makaron-persona-look-cli 0.4.1

package/cloudflare-worker/src/worker.mjs

@@ -0,0 +1,206 @@
+const encoder = new TextEncoder();
+
+function json(payload, status = 200) {
+  return new Response(JSON.stringify(payload), { status, headers: { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" } });
+}
+
+function error(message, status = 400) {
+  return json({ error: message }, status);
+}
+
+async function sha256(value) {
+  const input = typeof value === "string" ? encoder.encode(value) : value;
+  const hash = await crypto.subtle.digest("SHA-256", input);
+  return [...new Uint8Array(hash)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+function randomId(prefix) {
+  const bytes = crypto.getRandomValues(new Uint8Array(18));
+  return `${prefix}_${[...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+
+function bearer(request) {
+  const value = request.headers.get("authorization") || "";
+  return value.startsWith("Bearer ") ? value.slice(7) : undefined;
+}
+
+async function requireAgent(request, env) {
+  const token = bearer(request);
+  if (!token) return undefined;
+  const record = await env.DB.prepare("SELECT id, name FROM agents WHERE token_hash = ? AND revoked_at IS NULL").bind(await sha256(token)).first();
+  return record || undefined;
+}
+
+function requireOwner(request, env) {
+  const token = bearer(request);
+  return Boolean(token && env.OWNER_SYNC_TOKEN && token === env.OWNER_SYNC_TOKEN);
+}
+
+function openEnrollmentEnabled(env) {
+  return String(env.OPEN_ENROLLMENT || "").toLowerCase() === "true";
+}
+
+function publicPersona(record) {
+  return { id: record.id, display_name: record.display_name, status: record.status, identity: record.identity };
+}
+
+function publicLook(record) {
+  return { id: record.id, display_name: record.display_name, status: record.status, ...record.look, identity_policy: "persona-is-the-only-identity-reference", brand_policy: "original-unbranded-design-only" };
+}
+
+function scorePersona(record, brief) {
+  const query = brief.toLowerCase();
+  const identity = JSON.stringify(record.identity || {}).toLowerCase();
+  let score = record.identity?.presentation === "feminine adult" ? 2 : 0;
+  if (/干净|clean|beauty|美妆/.test(query)) for (const signal of ["fine", "soft", "natural", "even", "neutral", "low-contrast"]) if (identity.includes(signal)) score += 2;
+  if (/冷感|cool|冷调|高端|luxury/.test(query)) for (const signal of ["narrow", "long", "straight", "low-contrast", "calm", "slim"]) if (identity.includes(signal)) score += 2;
+  return score;
+}
+
+function scoreLook(record, brief) {
+  const query = brief.toLowerCase();
+  const text = JSON.stringify(record.look || {}).toLowerCase();
+  let score = 0;
+  const signals = (pattern, entries) => {
+    if (!pattern.test(query)) return;
+    for (const [signal, weight] of entries) if (text.includes(signal)) score += weight;
+  };
+  signals(/美妆|beauty|cosmetic|skincare|护肤/, [["beauty", 4], ["skincare", 4], ["serum", 3], ["fragrance", 2], ["treatment", 2]]);
+  signals(/高端|luxury|premium|prestige/, [["luxury", 3], ["premium", 3], ["prestige", 3], ["sculptural", 2], ["metallic", 2], ["gold", 2], ["silver", 2]]);
+  signals(/干净|clean|minimal/, [["clean", 3], ["white", 2], ["minimal", 2], ["bright", 1], ["soft", 1]]);
+  signals(/冷感|cool|冷调/, [["silver", 2], ["graphite", 2], ["grey", 2], ["icy", 2], ["black", 1], ["violet", 1]]);
+  signals(/y2k|千禧/, [["y2k", 6]]);
+  signals(/学院|校园|collegiate|academic/, [["collegiate", 5], ["academic", 5], ["campus", 3]]);
+  signals(/哥特|gothic|暗黑|grunge/, [["gothic", 4], ["grunge", 4], ["dark", 2]]);
+  signals(/街头|street/, [["street", 4], ["cargo", 2], ["denim", 1]]);
+  signals(/地铁|metro|subway|transit/, [["transit", 5], ["metro", 4], ["commuter", 3], ["urban", 1]]);
+  signals(/机车夹克|皮夹克|moto|leather jacket/, [["leather", 4], ["moto", 11], ["black", 1], ["grey", 1]]);
+  signals(/中性|男女同款|unisex|androgynous|gender[- ]?neutral/, [["unisex", 5], ["gender-neutral", 5], ["oversized", 2], ["cargo", 2], ["long short", 2], ["knit", 1]]);
+  signals(/嘻哈|说唱|hip[- ]?hop|rap(?:per)?/, [["hip-hop", 5], ["rap", 5], ["street", 3], ["baggy", 2], ["cargo", 2], ["jersey", 2], ["chain", 2], ["camo", 3], ["wide", 1]]);
+  signals(/度假|海岛|resort|beach|holiday|pool|yacht|sailing|夏日/, [["resort", 5], ["beach", 5], ["island", 4], ["pool", 4], ["sailing", 4], ["summer", 3], ["linen", 2], ["swim", 2], ["nautical", 2]]);
+  signals(/通勤|office|职场|workwear|商务|上班|commute/, [["office", 4], ["commute", 4], ["workwear", 4], ["tailored", 2], ["suit", 2], ["blazer", 2]]);
+  signals(/极简轻奢|quiet luxury|成熟通勤|mature commute/, [["quiet luxury", 6], ["mature commute", 6], ["trench", 3], ["tailored", 2], ["minimal", 2], ["wool", 1]]);
+  signals(/杂志|magazine|editorial|时尚大片/, [["magazine", 4], ["editorial", 4], ["studio", 1], ["tailored", 1]]);
+  signals(/晚宴|gala|black-tie|formal/, [["gala", 4], ["evening", 3], ["formal", 3], ["gown", 2], ["soiree", 2]]);
+  signals(/红毯|red carpet/, [["red carpet", 6], ["gala", 3], ["carpet", 2], ["train", 2], ["gown", 2]]);
+  signals(/高级派对|party|cocktail|after-party/, [["party", 4], ["cocktail", 3], ["soiree", 3], ["crystal", 1], ["sequin", 1], ["gown", 1]]);
+  signals(/运动休闲|athleisure|运动|sport|sportswear|健身|球类|篮球|网球|跑步|track|训练/, [["athleisure", 5], ["sport", 4], ["track", 3], ["running", 2], ["tennis", 2], ["basketball", 2], ["technical", 1], ["fleece", 1], ["hoodie", 1]]);
+  return score;
+}
+
+function buildRenderBrief(persona, look) {
+  const identity = persona.identity || {};
+  const lock = [identity.face_shape, identity.brows, identity.eyes, identity.nose, identity.mouth, identity.skin, identity.stable_marks, identity.body_evidence].filter(Boolean).join("; ");
+  return `Original ${identity.presentation || "adult"} character. Identity lock: ${lock}. Keep this Persona facial structure and stable marks; do not use the Look reference face. Look direction: ${look.family}. ${look.silhouette}. Garments: ${look.garments}. Palette: ${look.palette}. Materials: ${look.materials}. Accessories: ${look.accessories}. Scene: ${look.scene}. Replace source logos, watermarks, wordmarks, celebrity likenesses, and recognizable brand elements with original generic design.`;
+}
+
+async function records(env, table) {
+  const result = await env.DB.prepare(`SELECT record_json FROM ${table} ORDER BY id`).all();
+  return (result.results || []).map((row) => JSON.parse(row.record_json));
+}
+
+async function select(env, { brief, personaId, lookId }) {
+  const personas = await records(env, "persona_records");
+  const looks = await records(env, "look_records");
+  const persona = personaId ? personas.find((record) => record.id === personaId) : personas.map((record) => ({ record, score: scorePersona(record, brief || "") })).sort((a, b) => b.score - a.score || a.record.id.localeCompare(b.record.id))[0]?.record;
+  if (!persona) throw new Error(personaId ? `persona not found: ${personaId}` : "no Persona records available");
+  let look;
+  let lookScore;
+  if (lookId) look = looks.find((record) => record.id === lookId);
+  else if (brief) {
+    const candidates = looks.map((record) => ({ record, score: scoreLook(record, brief) })).sort((a, b) => b.score - a.score || a.record.id.localeCompare(b.record.id));
+    look = candidates[0]?.record;
+    lookScore = candidates[0]?.score;
+  }
+  if (!look) throw new Error(lookId ? `look not found: ${lookId}` : "no catalog Look matched this brief");
+  if (brief && lookScore < 6) throw new Error("no catalog Look matched this brief");
+  return { persona, look, look_score: lookScore };
+}
+
+async function route(request, env) {
+  const url = new URL(request.url);
+  if (request.method === "POST" && url.pathname === "/v1/agents/setup") {
+    const body = await request.json().catch(() => undefined);
+    const ownerControlledEnrollment = Boolean(body?.registration_token && env.AGENT_REGISTRATION_TOKEN && body.registration_token === env.AGENT_REGISTRATION_TOKEN);
+    if (!body?.agent_name || (!openEnrollmentEnabled(env) && !ownerControlledEnrollment)) return error("open enrollment is disabled", 401);
+    const agentId = randomId("agent");
+    const agentToken = randomId("plk");
+    await env.DB.prepare("INSERT INTO agents (id, name, token_hash, created_at) VALUES (?, ?, ?, ?)").bind(agentId, String(body.agent_name || "openclaw-agent").slice(0, 120), await sha256(agentToken), new Date().toISOString()).run();
+    return json({ agent_id: agentId, agent_token: agentToken, token_delivery: "shown-once-store-locally", enrollment: openEnrollmentEnabled(env) ? "open-self-registration" : "owner-controlled" }, 201);
+  }
+  if (url.pathname.startsWith("/v1/owner/")) {
+    if (!requireOwner(request, env)) return error("owner authorization required", 401);
+    if (request.method === "POST" && url.pathname === "/v1/owner/sync/manifest") {
+      const body = await request.json().catch(() => undefined);
+      if (!body?.manifest || !Array.isArray(body.assets)) return error("manifest and assets are required");
+      const personas = body.manifest.personas || [];
+      const looks = body.manifest.looks || [];
+      const statements = [
+        env.DB.prepare("DELETE FROM persona_records"), env.DB.prepare("DELETE FROM look_records"), env.DB.prepare("DELETE FROM assets")
+      ];
+      for (const record of personas) statements.push(env.DB.prepare("INSERT INTO persona_records (id, display_name, record_json) VALUES (?, ?, ?)").bind(record.id, record.display_name, JSON.stringify(record)));
+      for (const record of looks) statements.push(env.DB.prepare("INSERT INTO look_records (id, display_name, record_json) VALUES (?, ?, ?)").bind(record.id, record.display_name, JSON.stringify(record)));
+      for (const asset of body.assets) statements.push(env.DB.prepare("INSERT INTO assets (id, object_key, sha256, mime_type) VALUES (?, ?, ?, ?)").bind(asset.id, asset.object_key, asset.sha256, asset.mime_type));
+      // Keep below conservative D1 batch-size limits; a repeated owner sync is
+      // idempotent and replaces the previous metadata before asset upload.
+      for (let index = 0; index < statements.length; index += 75) {
+        await env.DB.batch(statements.slice(index, index + 75));
+      }
+      return json({ ok: true, personas: personas.length, looks: looks.length, assets: body.assets.length });
+    }
+    const assetMatch = url.pathname.match(/^\/v1\/owner\/assets\/(.+)$/);
+    if (request.method === "PUT" && assetMatch) {
+      const assetId = decodeURIComponent(assetMatch[1]);
+      const asset = await env.DB.prepare("SELECT object_key, sha256, mime_type FROM assets WHERE id = ?").bind(assetId).first();
+      if (!asset) return error("asset is not declared in the current manifest", 404);
+      const bytes = await request.arrayBuffer();
+      const declaredHash = request.headers.get("x-personlib-sha256");
+      if (!declaredHash || declaredHash !== asset.sha256 || await sha256(bytes) !== asset.sha256) return error("asset checksum mismatch", 422);
+      await env.ASSETS.put(asset.object_key, bytes, { httpMetadata: { contentType: request.headers.get("content-type") || asset.mime_type } });
+      return json({ ok: true, asset_id: assetId });
+    }
+    return error("owner endpoint not found", 404);
+  }
+  const agent = await requireAgent(request, env);
+  if (!agent) return error("agent authorization required", 401);
+  if (request.method === "GET" && url.pathname === "/v1/doctor") {
+    const count = await env.DB.prepare("SELECT COUNT(*) AS count FROM look_records").first();
+    return json({ ok: true, service: "personlib-worker", version: "1", agent_id: agent.id, d1: "ok", r2_binding: Boolean(env.ASSETS), look_records: Number(count?.count || 0) });
+  }
+  if (request.method === "POST" && url.pathname === "/v1/recommend") {
+    const body = await request.json().catch(() => undefined);
+    if (!body?.brief) return error("brief is required");
+    try {
+      const selected = await select(env, { brief: String(body.brief) });
+      return json({ request: body.brief, persona: publicPersona(selected.persona), look: publicLook(selected.look), look_match: { source: "catalog-match", score: selected.look_score }, render_brief: buildRenderBrief(selected.persona, selected.look), source_face_policy: "persona-is-the-only-identity-reference" });
+    } catch (cause) { return error(cause.message, 404); }
+  }
+  if (request.method === "POST" && url.pathname === "/v1/compose") {
+    const body = await request.json().catch(() => undefined);
+    try {
+      const selected = await select(env, { personaId: body?.persona_id, lookId: body?.look_id });
+      return json({ composition: { persona: publicPersona(selected.persona), look: publicLook(selected.look), policies: { use_persona_as_only_identity_reference: true, look_source_face: "excluded", source_logos_and_wordmarks: "replace-with-original-generic-design" }, render_brief: buildRenderBrief(selected.persona, selected.look), render_status: "brief-only-no-generation-submitted" } });
+    } catch (cause) { return error(cause.message, 404); }
+  }
+  if (request.method === "POST" && url.pathname === "/v1/preview") {
+    const body = await request.json().catch(() => undefined);
+    try {
+      const selected = await select(env, body?.brief ? { brief: String(body.brief) } : { personaId: body?.persona_id, lookId: body?.look_id });
+      const assets = [{ role: "persona", asset_id: selected.persona.source_asset_id }];
+      for (const reference of selected.persona.identity_references || []) assets.push({ role: "persona-reference", index: reference.index, asset_id: reference.asset_id });
+      assets.push({ role: "look", asset_id: selected.look.source_asset_id });
+      return json({ kind: "persona-look-reference-pack", image_status: "source-reference-pack-not-a-generated-composite", persona: publicPersona(selected.persona), look: publicLook(selected.look), render_brief: buildRenderBrief(selected.persona, selected.look), source_face_policy: "persona-is-the-only-identity-reference", assets: assets.map((asset) => ({ ...asset, url: `/v1/assets/${encodeURIComponent(asset.asset_id)}` })) });
+    } catch (cause) { return error(cause.message, 404); }
+  }
+  const assetMatch = url.pathname.match(/^\/v1\/assets\/(.+)$/);
+  if (request.method === "GET" && assetMatch) {
+    const asset = await env.DB.prepare("SELECT object_key, mime_type FROM assets WHERE id = ?").bind(decodeURIComponent(assetMatch[1])).first();
+    if (!asset) return error("asset not found", 404);
+    const object = await env.ASSETS.get(asset.object_key);
+    if (!object) return error("asset bytes are not synced", 404);
+    return new Response(object.body, { headers: { "content-type": object.httpMetadata?.contentType || asset.mime_type, "cache-control": "private, no-store" } });
+  }
+  return error("not found", 404);
+}
+
+export default { fetch: route };

package/cloudflare-worker/test/worker.test.mjs

@@ -0,0 +1,111 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import worker from "../src/worker.mjs";
+
+class Statement {
+  constructor(db, sql) { this.db = db; this.sql = sql; this.values = []; }
+  bind(...values) { this.values = values; return this; }
+  async first() { return this.db.execute(this.sql, this.values, "first"); }
+  async all() { return this.db.execute(this.sql, this.values, "all"); }
+  async run() { return this.db.execute(this.sql, this.values, "run"); }
+}
+
+class FakeDB {
+  constructor() {
+    this.agents = [];
+    this.personas = new Map();
+    this.looks = new Map();
+    this.assets = new Map();
+  }
+  prepare(sql) { return new Statement(this, sql); }
+  async batch(statements) { for (const statement of statements) await statement.run(); }
+  execute(sql, values, mode) {
+    const normalized = sql.replace(/\s+/g, " ").trim();
+    if (normalized.startsWith("INSERT INTO agents")) {
+      this.agents.push({ id: values[0], name: values[1], token_hash: values[2], created_at: values[3], revoked_at: null });
+      return { success: true };
+    }
+    if (normalized.startsWith("SELECT id, name FROM agents")) return this.agents.find((agent) => agent.token_hash === values[0] && !agent.revoked_at) || null;
+    if (normalized.startsWith("DELETE FROM persona_records")) { this.personas.clear(); return { success: true }; }
+    if (normalized.startsWith("DELETE FROM look_records")) { this.looks.clear(); return { success: true }; }
+    if (normalized.startsWith("DELETE FROM assets")) { this.assets.clear(); return { success: true }; }
+    if (normalized.startsWith("INSERT INTO persona_records")) { this.personas.set(values[0], { id: values[0], display_name: values[1], record_json: values[2] }); return { success: true }; }
+    if (normalized.startsWith("INSERT INTO look_records")) { this.looks.set(values[0], { id: values[0], display_name: values[1], record_json: values[2] }); return { success: true }; }
+    if (normalized.startsWith("INSERT INTO assets")) { this.assets.set(values[0], { id: values[0], object_key: values[1], sha256: values[2], mime_type: values[3] }); return { success: true }; }
+    if (normalized.startsWith("SELECT COUNT(*) AS count FROM look_records")) return { count: this.looks.size };
+    if (normalized.startsWith("SELECT record_json FROM persona_records")) return { results: [...this.personas.values()].sort((a, b) => a.id.localeCompare(b.id)).map(({ record_json }) => ({ record_json })) };
+    if (normalized.startsWith("SELECT record_json FROM look_records")) return { results: [...this.looks.values()].sort((a, b) => a.id.localeCompare(b.id)).map(({ record_json }) => ({ record_json })) };
+    if (normalized.startsWith("SELECT object_key, sha256, mime_type FROM assets")) {
+      const asset = this.assets.get(values[0]);
+      return asset ? { object_key: asset.object_key, sha256: asset.sha256, mime_type: asset.mime_type } : null;
+    }
+    if (normalized.startsWith("SELECT object_key, mime_type FROM assets")) {
+      const asset = this.assets.get(values[0]);
+      return asset ? { object_key: asset.object_key, mime_type: asset.mime_type } : null;
+    }
+    throw new Error(`unsupported fake SQL: ${normalized}`);
+  }
+}
+
+class FakeBucket {
+  constructor() { this.objects = new Map(); }
+  async put(key, bytes, options) { this.objects.set(key, { bytes: new Uint8Array(bytes), httpMetadata: options.httpMetadata }); }
+  async get(key) {
+    const object = this.objects.get(key);
+    return object && { body: new Blob([object.bytes]).stream(), httpMetadata: object.httpMetadata };
+  }
+}
+
+async function digest(bytes) {
+  const hash = await crypto.subtle.digest("SHA-256", bytes);
+  return [...new Uint8Array(hash)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+function request(path, options = {}) {
+  return new Request(`https://personlib.example${path}`, options);
+}
+
+test("owner sync, self-registration, recommendation, compose, and private preview work together", async () => {
+  const env = { DB: new FakeDB(), ASSETS: new FakeBucket(), OWNER_SYNC_TOKEN: "owner-token", OPEN_ENROLLMENT: "true" };
+  const personaBytes = new TextEncoder().encode("persona-image");
+  const lookBytes = new TextEncoder().encode("look-image");
+  const personaHash = await digest(personaBytes);
+  const lookHash = await digest(lookBytes);
+  const manifest = {
+    personas: [{ id: "P-001", display_name: "Adult One", status: "private-staged", identity: { presentation: "feminine adult", face_shape: "oval", brows: "straight", eyes: "almond", nose: "straight", mouth: "soft", skin: "natural", stable_marks: "none" }, source_asset_id: "P-001:source", identity_references: [] }],
+    looks: [{ id: "L-132", display_name: "Metro Leather Transit", status: "private-staged", look: { family: "urban transit", silhouette: "moto", garments: "leather jacket", palette: "black grey", materials: "leather", accessories: "minimal", scene: "metro commuter" }, source_asset_id: "L-132:source" }]
+  };
+  const assets = [
+    { id: "P-001:source", object_key: "personas/P-001/source.png", sha256: personaHash, mime_type: "image/png" },
+    { id: "L-132:source", object_key: "looks/L-132/source.png", sha256: lookHash, mime_type: "image/png" }
+  ];
+  let response = await worker.fetch(request("/v1/owner/sync/manifest", { method: "POST", headers: { authorization: "Bearer owner-token", "content-type": "application/json" }, body: JSON.stringify({ manifest, assets }) }), env);
+  assert.equal(response.status, 200);
+  for (const [asset, bytes] of [[assets[0], personaBytes], [assets[1], lookBytes]]) {
+    response = await worker.fetch(request(`/v1/owner/assets/${encodeURIComponent(asset.id)}`, { method: "PUT", headers: { authorization: "Bearer owner-token", "content-type": asset.mime_type, "x-personlib-sha256": asset.sha256 }, body: bytes }), env);
+    assert.equal(response.status, 200);
+  }
+  response = await worker.fetch(request("/v1/agents/setup", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ agent_name: "xiaolongxia" }) }), env);
+  assert.equal(response.status, 201);
+  const agent = await response.json();
+  assert.match(agent.agent_token, /^plk_/);
+  assert.equal(agent.enrollment, "open-self-registration");
+  const headers = { authorization: `Bearer ${agent.agent_token}`, "content-type": "application/json" };
+  response = await worker.fetch(request("/v1/doctor", { headers }), env);
+  assert.deepEqual(await response.json(), { ok: true, service: "personlib-worker", version: "1", agent_id: agent.agent_id, d1: "ok", r2_binding: true, look_records: 1 });
+  response = await worker.fetch(request("/v1/recommend", { method: "POST", headers, body: JSON.stringify({ brief: "15 秒成年女性地铁皮夹克通勤广告" }) }), env);
+  const recommendation = await response.json();
+  assert.equal(response.status, 200);
+  assert.equal(recommendation.persona.id, "P-001");
+  assert.equal(recommendation.look.id, "L-132");
+  assert.match(recommendation.render_brief, /do not use the Look reference face/i);
+  response = await worker.fetch(request("/v1/compose", { method: "POST", headers, body: JSON.stringify({ persona_id: "P-001", look_id: "L-132" }) }), env);
+  assert.equal((await response.json()).composition.policies.look_source_face, "excluded");
+  response = await worker.fetch(request("/v1/preview", { method: "POST", headers, body: JSON.stringify({ persona_id: "P-001", look_id: "L-132" }) }), env);
+  const preview = await response.json();
+  assert.equal(preview.image_status, "source-reference-pack-not-a-generated-composite");
+  assert.equal(preview.assets.length, 2);
+  response = await worker.fetch(request(preview.assets[0].url, { headers: { authorization: `Bearer ${agent.agent_token}` } }), env);
+  assert.equal(response.status, 200);
+  assert.deepEqual(new Uint8Array(await response.arrayBuffer()), personaBytes);
+});

package/cloudflare-worker/wrangler.toml

@@ -0,0 +1,17 @@
+name = "personlib-agent"
+main = "src/worker.mjs"
+compatibility_date = "2026-09-04"
+
+[vars]
+# The owner requested that any Agent can self-register. Set false to require
+# AGENT_REGISTRATION_TOKEN as a Worker secret instead.
+OPEN_ENROLLMENT = "true"
+
+[[d1_databases]]
+binding = "DB"
+database_name = "personlib"
+database_id = "41229d0a-101d-4361-a69d-b6f29e77ef03"
+
+[[r2_buckets]]
+binding = "ASSETS"
+bucket_name = "personlib-assets"

package/lib/remote-client.mjs

@@ -0,0 +1,254 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { basename, dirname, extname, join, resolve } from "node:path";
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const CONFIG_VERSION = 1;
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+const packageMetadata = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
+const DEFAULT_API_URL = process.env.PERSONLIB_DEFAULT_API_URL || packageMetadata.personlib?.default_api_url || "";
+
+function getOption(args, name) {
+  const index = args.indexOf(name);
+  return index === -1 ? undefined : args[index + 1];
+}
+
+function has(args, name) {
+  return args.includes(name);
+}
+
+function configPath(args) {
+  return resolve(getOption(args, "--config") || process.env.PERSONLIB_REMOTE_CONFIG || join(process.env.HOME || ".", ".config", "personlib", "remote.json"));
+}
+
+function writeConfig(path, config) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+  chmodSync(path, 0o600);
+}
+
+function readConfig(path) {
+  if (!existsSync(path)) throw new Error(`remote configuration not found: ${path}; run personlib remote setup first`);
+  const config = JSON.parse(readFileSync(path, "utf8"));
+  if (config.schema_version !== CONFIG_VERSION || !config.endpoint || !config.agent_token) {
+    throw new Error(`invalid remote configuration: ${path}`);
+  }
+  return config;
+}
+
+function cleanEndpoint(value) {
+  if (!value) throw new Error("remote endpoint is not configured; pass --api-url https://your-worker.example during bootstrap or publish a package with personlib.default_api_url");
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" && url.hostname !== "localhost" && url.hostname !== "127.0.0.1") {
+      throw new Error("remote endpoint must use https");
+    }
+    return url.toString().replace(/\/$/, "");
+  } catch {
+    throw new Error(`invalid remote endpoint: ${value}`);
+  }
+}
+
+async function request(endpoint, path, { token, method = "GET", json, body, headers = {} } = {}) {
+  const response = await fetch(`${endpoint}${path}`, {
+    method,
+    headers: {
+      ...(token ? { authorization: `Bearer ${token}` } : {}),
+      ...(json !== undefined ? { "content-type": "application/json" } : {}),
+      ...headers
+    },
+    body: json !== undefined ? JSON.stringify(json) : body
+  });
+  const type = response.headers.get("content-type") || "";
+  const payload = type.includes("application/json") ? await response.json() : await response.text();
+  if (!response.ok) {
+    const message = typeof payload === "object" && payload?.error ? payload.error : String(payload || `${response.status} ${response.statusText}`);
+    throw new Error(`remote request failed (${response.status}): ${message}`);
+  }
+  return { response, payload };
+}
+
+function sha256(path) {
+  return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+
+function mimeType(path) {
+  const extension = extname(path).toLowerCase();
+  return { ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".webp": "image/webp" }[extension] || "application/octet-stream";
+}
+
+function sanitizedRemoteManifest(localManifest, root) {
+  const assets = [];
+  const asset = (id, source, objectKey) => {
+    const absolute = join(root, source.relative_path);
+    assets.push({
+      id,
+      object_key: objectKey,
+      sha256: source.sha256 || sha256(absolute),
+      mime_type: mimeType(absolute),
+      local_path: absolute
+    });
+    return id;
+  };
+  const personas = (localManifest.personas || []).filter((record) => record.status === "private-staged").map((record) => {
+    const sourceAssetId = asset(`${record.id}:source`, record.source, `personas/${record.id}/source${extname(record.source.relative_path)}`);
+    const identityReferences = (record.identity_references || []).map((reference, index) => ({
+      asset_id: asset(`${record.id}:reference:${index + 1}`, reference, `personas/${record.id}/reference-${index + 1}${extname(reference.relative_path)}`),
+      index: index + 1
+    }));
+    return {
+      id: record.id,
+      display_name: record.display_name,
+      status: record.status,
+      identity: record.identity,
+      source_asset_id: sourceAssetId,
+      identity_references: identityReferences
+    };
+  });
+  const looks = (localManifest.looks || []).filter((record) => record.status === "private-staged").map((record) => ({
+    id: record.id,
+    display_name: record.display_name,
+    status: record.status,
+    look: record.look,
+    source_asset_id: asset(`${record.id}:source`, record.source, `looks/${record.id}/source${extname(record.source.relative_path)}`),
+    identity_policy: "persona-is-the-only-identity-reference",
+    brand_policy: "original-unbranded-design-only"
+  }));
+  return { schema_version: "1", personas, looks, assets };
+}
+
+function jsonOutput(payload, output, args) {
+  output(payload, has(args, "--json"));
+}
+
+function endpointForSetup(args) {
+  return cleanEndpoint(getOption(args, "--api-url") || getOption(args, "--endpoint") || process.env.PERSONLIB_API_URL || DEFAULT_API_URL);
+}
+
+async function enroll(args) {
+  const endpoint = endpointForSetup(args);
+  const agentName = getOption(args, "--agent-name") || process.env.HOSTNAME || "openclaw-agent";
+  const legacyRegistrationToken = getOption(args, "--registration-token") || process.env.PERSONLIB_REGISTRATION_TOKEN;
+  const { payload } = await request(endpoint, "/v1/agents/setup", {
+    method: "POST",
+    json: { agent_name: agentName, ...(legacyRegistrationToken ? { registration_token: legacyRegistrationToken } : {}) }
+  });
+  if (!payload?.agent_token || !payload?.agent_id) throw new Error("remote setup response did not contain an agent credential");
+  const path = configPath(args);
+  writeConfig(path, { schema_version: CONFIG_VERSION, endpoint, agent_id: payload.agent_id, agent_token: payload.agent_token, created_at: new Date().toISOString() });
+  return { endpoint, agent_id: payload.agent_id, config_path: path, credential: "stored-locally-not-printed", enrollment: payload.enrollment || "open-or-owner-controlled" };
+}
+
+async function setup(args, output) {
+  jsonOutput({ ok: true, remote: await enroll(args) }, output, args);
+}
+
+function installStep(command, args, label) {
+  const result = spawnSync(command, args, { encoding: "utf8", timeout: 180000, maxBuffer: 2 * 1024 * 1024 });
+  if (result.error || result.status !== 0) {
+    const detail = String(result.stderr || result.stdout || result.error?.message || "").slice(-800);
+    throw new Error(`${label} failed${detail ? `: ${detail}` : ""}`);
+  }
+}
+
+export async function runBootstrapSetup(args, { output }) {
+  const endpoint = endpointForSetup(args);
+  const packageSpec = `${packageMetadata.name}@${packageMetadata.version}`;
+  const skillDir = join(packageRoot, "skills", "makaron-persona-look");
+  const plan = {
+    global_install: ["npm", "install", "-g", packageSpec],
+    skill_install: ["npx", "-y", "skills", "add", skillDir, "--skill", "makaron-persona-look", "--copy", "--global", "--yes"],
+    enrollment: { endpoint, mode: "open-self-registration", credential: "stored-locally-not-printed" }
+  };
+  if (has(args, "--dry-run")) return jsonOutput({ ok: true, dry_run: true, setup: plan }, output, args);
+  if (!has(args, "--skip-global-install")) installStep("npm", plan.global_install.slice(1), "global CLI installation");
+  if (!has(args, "--skip-skill-install")) installStep("npx", plan.skill_install.slice(1), "Agent Skill installation");
+  const remote = await enroll(args);
+  jsonOutput({ ok: true, setup: { global_install: has(args, "--skip-global-install") ? "skipped" : "installed", skill_install: has(args, "--skip-skill-install") ? "skipped" : "installed", remote } }, output, args);
+}
+
+function agentConnection(args) {
+  const config = readConfig(configPath(args));
+  return { endpoint: cleanEndpoint(config.endpoint), token: config.agent_token, config };
+}
+
+async function authenticated(args, output, path, json) {
+  const remote = agentConnection(args);
+  const { payload } = await request(remote.endpoint, path, { token: remote.token, method: json === undefined ? "GET" : "POST", json });
+  jsonOutput({ ok: true, remote: payload }, output, args);
+}
+
+async function preview(args, output) {
+  const remote = agentConnection(args);
+  const brief = getOption(args, "--brief");
+  const personaId = getOption(args, "--persona");
+  const lookId = getOption(args, "--look");
+  if (!brief && !(personaId && lookId)) throw new Error("usage: personlib remote preview --brief TEXT | --persona P-001 --look L-001 [--output-dir PATH]");
+  const { payload } = await request(remote.endpoint, "/v1/preview", { token: remote.token, method: "POST", json: brief ? { brief } : { persona_id: personaId, look_id: lookId } });
+  const destination = getOption(args, "--output-dir");
+  if (!destination) {
+    jsonOutput({ ok: true, remote: payload }, output, args);
+    return;
+  }
+  const absoluteDestination = resolve(destination);
+  mkdirSync(absoluteDestination, { recursive: true });
+  const downloaded = [];
+  for (const asset of payload.assets || []) {
+    const response = await fetch(`${remote.endpoint}${asset.url}`, { headers: { authorization: `Bearer ${remote.token}` } });
+    if (!response.ok) throw new Error(`remote asset download failed (${response.status}): ${asset.asset_id}`);
+    const extension = { "image/png": ".png", "image/jpeg": ".jpg", "image/webp": ".webp" }[response.headers.get("content-type")] || ".bin";
+    const name = `${asset.role}${asset.index ? `-${asset.index}` : ""}${extension}`;
+    const target = join(absoluteDestination, name);
+    if (existsSync(target) && !has(args, "--overwrite")) throw new Error(`refusing to overwrite ${target}; pass --overwrite to replace it`);
+    writeFileSync(target, Buffer.from(await response.arrayBuffer()));
+    downloaded.push({ role: asset.role, filename: name });
+  }
+  writeFileSync(join(absoluteDestination, "selection.json"), `${JSON.stringify({ ...payload, assets: downloaded }, null, 2)}\n`, "utf8");
+  jsonOutput({ ok: true, retrieval: { kind: "persona-look-reference-pack", image_status: "source-reference-pack-not-a-generated-composite", output_dir: absoluteDestination, files: [...downloaded, { role: "selection", filename: "selection.json" }] } }, output, args);
+}
+
+async function sync(args, output, { readManifest }) {
+  const root = resolve(getOption(args, "--library") || process.env.PERSONLIB_LIBRARY || "private-library");
+  const manifest = readManifest(root);
+  const payload = sanitizedRemoteManifest(manifest, root);
+  if (has(args, "--dry-run")) {
+    jsonOutput({ ok: true, dry_run: true, records: { personas: payload.personas.length, looks: payload.looks.length }, assets: { count: payload.assets.length, first_asset_id: payload.assets[0]?.id, last_asset_id: payload.assets.at(-1)?.id } }, output, args);
+    return;
+  }
+  const endpoint = cleanEndpoint(getOption(args, "--endpoint") || process.env.PERSONLIB_REMOTE_ENDPOINT);
+  const ownerToken = process.env.PERSONLIB_OWNER_SYNC_TOKEN;
+  if (!ownerToken) throw new Error("PERSONLIB_OWNER_SYNC_TOKEN is required for owner sync");
+  await request(endpoint, "/v1/owner/sync/manifest", { token: ownerToken, method: "POST", json: { manifest: { schema_version: payload.schema_version, personas: payload.personas, looks: payload.looks }, assets: payload.assets.map(({ local_path, ...asset }) => asset) } });
+  for (const asset of payload.assets) {
+    await request(endpoint, `/v1/owner/assets/${encodeURIComponent(asset.id)}`, {
+      token: ownerToken,
+      method: "PUT",
+      body: readFileSync(asset.local_path),
+      headers: { "content-type": asset.mime_type, "x-personlib-sha256": asset.sha256 }
+    });
+  }
+  jsonOutput({ ok: true, synced: { endpoint, personas: payload.personas.length, looks: payload.looks.length, assets: payload.assets.length } }, output, args);
+}
+
+export async function runRemote(args, { output, readManifest }) {
+  const subcommand = args[0];
+  if (subcommand === "setup") return setup(args.slice(1), output);
+  if (subcommand === "doctor") return authenticated(args.slice(1), output, "/v1/doctor");
+  if (subcommand === "recommend") {
+    const childArgs = args.slice(1);
+    const brief = getOption(childArgs, "--brief");
+    if (!brief) throw new Error("usage: personlib remote recommend --brief TEXT");
+    return authenticated(childArgs, output, "/v1/recommend", { brief });
+  }
+  if (subcommand === "compose") {
+    const childArgs = args.slice(1);
+    const personaId = getOption(childArgs, "--persona");
+    const lookId = getOption(childArgs, "--look");
+    if (!personaId || !lookId) throw new Error("usage: personlib remote compose --persona P-001 --look L-001");
+    return authenticated(childArgs, output, "/v1/compose", { persona_id: personaId, look_id: lookId });
+  }
+  if (subcommand === "preview") return preview(args.slice(1), output);
+  if (subcommand === "sync") return sync(args.slice(1), output, { readManifest });
+  throw new Error("usage: personlib remote <setup|doctor|recommend|compose|preview|sync>");
+}

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "makaron-persona-look-cli",
+  "version": "0.4.1",
+  "description": "Portable Persona and Look library for Makaron agents",
+  "private": false,
+  "type": "module",
+  "bin": {
+    "personlib": "bin/personlib.mjs",
+    "makaron-persona-look-cli": "bin/personlib.mjs"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "cloudflare-worker",
+    "skills",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "test": "node test/smoke.mjs",
+    "test:remote": "node --test cloudflare-worker/test/worker.test.mjs test/remote-client.test.mjs",
+    "prepublishOnly": "node scripts/assert-release.mjs"
+  },
+  "license": "UNLICENSED",
+  "personlib": {
+    "default_api_url": "https://personlib-agent.bzz0309.workers.dev"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}