sdtk-kit 0.3.8 → 1.0.0

package/src/lib/args.js

@@ -1,116 +0,0 @@
-"use strict";
-
-const { ValidationError } = require("./errors");
-
-/**
- * Parse argv into a structured flags object.
- * Supports: --flag value, --flag=value, --bool-flag (no value).
- *
- * @param {string[]} argv - Raw arguments (after command is stripped).
- * @param {Object<string, {type: 'string'|'boolean', required?: boolean, alias?: string}>} defs - Flag definitions.
- * @returns {{ flags: Object, positional: string[] }}
- */
-function parseFlags(argv, defs) {
-  const flags = {};
-  const positional = [];
-  const aliasMap = {};
-
-  for (const [name, def] of Object.entries(defs)) {
-    if (def.alias) aliasMap[def.alias] = name;
-    if (def.type === "boolean") flags[name] = false;
-    else flags[name] = undefined;
-  }
-
-  let i = 0;
-  while (i < argv.length) {
-    const arg = argv[i];
-
-    if (!arg.startsWith("-")) {
-      positional.push(arg);
-      i++;
-      continue;
-    }
-
-    let key;
-    let inlineValue;
-
-    if (arg.includes("=")) {
-      const eqIdx = arg.indexOf("=");
-      key = arg.slice(0, eqIdx);
-      inlineValue = arg.slice(eqIdx + 1);
-    } else {
-      key = arg;
-    }
-
-    // Normalize: strip leading dashes, resolve alias
-    const stripped = key.replace(/^-{1,2}/, "");
-    const resolved = aliasMap[stripped] || stripped;
-
-    if (!(resolved in defs)) {
-      throw new ValidationError(`Unknown flag: ${key}`);
-    }
-
-    const def = defs[resolved];
-
-    if (def.type === "boolean") {
-      flags[resolved] = true;
-      i++;
-    } else {
-      // string type
-      let value = inlineValue;
-      if (value === undefined) {
-        i++;
-        if (i >= argv.length) {
-          throw new ValidationError(`Flag ${key} requires a value.`);
-        }
-        value = argv[i];
-      }
-      flags[resolved] = value;
-      i++;
-    }
-  }
-
-  return { flags, positional };
-}
-
-/**
- * Require a flag to be present (non-undefined, non-empty for strings).
- */
-function requireFlag(flags, name, label) {
-  const val = flags[name];
-  if (val === undefined || val === null || val === "") {
-    throw new ValidationError(`Missing required flag: --${label || name}`);
-  }
-  return val;
-}
-
-/**
- * Validate a value is one of the allowed choices.
- */
-function validateChoice(value, choices, label) {
-  if (!choices.includes(value)) {
-    throw new ValidationError(
-      `Invalid value for --${label}: "${value}". Must be one of: ${choices.join(", ")}`
-    );
-  }
-  return value;
-}
-
-/**
- * Validate a value matches a regex pattern.
- */
-function validatePattern(value, regex, label, hint) {
-  if (!regex.test(value)) {
-    throw new ValidationError(
-      `Invalid value for --${label}: "${value}". ${hint || `Must match ${regex}`}`
-    );
-  }
-  return value;
-}
-
-module.exports = {
-  parseFlags,
-  requireFlag,
-  validateChoice,
-  validatePattern,
-};

package/src/lib/errors.js

@@ -1,41 +0,0 @@
-"use strict";
-
-class CliError extends Error {
-  constructor(message, exitCode = 4) {
-    super(message);
-    this.name = this.constructor.name;
-    this.exitCode = exitCode;
-  }
-}
-
-class ValidationError extends CliError {
-  constructor(message) {
-    super(message, 1);
-  }
-}
-
-class DependencyError extends CliError {
-  constructor(message) {
-    super(message, 2);
-  }
-}
-
-class IntegrityError extends CliError {
-  constructor(message) {
-    super(message, 3);
-  }
-}
-
-class InternalError extends CliError {
-  constructor(message) {
-    super(message, 4);
-  }
-}
-
-module.exports = {
-  CliError,
-  ValidationError,
-  DependencyError,
-  IntegrityError,
-  InternalError,
-};

package/src/lib/github-access.js

@@ -1,68 +0,0 @@
-"use strict";
-
-const { ValidationError } = require("./errors");
-
-// Entitlement repo: configurable via env var, falls back to default.
-// Set SDTK_ENTITLEMENT_REPO=owner/repo to override.
-const DEFAULT_REPO = "DucTN/sdtk-private";
-
-function getEntitlementRepo() {
-  return process.env.SDTK_ENTITLEMENT_REPO || DEFAULT_REPO;
-}
-
-/**
- * Check if a GitHub token has access to the private distribution repo.
- *
- * @param {string} token - GitHub PAT.
- * @param {string} [repo] - Repo in "owner/name" format. Defaults to SDTK_ENTITLEMENT_REPO env or built-in default.
- * @returns {Promise<{hasAccess: boolean, message: string}>}
- */
-async function checkRepoAccess(token, repo) {
-  const targetRepo = repo || getEntitlementRepo();
-  const url = `https://api.github.com/repos/${targetRepo}`;
-
-  try {
-    const response = await fetch(url, {
-      headers: {
-        Authorization: `Bearer ${token}`,
-        Accept: "application/vnd.github.v3+json",
-        "User-Agent": "sdtk-cli",
-      },
-    });
-
-    if (response.status === 200) {
-      return {
-        hasAccess: true,
-        message: `Access verified for ${targetRepo}.`,
-      };
-    }
-
-    if (response.status === 404 || response.status === 403) {
-      return {
-        hasAccess: false,
-        message: `No access to ${targetRepo}. Check your token permissions.`,
-      };
-    }
-
-    if (response.status === 401) {
-      return {
-        hasAccess: false,
-        message: "Token is invalid or expired.",
-      };
-    }
-
-    return {
-      hasAccess: false,
-      message: `Unexpected response (HTTP ${response.status}) from GitHub API.`,
-    };
-  } catch (err) {
-    throw new ValidationError(
-      `Failed to reach GitHub API: ${err.message}\nCheck your network connection.`
-    );
-  }
-}
-
-module.exports = {
-  checkRepoAccess,
-  getEntitlementRepo,
-};

package/src/lib/powershell.js

@@ -1,85 +0,0 @@
-"use strict";
-
-const { execFile } = require("child_process");
-const { DependencyError } = require("./errors");
-
-/**
- * Find available PowerShell executable.
- * Prefers pwsh (PowerShell Core) over powershell.exe (Windows PowerShell).
- * @returns {string} PowerShell executable name.
- */
-function findPowerShell() {
-  // On Windows, powershell.exe is always available
-  // pwsh (PowerShell Core) is preferred if available
-  if (process.platform === "win32") {
-    return "powershell.exe";
-  }
-  // On non-Windows, pwsh must be installed
-  return "pwsh";
-}
-
-/**
- * Execute a PowerShell script file with arguments.
- *
- * @param {string} scriptPath - Absolute path to the .ps1 file.
- * @param {Object<string, string|boolean>} params - Parameters to pass.
- *   String values become `-ParamName "value"`, boolean true becomes `-ParamName`.
- * @param {Object} [options] - Optional settings.
- * @param {boolean} [options.silent] - If true, suppress stdout output.
- * @returns {Promise<{exitCode: number, stdout: string, stderr: string}>}
- */
-function runScript(scriptPath, params = {}, options = {}) {
-  return new Promise((resolve, reject) => {
-    const psExe = findPowerShell();
-    const args = [
-      "-ExecutionPolicy",
-      "Bypass",
-      "-NoProfile",
-      "-NonInteractive",
-      "-File",
-      scriptPath,
-    ];
-
-    // Build parameters safely using execFile array args
-    for (const [key, value] of Object.entries(params)) {
-      if (value === true) {
-        args.push(`-${key}`);
-      } else if (value === false || value === undefined || value === null) {
-        // Skip false/undefined/null switches
-      } else {
-        args.push(`-${key}`);
-        args.push(String(value));
-      }
-    }
-
-    execFile(psExe, args, { maxBuffer: 10 * 1024 * 1024 }, (error, stdout, stderr) => {
-      if (error && error.code === "ENOENT") {
-        reject(
-          new DependencyError(
-            `PowerShell not found. Ensure PowerShell is installed and available in PATH.\n` +
-              `Tried: ${psExe}`
-          )
-        );
-        return;
-      }
-
-      const exitCode = error ? error.code || 1 : 0;
-      const result = {
-        exitCode: typeof exitCode === "number" ? exitCode : 1,
-        stdout: stdout || "",
-        stderr: stderr || "",
-      };
-
-      if (!options.silent && result.stdout) {
-        process.stdout.write(result.stdout);
-      }
-
-      resolve(result);
-    });
-  });
-}
-
-module.exports = {
-  runScript,
-  findPowerShell,
-};

package/src/lib/scope.js

@@ -1,68 +0,0 @@
-"use strict";
-
-const path = require("path");
-const os = require("os");
-
-const VALID_SCOPES = ["project", "user"];
-
-/**
- * Returns the default scope for a given runtime.
- * Claude defaults to project-local, Codex defaults to user/global.
- */
-function defaultScope(runtime) {
-  return runtime === "claude" ? "project" : "user";
-}
-
-/**
- * Returns true if the given runtime supports project-local scope.
- * Gate C0: Codex does not support project-local skills.
- */
-function isProjectScopeSupported(runtime) {
-  return runtime === "claude";
-}
-
-/**
- * Resolves the skills directory for a given runtime, scope, and project path.
- */
-function resolveSkillsDir(runtime, scope, projectPath) {
-  if (runtime === "claude") {
-    if (scope === "user") {
-      return path.join(os.homedir(), ".claude", "skills");
-    }
-    return path.join(projectPath || process.cwd(), ".claude", "skills");
-  }
-
-  // Codex: always user/global scope
-  const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), ".codex");
-  return path.join(codexHome, "skills");
-}
-
-/**
- * SDTK-managed skill directory names per runtime.
- * Used by runtime status to distinguish SDTK skills from unrelated user skills.
- */
-const MANAGED_CODEX_SKILLS = [
-  "sdtk-api-design-spec", "sdtk-api-doc", "sdtk-arch", "sdtk-ba",
-  "sdtk-design-layout", "sdtk-dev", "sdtk-dev-backend", "sdtk-dev-frontend",
-  "sdtk-orchestrator", "sdtk-pm", "sdtk-qa", "sdtk-screen-design-spec",
-  "sdtk-test-case-spec",
-];
-
-const MANAGED_CLAUDE_SKILLS = [
-  "api-design-spec", "api-doc", "arch", "ba",
-  "design-layout", "dev", "dev-backend", "dev-frontend",
-  "orchestrator", "pm", "qa", "screen-design-spec",
-  "test-case-spec",
-];
-
-function managedSkillNames(runtime) {
-  return runtime === "claude" ? MANAGED_CLAUDE_SKILLS : MANAGED_CODEX_SKILLS;
-}
-
-module.exports = {
-  VALID_SCOPES,
-  defaultScope,
-  isProjectScopeSupported,
-  resolveSkillsDir,
-  managedSkillNames,
-};

package/src/lib/state.js

@@ -1,83 +0,0 @@
-"use strict";
-
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-const { execFileSync } = require("child_process");
-
-function ensureDir(dirPath) {
-  fs.mkdirSync(dirPath, { recursive: true });
-}
-
-function getAuthFile() {
-  return path.join(os.homedir(), ".sdtkrc");
-}
-
-/**
- * Harden file permissions so only the current user can read/write.
- * - POSIX: chmod 600
- * - Windows: icacls to grant only current user Full Control
- * @returns {boolean} true if hardening succeeded, false otherwise.
- */
-function hardenFilePermissions(filePath) {
-  try {
-    if (process.platform === "win32") {
-      const username = os.userInfo().username;
-      execFileSync("icacls", [
-        filePath,
-        "/inheritance:r",
-        "/grant:r",
-        `${username}:(F)`,
-      ], { stdio: "ignore" });
-    } else {
-      fs.chmodSync(filePath, 0o600);
-    }
-    return true;
-  } catch (_err) {
-    return false;
-  }
-}
-
-function readAuthState() {
-  const authFile = getAuthFile();
-  if (!fs.existsSync(authFile)) {
-    return { authenticated: false, token: "" };
-  }
-  try {
-    const payload = JSON.parse(fs.readFileSync(authFile, "utf8"));
-    const token = payload.github_token || "";
-    return { authenticated: token.length > 0, token };
-  } catch (_error) {
-    return { authenticated: false, token: "" };
-  }
-}
-
-/**
- * Write auth state and harden file permissions.
- * @returns {{ path: string, hardened: boolean }}
- */
-function writeAuthState(token) {
-  const authFile = getAuthFile();
-  const payload = {
-    github_token: token,
-    updated_at: new Date().toISOString(),
-  };
-  fs.writeFileSync(authFile, JSON.stringify(payload, null, 2), "utf8");
-  const hardened = hardenFilePermissions(authFile);
-  return { path: authFile, hardened };
-}
-
-function clearAuthState() {
-  const authFile = getAuthFile();
-  if (fs.existsSync(authFile)) {
-    fs.unlinkSync(authFile);
-  }
-}
-
-module.exports = {
-  ensureDir,
-  getAuthFile,
-  readAuthState,
-  writeAuthState,
-  clearAuthState,
-};

package/src/lib/toolkit-payload.js

@@ -1,99 +0,0 @@
-"use strict";
-
-const fs = require("fs");
-const path = require("path");
-const crypto = require("crypto");
-const { IntegrityError } = require("./errors");
-
-const PACKAGE_ROOT = path.resolve(__dirname, "..", "..");
-const ASSETS_DIR = path.join(PACKAGE_ROOT, "assets", "toolkit");
-const MANIFEST_PATH = path.join(
-  PACKAGE_ROOT,
-  "assets",
-  "manifest",
-  "toolkit-bundle.manifest.json"
-);
-
-/**
- * Load and parse the toolkit bundle manifest.
- * @returns {Object} Parsed manifest object.
- */
-function loadManifest() {
-  if (!fs.existsSync(MANIFEST_PATH)) {
-    throw new IntegrityError(
-      `Toolkit manifest not found: ${MANIFEST_PATH}\n` +
-        'Run "npm run build:payload" to sync toolkit assets.'
-    );
-  }
-  try {
-    const raw = fs.readFileSync(MANIFEST_PATH, "utf-8");
-    return JSON.parse(raw);
-  } catch (err) {
-    throw new IntegrityError(`Failed to parse manifest: ${err.message}`);
-  }
-}
-
-/**
- * Compute SHA256 hash of a file.
- * @param {string} filePath
- * @returns {string} Lowercase hex hash.
- */
-function hashFile(filePath) {
-  const data = fs.readFileSync(filePath);
-  return crypto.createHash("sha256").update(data).digest("hex");
-}
-
-/**
- * Verify payload integrity against manifest.
- * Checks all files exist and SHA256 hashes match.
- * @throws {IntegrityError} on mismatch or missing file.
- */
-function verify() {
-  const manifest = loadManifest();
-
-  if (!manifest.files || !Array.isArray(manifest.files)) {
-    throw new IntegrityError("Manifest has no files array.");
-  }
-
-  const errors = [];
-
-  for (const entry of manifest.files) {
-    const filePath = path.join(ASSETS_DIR, entry.path);
-
-    if (!fs.existsSync(filePath)) {
-      errors.push(`MISSING: ${entry.path}`);
-      continue;
-    }
-
-    const actualHash = hashFile(filePath);
-    if (actualHash !== entry.sha256) {
-      errors.push(
-        `HASH MISMATCH: ${entry.path}\n` +
-          `  expected: ${entry.sha256}\n` +
-          `  actual:   ${actualHash}`
-      );
-    }
-  }
-
-  if (errors.length > 0) {
-    throw new IntegrityError(
-      `Toolkit payload integrity check failed:\n${errors.join("\n")}`
-    );
-  }
-}
-
-/**
- * Resolve absolute path to a file inside the bundled toolkit payload.
- * @param {string} relativePath - Path relative to assets/toolkit/ (e.g., "toolkit/install.ps1").
- * @returns {string} Absolute path.
- */
-function resolvePayloadFile(relativePath) {
-  return path.join(ASSETS_DIR, relativePath);
-}
-
-module.exports = {
-  verify,
-  loadManifest,
-  resolvePayloadFile,
-  ASSETS_DIR,
-};