZ,CAAC"}

package/dist/commands/add.js

@@ -4,24 +4,24 @@ import pc from "picocolors";
 import fs from "fs";
 import path from "path";
 import { execSync } from "child_process";
-import { getToken, getMachineId } from "../utils/config.js";
+import { getToken } from "../utils/config.js";
+import { signWithDeviceKey } from "../utils/secureKeyStore.js";
+import machineIdPkg from "node-machine-id";
+const { machineIdSync } = machineIdPkg;
 const API_BASE_URL = process.env.DS01_API_URL || "https://ds-01.vercel.app";
 // Helper to verify Tailwind exists before doing anything
 function checkTailwindInstallation() {
     const targetDir = process.cwd();
     const pkgJsonPath = path.join(targetDir, "package.json");
-    // 1. Ensure they are in a valid Node.js project
     if (!fs.existsSync(pkgJsonPath)) {
         cancel(pc.red("No package.json found. Please run this command inside a Node.js project."));
         process.exit(1);
     }
-    // 2. Read package.json dependencies
     const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
     const allDeps = {
         ...pkgJson.dependencies,
         ...pkgJson.devDependencies,
     };
-    // 3. Strict Tailwind Check
     if (!allDeps["tailwindcss"]) {
         cancel(pc.red("Tailwind CSS is missing from your project dependencies.\n") +
             pc.gray("DS01 components rely strictly on Tailwind CSS for styling.\n\n") +
@@ -37,10 +37,8 @@ export const add = new Command()
     .description("Add a component from DS01 to your project")
     .argument("<component>", "The name of the component (e.g., premium-section)")
     .action(async (componentName) => {
-    console.log(); // Spacing for visual breathing room
-    // 1. Premium Header
+    console.log();
     intro(`${pc.bgWhite(pc.black(pc.bold(" DS01 ")))} ${pc.gray("Adding Component")}`);
-    // 2. Run Pre-Flight Tailwind Check
     checkTailwindInstallation();
     const cwd = process.cwd();
     const configPath = path.join(cwd, "ds01.config.json");
@@ -49,9 +47,8 @@ export const add = new Command()
         process.exit(1);
     }
     const config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
-    // Read the GLOBAL credentials, not the local project config
     const token = getToken();
-    const machineId = getMachineId();
+    const machineId = machineIdSync();
     if (!token || !machineId) {
         cancel(pc.red("You are not authenticated. Run 'npx ds-01 login' first."));
         process.exit(1);
@@ -59,11 +56,31 @@ export const add = new Command()
     const s = spinner();
     s.start(`Fetching ${pc.cyan(`<${componentName} />`)} from registry...`);
     try {
-        // 3. Fetch component from your API
+        // --------------------------------------------------
+        // 1. Create request-specific message
+        // --------------------------------------------------
+        const timestamp = Date.now().toString();
+        const message = [
+            "GET",
+            `/api/registry/${componentName}`,
+            timestamp,
+            machineId,
+        ].join("\n");
+        // --------------------------------------------------
+        // 2. Sign message using the device private key
+        // --------------------------------------------------
+        const signature = await signWithDeviceKey(new TextEncoder().encode(message));
+        const signatureBase64 = Buffer.from(signature).toString("base64");
+        // --------------------------------------------------
+        // 3. Send token + machine ID + signature
+        // --------------------------------------------------
         const response = await fetch(`${API_BASE_URL}/api/registry/${componentName}`, {
+            method: "GET",
             headers: {
                 Authorization: `Bearer ${token}`,
-                "X-Machine-ID": machineId, // <-- TypeScript error fixed here
+                "X-Machine-ID": machineId,
+                "X-DS01-Timestamp": timestamp,
+                "X-DS01-Signature": signatureBase64,
             },
         });
         if (!response.ok) {
@@ -72,54 +89,63 @@ export const add = new Command()
             process.exit(1);
         }
         const componentData = await response.json();
-        // 4. Create dedicated component folder
+        // --------------------------------------------------
+        // 4. Create component folder
+        // --------------------------------------------------
         const targetDir = path.join(cwd, config.componentsPath, componentName);
         if (!fs.existsSync(targetDir)) {
-            fs.mkdirSync(targetDir, { recursive: true });
+            fs.mkdirSync(targetDir, {
+                recursive: true,
+            });
         }
-        // 🛠️ EXTRACT NAMES FOR SMART REWRITING (e.g., ["PremiumHero", "Section", "AnimatedText"])
-        // We strip the extension (.tsx, .ts) to get the raw component name for import matching
+        // --------------------------------------------------
+        // 5. Extract bundled file names
+        // --------------------------------------------------
         const bundledFileNames = componentData.files.map((file) => file.name.replace(/\.[^/.]+$/, ""));
-        // 5. Inject the pure code files
+        // --------------------------------------------------
+        // 6. Write component files
+        // --------------------------------------------------
         for (const file of componentData.files) {
-            // Because the server sends just the basename (e.g., PremiumHero.tsx),
-            // path.join inherently flattens all files into the single targetDir folder.
             const filePath = path.join(targetDir, file.name);
             let content = file.content;
-            // 🛠️ DYNAMIC IMPORT REWRITER
             bundledFileNames.forEach((fileName) => {
-                // Finds any relative import pointing to a bundled file (e.g., "../Section", "../../Section")
-                // and rewrites it strictly to a sibling import (e.g., "./Section")
                 const regex = new RegExp(`from\\s+["']\\.[^"']*?\\/${fileName}["']`, "g");
                 content = content.replace(regex, `from "./${fileName}"`);
             });
             fs.writeFileSync(filePath, content);
         }
         s.stop(pc.green(`Downloaded ${componentData.files.length} files into ${pc.white(`/${config.componentsPath}/${componentName}`)}`));
-        // 6. Auto-install Missing Component Dependencies (e.g., framer-motion)
-        if (componentData.dependencies && componentData.dependencies.length > 0) {
+        // --------------------------------------------------
+        // 7. Install dependencies
+        // --------------------------------------------------
+        if (componentData.dependencies &&
+            componentData.dependencies.length > 0) {
             const depsToInstall = componentData.dependencies.join(" ");
             s.start(`Installing missing dependencies: ${pc.cyan(depsToInstall)}...`);
             try {
-                // Silently runs the npm install command in the background
-                execSync(`npm install ${depsToInstall}`, { stdio: "ignore" });
+                execSync(`npm install ${depsToInstall}`, {
+                    stdio: "ignore",
+                });
                 s.stop(pc.green(`Dependencies installed successfully: ${pc.gray(depsToInstall)}`));
             }
-            catch (error) {
+            catch {
                 s.stop(pc.red("Failed to auto-install dependencies."));
                 note(`Please run: ${pc.cyan(`npm install ${depsToInstall}`)} manually.`, "Manual Action Required");
             }
         }
-        // 7. Clean Success Outro
-        // Find the main file to import (prioritize the one that matches the component name or use the first one)
-        const mainFile = bundledFileNames.find((name) => name.toLowerCase() === componentName.toLowerCase()) || bundledFileNames[0];
+        // --------------------------------------------------
+        // 8. Success
+        // --------------------------------------------------
+        const mainFile = bundledFileNames.find((name) => name.toLowerCase() ===
+            componentName.toLowerCase()) || bundledFileNames[0];
         outro(`${pc.white("✔")} ${pc.bold(`Component <${componentName} /> is ready!`)}\n` +
-            pc.gray(`Import it: `) +
+            pc.gray("Import it: ") +
             pc.cyan(`import { ${mainFile} } from "@/${config.componentsPath}/${componentName}/${mainFile}"`));
     }
     catch (error) {
         s.stop(pc.red("An error occurred during injection."));
-        cancel(pc.gray(error.message || "Unknown CLI Error"));
+        cancel(pc.gray(error?.message ||
+            "Unknown CLI Error"));
         process.exit(1);
     }
 });

package/dist/commands/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC,eAAO,MAAM,KAAK,SA4Fd,CAAC"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgBpC,eAAO,MAAM,KAAK,SA2Id,CAAC"}

package/dist/commands/login.js

@@ -4,24 +4,40 @@ import pc from "picocolors";
 import open from "open";
 import machineIdPkg from "node-machine-id";
 import { saveToken } from "../utils/config.js";
+import { createDeviceKey, getDevicePublicKey, } from "../utils/secureKeyStore.js";
 const API_BASE_URL = process.env.DS01_API_URL || "https://ds-01.vercel.app";
 const { machineIdSync } = machineIdPkg;
 export const login = new Command()
     .name("login")
     .description("Authenticate your terminal with DS01 via browser")
     .action(async () => {
-    console.log(); // Spacing for breathing room
-    // 1. Header banner
+    console.log();
     intro(`${pc.bgWhite(pc.black(pc.bold(" DS01 ")))} ${pc.gray("v1.0.0 — Terminal Authentication")}`);
     const s = spinner();
     try {
-        // 2. Hardware ID Generation & Device Code Request
-        s.start("Generating hardware fingerprint & requesting pairing code...");
+        // --------------------------------------------------
+        // 1. Create / load the device's secure key
+        // --------------------------------------------------
+        s.start("Preparing secure device identity...");
+        await createDeviceKey();
+        // Only the PUBLIC certificate/key leaves the machine.
+        const publicKey = await getDevicePublicKey();
+        // Existing machine fingerprint.
         const hardwareId = machineIdSync();
+        // --------------------------------------------------
+        // 2. Start device authorization
+        // --------------------------------------------------
+        s.start("Requesting pairing code...");
         const initResponse = await fetch(`${API_BASE_URL}/api/auth/device/code`, {
             method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ machineId: hardwareId }),
+            headers: {
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                machineId: hardwareId,
+                publicKey,
+                publicKeyType: process.platform === "win32" ? "windows-rsa" : "macos-ec",
+            }),
         });
         if (!initResponse.ok) {
             s.stop(pc.red("Failed to reach DS01 authorization server."));
@@ -29,18 +45,24 @@ export const login = new Command()
             process.exit(1);
         }
         const { deviceCode, userCode, verificationUrl, interval } = await initResponse.json();
-        s.stop(pc.green("Device authorization code generated."));
-        // 3. Highlighted Box for User Action
+        if (!deviceCode || !userCode || !verificationUrl) {
+            throw new Error("Authorization server returned an invalid device response.");
+        }
+        s.stop(pc.green("Secure device identity registered."));
+        // --------------------------------------------------
+        // 3. Ask user to approve in browser
+        // --------------------------------------------------
         note(`${pc.bold("Pairing Code:")}    ${pc.cyan(pc.bold(` ${userCode} `))}\n` +
             `${pc.bold("Verification URL:")} ${pc.underline(verificationUrl)}`, "Action Required");
-        // 4. Auto-launch Browser
         try {
             await open(verificationUrl);
         }
         catch {
-            // Non-blocking fallback if browser launch fails on headless setups
+            // Browser launch failure is non-fatal.
         }
-        // 5. Polling Loop
+        // --------------------------------------------------
+        // 4. Poll for authorization
+        // --------------------------------------------------
         s.start("Waiting for web authorization...");
         let token = null;
         const pollInterval = (interval || 5) * 1000;
@@ -48,8 +70,13 @@ export const login = new Command()
             await new Promise((resolve) => setTimeout(resolve, pollInterval));
             const tokenResponse = await fetch(`${API_BASE_URL}/api/auth/device/token`, {
                 method: "POST",
-                headers: { "Content-Type": "application/json" },
-                body: JSON.stringify({ deviceCode, machineId: hardwareId }),
+                headers: {
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify({
+                    deviceCode,
+                    machineId: hardwareId,
+                }),
             });
             const tokenData = await tokenResponse.json();
             if (tokenResponse.ok && tokenData.accessToken) {
@@ -61,15 +88,17 @@ export const login = new Command()
                 process.exit(1);
             }
         }
-        // 6. Save token to local wallet
+        // --------------------------------------------------
+        // 5. Save CLI token + machine ID
+        // --------------------------------------------------
         saveToken(token, hardwareId);
         s.stop(pc.green("Hardware signature linked & token verified!"));
-        // 7. Clean Success Outro
-        outro(`${pc.white("✔")} ${pc.bold("Terminal synced successfully")} ${pc.gray("Session token saved locally.")}`);
+        outro(`${pc.white("✔")} ${pc.bold("Terminal synced successfully")}\n` +
+            pc.gray("Secure device key and session token are ready."));
     }
     catch (error) {
         s.stop(pc.red("An error occurred during login."));
-        cancel(pc.gray(error.message || "Unknown CLI Error"));
+        cancel(pc.gray(error?.message || "Unknown CLI Error"));
         process.exit(1);
     }
 });

package/dist/commands/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/commands/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,eAAO,MAAM,MAAM,SAuBf,CAAC"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/commands/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,eAAO,MAAM,MAAM,SAiDf,CAAC"}

package/dist/commands/logout.js

@@ -2,24 +2,44 @@ import { Command } from "commander";
 import chalk from "chalk";
 import ora from "ora";
 import { deleteToken, getToken } from "../utils/config.js";
+import machineIdPkg from "node-machine-id";
+const { machineIdSync } = machineIdPkg;
+const API_BASE_URL = process.env.DS01_API_URL || "https://ds-01.vercel.app";
 export const logout = new Command()
     .name("logout")
-    .description("Log out of your DS01 account and clear local credentials")
+    .description("Log out of your DS01 account and revoke the CLI session")
     .action(async () => {
     const token = getToken();
-    if (!token) {
+    const machineId = machineIdSync();
+    if (!token || !machineId) {
         console.log(chalk.yellow("You are already logged out."));
         return;
     }
-    const spinner = ora("Logging out...").start();
+    const spinner = ora("Revoking CLI session...").start();
     try {
-        // Throw away the digital wallet / token
+        const response = await fetch(`${API_BASE_URL}/api/auth/cli/logout`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "X-Machine-ID": machineId,
+            },
+        });
+        // NEW: Do not silently delete local credentials if the server
+        // failed to revoke the session.
+        if (!response.ok) {
+            const data = await response.json().catch(() => null);
+            throw new Error(data?.error || `Logout failed (HTTP ${response.status})`);
+        }
+        // NEW: Delete local credentials only after the server confirms
+        // that the CLI session has been revoked.
+        console.log("✅ Server confirmed CLI session was revoked.");
         deleteToken();
+        console.log("✅ Local credentials deleted.");
         spinner.succeed(chalk.green("Successfully logged out."));
-        console.log(chalk.gray("Your local credentials have been cleared."));
+        console.log(chalk.gray("Your CLI session has been revoked and local credentials have been cleared."));
     }
     catch (error) {
-        spinner.fail(chalk.red("Failed to log out cleanly."));
-        console.error(error);
+        spinner.fail(chalk.red("Failed to log out."));
+        console.error(chalk.red(error.message || "Unknown logout error."));
     }
 });

package/dist/index.js

@@ -17,4 +17,6 @@ program.addCommand(logout);
 program.addCommand(init);
 program.addCommand(add); // <-- 2. Register the add command!
 // Parse the arguments from the terminal
+// It is the point where Commander reads the user's terminal input and decides 
+// which registered command's .action() function should execute.
 program.parse(process.argv);

package/dist/test-key.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=test-key.d.ts.map

package/dist/test-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-key.d.ts","sourceRoot":"","sources":["../src/test-key.ts"],"names":[],"mappings":""}

package/dist/test-key.js

@@ -0,0 +1,7 @@
+import { createDeviceKey, getDevicePublicKey, signWithDeviceKey, } from "./utils/secureKeyStore.js";
+await createDeviceKey();
+const publicKey = await getDevicePublicKey();
+console.log("Public key:", publicKey);
+const message = new TextEncoder().encode("hello DS01");
+const signature = await signWithDeviceKey(message);
+console.log("Signature:", Buffer.from(signature).toString("base64"));

package/dist/utils/config.d.ts

@@ -1,5 +1,4 @@
 export declare function saveToken(token: string, machineId: string): void;
 export declare function getToken(): string | null;
-export declare function getMachineId(): string | null;
 export declare function deleteToken(): void;
 //# sourceMappingURL=config.d.ts.map

package/dist/utils/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAQA,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAczD;AAED,wBAAgB,QAAQ,IAAI,MAAM,GAAG,IAAI,CAWxC;AAED,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAW5C;AAED,wBAAgB,WAAW,SAI1B"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAQA,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAczD;AAED,wBAAgB,QAAQ,IAAI,MAAM,GAAG,IAAI,CAWxC;AAID,wBAAgB,WAAW,SAI1B"}

package/dist/utils/config.js

@@ -30,19 +30,6 @@ export function getToken() {
     }
     return null;
 }
-export function getMachineId() {
-    if (fs.existsSync(credentialsPath)) {
-        try {
-            const data = fs.readFileSync(credentialsPath, "utf-8");
-            const parsed = JSON.parse(data);
-            return parsed.machineId || null;
-        }
-        catch {
-            return null;
-        }
-    }
-    return null;
-}
 export function deleteToken() {
     if (fs.existsSync(credentialsPath)) {
         fs.unlinkSync(credentialsPath);

package/dist/utils/deviceKey.d.ts

@@ -0,0 +1,3 @@
+import { webcrypto } from "node:crypto";
+export declare function generateDeviceKeyPair(): Promise<webcrypto.CryptoKeyPair>;
+//# sourceMappingURL=deviceKey.d.ts.map

package/dist/utils/deviceKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deviceKey.d.ts","sourceRoot":"","sources":["../../src/utils/deviceKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,wBAAsB,qBAAqB,qCAc1C"}

package/dist/utils/deviceKey.js

@@ -0,0 +1,13 @@
+import { webcrypto } from "node:crypto";
+const { subtle } = webcrypto;
+export async function generateDeviceKeyPair() {
+    // Generate an asymmetric key pair:
+    // - publicKey  → can be shared with the server
+    // - privateKey → stays on this device
+    const keyPair = await subtle.generateKey({
+        name: "ECDSA",
+        namedCurve: "P-256",
+    }, false, // 🔐 Private key is NON-EXPORTABLE
+    ["sign", "verify"]);
+    return keyPair;
+}

package/dist/utils/secureKeyStore.d.ts

@@ -0,0 +1,10 @@
+/**
+ * ---------------------------------------------------------
+ * PUBLIC API
+ * ---------------------------------------------------------
+ */
+export declare function createDeviceKey(): Promise<void>;
+export declare function getDevicePublicKey(): Promise<string>;
+export declare function signWithDeviceKey(data: Uint8Array): Promise<Uint8Array>;
+export declare function deleteDeviceKey(): Promise<void>;
+//# sourceMappingURL=secureKeyStore.d.ts.map

package/dist/utils/secureKeyStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secureKeyStore.d.ts","sourceRoot":"","sources":["../../src/utils/secureKeyStore.ts"],"names":[],"mappings":"AAwTA;;;;GAIG;AAEH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAQ1D;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD"}