ds-01 1.0.4 → 1.0.6

package/dist/utils/secureKeyStore.js

@@ -0,0 +1,266 @@
+// cli/src/utils/secureKeyStore.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+const execFileAsync = promisify(execFile);
+const KEY_NAME = "DS01-CLI-Device-Key";
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+function getMacHelperPath() {
+    // dist/utils/secureKeyStore.js
+    // ../native/macos-key-helper.swift
+    return path.resolve(__dirname, "../native/macos-key-helper.swift");
+}
+function ensureSupportedOS() {
+    const platform = os.platform();
+    if (platform !== "win32" && platform !== "darwin") {
+        throw new Error("DS01 secure device keys currently support Windows and macOS.");
+    }
+}
+/**
+ * ---------------------------------------------------------
+ * WINDOWS
+ * ---------------------------------------------------------
+ */
+async function createWindowsDeviceKey() {
+    const script = `
+$ErrorActionPreference = "Stop"
+
+$existing = Get-ChildItem Cert:\\CurrentUser\\My |
+  Where-Object {
+    $_.Subject -eq "CN=${KEY_NAME}"
+  } |
+  Select-Object -First 1
+
+if ($existing) {
+  Write-Output "EXISTS"
+  exit 0
+}
+
+$params = @{
+  Type = "Custom"
+  Subject = "CN=${KEY_NAME}"
+
+  Provider = "Microsoft Platform Crypto Provider"
+
+  KeyAlgorithm = "RSA"
+  KeyLength = 2048
+
+  KeyExportPolicy = "NonExportable"
+
+  KeyUsage = "DigitalSignature"
+  KeySpec = "Signature"
+
+  CertStoreLocation = "Cert:\\CurrentUser\\My"
+
+  NotAfter = (Get-Date).AddYears(10)
+}
+
+New-SelfSignedCertificate @params | Out-Null
+
+Write-Output "CREATED"
+`;
+    const { stdout } = await execFileAsync("powershell.exe", [
+        "-NoProfile",
+        "-NonInteractive",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-Command",
+        script,
+    ], {
+        windowsHide: true,
+    });
+    const result = stdout.trim();
+    if (result !== "CREATED" && result !== "EXISTS") {
+        throw new Error("Failed to create Windows DS01 device key.");
+    }
+}
+async function getWindowsPublicKey() {
+    const script = `
+$ErrorActionPreference = "Stop"
+
+$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+  Where-Object {
+    $_.Subject -eq "CN=${KEY_NAME}"
+  } |
+  Select-Object -First 1
+
+if (-not $cert) {
+  throw "DS01 device key not found."
+}
+
+[Convert]::ToBase64String($cert.RawData)
+`;
+    const { stdout } = await execFileAsync("powershell.exe", [
+        "-NoProfile",
+        "-NonInteractive",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-Command",
+        script,
+    ], {
+        windowsHide: true,
+    });
+    const certificate = stdout.trim();
+    if (!certificate) {
+        throw new Error("Unable to read Windows DS01 public certificate.");
+    }
+    return certificate;
+}
+async function signWindowsDeviceKey(data) {
+    const dataBase64 = Buffer.from(data).toString("base64");
+    const script = `
+$ErrorActionPreference = "Stop"
+
+$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+  Where-Object {
+    $_.Subject -eq "CN=${KEY_NAME}"
+  } |
+  Select-Object -First 1
+
+if (-not $cert) {
+  throw "DS01 device key not found."
+}
+
+if (-not $cert.HasPrivateKey) {
+  throw "DS01 device certificate has no private key."
+}
+
+$rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
+
+if (-not $rsa) {
+  throw "Unable to access DS01 private signing key."
+}
+
+try {
+  $data = [Convert]::FromBase64String("${dataBase64}")
+
+  $signature = $rsa.SignData(
+    $data,
+    [System.Security.Cryptography.HashAlgorithmName]::SHA256,
+    [System.Security.Cryptography.RSASignaturePadding]::Pkcs1
+  )
+
+  [Convert]::ToBase64String($signature)
+}
+finally {
+  $rsa.Dispose()
+}
+`;
+    const { stdout } = await execFileAsync("powershell.exe", [
+        "-NoProfile",
+        "-NonInteractive",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-Command",
+        script,
+    ], {
+        windowsHide: true,
+    });
+    const signature = stdout.trim();
+    if (!signature) {
+        throw new Error("Failed to sign data with Windows device key.");
+    }
+    return new Uint8Array(Buffer.from(signature, "base64"));
+}
+async function deleteWindowsDeviceKey() {
+    const script = `
+$ErrorActionPreference = "Stop"
+
+$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+  Where-Object {
+    $_.Subject -eq "CN=${KEY_NAME}"
+  } |
+  Select-Object -First 1
+
+if ($cert) {
+  Remove-Item $cert.PSPath
+}
+`;
+    await execFileAsync("powershell.exe", [
+        "-NoProfile",
+        "-NonInteractive",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-Command",
+        script,
+    ], {
+        windowsHide: true,
+    });
+}
+/**
+ * ---------------------------------------------------------
+ * MACOS
+ * ---------------------------------------------------------
+ */
+async function runMacHelper(operation, data) {
+    const helper = getMacHelperPath();
+    const args = [helper, operation];
+    if (data) {
+        args.push(Buffer.from(data).toString("base64"));
+    }
+    const { stdout } = await execFileAsync("swift", args, {
+        windowsHide: true,
+    });
+    return stdout.trim();
+}
+async function createMacDeviceKey() {
+    const result = await runMacHelper("create");
+    if (result !== "CREATED" && result !== "EXISTS") {
+        throw new Error(result || "Failed to create macOS Secure Enclave device key.");
+    }
+}
+async function getMacPublicKey() {
+    const result = await runMacHelper("public");
+    if (!result) {
+        throw new Error("Unable to read macOS DS01 public key.");
+    }
+    return result;
+}
+async function signMacDeviceKey(data) {
+    const result = await runMacHelper("sign", data);
+    if (!result) {
+        throw new Error("Failed to sign data with macOS Secure Enclave key.");
+    }
+    return new Uint8Array(Buffer.from(result, "base64"));
+}
+async function deleteMacDeviceKey() {
+    await runMacHelper("delete");
+}
+/**
+ * ---------------------------------------------------------
+ * PUBLIC API
+ * ---------------------------------------------------------
+ */
+export async function createDeviceKey() {
+    ensureSupportedOS();
+    if (os.platform() === "win32") {
+        await createWindowsDeviceKey();
+        return;
+    }
+    await createMacDeviceKey();
+}
+export async function getDevicePublicKey() {
+    ensureSupportedOS();
+    if (os.platform() === "win32") {
+        return getWindowsPublicKey();
+    }
+    return getMacPublicKey();
+}
+export async function signWithDeviceKey(data) {
+    ensureSupportedOS();
+    if (os.platform() === "win32") {
+        return signWindowsDeviceKey(data);
+    }
+    return signMacDeviceKey(data);
+}
+export async function deleteDeviceKey() {
+    ensureSupportedOS();
+    if (os.platform() === "win32") {
+        await deleteWindowsDeviceKey();
+        return;
+    }
+    await deleteMacDeviceKey();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ds-01",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "Make your site best with DS01",
   "type": "module",
   "bin": {
@@ -16,6 +16,7 @@
     "@clack/prompts": "^1.7.0",
     "chalk": "^5.6.2",
     "commander": "^14",
+    "cross-keychain": "^1.1.0",
     "node-machine-id": "^1",
     "open": "^10",
     "ora": "^8",

package/src/commands/add.ts

@@ -4,46 +4,60 @@ import pc from "picocolors";
 import fs from "fs";
 import path from "path";
 import { execSync } from "child_process";
-import { getToken, getMachineId } from "../utils/config.js";
 
-const API_BASE_URL = process.env.DS01_API_URL || "https://ds-01.vercel.app";
+import { getToken } from "../utils/config.js";
+import { signWithDeviceKey } from "../utils/secureKeyStore.js";
+
+import machineIdPkg from "node-machine-id";
+
+const { machineIdSync } = machineIdPkg;
+
+const API_BASE_URL =
+  process.env.DS01_API_URL || "https://ds-01.vercel.app";
 
 // Helper to verify Tailwind exists before doing anything
 function checkTailwindInstallation() {
   const targetDir = process.cwd();
   const pkgJsonPath = path.join(targetDir, "package.json");
 
-  // 1. Ensure they are in a valid Node.js project
   if (!fs.existsSync(pkgJsonPath)) {
     cancel(
       pc.red(
-        "No package.json found. Please run this command inside a Node.js project."
-      )
+        "No package.json found. Please run this command inside a Node.js project.",
+      ),
     );
     process.exit(1);
   }
 
-  // 2. Read package.json dependencies
-  const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+  const pkgJson = JSON.parse(
+    fs.readFileSync(pkgJsonPath, "utf-8"),
+  );
+
   const allDeps = {
     ...pkgJson.dependencies,
     ...pkgJson.devDependencies,
   };
 
-  // 3. Strict Tailwind Check
   if (!allDeps["tailwindcss"]) {
     cancel(
-      pc.red("Tailwind CSS is missing from your project dependencies.\n") +
+      pc.red(
+        "Tailwind CSS is missing from your project dependencies.\n",
+      ) +
         pc.gray(
-          "DS01 components rely strictly on Tailwind CSS for styling.\n\n"
+          "DS01 components rely strictly on Tailwind CSS for styling.\n\n",
         ) +
         pc.white(
-          "Kindly install it and configure your project, then retry:\n"
+          "Kindly install it and configure your project, then retry:\n",
+        ) +
+        pc.cyan(
+          "  npm install tailwindcss @tailwindcss/postcss postcss\n\n",
         ) +
-        pc.cyan("  npm install tailwindcss @tailwindcss/postcss postcss\n\n") +
         pc.gray("Official Setup Guide: ") +
-        pc.underline("https://tailwindcss.com/docs/installation")
+        pc.underline(
+          "https://tailwindcss.com/docs/installation",
+        ),
     );
+
     process.exit(1);
   }
 }
@@ -51,134 +65,275 @@ function checkTailwindInstallation() {
 export const add = new Command()
   .name("add")
   .description("Add a component from DS01 to your project")
-  .argument("<component>", "The name of the component (e.g., premium-section)")
+  .argument(
+    "<component>",
+    "The name of the component (e.g., premium-section)",
+  )
   .action(async (componentName: string) => {
-    console.log(); // Spacing for visual breathing room
+    console.log();
 
-    // 1. Premium Header
     intro(
-      `${pc.bgWhite(pc.black(pc.bold(" DS01 ")))} ${pc.gray("Adding Component")}`
+      `${pc.bgWhite(pc.black(pc.bold(" DS01 ")))} ${pc.gray(
+        "Adding Component",
+      )}`,
     );
 
-    // 2. Run Pre-Flight Tailwind Check
     checkTailwindInstallation();
 
     const cwd = process.cwd();
-    const configPath = path.join(cwd, "ds01.config.json");
+
+    const configPath = path.join(
+      cwd,
+      "ds01.config.json",
+    );
 
     if (!fs.existsSync(configPath)) {
-      cancel(pc.red("ds01.config.json not found. Run 'npx ds-01 init' first."));
+      cancel(
+        pc.red(
+          "ds01.config.json not found. Run 'npx ds-01 init' first.",
+        ),
+      );
+
       process.exit(1);
     }
 
-    const config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
-    
-    // Read the GLOBAL credentials, not the local project config
+    const config = JSON.parse(
+      fs.readFileSync(configPath, "utf-8"),
+    );
+
     const token = getToken();
-    const machineId = getMachineId();
+    const machineId = machineIdSync();
 
     if (!token || !machineId) {
-      cancel(pc.red("You are not authenticated. Run 'npx ds-01 login' first."));
+      cancel(
+        pc.red(
+          "You are not authenticated. Run 'npx ds-01 login' first.",
+        ),
+      );
+
       process.exit(1);
     }
 
     const s = spinner();
-    s.start(`Fetching ${pc.cyan(`<${componentName} />`)} from registry...`);
+
+    s.start(
+      `Fetching ${pc.cyan(
+        `<${componentName} />`,
+      )} from registry...`,
+    );
 
     try {
-      // 3. Fetch component from your API
+      // --------------------------------------------------
+      // 1. Create request-specific message
+      // --------------------------------------------------
+
+      const timestamp = Date.now().toString();
+
+      const message = [
+        "GET",
+        `/api/registry/${componentName}`,
+        timestamp,
+        machineId,
+      ].join("\n");
+
+      // --------------------------------------------------
+      // 2. Sign message using the device private key
+      // --------------------------------------------------
+
+      const signature = await signWithDeviceKey(
+        new TextEncoder().encode(message),
+      );
+
+      const signatureBase64 =
+        Buffer.from(signature).toString("base64");
+
+      // --------------------------------------------------
+      // 3. Send token + machine ID + signature
+      // --------------------------------------------------
+
       const response = await fetch(
         `${API_BASE_URL}/api/registry/${componentName}`,
         {
+          method: "GET",
+
           headers: {
             Authorization: `Bearer ${token}`,
-            "X-Machine-ID": machineId as string, // <-- TypeScript error fixed here
+
+            "X-Machine-ID": machineId,
+
+            "X-DS01-Timestamp": timestamp,
+
+            "X-DS01-Signature": signatureBase64,
           },
-        }
+        },
       );
 
       if (!response.ok) {
-        s.stop(pc.red("Component fetch failed."));
-        cancel(`Component not found or server error (HTTP ${response.status})`);
+        s.stop(
+          pc.red("Component fetch failed."),
+        );
+
+        cancel(
+          `Component not found or server error (HTTP ${response.status})`,
+        );
+
         process.exit(1);
       }
 
-      const componentData = await response.json();
+      const componentData =
+        await response.json();
+
+      // --------------------------------------------------
+      // 4. Create component folder
+      // --------------------------------------------------
+
+      const targetDir = path.join(
+        cwd,
+        config.componentsPath,
+        componentName,
+      );
 
-      // 4. Create dedicated component folder
-      const targetDir = path.join(cwd, config.componentsPath, componentName);
       if (!fs.existsSync(targetDir)) {
-        fs.mkdirSync(targetDir, { recursive: true });
+        fs.mkdirSync(targetDir, {
+          recursive: true,
+        });
       }
 
-      // 🛠️ EXTRACT NAMES FOR SMART REWRITING (e.g., ["PremiumHero", "Section", "AnimatedText"])
-      // We strip the extension (.tsx, .ts) to get the raw component name for import matching
-      const bundledFileNames = componentData.files.map((file: any) => 
-        file.name.replace(/\.[^/.]+$/, "") 
-      );
+      // --------------------------------------------------
+      // 5. Extract bundled file names
+      // --------------------------------------------------
+
+      const bundledFileNames =
+        componentData.files.map(
+          (file: any) =>
+            file.name.replace(
+              /\.[^/.]+$/,
+              "",
+            ),
+        );
+
+      // --------------------------------------------------
+      // 6. Write component files
+      // --------------------------------------------------
 
-      // 5. Inject the pure code files
       for (const file of componentData.files) {
-        // Because the server sends just the basename (e.g., PremiumHero.tsx),
-        // path.join inherently flattens all files into the single targetDir folder.
-        const filePath = path.join(targetDir, file.name);
+        const filePath = path.join(
+          targetDir,
+          file.name,
+        );
+
         let content = file.content;
 
-        // 🛠️ DYNAMIC IMPORT REWRITER
-        bundledFileNames.forEach((fileName: string) => {
-          // Finds any relative import pointing to a bundled file (e.g., "../Section", "../../Section")
-          // and rewrites it strictly to a sibling import (e.g., "./Section")
-          const regex = new RegExp(`from\\s+["']\\.[^"']*?\\/${fileName}["']`, "g");
-          content = content.replace(regex, `from "./${fileName}"`);
-        });
+        bundledFileNames.forEach(
+          (fileName: string) => {
+            const regex = new RegExp(
+              `from\\s+["']\\.[^"']*?\\/${fileName}["']`,
+              "g",
+            );
+
+            content = content.replace(
+              regex,
+              `from "./${fileName}"`,
+            );
+          },
+        );
 
-        fs.writeFileSync(filePath, content);
+        fs.writeFileSync(
+          filePath,
+          content,
+        );
       }
 
       s.stop(
         pc.green(
-          `Downloaded ${componentData.files.length} files into ${pc.white(`/${config.componentsPath}/${componentName}`)}`
-        )
+          `Downloaded ${componentData.files.length} files into ${pc.white(
+            `/${config.componentsPath}/${componentName}`,
+          )}`,
+        ),
       );
 
-      // 6. Auto-install Missing Component Dependencies (e.g., framer-motion)
-      if (componentData.dependencies && componentData.dependencies.length > 0) {
-        const depsToInstall = componentData.dependencies.join(" ");
+      // --------------------------------------------------
+      // 7. Install dependencies
+      // --------------------------------------------------
+
+      if (
+        componentData.dependencies &&
+        componentData.dependencies.length > 0
+      ) {
+        const depsToInstall =
+          componentData.dependencies.join(" ");
+
         s.start(
-          `Installing missing dependencies: ${pc.cyan(depsToInstall)}...`
+          `Installing missing dependencies: ${pc.cyan(
+            depsToInstall,
+          )}...`,
         );
 
         try {
-          // Silently runs the npm install command in the background
-          execSync(`npm install ${depsToInstall}`, { stdio: "ignore" });
+          execSync(
+            `npm install ${depsToInstall}`,
+            {
+              stdio: "ignore",
+            },
+          );
+
           s.stop(
             pc.green(
-              `Dependencies installed successfully: ${pc.gray(depsToInstall)}`
-            )
+              `Dependencies installed successfully: ${pc.gray(
+                depsToInstall,
+              )}`,
+            ),
+          );
+        } catch {
+          s.stop(
+            pc.red(
+              "Failed to auto-install dependencies.",
+            ),
           );
-        } catch (error) {
-          s.stop(pc.red("Failed to auto-install dependencies."));
+
           note(
-            `Please run: ${pc.cyan(`npm install ${depsToInstall}`)} manually.`,
-            "Manual Action Required"
+            `Please run: ${pc.cyan(
+              `npm install ${depsToInstall}`,
+            )} manually.`,
+            "Manual Action Required",
           );
         }
       }
 
-      // 7. Clean Success Outro
-      // Find the main file to import (prioritize the one that matches the component name or use the first one)
-      const mainFile = bundledFileNames.find((name: string) => name.toLowerCase() === componentName.toLowerCase()) || bundledFileNames[0];
-      
+      // --------------------------------------------------
+      // 8. Success
+      // --------------------------------------------------
+
+      const mainFile =
+        bundledFileNames.find(
+          (name: string) =>
+            name.toLowerCase() ===
+            componentName.toLowerCase(),
+        ) || bundledFileNames[0];
+
       outro(
-        `${pc.white("✔")} ${pc.bold(`Component <${componentName} /> is ready!`)}\n` +
-          pc.gray(`Import it: `) +
+        `${pc.white("✔")} ${pc.bold(
+          `Component <${componentName} /> is ready!`,
+        )}\n` +
+          pc.gray("Import it: ") +
           pc.cyan(
-            `import { ${mainFile} } from "@/${config.componentsPath}/${componentName}/${mainFile}"`
-          )
+            `import { ${mainFile} } from "@/${config.componentsPath}/${componentName}/${mainFile}"`,
+          ),
       );
     } catch (error: any) {
-      s.stop(pc.red("An error occurred during injection."));
-      cancel(pc.gray(error.message || "Unknown CLI Error"));
+      s.stop(
+        pc.red(
+          "An error occurred during injection.",
+        ),
+      );
+
+      cancel(
+        pc.gray(
+          error?.message ||
+            "Unknown CLI Error",
+        ),
+      );
+
       process.exit(1);
     }
   });