mobbin 0.1.0

package/mobbin-cli.js

@@ -0,0 +1,1297 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { parseArgs } from 'node:util';
+import { MobbinClient, buildContentAppsPayload } from './mobbin-sdk.js';
+
+const AUTH_LIKELY_COMMANDS = new Set([
+  'search',
+  'popular-apps',
+  'app-versions',
+  'screen-info',
+  'recent-searches',
+  'content-apps',
+  'call',
+]);
+
+const UUID_RE = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i;
+
+function toCamelCaseFlag(kebab) {
+  return kebab.replace(/-([a-z0-9])/gi, (_, ch) => ch.toUpperCase());
+}
+
+function tryReadTextFile(filePath) {
+  try {
+    return fs.readFileSync(filePath, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+function normalizeCliArgs(argv) {
+  const out = [];
+  let afterDoubleDash = false;
+
+  for (const arg of argv) {
+    if (afterDoubleDash) {
+      out.push(arg);
+      continue;
+    }
+    if (arg === '--') {
+      out.push(arg);
+      afterDoubleDash = true;
+      continue;
+    }
+    if (!arg.startsWith('--') || !arg.includes('-')) {
+      out.push(arg);
+      continue;
+    }
+
+    const [flag, value] = arg.split('=', 2);
+    const normalizedFlag = `--${toCamelCaseFlag(flag.slice(2))}`;
+    out.push(value === undefined ? normalizedFlag : `${normalizedFlag}=${value}`);
+  }
+
+  return out;
+}
+
+function readCookieFile(filePath) {
+  const raw = (tryReadTextFile(filePath) || '').trim();
+  if (!raw) return '';
+
+  if (raw.startsWith('{') || raw.startsWith('[')) {
+    try {
+      const json = JSON.parse(raw);
+      const cookies = Array.isArray(json) ? json : json.cookies;
+      if (Array.isArray(cookies)) {
+        const pairs = cookies
+          .filter((c) => {
+            const domain = c.domain || c.host || c.hostKey || c.host_key || '';
+            return String(domain).includes('mobbin.com');
+          })
+          .map((c) => {
+            const name = c.name || c.Name || '';
+            const value = c.value || c.Value || '';
+            return `${name}=${value}`;
+          })
+          .filter((pair) => pair !== '=');
+        return pairs.join('; ');
+      }
+    } catch {
+      return raw;
+    }
+  }
+
+  if (raw.startsWith('# Netscape')) {
+    const pairs = [];
+    for (const line of raw.split(/\r?\n/)) {
+      if (!line || line.startsWith('#')) continue;
+      const parts = line.split('\t');
+      if (parts.length < 7) continue;
+      const [domain, , , , , name, value] = parts;
+      if (domain && domain.includes('mobbin.com')) {
+        pairs.push(`${name}=${value}`);
+      }
+    }
+    return pairs.join('; ');
+  }
+
+  return raw.split(/\r?\n/)[0].trim();
+}
+
+function execText(cmd, args) {
+  return execFileSync(cmd, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+}
+
+function decryptChromeCookieValueMac(encryptedBytes, safeStoragePassword) {
+  const prefix = encryptedBytes.subarray(0, 3).toString('utf8');
+  if (prefix !== 'v10' && prefix !== 'v11') return null;
+
+  const ciphertext = encryptedBytes.subarray(3);
+  const key = crypto.pbkdf2Sync(safeStoragePassword, 'saltysalt', 1003, 16, 'sha1');
+  const iv = Buffer.alloc(16, 0x20);
+
+  const decipher = crypto.createDecipheriv('aes-128-cbc', key, iv);
+  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return plaintext.toString('utf8');
+}
+
+function readNullTerminatedString(buf, offset) {
+  if (!Number.isFinite(offset) || offset < 0 || offset >= buf.length) return '';
+  const end = buf.indexOf(0x00, offset);
+  const sliceEnd = end === -1 ? buf.length : end;
+  return buf.toString('utf8', offset, sliceEnd);
+}
+
+function parseSafariBinaryCookies(buf) {
+  if (!buf || buf.length < 16) return [];
+  if (buf.toString('ascii', 0, 4) !== 'cook') return [];
+
+  const pages = buf.readUInt32BE(4);
+  const sizesOffset = 8;
+  const sizesBytes = pages * 4;
+  if (sizesOffset + sizesBytes > buf.length) return [];
+
+  const pageSizes = [];
+  for (let i = 0; i < pages; i++) {
+    pageSizes.push(buf.readUInt32BE(sizesOffset + i * 4));
+  }
+
+  let pageOffset = sizesOffset + sizesBytes;
+  const cookies = [];
+
+  for (const pageSize of pageSizes) {
+    if (pageOffset + pageSize > buf.length) break;
+    const page = buf.subarray(pageOffset, pageOffset + pageSize);
+    pageOffset += pageSize;
+
+    if (page.length < 12) continue;
+    // Page header is big-endian 0x00000100, but fields within the page are little-endian.
+    const numCookies = page.readUInt32LE(4);
+    const offsetsStart = 8;
+    const offsetsEnd = offsetsStart + numCookies * 4;
+    if (offsetsEnd > page.length) continue;
+
+    const offsets = [];
+    for (let i = 0; i < numCookies; i++) {
+      offsets.push(page.readUInt32LE(offsetsStart + i * 4));
+    }
+
+    for (const cookieOffset of offsets) {
+      if (cookieOffset + 4 > page.length) continue;
+      const cookieSize = page.readUInt32LE(cookieOffset);
+      if (cookieSize <= 0 || cookieOffset + cookieSize > page.length) continue;
+
+      const cookie = page.subarray(cookieOffset, cookieOffset + cookieSize);
+      if (cookie.length < 56) continue;
+
+      const domainOffset = cookie.readUInt32LE(16);
+      const nameOffset = cookie.readUInt32LE(20);
+      const pathOffset = cookie.readUInt32LE(24);
+      const valueOffset = cookie.readUInt32LE(28);
+      const expires = cookie.readDoubleLE(40);
+      const created = cookie.readDoubleLE(48);
+
+      const domain = readNullTerminatedString(cookie, domainOffset);
+      const name = readNullTerminatedString(cookie, nameOffset);
+      const cookiePath = readNullTerminatedString(cookie, pathOffset);
+      const value = readNullTerminatedString(cookie, valueOffset);
+
+      if (!name) continue;
+      cookies.push({ domain, name, path: cookiePath, value, expires, created });
+    }
+  }
+
+  return cookies;
+}
+
+function queryCookiesSqlite(cookieDbPath) {
+  const tmp = path.join(
+    os.tmpdir(),
+    `mobbin-cookies-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}.sqlite`,
+  );
+  try {
+    fs.copyFileSync(cookieDbPath, tmp);
+  } catch {
+    return [];
+  }
+
+  try {
+    const out = execText('sqlite3', [
+      '-readonly',
+      '-separator',
+      '\t',
+      tmp,
+      "SELECT host_key, name, value, hex(encrypted_value), expires_utc FROM cookies WHERE host_key LIKE '%mobbin.com%' AND name != '' ORDER BY expires_utc DESC;",
+    ]);
+    if (!out) return [];
+
+    const rows = [];
+    for (const line of out.split(/\r?\n/)) {
+      if (!line) continue;
+      const [hostKey, name, value, encryptedHex] = line.split('\t');
+      rows.push({ hostKey, name, value, encryptedHex });
+    }
+    return rows;
+  } catch {
+    return [];
+  } finally {
+    try {
+      fs.unlinkSync(tmp);
+    } catch {}
+  }
+}
+
+function getMacSafeStoragePassword({ service, account }) {
+  try {
+    return execText('security', ['find-generic-password', '-w', '-s', service, '-a', account]);
+  } catch {
+    return null;
+  }
+}
+
+function readMobbinCookieFromSafariMac() {
+  if (process.platform !== 'darwin') return '';
+
+  const home = os.homedir();
+  const candidates = [
+    path.join(home, 'Library/Cookies/Cookies.binarycookies'),
+    path.join(home, 'Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies'),
+  ];
+
+  const nowUnix = Date.now() / 1000;
+  const cocoaToUnix = (cocoaSeconds) => (Number.isFinite(cocoaSeconds) ? cocoaSeconds + 978307200 : 0);
+
+  const bestByName = new Map();
+
+  for (const filePath of candidates) {
+    let buf;
+    try {
+      buf = fs.readFileSync(filePath);
+    } catch {
+      continue;
+    }
+
+    const cookies = parseSafariBinaryCookies(buf);
+    for (const c of cookies) {
+      if (!c.domain || !String(c.domain).includes('mobbin.com')) continue;
+      if (!c.name || !c.value) continue;
+
+      const expiresUnix = cocoaToUnix(c.expires);
+      const isExpired = expiresUnix > 0 && expiresUnix < nowUnix;
+      if (isExpired) continue;
+
+      const prev = bestByName.get(c.name);
+      if (!prev || (expiresUnix || 0) > (prev.expiresUnix || 0)) {
+        bestByName.set(c.name, { value: c.value, expiresUnix });
+      }
+    }
+
+    if (bestByName.size) break;
+  }
+
+  const pairs = [];
+  for (const [name, meta] of bestByName.entries()) {
+    pairs.push(`${name}=${meta.value}`);
+  }
+  return pairs.join('; ');
+}
+
+function readMobbinCookieFromMacBrowsers({ browser = 'auto', profile = 'Default' } = {}) {
+  if (process.platform !== 'darwin') return '';
+
+  if (browser === 'safari') {
+    return readMobbinCookieFromSafariMac();
+  }
+
+  const home = os.homedir();
+  const candidates = [
+    {
+      id: 'chrome',
+      cookieDbPath: path.join(home, 'Library/Application Support/Google/Chrome', profile, 'Cookies'),
+      keychain: { service: 'Chrome Safe Storage', account: 'Chrome' },
+    },
+    {
+      id: 'edge',
+      cookieDbPath: path.join(
+        home,
+        'Library/Application Support/Microsoft Edge',
+        profile,
+        'Cookies',
+      ),
+      keychain: { service: 'Microsoft Edge Safe Storage', account: 'Microsoft Edge' },
+    },
+    {
+      id: 'brave',
+      cookieDbPath: path.join(
+        home,
+        'Library/Application Support/BraveSoftware/Brave-Browser',
+        profile,
+        'Cookies',
+      ),
+      keychain: { service: 'Brave Safe Storage', account: 'Brave' },
+    },
+    {
+      id: 'chromium',
+      cookieDbPath: path.join(home, 'Library/Application Support/Chromium', profile, 'Cookies'),
+      keychain: { service: 'Chromium Safe Storage', account: 'Chromium' },
+    },
+  ].filter((c) => browser === 'auto' || c.id === browser);
+
+  for (const candidate of candidates) {
+    if (!fs.existsSync(candidate.cookieDbPath)) continue;
+
+    const rows = queryCookiesSqlite(candidate.cookieDbPath);
+    if (!rows.length) continue;
+
+    const byName = new Map();
+    let needsDecrypt = false;
+
+    for (const row of rows) {
+      if (byName.has(row.name)) continue;
+      if (row.value) {
+        byName.set(row.name, row.value);
+        continue;
+      }
+      if (row.encryptedHex) needsDecrypt = true;
+    }
+
+    let safeStoragePassword = null;
+    if (needsDecrypt) {
+      safeStoragePassword = getMacSafeStoragePassword(candidate.keychain);
+    }
+
+    for (const row of rows) {
+      if (byName.has(row.name)) continue;
+      if (!row.encryptedHex) continue;
+      if (!safeStoragePassword) continue;
+
+      try {
+        const encryptedBytes = Buffer.from(row.encryptedHex, 'hex');
+        const decrypted = decryptChromeCookieValueMac(encryptedBytes, safeStoragePassword);
+        if (decrypted) byName.set(row.name, decrypted);
+      } catch {}
+    }
+
+    const pairs = [];
+    for (const [name, value] of byName.entries()) {
+      if (!name || !value) continue;
+      pairs.push(`${name}=${value}`);
+    }
+
+    if (pairs.length) return pairs.join('; ');
+  }
+
+  return '';
+}
+
+function defaultCookieFileCandidates() {
+  const home = os.homedir();
+  return [
+    process.env.MOBBIN_COOKIE_FILE,
+    path.join(home, '.config/mobbin/cookie.txt'),
+    path.join(home, '.config/mobbin/storage-state.json'),
+    path.join(home, '.mobbin-cookie'),
+    path.join(process.cwd(), 'cookie.txt'),
+    path.join(process.cwd(), 'cookies.txt'),
+    path.join(process.cwd(), 'storage-state.json'),
+  ].filter(Boolean);
+}
+
+function resolveCookie(values, { command } = {}) {
+  if (values.cookie) return values.cookie;
+  if (values.cookieFile) {
+    const fromFile = readCookieFile(values.cookieFile);
+    if (fromFile) return fromFile;
+  }
+  if (process.env.MOBBIN_COOKIE) return process.env.MOBBIN_COOKIE;
+
+  for (const candidate of defaultCookieFileCandidates()) {
+    const fromFile = readCookieFile(candidate);
+    if (fromFile) return fromFile;
+  }
+
+  const authLikely =
+    values.cookieFrom || AUTH_LIKELY_COMMANDS.has(command);
+
+  if (authLikely) {
+    const cookieFrom = values.cookieFrom || 'auto';
+    let fromBrowser = readMobbinCookieFromMacBrowsers({
+      browser: cookieFrom,
+      profile: values.cookieProfile || 'Default',
+    });
+
+    if (!fromBrowser && cookieFrom === 'auto') {
+      fromBrowser = readMobbinCookieFromSafariMac();
+    }
+
+    if (fromBrowser) return fromBrowser;
+  }
+
+  return undefined;
+}
+
+async function maybeInteractiveAuthCookie(values) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return undefined;
+  if (process.platform !== 'darwin') return undefined;
+
+  try {
+    execFileSync('open', ['https://mobbin.com'], { stdio: 'ignore' });
+  } catch {}
+
+  process.stdout.write(
+    'Mobbin auth required. Log into Mobbin in your browser, then press Enter to continue...\n',
+  );
+  await new Promise((resolve) => process.stdin.once('data', resolve));
+
+  return resolveCookie(
+    { ...values, cookieFrom: values.cookieFrom || 'auto' },
+    { command: 'recent-searches' },
+  );
+}
+
+const DEFAULT_BYTESCALE_ACCOUNT_ID = 'FW25bBB';
+const DEFAULT_SUPABASE_BYTESCALE_PREFIX_MAP = {
+  'https://eqcn': 'mobbin.com/development/',
+  'https://qvzj': 'mobbin.com/staging/',
+  'https://ujas': 'mobbin.com/prod/',
+};
+
+const SUPABASE_PUBLIC_OBJECT_PREFIX = '/storage/v1/object/public/';
+
+function readJsonFile(filePath) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function writeJsonFile(filePath, data) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(data, null, 2)}\n`, { mode: 0o600 });
+}
+
+async function fetchText(url, { timeoutMs = 15000, headers } = {}) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(url, { headers, signal: controller.signal });
+    if (!res.ok) throw new Error(`HTTP ${res.status} ${res.statusText} for ${url}`);
+    return await res.text();
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+async function fetchRedirectLocation(url, { timeoutMs = 15000, headers } = {}) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(url, { headers, redirect: 'manual', signal: controller.signal });
+    return { status: res.status, location: res.headers.get('location') || null };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+function findMobbinMainAppChunkUrl(html) {
+  const match = html.match(/\/_next\/static\/chunks\/main-app-[^"']+\.js[^"']*/);
+  if (!match) return null;
+  return `https://mobbin.com${match[0].replace(/&amp;/g, '&')}`;
+}
+
+function extractBytescaleConfigFromMobbinJs(js) {
+  const accountIdMatch = js.match(/NEXT_PUBLIC_BYTESCALE_ACCOUNT_ID:"([^"]+)"/);
+  const accountId = accountIdMatch ? accountIdMatch[1] : null;
+
+  const prefixMapMatch = js.match(/NEXT_PUBLIC_SUPABASE_BYTESCALE_IMAGE_HOST_PREFIX:'([^']+)'/);
+  let prefixMap = null;
+  if (prefixMapMatch) {
+    try {
+      prefixMap = JSON.parse(prefixMapMatch[1]);
+    } catch {}
+  }
+
+  return { accountId, prefixMap };
+}
+
+async function fetchBytescaleConfigFromMobbin() {
+  const html = await fetchText('https://mobbin.com');
+  const mainChunkUrl = findMobbinMainAppChunkUrl(html);
+  if (!mainChunkUrl) throw new Error('Unable to locate Mobbin main-app chunk URL');
+  const js = await fetchText(mainChunkUrl);
+
+  const extracted = extractBytescaleConfigFromMobbinJs(js);
+  return {
+    accountId: extracted.accountId || DEFAULT_BYTESCALE_ACCOUNT_ID,
+    prefixMap: extracted.prefixMap || DEFAULT_SUPABASE_BYTESCALE_PREFIX_MAP,
+  };
+}
+
+async function getBytescaleConfig({ refresh = false } = {}) {
+  const configPath = path.join(os.homedir(), '.config', 'mobbin', 'bytescale.json');
+
+  const envAccountId = process.env.MOBBIN_BYTESCALE_ACCOUNT_ID;
+  const envPrefixMapRaw =
+    process.env.MOBBIN_SUPABASE_BYTESCALE_PREFIX_MAP || process.env.MOBBIN_BYTESCALE_PREFIX_MAP;
+
+  let envPrefixMap = null;
+  if (envPrefixMapRaw) {
+    try {
+      envPrefixMap = JSON.parse(envPrefixMapRaw);
+    } catch {
+      throw new Error(
+        'MOBBIN_SUPABASE_BYTESCALE_PREFIX_MAP must be a JSON object like {"https://ujas":"mobbin.com/prod/"}',
+      );
+    }
+  }
+
+  const cached = refresh ? null : readJsonFile(configPath);
+  let accountId = envAccountId || cached?.accountId || DEFAULT_BYTESCALE_ACCOUNT_ID;
+  let prefixMap = envPrefixMap || cached?.prefixMap || DEFAULT_SUPABASE_BYTESCALE_PREFIX_MAP;
+
+  // If we have no cache/env, try to fetch the latest config from mobbin.com (public).
+  if (refresh || (!cached && !envAccountId && !envPrefixMapRaw)) {
+    try {
+      const fetched = await fetchBytescaleConfigFromMobbin();
+      accountId = envAccountId || fetched.accountId || accountId;
+      prefixMap = envPrefixMap || fetched.prefixMap || prefixMap;
+      writeJsonFile(configPath, { accountId, prefixMap, fetchedAt: new Date().toISOString() });
+    } catch {
+      // Keep defaults if discovery fails.
+    }
+  }
+
+  return { accountId, prefixMap };
+}
+
+function parseSupabasePublicObjectUrl(url) {
+  try {
+    const u = new URL(url);
+    if (!u.host.endsWith('.supabase.co')) return null;
+    if (!u.pathname.startsWith(SUPABASE_PUBLIC_OBJECT_PREFIX)) return null;
+    return { origin: u.origin, path: u.pathname.slice(SUPABASE_PUBLIC_OBJECT_PREFIX.length) };
+  } catch {
+    return null;
+  }
+}
+
+function encodePathSegments(p) {
+  return p.split('/').map((seg) => encodeURIComponent(seg)).join('/');
+}
+
+async function toBytescaleRawUrlFromSupabase(url, bytescaleConfig) {
+  const parsed = parseSupabasePublicObjectUrl(url);
+  if (!parsed) return null;
+
+  const originPrefix = parsed.origin.slice(0, 12);
+  const hostPrefix = bytescaleConfig.prefixMap?.[originPrefix];
+  if (!hostPrefix) return null;
+
+  const filePath = `${hostPrefix}${parsed.path}`;
+  return `https://bytescale.mobbin.com/${bytescaleConfig.accountId}/raw/${encodePathSegments(filePath)}`;
+}
+
+async function toBytescaleImageUrlFromSupabase(
+  url,
+  bytescaleConfig,
+  { width = 1920, quality = 85, format = 'png' } = {},
+) {
+  const parsed = parseSupabasePublicObjectUrl(url);
+  if (!parsed) return null;
+
+  const originPrefix = parsed.origin.slice(0, 12);
+  const hostPrefix = bytescaleConfig.prefixMap?.[originPrefix];
+  if (!hostPrefix) return null;
+
+  const filePath = `${hostPrefix}${parsed.path}`;
+  const out = new URL(
+    `https://bytescale.mobbin.com/${bytescaleConfig.accountId}/image/${encodePathSegments(filePath)}`,
+  );
+  out.searchParams.set('f', format);
+  out.searchParams.set('w', String(width));
+  out.searchParams.set('q', String(quality));
+  out.searchParams.set('fit', 'shrink-cover');
+  return out.toString();
+}
+
+function toBytescaleRawUrlFromBytescaleImageUrl(url) {
+  try {
+    const u = new URL(url);
+    if (u.host !== 'bytescale.mobbin.com') return null;
+
+    const parts = u.pathname.split('/').filter(Boolean);
+    if (parts.length < 3) return null;
+    const [accountId, kind, ...rest] = parts;
+    if (kind !== 'image') return null;
+
+    u.pathname = `/${[accountId, 'raw', ...rest].join('/')}`;
+    u.search = '';
+    return u.toString();
+  } catch {
+    return null;
+  }
+}
+
+function sanitizePathSegment(s) {
+  return String(s)
+    .replace(/[^A-Za-z0-9._-]+/g, '-')
+    .replace(/^-+/, '')
+    .replace(/-+$/, '')
+    .slice(0, 120);
+}
+
+function extFromUrl(url) {
+  try {
+    const u = new URL(url);
+    const base = path.basename(u.pathname);
+    const ext = path.extname(base);
+    return ext || '';
+  } catch {
+    return '';
+  }
+}
+
+function normalizeUrlInput(s) {
+  let out = String(s).trim();
+  while (out.endsWith('\\')) out = out.slice(0, -1);
+  return out;
+}
+
+function extractMobbinScreenIdFromUrl(url) {
+  try {
+    const u = new URL(url);
+    if (u.host !== 'mobbin.com') return null;
+    const parts = u.pathname.split('/').filter(Boolean);
+    if (parts.length !== 2) return null;
+    const [kind, id] = parts;
+    if (kind !== 'screens' && kind !== '@modalscreens') return null;
+    return id || null;
+  } catch {
+    return null;
+  }
+}
+
+function extractUuidFromString(s) {
+  const m = String(s || '').match(UUID_RE);
+  return m ? m[0].toLowerCase() : null;
+}
+
+function extractMobbinSiteInfoFromUrl(url) {
+  try {
+    const u = new URL(url);
+    if (u.host !== 'mobbin.com') return null;
+
+    const parts = u.pathname.split('/').filter(Boolean);
+    if (parts[0] !== 'sites') return null;
+    if (!parts[1]) return null;
+
+    const siteSlug = parts[1];
+    const siteId = extractUuidFromString(siteSlug);
+    const siteVersionId = parts[2] && UUID_RE.test(parts[2]) ? parts[2].toLowerCase() : null;
+    const tab = parts[3] || null;
+
+    return { siteSlug, siteId, siteVersionId, tab };
+  } catch {
+    return null;
+  }
+}
+
+function extractMobbinSiteVersionFromPathname(pathname) {
+  const parts = String(pathname || '')
+    .split('/')
+    .filter(Boolean);
+  if (parts[0] !== 'sites') return null;
+  if (parts.length < 3) return null;
+  return { siteSlug: parts[1], siteVersionId: parts[2], tab: parts[3] || null };
+}
+
+function decodeBasicHtmlEntities(s) {
+  return String(s || '').replace(/&amp;/g, '&');
+}
+
+function extractMobbinTitle(html) {
+  const m = String(html || '').match(/<title>([^<]+)<\/title>/i);
+  if (!m) return null;
+  return decodeBasicHtmlEntities(m[1]).trim();
+}
+
+function extractFullpageScreenUrlsFromMobbinSiteHtml(html) {
+  const out = [];
+  const seen = new Set();
+
+  const add = (url) => {
+    const normalized = normalizeUrlInput(decodeBasicHtmlEntities(url));
+    if (!normalized) return;
+    if (seen.has(normalized)) return;
+    seen.add(normalized);
+    out.push(normalized);
+  };
+
+  const supabaseRe =
+    /https:\/\/[a-z0-9]+\.supabase\.co\/storage\/v1\/object\/public\/content\/app_fullpage_screens\/[^"<> ]+/gi;
+  const bytescaleRe = /https:\/\/bytescale\.mobbin\.com\/[^"<> ]+/gi;
+
+  for (const m of String(html || '').matchAll(supabaseRe)) add(m[0]);
+  for (const m of String(html || '').matchAll(bytescaleRe)) {
+    if (m[0].includes('content/app_fullpage_screens/')) add(m[0]);
+  }
+
+  return out;
+}
+
+async function downloadFile(url, destPath, { overwrite = false, headers } = {}) {
+  if (!overwrite && fs.existsSync(destPath)) {
+    return { status: 'skipped', destPath, url };
+  }
+
+  fs.mkdirSync(path.dirname(destPath), { recursive: true });
+  const tmpPath = `${destPath}.tmp`;
+
+  try {
+    const res = await fetch(url, { headers });
+    if (!res.ok) {
+      throw new Error(`HTTP ${res.status} ${res.statusText}`);
+    }
+    if (!res.body) throw new Error('No response body');
+
+    await pipeline(Readable.fromWeb(res.body), fs.createWriteStream(tmpPath));
+    fs.renameSync(tmpPath, destPath);
+
+    return {
+      status: 'downloaded',
+      destPath,
+      url,
+      contentType: res.headers.get('content-type') || null,
+      bytes: Number(res.headers.get('content-length') || 0) || null,
+    };
+  } catch (err) {
+    try {
+      fs.unlinkSync(tmpPath);
+    } catch {}
+    throw err;
+  }
+}
+
+async function mapWithConcurrency(items, concurrency, fn) {
+  const results = new Array(items.length);
+  let index = 0;
+
+  const workerCount = Math.max(1, Math.min(concurrency, items.length));
+  const workers = Array.from({ length: workerCount }, async () => {
+    while (true) {
+      const i = index++;
+      if (i >= items.length) break;
+      results[i] = await fn(items[i], i);
+    }
+  });
+
+  await Promise.all(workers);
+  return results;
+}
+
+function printUsage() {
+  const bin = path.basename(process.argv[1] || 'mobbin-cli.js');
+  console.log(
+    [
+      '',
+      'Mobbin CLI',
+      '',
+      'Commands:',
+      '  trending-apps --platform ios',
+      '  trending-filter-tags --platform ios --experience apps',
+      '  trending-keywords --platform ios',
+      '  trending-sites',
+      '  searchable-sites',
+      '  searchable-apps --platform ios',
+      '  dictionary',
+      '  search --query "login" --platform ios --experience apps',
+      '  popular-apps --platform ios --limit 10',
+      '  app-versions --app-id <uuid>',
+      '  screen-info --screen-id <uuid>',
+      '  download [--app-id <uuid> | --site-id <uuid> | --screen-id <uuid> | <url> ...] --out-dir ./out',
+      '  extract [--app-id <uuid> | --site-id <uuid> | --screen-id <uuid> | <url> ...] --out-dir ./out',
+      '  recent-searches',
+      '  content-apps --platform ios --tab latest --page-size 24',
+      '  auth print-cookie',
+      '  auth save-cookie --out ~/.config/mobbin/cookie.txt',
+      `  call /api/endpoint --method POST --data '{"foo":"bar"}'`,
+      '',
+      'Options:',
+      '  --cookie <string>           Raw Cookie header value',
+      '  --cookie-file <path>        Netscape cookie file or Playwright storage state JSON',
+      '  --cookie-from <auto|safari|chrome|edge|brave|chromium>  Read cookies from local browser store (macOS)',
+      '  --cookie-profile <name>     Browser profile dir (default: Default)',
+      '  --base-url <url>            Override API base URL',
+      '  --out-dir <path>            Download output directory (default: ./out)',
+      '  --concurrency <n>           Download concurrency (default: 6)',
+      '  --overwrite                 Overwrite existing files when downloading',
+      '  --bytescale-refresh         Refresh cached Bytescale config (download)',
+      '  --raw                       Print raw (non-JSON) output',
+      '  --compact                   Print compact JSON (1 line)',
+      '',
+      'Examples:',
+      `  ${bin} trending-apps --platform ios`,
+      `  ${bin} search --query "login" --platform ios --experience apps`,
+      `  ${bin} auth save-cookie --out ~/.config/mobbin/cookie.txt`,
+      `  ${bin} download --screen-id <uuid> --out-dir ./out`,
+      `  ${bin} download --app-id <uuid> --out-dir ./out`,
+      `  ${bin} download --site-id <uuid> --out-dir ./out`,
+      `  ${bin} call /api/search-bar/fetch-trending-sites --method POST --data "{}"`,
+      '',
+    ].join('\n'),
+  );
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  if (!args.length || args[0] === 'help' || args[0] === '--help') {
+    printUsage();
+    process.exit(0);
+  }
+
+  const command = args[0];
+  const isDownloadCommand = command === 'download' || command === 'extract';
+
+  const { values, positionals } = parseArgs({
+    args: normalizeCliArgs(args.slice(1)),
+    options: {
+      cookie: { type: 'string' },
+      cookieFile: { type: 'string' },
+      cookieFrom: { type: 'string' },
+      cookieProfile: { type: 'string' },
+      baseUrl: { type: 'string' },
+      platform: { type: 'string' },
+      experience: { type: 'string' },
+      query: { type: 'string' },
+      limit: { type: 'string' },
+      pageSize: { type: 'string' },
+      tab: { type: 'string' },
+      appId: { type: 'string' },
+      siteId: { type: 'string' },
+      screenId: { type: 'string' },
+      method: { type: 'string' },
+      data: { type: 'string' },
+      out: { type: 'string' },
+      outDir: { type: 'string' },
+      concurrency: { type: 'string' },
+      overwrite: { type: 'boolean', default: false },
+      bytescaleRefresh: { type: 'boolean', default: false },
+      raw: { type: 'boolean', default: false },
+      compact: { type: 'boolean', default: false },
+    },
+    allowPositionals: true,
+  });
+
+  const downloadNeedsAuth =
+    isDownloadCommand &&
+    (Boolean(values.appId) ||
+      Boolean(values.siteId) ||
+      Boolean(values.screenId) ||
+      positionals.some((p) => extractMobbinScreenIdFromUrl(normalizeUrlInput(p))) ||
+      positionals.some((p) => extractMobbinSiteInfoFromUrl(normalizeUrlInput(p))));
+
+  // `download` only needs cookies when we have to call auth-gated JSON endpoints
+  // (e.g. resolving screen IDs or fetching app versions).
+  const cookieDiscoveryCommand = downloadNeedsAuth ? 'recent-searches' : command;
+
+  let cookie = resolveCookie(values, { command: cookieDiscoveryCommand });
+  if (!cookie && (AUTH_LIKELY_COMMANDS.has(command) || downloadNeedsAuth)) {
+    cookie = await maybeInteractiveAuthCookie(values);
+  }
+
+  const client = new MobbinClient({
+    baseUrl: values.baseUrl || 'https://mobbin.com',
+    cookie,
+  });
+
+  let result;
+  switch (command) {
+    case 'trending-apps':
+      result = await client.fetchTrendingApps({ platform: values.platform || 'ios' });
+      break;
+    case 'trending-filter-tags':
+      result = await client.fetchTrendingFilterTags({
+        platform: values.platform || 'ios',
+        experience: values.experience || 'apps',
+      });
+      break;
+    case 'trending-keywords':
+      result = await client.fetchTrendingKeywords({ platform: values.platform || 'ios' });
+      break;
+    case 'trending-sites':
+      result = await client.fetchTrendingSites();
+      break;
+    case 'searchable-sites':
+      result = await client.fetchSearchableSites();
+      break;
+    case 'searchable-apps':
+      result = await client.fetchSearchableApps({ platform: values.platform || 'ios' });
+      break;
+    case 'dictionary':
+      result = await client.fetchDictionaryDefinitions();
+      break;
+    case 'search':
+      result = await client.search({
+        query: values.query,
+        experience: values.experience || 'apps',
+        platform: values.platform || 'ios',
+      });
+      break;
+    case 'popular-apps':
+      result = await client.fetchPopularApps({
+        platform: values.platform || 'ios',
+        limitPerCategory: Number(values.limit || 10),
+      });
+      break;
+    case 'app-versions':
+      result = await client.fetchAppVersionsScreens({ appId: values.appId });
+      break;
+    case 'screen-info':
+      result = await client.fetchScreenInfo({ screenId: values.screenId });
+      break;
+    case 'extract':
+    case 'download': {
+      const outDir = values.outDir || path.join(process.cwd(), 'out');
+      const concurrency = Math.max(1, Number(values.concurrency || 6) || 6);
+      const overwrite = values.overwrite === true;
+      const userAgent =
+        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120 Safari/537.36';
+
+      let bytescaleConfigPromise = null;
+      const getBytescale = async () => {
+        if (!bytescaleConfigPromise) {
+          bytescaleConfigPromise = getBytescaleConfig({ refresh: values.bytescaleRefresh === true });
+        }
+        return bytescaleConfigPromise;
+      };
+
+      const jobs = [];
+      const usedDestinations = new Set();
+
+      const uniqueDestPath = (candidatePath) => {
+        if (!usedDestinations.has(candidatePath)) {
+          usedDestinations.add(candidatePath);
+          return candidatePath;
+        }
+
+        const ext = path.extname(candidatePath);
+        const base = candidatePath.slice(0, candidatePath.length - ext.length);
+        let n = 2;
+        while (usedDestinations.has(`${base}__${n}${ext}`)) {
+          n += 1;
+        }
+        const out = `${base}__${n}${ext}`;
+        usedDestinations.add(out);
+        return out;
+      };
+
+      const addUrlJob = (url, filenameHint) => {
+        const ext = extFromUrl(url);
+        const fallbackName = filenameHint || `download${ext || ''}`;
+        const fileName = sanitizePathSegment(fallbackName) || `download${ext || ''}`;
+        const destPath = uniqueDestPath(path.join(outDir, fileName));
+        jobs.push({ url, destPath });
+      };
+
+      const cookieHeader = cookie ? { Cookie: cookie } : {};
+
+      const resolveSiteTarget = async ({ siteSlug, siteId }) => {
+        const slug = siteSlug || (siteId ? `x-${siteId}` : null);
+        if (!slug) throw new Error('Unable to resolve site target: missing siteSlug/siteId');
+
+        const res = await fetchRedirectLocation(`https://mobbin.com/sites/${slug}`, {
+          headers: { 'User-Agent': userAgent, ...cookieHeader },
+        });
+        if (!res.location) {
+          throw new Error('Unable to resolve site version: missing redirect location');
+        }
+
+        const resolved = extractMobbinSiteVersionFromPathname(
+          new URL(res.location, 'https://mobbin.com').pathname,
+        );
+        if (!resolved?.siteVersionId) {
+          throw new Error('Unable to resolve site version: unexpected redirect location');
+        }
+
+        return resolved;
+      };
+
+      const addSiteJobsFromSectionsPage = async ({ siteSlug, siteVersionId, siteId }) => {
+        if (!cookie) {
+          throw new Error(
+            'Downloading from Mobbin site pages requires auth cookies. Run: mobbin auth save-cookie',
+          );
+        }
+
+        const sectionsUrl = `https://mobbin.com/sites/${siteSlug}/${siteVersionId}/sections`;
+        const html = await fetchText(sectionsUrl, {
+          headers: { 'User-Agent': userAgent, ...cookieHeader },
+        });
+
+        const title = extractMobbinTitle(html);
+        const siteNameFromTitle = title ? title.replace(/\s*\|\s*Mobbin.*$/i, '').trim() : '';
+        const siteName = sanitizePathSegment(siteNameFromTitle || siteSlug || 'site') || 'site';
+        const siteDir = path.join(outDir, `${siteName}__${siteId || 'site'}`);
+        fs.mkdirSync(siteDir, { recursive: true });
+
+        const urls = extractFullpageScreenUrlsFromMobbinSiteHtml(html);
+        if (!urls.length) {
+          throw new Error(`No fullpage screens found at ${sectionsUrl}`);
+        }
+
+        let index = 1;
+        for (const url of urls) {
+          const base = path.basename(new URL(url).pathname) || `screen${extFromUrl(url) || '.png'}`;
+          const fileName = `${String(index).padStart(4, '0')}__${base}`;
+          const destPath = uniqueDestPath(path.join(siteDir, fileName));
+          jobs.push({ url, destPath });
+          index += 1;
+        }
+      };
+
+      if (values.appId) {
+        const appIds = String(values.appId)
+          .split(',')
+          .map((s) => s.trim())
+          .filter(Boolean);
+
+        for (const appId of appIds) {
+          const data = await client.fetchAppVersionsScreens({ appId });
+          const app = data?.value;
+          if (!app) throw new Error('Unexpected response from app-versions: missing value');
+
+          const appName = sanitizePathSegment(app.appName || 'app') || 'app';
+          const appDir = path.join(outDir, `${appName}__${appId}`);
+          fs.mkdirSync(appDir, { recursive: true });
+
+          for (const version of app.appVersions || []) {
+            for (const screen of version.appScreens || []) {
+              const ext = extFromUrl(screen.screenUrl) || '.png';
+              const screenNumber = Number.isFinite(screen.screenNumber)
+                ? String(screen.screenNumber).padStart(3, '0')
+                : '000';
+              const fileName = `${version.id}__${screenNumber}__${screen.id}${ext}`;
+              const destPath = uniqueDestPath(path.join(appDir, fileName));
+              jobs.push({ url: screen.screenUrl, destPath });
+            }
+          }
+        }
+      } else if (values.siteId) {
+        const siteIds = String(values.siteId)
+          .split(',')
+          .map((s) => s.trim())
+          .filter(Boolean);
+
+        for (const siteId of siteIds) {
+          const resolved = await resolveSiteTarget({ siteId });
+          await addSiteJobsFromSectionsPage({
+            siteSlug: resolved.siteSlug,
+            siteVersionId: resolved.siteVersionId,
+            siteId,
+          });
+        }
+      } else if (values.screenId) {
+        const screenIds = String(values.screenId)
+          .split(',')
+          .map((s) => s.trim())
+          .filter(Boolean);
+
+        for (const screenId of screenIds) {
+          const data = await client.fetchScreenInfo({ screenId });
+          const screenUrl = data?.value?.screenUrl;
+          if (!screenUrl) throw new Error('Unexpected response from screen-info: missing screenUrl');
+          const ext = extFromUrl(screenUrl) || '.png';
+          const fileName = `screen__${screenId}${ext}`;
+          const destPath = uniqueDestPath(path.join(outDir, fileName));
+          jobs.push({ url: screenUrl, destPath });
+        }
+      } else if (positionals.length) {
+        let i = 0;
+        for (const rawInput of positionals) {
+          const input = normalizeUrlInput(rawInput);
+          if (!input) continue;
+
+          const screenIdFromUrl = extractMobbinScreenIdFromUrl(input);
+          if (screenIdFromUrl) {
+            const data = await client.fetchScreenInfo({ screenId: screenIdFromUrl });
+            const screenUrl = data?.value?.screenUrl;
+            if (!screenUrl) throw new Error(`Unexpected response from screen-info for ${input}`);
+            const ext = extFromUrl(screenUrl) || '.png';
+            const fileName = `screen__${screenIdFromUrl}${ext}`;
+            const destPath = uniqueDestPath(path.join(outDir, fileName));
+            jobs.push({ url: screenUrl, destPath });
+            continue;
+          }
+
+          const siteInfo = extractMobbinSiteInfoFromUrl(input);
+          if (siteInfo) {
+            const resolved =
+              siteInfo.siteVersionId
+                ? { siteSlug: siteInfo.siteSlug, siteVersionId: siteInfo.siteVersionId }
+                : await resolveSiteTarget({ siteSlug: siteInfo.siteSlug, siteId: siteInfo.siteId });
+
+            await addSiteJobsFromSectionsPage({
+              siteSlug: resolved.siteSlug,
+              siteVersionId: resolved.siteVersionId,
+              siteId: siteInfo.siteId || extractUuidFromString(resolved.siteSlug) || 'site',
+            });
+            continue;
+          }
+
+          addUrlJob(input, path.basename(new URL(input).pathname) || `download__${i}`);
+          i += 1;
+        }
+      } else {
+        throw new Error('download requires --app-id, --site-id, --screen-id, or one or more URLs');
+      }
+
+      if (!jobs.length) {
+        throw new Error('Nothing to download (no URLs resolved)');
+      }
+
+      const results = await mapWithConcurrency(jobs, concurrency, async (job) => {
+        const normalized = normalizeUrlInput(job.url);
+        const candidates = [];
+
+        const bytescaleRawFromBytescaleImage = toBytescaleRawUrlFromBytescaleImageUrl(normalized);
+        if (bytescaleRawFromBytescaleImage) {
+          candidates.push(bytescaleRawFromBytescaleImage, normalized);
+        } else {
+          const supabaseParsed = parseSupabasePublicObjectUrl(normalized);
+          if (supabaseParsed) {
+            const cfg = await getBytescale();
+            const rawUrl = await toBytescaleRawUrlFromSupabase(normalized, cfg);
+            if (rawUrl) candidates.push(rawUrl);
+
+            const ext = extFromUrl(normalized).replace(/^\./, '');
+            const format = ext || 'png';
+            const imgUrl = await toBytescaleImageUrlFromSupabase(normalized, cfg, {
+              width: 3840,
+              quality: 90,
+              format,
+            });
+            if (imgUrl) candidates.push(imgUrl);
+
+            candidates.push(normalized);
+          } else {
+            candidates.push(normalized);
+          }
+        }
+
+        let lastErr = null;
+        for (const candidate of candidates) {
+          try {
+            const downloaded = await downloadFile(candidate, job.destPath, {
+              overwrite,
+              headers: { 'User-Agent': userAgent },
+            });
+            return { ...downloaded, sourceUrl: normalized, finalUrl: candidate };
+          } catch (err) {
+            lastErr = err;
+          }
+        }
+
+        return {
+          status: 'error',
+          destPath: job.destPath,
+          url: normalized,
+          error: lastErr ? String(lastErr.message || lastErr) : 'Unknown error',
+        };
+      });
+
+      const summary = {
+        outDir,
+        downloaded: results.filter((r) => r.status === 'downloaded'),
+        skipped: results.filter((r) => r.status === 'skipped'),
+        errors: results.filter((r) => r.status === 'error'),
+      };
+
+      if (values.raw) {
+        for (const r of summary.downloaded) console.log(r.destPath);
+        for (const r of summary.skipped) console.log(r.destPath);
+      } else {
+        console.log(JSON.stringify(summary, null, values.compact ? 0 : 2));
+      }
+      return;
+    }
+    case 'recent-searches':
+      result = await client.fetchRecentSearches();
+      break;
+    case 'content-apps': {
+      const payload = buildContentAppsPayload({
+        platform: values.platform || 'ios',
+        tab: values.tab || 'latest',
+        pageSize: Number(values.pageSize || 24),
+      });
+      result = await client.fetchContentApps(payload);
+      break;
+    }
+    case 'auth': {
+      const sub = positionals[0] || 'help';
+      if (sub === 'print-cookie') {
+        const cookie = resolveCookie(
+          { ...values, cookieFrom: values.cookieFrom || 'auto' },
+          { command: 'recent-searches' },
+        );
+        if (!cookie) {
+          throw new Error(
+            'No mobbin.com cookies found. Log into Mobbin in your browser, then run: mobbin auth save-cookie (you may need --cookie-profile "Profile 1")',
+          );
+        }
+        console.log(cookie);
+        return;
+      }
+
+      if (sub === 'save-cookie') {
+        const outPath = values.out || path.join(os.homedir(), '.config/mobbin/cookie.txt');
+        fs.mkdirSync(path.dirname(outPath), { recursive: true });
+
+        let cookie = resolveCookie(
+          { ...values, cookieFrom: values.cookieFrom || 'auto' },
+          { command: 'recent-searches' },
+        );
+
+        if (!cookie && process.platform === 'darwin') {
+          try {
+            execFileSync('open', ['https://mobbin.com'], { stdio: 'ignore' });
+          } catch {}
+
+          if (process.stdin.isTTY) {
+            process.stdout.write(
+              'No mobbin.com cookies found. Log into Mobbin in your browser, then press Enter to retry...\n',
+            );
+            await new Promise((resolve) => process.stdin.once('data', resolve));
+            cookie = resolveCookie(
+              { ...values, cookieFrom: values.cookieFrom || 'auto' },
+              { command: 'recent-searches' },
+            );
+          }
+        }
+
+        if (!cookie) {
+          throw new Error(
+            'No mobbin.com cookies found. Ensure you are logged in, then re-run `mobbin auth save-cookie`.',
+          );
+        }
+
+        fs.writeFileSync(outPath, `${cookie}\n`, { mode: 0o600 });
+        console.log(
+          JSON.stringify({ savedTo: outPath, cookieCount: cookie.split(';').length }, null, 2),
+        );
+        return;
+      }
+
+      printUsage();
+      process.exit(1);
+    }
+    case 'call': {
+      const path = positionals[0];
+      if (!path) throw new Error('call requires a path, e.g. /api/search-bar/search');
+      const method = (values.method || 'GET').toUpperCase();
+      const data = values.data ? JSON.parse(values.data) : undefined;
+      result = await client.request(path, { method, json: data });
+      break;
+    }
+    default:
+      printUsage();
+      process.exit(1);
+  }
+
+  if (values.raw) {
+    console.log(result);
+  } else {
+    console.log(JSON.stringify(result, null, values.compact ? 0 : 2));
+  }
+}
+
+main().catch((err) => {
+  console.error(err?.data ? JSON.stringify(err.data, null, 2) : err.message);
+  process.exit(1);
+});