squidcloudctl 1.3.0 → 3.0.0

package/dist/lib/api/client.js

@@ -0,0 +1,132 @@
+import { loadSession } from '../auth/session.js';
+import { authToken as oauthToken, anonKey as oauthAnonKey } from '../auth/oauth-session.js';
+export const API_BASE = process.env.SQUIDCLOUD_API_BASE ||
+    'https://squidcloud.vercel.app/api/v1';
+const MAX_RETRIES = 3;
+const BASE_DELAY = 600;
+const RATE_LIMIT_WINDOW = 170;
+let lastRequestTime = 0;
+async function rateLimit() {
+    const now = Date.now();
+    const elapsed = now - lastRequestTime;
+    if (elapsed < RATE_LIMIT_WINDOW) {
+        await new Promise((r) => setTimeout(r, RATE_LIMIT_WINDOW - elapsed));
+    }
+    lastRequestTime = Date.now();
+}
+/** Auth header chain: OAuth session token → SQUIDCLOUD_API_KEY env → stored api key. */
+async function authHeaders() {
+    if (oauthToken)
+        return { Authorization: `Bearer ${oauthToken}` };
+    const envKey = process.env.SQUIDCLOUD_API_KEY;
+    if (envKey)
+        return { 'X-SquidCloud-Key': envKey };
+    try {
+        const session = await loadSession();
+        if (session?.api_key)
+            return { 'X-SquidCloud-Key': session.api_key };
+        if (session?.access_token)
+            return { Authorization: `Bearer ${session.access_token}` };
+    }
+    catch {
+        /* unauthenticated */
+    }
+    return {};
+}
+export async function buildHeaders(extra = {}) {
+    const auth = await authHeaders();
+    if (oauthAnonKey && !auth['X-SquidCloud-Key'])
+        auth['apikey'] = oauthAnonKey;
+    return { 'Content-Type': 'application/json', ...auth, ...extra };
+}
+export class ApiError extends Error {
+    status;
+    details;
+    constructor(message, status, details) {
+        super(message);
+        this.status = status;
+        this.details = details;
+        this.name = 'ApiError';
+    }
+}
+function extractError(body, status) {
+    if (body && typeof body === 'object') {
+        const b = body;
+        const msg = b?.error?.message || b?.error || b?.message || `HTTP ${status}`;
+        return new ApiError(typeof msg === 'string' ? msg : JSON.stringify(msg), status, b?.error?.code ?? b?.code);
+    }
+    return new ApiError(`HTTP ${status}`, status);
+}
+export async function apiRaw(path, options = {}) {
+    const { method = 'GET', headers = {}, body, retries = MAX_RETRIES } = options;
+    let lastError = null;
+    for (let attempt = 0; attempt <= retries; attempt++) {
+        await rateLimit();
+        const reqHeaders = await buildHeaders(headers);
+        try {
+            const res = await fetch(`${API_BASE}${path}`, {
+                method,
+                headers: reqHeaders,
+                body: body === undefined || ['GET', 'HEAD'].includes(method)
+                    ? undefined
+                    : typeof body === 'string' || body instanceof Uint8Array || body instanceof ArrayBuffer
+                        ? body
+                        : JSON.stringify(body),
+            });
+            // Retry transient failures only.
+            if (res.status >= 500 && attempt < retries) {
+                lastError = new ApiError(`HTTP ${res.status}`, res.status);
+                await sleepBackoff(attempt);
+                continue;
+            }
+            if (res.status === 429 && attempt < retries) {
+                const retryAfter = Number(res.headers.get('Retry-After')) || 2;
+                lastError = new ApiError('Rate limited', 429);
+                await new Promise((r) => setTimeout(r, retryAfter * 1000));
+                continue;
+            }
+            return res;
+        }
+        catch (err) {
+            lastError = err instanceof Error ? err : new Error(String(err));
+            if (attempt < retries)
+                await sleepBackoff(attempt);
+        }
+    }
+    throw lastError || new Error(`Request failed: ${path}`);
+}
+function sleepBackoff(attempt) {
+    const delay = BASE_DELAY * Math.pow(2, attempt) * (0.5 + Math.random() * 0.5);
+    return new Promise((r) => setTimeout(r, delay));
+}
+export async function apiRequest(path, options = {}) {
+    const res = await apiRaw(path, options);
+    if (res.status === 204)
+        return undefined;
+    const contentType = res.headers.get('content-type') || '';
+    if (contentType.includes('application/json')) {
+        const data = await res.json().catch(() => null);
+        if (!res.ok)
+            throw extractError(data, res.status);
+        return data;
+    }
+    const text = await res.text();
+    if (!res.ok)
+        throw new ApiError(text.slice(0, 400) || `HTTP ${res.status}`, res.status);
+    return text;
+}
+export async function apiGet(path, options) {
+    return apiRequest(path, { ...options, method: 'GET' });
+}
+export async function apiPost(path, body, options) {
+    return apiRequest(path, { ...options, method: 'POST', body });
+}
+export async function apiPut(path, body, options) {
+    return apiRequest(path, { ...options, method: 'PUT', body });
+}
+export async function apiPatch(path, body, options) {
+    return apiRequest(path, { ...options, method: 'PATCH', body });
+}
+export async function apiDelete(path, options) {
+    return apiRequest(path, { ...options, method: 'DELETE' });
+}

package/dist/lib/api/index.js

@@ -1,2 +1 @@
-export{b as ApiError,f as apiDelete,c as apiGet,d as apiPost,e as apiPut,a as apiRequest,g as apiUpload}from'../../chunk-5TMR6Y7L.js';export{a as getApiBase}from'../../chunk-NDB6KXYI.js';import'../../chunk-IJ3JNWT6.js';import'../../chunk-BQGHHBGH.js';import'../../chunk-6VDGYAGT.js';//# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map
+export { apiRaw, apiRequest, apiGet, apiPost, apiPut, apiPatch, apiDelete, ApiError, buildHeaders, API_BASE } from './client.js';

package/dist/lib/api/upload-res54.js

@@ -0,0 +1,104 @@
+import { loadSession } from '../auth/session.js';
+import { encryptFile } from '../crypto/encrypt-file.js';
+import { SUPABASE_URL, getAnonKey } from '../auth/constants.js';
+async function supabaseFetch(method, path, body) {
+    const session = await loadSession();
+    if (!session?.access_token)
+        throw new Error('Not logged in');
+    const response = await fetch(`${SUPABASE_URL}${path}`, {
+        method,
+        headers: {
+            'Content-Type': 'application/json',
+            'Authorization': `Bearer ${session.access_token}`,
+            'apikey': getAnonKey(),
+        },
+        body: body ? JSON.stringify(body) : undefined,
+    });
+    if (!response.ok) {
+        const text = await response.text();
+        throw new Error(`Supabase API error (${response.status}): ${text.slice(0, 500)}`);
+    }
+    if (response.status === 204)
+        return undefined;
+    return response.json();
+}
+function getRepoPath(userId, chunkIndex, totalChunks) {
+    const id = `res54_${Date.now().toString(36)}_${Math.random().toString(36).substring(2, 9)}_${chunkIndex}`;
+    return `${userId}/${id}.json`;
+}
+export async function uploadFileRes54(data, fileName, fileType, onProgress) {
+    const session = await loadSession();
+    if (!session?.access_token)
+        throw new Error('Not logged in. Run `squidcloud auth login` first.');
+    const userId = session.user.id;
+    const repos = await supabaseFetch('GET', `/rest/v1/repositories?select=repo_name&user_id=eq.${userId}`);
+    if (!repos || repos.length === 0)
+        throw new Error('No storage vault found. Create one on the dashboard first.');
+    onProgress?.(0, 1, 'Encrypting');
+    const result = encryptFile(data, fileName, fileType);
+    const totalChunks = result.chunks.length;
+    const chunkResults = [];
+    onProgress?.(0, totalChunks, 'Uploading');
+    for (let i = 0; i < totalChunks; i++) {
+        const chunk = result.chunks[i];
+        const repo = repos[i % repos.length];
+        const path = getRepoPath(userId, chunk.index, totalChunks);
+        const chunkData = {
+            version: '3.0',
+            chunkIndex: chunk.index,
+            totalChunks: chunk.totalChunks,
+            fileName: result.fileName,
+            fileType: result.fileType,
+            fileSize: result.fileSize,
+            chunkData: chunk.encryptedBase64,
+            chunkSize: chunk.encryptedBase64.length,
+            checksum: chunk.sha256,
+            repo: repo.repo_name,
+            path,
+        };
+        const uploadResponse = await supabaseFetch('POST', '/functions/v1/github-storage', {
+            action: 'upload',
+            fileName: path.split('/').pop(),
+            fileType: 'application/json',
+            data: JSON.stringify(chunkData),
+            userId,
+            path,
+            repo: repo.repo_name,
+        });
+        if (!uploadResponse.success) {
+            throw new Error(`Failed to upload chunk ${i}`);
+        }
+        chunkResults.push({ index: i, repo: repo.repo_name, path, sha: uploadResponse.sha });
+        onProgress?.(i + 1, totalChunks, 'Uploading');
+    }
+    onProgress?.(totalChunks, totalChunks, 'Finalizing');
+    const metadata = {
+        fileName: result.fileName,
+        fileType: result.fileType,
+        fileSize: result.fileSize,
+        chunks: result.chunks.map((c, idx) => ({
+            ...c,
+            repo: chunkResults[idx].repo,
+            path: chunkResults[idx].path,
+        })),
+        encryptionKey: result.encryptionKey,
+        created: new Date().toISOString(),
+        previewAvailable: false,
+    };
+    const rpcResult = await supabaseFetch('POST', '/rest/v1/rpc/create_file_record', {
+        p_name: result.fileName,
+        p_type: result.fileType || 'application/octet-stream',
+        p_size: result.fileSize,
+        p_storage_path: 'res54_distributed',
+        p_user_id: userId,
+        p_encrypted: true,
+        p_encryption_key: result.encryptionKey,
+        p_metadata: JSON.stringify(metadata),
+        p_workspace_id: null,
+    });
+    const fileId = rpcResult?.id;
+    if (!fileId)
+        throw new Error('Failed to create file record: no id returned');
+    onProgress?.(totalChunks, totalChunks, 'Complete');
+    return { id: fileId };
+}

package/dist/lib/auth/constants.js

@@ -0,0 +1,6 @@
+import { anonKey as sessionAnonKey } from './oauth-session.js';
+export const SUPABASE_URL = 'https://aouqcwbdoyrccjcrhzzi.supabase.co';
+export function getAnonKey() {
+    return sessionAnonKey || process.env.SQUIDCLOUD_ANON_KEY || '';
+}
+export { SUPABASE_URL as SUPABASE_URL_RAW };

package/dist/lib/auth/fingerprint.js

@@ -0,0 +1,39 @@
+import { createHash, randomBytes } from 'node:crypto';
+import os from 'node:os';
+import { readFileSync, existsSync } from 'node:fs';
+import { blake3 } from '@noble/hashes/blake3.js';
+import { bytesToHex } from '../crypto/ssp.js';
+const MACHINE_ID_PATHS = [
+    '/etc/machine-id',
+    '/var/lib/dbus/machine-id',
+    '/etc/hostid',
+];
+function getMachineId() {
+    for (const p of MACHINE_ID_PATHS) {
+        try {
+            if (existsSync(p)) {
+                return readFileSync(p, 'utf-8').trim();
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    const h = createHash('sha256').update(os.hostname() + os.arch() + os.platform()).digest('hex');
+    return h;
+}
+export function computeDeviceFingerprint() {
+    const machineId = getMachineId();
+    const components = [
+        machineId,
+        os.hostname(),
+        os.platform(),
+        os.arch(),
+        os.release(),
+    ];
+    const data = components.join(':');
+    return bytesToHex(blake3(new TextEncoder().encode(data)));
+}
+export function generateDeviceId() {
+    return randomBytes(32).toString('hex');
+}

package/dist/lib/auth/index.js

@@ -1,2 +1,5 @@
-export{a as performSSPHandshake}from'../../chunk-CQAXMUFB.js';export{a as refreshAccessToken}from'../../chunk-IJ3JNWT6.js';export{h as clearSession,a as computeDeviceFingerprint,e as deleteSession,b as generateDeviceId,d as getSession,k as getTimeUntilExpiry,i as isSessionExpired,f as loadSession,g as saveSession,j as shouldRefreshToken,c as storeSession}from'../../chunk-BQGHHBGH.js';import'../../chunk-6VDGYAGT.js';//# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map
+export { computeDeviceFingerprint, generateDeviceId } from './fingerprint.js';
+export { storeSession, getSession, deleteSession } from './keychain.js';
+export { loadSession, saveSession, clearSession, isSessionExpired, shouldRefreshToken, getTimeUntilExpiry } from './session.js';
+export { refreshAccessToken } from './refresh.js';
+export { performSSPHandshake } from './ssp-handshake.js';

package/dist/lib/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}
+{"version":3,"sources":["../../../src/lib/auth/constants.ts","../../../src/lib/auth/refresh.ts","../../../src/lib/auth/ssp-handshake.ts"],"names":["SUPABASE_URL","getAnonKey","anonKey","LOCK_FILE","path","os","ensureLockDir","dir","fs","acquireLock","acquired","attempts","fd","stat","r","refreshAccessToken","release","session","loadSession","fingerprint","computeDeviceFingerprint","clearSession","response","data","newSession","saveSession","generateApiKey","randomBytes","hashApiKey","key","salt","saltBytes","combined","createHash","performSSPHandshake","email","password","text","apiKey","hash","prefix","createKeyResponse"],"mappings":"yeAEO,IAAMA,CAAAA,CAAe,0CAAA,CAErB,SAASC,GAAqB,CACnC,OAAOC,CAAAA,EAAkB,OAAA,CAAQ,GAAA,CAAI,mBAAA,EAAuB,EAC9D,CCEA,IAAMC,CAAAA,CAAYC,CAAAA,CAAK,IAAA,CAAKC,CAAAA,CAAG,OAAA,EAAQ,CAAG,aAAA,CAAe,eAAe,EAExE,SAASC,CAAAA,EAAsB,CAC7B,IAAMC,CAAAA,CAAMH,CAAAA,CAAK,OAAA,CAAQD,CAAS,CAAA,CAC7BK,CAAAA,CAAG,UAAA,CAAWD,CAAG,CAAA,EACpBC,CAAAA,CAAG,SAAA,CAAUD,CAAAA,CAAK,CAAE,SAAA,CAAW,IAAA,CAAM,IAAA,CAAM,GAAM,CAAC,EAEtD,CAEA,eAAeE,GAAmC,CAChDH,CAAAA,EAAc,CACd,IAAII,CAAAA,CAAW,KAAA,CACXC,CAAAA,CAAW,CAAA,CACf,KAAO,CAACD,CAAAA,EAAYC,CAAAA,CAAW,EAAA,EAC7B,GAAI,CACF,IAAMC,CAAAA,CAAKJ,CAAAA,CAAG,QAAA,CAASL,CAAAA,CAAW,IAAI,CAAA,CACtCK,CAAAA,CAAG,SAAA,CAAUI,CAAAA,CAAI,OAAO,OAAA,CAAQ,GAAG,CAAC,CAAA,CACpCJ,CAAAA,CAAG,SAAA,CAAUI,CAAE,CAAA,CACfF,EAAW,CAAA,EACb,CAAA,KAAQ,CACN,IAAMG,CAAAA,CAAOL,CAAAA,CAAG,QAAA,CAASL,CAAS,EAElC,GADY,IAAA,CAAK,GAAA,EAAI,CAAIU,CAAAA,CAAK,OAAA,CACpB,GAAA,CACR,GAAI,CAAEL,CAAAA,CAAG,UAAA,CAAWL,CAAS,EAAE,CAAA,KAAQ,CAAC,CAE1C,MAAM,IAAI,OAAA,CAAQW,CAAAA,EAAK,UAAA,CAAWA,CAAAA,CAAG,GAAG,CAAC,CAAA,CACzCH,CAAAA,GACF,CAEF,OAAO,IAAM,CACX,GAAI,CAAEH,CAAAA,CAAG,UAAA,CAAWL,CAAS,EAAE,CAAA,KAAQ,CAAC,CAC1C,CACF,CAeA,eAAsBY,CAAAA,EAAmD,CACvE,IAAMC,CAAAA,CAAU,MAAMP,CAAAA,EAAY,CAClC,GAAI,CACF,IAAMQ,EAAU,MAAMC,GAAAA,EAAY,CAClC,GAAI,CAACD,CAAAA,CAAS,OAAO,IAAA,CAErB,IAAME,CAAAA,CAAcC,CAAAA,EAAyB,CAC7C,GAAIH,CAAAA,CAAQ,kBAAA,GAAuBE,CAAAA,CACjC,OAAA,MAAME,GAAa,CACZ,IAAA,CAGT,IAAMC,CAAAA,CAAW,MAAM,KAAA,CAAM,CAAA,EAAGtB,CAAY,CAAA,uCAAA,CAAA,CAA2C,CACrF,MAAA,CAAQ,MAAA,CACR,OAAA,CAAS,CACP,cAAA,CAAgB,kBAAA,CAChB,OAAUC,CAAAA,EACZ,CAAA,CACA,IAAA,CAAM,IAAA,CAAK,SAAA,CAAU,CAAE,aAAA,CAAegB,EAAQ,aAAc,CAAC,CAC/D,CAAC,CAAA,CAED,GAAI,CAACK,CAAAA,CAAS,GACZ,OAAA,MAAMD,CAAAA,EAAa,CACZ,IAAA,CAGT,IAAME,CAAAA,CAAgC,MAAMD,CAAAA,CAAS,IAAA,EAAK,CAEpDE,CAAAA,CAA2B,CAC/B,GAAGP,CAAAA,CACH,YAAA,CAAcM,CAAAA,CAAK,aACnB,aAAA,CAAeA,CAAAA,CAAK,aAAA,CACpB,UAAA,CAAYA,CAAAA,CAAK,UAAA,CAAa,GAAA,CAC9B,SAAA,CAAW,KAAK,GAAA,EAAI,CACpB,kBAAA,CAAoBJ,CAAAA,CACpB,IAAA,CAAM,CACJ,EAAA,CAAII,CAAAA,CAAK,KAAK,EAAA,CACd,KAAA,CAAOA,CAAAA,CAAK,IAAA,CAAK,KAAA,CACjB,QAAA,CAAWA,CAAAA,CAAK,IAAA,CAAK,eAAe,QAAA,EAAuBA,CAAAA,CAAK,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,GAAK,MAAA,CAC5F,IAAA,CAAM,MACR,CACF,CAAA,CACA,OAAA,MAAME,CAAAA,CAAYD,CAAU,EACrBA,CACT,CAAA,KAAQ,CACN,OAAA,MAAMH,CAAAA,EAAa,CACZ,IACT,CAAA,OAAE,CACAL,CAAAA,GACF,CACF,CCrFA,SAASU,CAAAA,EAAyB,CAChC,OAAO,MAAA,CAASC,WAAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,KAAK,CAChD,CAEA,SAASC,CAAAA,CAAWC,CAAAA,CAA6D,CAC/E,IAAMC,CAAAA,CAAOH,WAAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA,CACxCI,EAAY,MAAA,CAAO,IAAA,CAAKD,CAAAA,CAAM,QAAQ,CAAA,CACtCE,CAAAA,CAAW,MAAA,CAAO,MAAA,CAAO,CAACD,CAAAA,CAAW,MAAA,CAAO,IAAA,CAAKF,CAAG,CAAC,CAAC,CAAA,CAE5D,OAAO,CAAE,IAAA,CADII,UAAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAOD,CAAQ,CAAA,CAAE,OAAO,KAAK,CAAA,CAChD,MAAA,CAAQH,CAAAA,CAAI,KAAA,CAAM,CAAA,CAAG,CAAC,CAAA,CAAG,KAAAC,CAAK,CAC/C,CAEA,eAAsBI,CAAAA,CAAoBC,CAAAA,CAAeC,CAAAA,CAAyC,CAChG,IAAMd,CAAAA,CAAW,MAAM,KAAA,CAAM,CAAA,EAAGtB,CAAY,CAAA,kCAAA,CAAA,CAAsC,CAChF,OAAQ,MAAA,CACR,OAAA,CAAS,CACP,cAAA,CAAgB,kBAAA,CAChB,MAAA,CAAUC,CAAAA,EACZ,EACA,IAAA,CAAM,IAAA,CAAK,SAAA,CAAU,CAAE,KAAA,CAAAkC,CAAAA,CAAO,QAAA,CAAAC,CAAS,CAAC,CAC1C,CAAC,CAAA,CAED,GAAI,CAACd,CAAAA,CAAS,EAAA,CAAI,CAChB,IAAMe,CAAAA,CAAO,MAAMf,CAAAA,CAAS,IAAA,EAAK,CACjC,MAAM,IAAI,KAAA,CAAMe,GAAQ,CAAA,4BAAA,EAA+Bf,CAAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAC3E,CAEA,IAAMC,CAAAA,CAA6B,MAAMD,CAAAA,CAAS,IAAA,EAAK,CACjDH,CAAAA,CAAcC,CAAAA,EAAyB,CAEvCkB,CAAAA,CAASZ,CAAAA,GACT,CAAE,IAAA,CAAAa,CAAAA,CAAM,MAAA,CAAAC,CAAAA,CAAQ,IAAA,CAAAV,CAAK,CAAA,CAAIF,CAAAA,CAAWU,CAAM,CAAA,CAE1CG,CAAAA,CAAoB,MAAM,KAAA,CAAM,CAAA,EAAGzC,CAAY,oBAAqB,CACxE,MAAA,CAAQ,MAAA,CACR,OAAA,CAAS,CACP,cAAA,CAAgB,kBAAA,CAChB,MAAA,CAAUC,GAAW,CACrB,aAAA,CAAiB,CAAA,OAAA,EAAUsB,CAAAA,CAAK,YAAY,CAAA,CAAA,CAC5C,MAAA,CAAU,gBACZ,EACA,IAAA,CAAM,IAAA,CAAK,SAAA,CAAU,CACnB,OAAA,CAASA,CAAAA,CAAK,IAAA,CAAK,EAAA,CACnB,IAAA,CAAM,gBAAA,CACN,QAAA,CAAUgB,CAAAA,CACV,UAAA,CAAYC,CAAAA,CACZ,QAAA,CAAUV,CAAAA,CACV,OAAQ,CAAC,KAAK,CAAA,CACd,SAAA,CAAW,IACb,CAAC,CACH,CAAC,EAED,GAAI,CAACW,CAAAA,CAAkB,EAAA,CAAI,CACzB,IAAMJ,CAAAA,CAAO,MAAMI,EAAkB,IAAA,EAAK,CAC1C,OAAA,CAAQ,KAAA,CAAM,0BAAA,CAA4BJ,CAAI,EAChD,CAEA,IAAMpB,CAAAA,CAAwB,CAC5B,UAAA,CAAYM,CAAAA,CAAK,IAAA,CAAK,EAAA,CAAK,GAAA,CAAM,KAAK,GAAA,EAAI,CAC1C,YAAA,CAAcA,CAAAA,CAAK,YAAA,CACnB,aAAA,CAAeA,CAAAA,CAAK,aAAA,CACpB,iBAAkB,EAAA,CAClB,kBAAA,CAAoBJ,CAAAA,CACpB,SAAA,CAAW,IAAA,CAAK,GAAA,EAAI,CACpB,UAAA,CAAYI,EAAK,UAAA,CAAa,GAAA,CAC9B,IAAA,CAAM,CACJ,EAAA,CAAIA,CAAAA,CAAK,IAAA,CAAK,EAAA,CACd,MAAOA,CAAAA,CAAK,IAAA,CAAK,KAAA,CACjB,QAAA,CAAWA,CAAAA,CAAK,IAAA,CAAK,aAAA,EAAe,QAAA,EAAuBA,EAAK,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAK,MAAA,CAC5F,KAAM,MACR,CAAA,CACA,OAAA,CAASe,CACX,CAAA,CAEA,OAAA,MAAMb,CAAAA,CAAYR,CAAO,EAClBA,CACT","file":"index.js","sourcesContent":["import { anonKey as sessionAnonKey } from './oauth-session.js'\n\nexport const SUPABASE_URL = 'https://aouqcwbdoyrccjcrhzzi.supabase.co'\n\nexport function getAnonKey(): string {\n  return sessionAnonKey || process.env.SQUIDCLOUD_ANON_KEY || ''\n}\n\nexport { SUPABASE_URL as SUPABASE_URL_RAW }\n","import fs from 'node:fs'\nimport path from 'node:path'\nimport os from 'node:os'\nimport { SquidSession } from '../crypto/ssp.js'\nimport { computeDeviceFingerprint } from './fingerprint.js'\nimport { loadSession, saveSession, clearSession } from './session.js'\nimport { SUPABASE_URL, getAnonKey } from './constants.js'\n\nconst LOCK_FILE = path.join(os.homedir(), '.squidcloud', '.refresh.lock')\n\nfunction ensureLockDir(): void {\n  const dir = path.dirname(LOCK_FILE)\n  if (!fs.existsSync(dir)) {\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 })\n  }\n}\n\nasync function acquireLock(): Promise<() => void> {\n  ensureLockDir()\n  let acquired = false\n  let attempts = 0\n  while (!acquired && attempts < 50) {\n    try {\n      const fd = fs.openSync(LOCK_FILE, 'wx')\n      fs.writeSync(fd, String(process.pid))\n      fs.closeSync(fd)\n      acquired = true\n    } catch {\n      const stat = fs.statSync(LOCK_FILE)\n      const age = Date.now() - stat.mtimeMs\n      if (age > 10000) {\n        try { fs.unlinkSync(LOCK_FILE) } catch {}\n      }\n      await new Promise(r => setTimeout(r, 100))\n      attempts++\n    }\n  }\n  return () => {\n    try { fs.unlinkSync(LOCK_FILE) } catch {}\n  }\n}\n\ninterface SupabaseRefreshResponse {\n  access_token: string\n  token_type: string\n  expires_in: number\n  expires_at: number\n  refresh_token: string\n  user: {\n    id: string\n    email: string\n    user_metadata: Record<string, unknown>\n  }\n}\n\nexport async function refreshAccessToken(): Promise<SquidSession | null> {\n  const release = await acquireLock()\n  try {\n    const session = await loadSession()\n    if (!session) return null\n\n    const fingerprint = computeDeviceFingerprint()\n    if (session.device_fingerprint !== fingerprint) {\n      await clearSession()\n      return null\n    }\n\n    const response = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=refresh_token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        'apikey': getAnonKey(),\n      },\n      body: JSON.stringify({ refresh_token: session.refresh_token }),\n    })\n\n    if (!response.ok) {\n      await clearSession()\n      return null\n    }\n\n    const data: SupabaseRefreshResponse = await response.json()\n\n    const newSession: SquidSession = {\n      ...session,\n      access_token: data.access_token,\n      refresh_token: data.refresh_token,\n      expires_at: data.expires_at * 1000,\n      issued_at: Date.now(),\n      device_fingerprint: fingerprint,\n      user: {\n        id: data.user.id,\n        email: data.user.email,\n        username: (data.user.user_metadata?.username as string) || data.user.email.split('@')[0] || 'user',\n        plan: 'free',\n      },\n    }\n    await saveSession(newSession)\n    return newSession\n  } catch {\n    await clearSession()\n    return null\n  } finally {\n    release()\n  }\n}\n","import { createHash, randomBytes } from 'node:crypto'\nimport { SquidSession } from '../crypto/ssp.js'\nimport { saveSession } from './session.js'\nimport { computeDeviceFingerprint } from './fingerprint.js'\nimport { SUPABASE_URL, getAnonKey } from './constants.js'\n\ninterface SupabaseAuthResponse {\n  access_token: string\n  token_type: string\n  expires_in: number\n  expires_at: number\n  refresh_token: string\n  user: {\n    id: string\n    email: string\n    user_metadata: Record<string, unknown>\n    aud: string\n  }\n}\n\nfunction generateApiKey(): string {\n  return 'sqc_' + randomBytes(32).toString('hex')\n}\n\nfunction hashApiKey(key: string): { hash: string; prefix: string; salt: string } {\n  const salt = randomBytes(16).toString('base64')\n  const saltBytes = Buffer.from(salt, 'base64')\n  const combined = Buffer.concat([saltBytes, Buffer.from(key)])\n  const hash = createHash('sha256').update(combined).digest('hex')\n  return { hash, prefix: key.slice(0, 8), salt }\n}\n\nexport async function performSSPHandshake(email: string, password: string): Promise<SquidSession> {\n  const response = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=password`, {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/json',\n      'apikey': getAnonKey(),\n    },\n    body: JSON.stringify({ email, password }),\n  })\n\n  if (!response.ok) {\n    const text = await response.text()\n    throw new Error(text || `Authentication failed (HTTP ${response.status})`)\n  }\n\n  const data: SupabaseAuthResponse = await response.json()\n  const fingerprint = computeDeviceFingerprint()\n\n  const apiKey = generateApiKey()\n  const { hash, prefix, salt } = hashApiKey(apiKey)\n\n  const createKeyResponse = await fetch(`${SUPABASE_URL}/rest/v1/api_keys`, {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/json',\n      'apikey': getAnonKey(),\n      'Authorization': `Bearer ${data.access_token}`,\n      'Prefer': 'return=minimal',\n    },\n    body: JSON.stringify({\n      user_id: data.user.id,\n      name: 'squidcloud-cli',\n      key_hash: hash,\n      key_prefix: prefix,\n      key_salt: salt,\n      scopes: ['all'],\n      is_active: true,\n    }),\n  })\n\n  if (!createKeyResponse.ok) {\n    const text = await createKeyResponse.text()\n    console.error('API key creation failed:', text)\n  }\n\n  const session: SquidSession = {\n    session_id: data.user.id + '-' + Date.now(),\n    access_token: data.access_token,\n    refresh_token: data.refresh_token,\n    refresh_token_id: '',\n    device_fingerprint: fingerprint,\n    issued_at: Date.now(),\n    expires_at: data.expires_at * 1000,\n    user: {\n      id: data.user.id,\n      email: data.user.email,\n      username: (data.user.user_metadata?.username as string) || data.user.email.split('@')[0] || 'user',\n      plan: 'free',\n    },\n    api_key: apiKey,\n  }\n\n  await saveSession(session)\n  return session\n}\n"]}

package/dist/lib/auth/keychain.js

@@ -0,0 +1,56 @@
+import os from 'node:os';
+import path from 'node:path';
+import fs from 'node:fs';
+import { randomBytes } from '@noble/hashes/utils.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { hkdf } from '@noble/hashes/hkdf.js';
+import { gcm } from '@noble/ciphers/aes.js';
+import { bytesToHex, hexToBytes } from '../crypto/ssp.js';
+import { computeDeviceFingerprint } from './fingerprint.js';
+const FALLBACK_DIR = path.join(os.homedir(), '.squidcloud');
+const FALLBACK_FILE = path.join(FALLBACK_DIR, '.session');
+function getFallbackKey() {
+    const fingerprint = computeDeviceFingerprint();
+    const ikm = new TextEncoder().encode(fingerprint);
+    return hkdf(sha256, ikm, new Uint8Array(32), new TextEncoder().encode('squidcloud-fallback-v1'), 32);
+}
+export async function storeSession(sessionJson) {
+    const key = getFallbackKey();
+    const iv = randomBytes(12);
+    const plaintext = new TextEncoder().encode(sessionJson);
+    const aes = gcm(key, iv);
+    const encrypted = aes.encrypt(plaintext);
+    if (!fs.existsSync(FALLBACK_DIR)) {
+        fs.mkdirSync(FALLBACK_DIR, { recursive: true, mode: 0o700 });
+    }
+    const payload = {
+        iv: bytesToHex(iv),
+        data: bytesToHex(encrypted),
+    };
+    fs.writeFileSync(FALLBACK_FILE, JSON.stringify(payload), { mode: 0o600, encoding: 'utf-8' });
+}
+export async function getSession() {
+    try {
+        if (!fs.existsSync(FALLBACK_FILE))
+            return null;
+        const raw = fs.readFileSync(FALLBACK_FILE, 'utf-8');
+        const { iv, data } = JSON.parse(raw);
+        const key = getFallbackKey();
+        const aes = gcm(key, hexToBytes(iv));
+        const decrypted = aes.decrypt(hexToBytes(data));
+        return new TextDecoder().decode(decrypted);
+    }
+    catch {
+        return null;
+    }
+}
+export async function deleteSession() {
+    try {
+        if (fs.existsSync(FALLBACK_FILE)) {
+            fs.unlinkSync(FALLBACK_FILE);
+        }
+    }
+    catch {
+        // ignore
+    }
+}

package/dist/lib/auth/oauth-session.js

@@ -0,0 +1,89 @@
+import os from 'node:os';
+import fs from 'node:fs';
+import path from 'node:path';
+export let authToken = null;
+export let userEmail = null;
+export let tokenExpiresAt = null;
+export let anonKey = null;
+export let sbToken = null;
+export let sbTokenExpiresAt = null;
+export let supaClient = null;
+const CREDENTIALS_PATH = path.join(os.homedir(), '.squidcloud', 'credentials');
+export function setAuthState(token, email, expiresAt, sessionAnonKey) {
+    authToken = token;
+    userEmail = email;
+    tokenExpiresAt = expiresAt;
+    if (sessionAnonKey !== undefined) {
+        anonKey = sessionAnonKey;
+    }
+}
+export function setSupaClient(client) {
+    supaClient = client;
+}
+function readCredentials() {
+    try {
+        if (!fs.existsSync(CREDENTIALS_PATH))
+            return null;
+        const raw = JSON.parse(fs.readFileSync(CREDENTIALS_PATH, 'utf-8'));
+        if (raw.token && raw.expires_at)
+            return raw;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export function loadSbToken() {
+    const creds = readCredentials();
+    if (creds?.sb_token && creds.sb_expires_at && creds.sb_expires_at * 1000 > Date.now()) {
+        sbToken = creds.sb_token;
+        sbTokenExpiresAt = creds.sb_expires_at * 1000;
+    }
+    else {
+        sbToken = null;
+        sbTokenExpiresAt = null;
+    }
+}
+export async function loadOAuthSession() {
+    const creds = readCredentials();
+    if (!creds) {
+        setAuthState(null, null, null, null);
+        return;
+    }
+    const now = Date.now();
+    if (creds.expires_at * 1000 > now) {
+        setAuthState(creds.token, creds.email, creds.expires_at * 1000, creds.anon_key || null);
+    }
+    else {
+        try {
+            fs.rmSync(CREDENTIALS_PATH, { force: true });
+        }
+        catch { }
+        setAuthState(null, null, null, null);
+    }
+}
+export async function clearOAuthSession() {
+    try {
+        fs.rmSync(CREDENTIALS_PATH, { force: true });
+    }
+    catch { }
+    setAuthState(null, null, null, null);
+}
+export function getCredentialsPath() {
+    return CREDENTIALS_PATH;
+}
+export function writeSbTokenFromUrl(jwt) {
+    // Supabase JWTs live ~1h; persist with a conservative 55-minute shelf life.
+    const exp = Math.floor((Date.now() + 55 * 60 * 1000) / 1000);
+    try {
+        const creds = readCredentials() ?? { token: '', email: 'unknown', expires_at: 0 };
+        writeCredentials({ ...creds, sb_token: jwt, sb_expires_at: exp });
+    }
+    catch { }
+    sbToken = jwt;
+    sbTokenExpiresAt = exp * 1000;
+}
+export function writeCredentials(creds) {
+    fs.mkdirSync(path.dirname(CREDENTIALS_PATH), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(CREDENTIALS_PATH, JSON.stringify(creds), { mode: 0o600 });
+}

package/dist/lib/auth/refresh.js

@@ -0,0 +1,93 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { computeDeviceFingerprint } from './fingerprint.js';
+import { loadSession, saveSession, clearSession } from './session.js';
+import { SUPABASE_URL, getAnonKey } from './constants.js';
+const LOCK_FILE = path.join(os.homedir(), '.squidcloud', '.refresh.lock');
+function ensureLockDir() {
+    const dir = path.dirname(LOCK_FILE);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+}
+async function acquireLock() {
+    ensureLockDir();
+    let acquired = false;
+    let attempts = 0;
+    while (!acquired && attempts < 50) {
+        try {
+            const fd = fs.openSync(LOCK_FILE, 'wx');
+            fs.writeSync(fd, String(process.pid));
+            fs.closeSync(fd);
+            acquired = true;
+        }
+        catch {
+            const stat = fs.statSync(LOCK_FILE);
+            const age = Date.now() - stat.mtimeMs;
+            if (age > 10000) {
+                try {
+                    fs.unlinkSync(LOCK_FILE);
+                }
+                catch { }
+            }
+            await new Promise(r => setTimeout(r, 100));
+            attempts++;
+        }
+    }
+    return () => {
+        try {
+            fs.unlinkSync(LOCK_FILE);
+        }
+        catch { }
+    };
+}
+export async function refreshAccessToken() {
+    const release = await acquireLock();
+    try {
+        const session = await loadSession();
+        if (!session)
+            return null;
+        const fingerprint = computeDeviceFingerprint();
+        if (session.device_fingerprint !== fingerprint) {
+            await clearSession();
+            return null;
+        }
+        const response = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=refresh_token`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'apikey': getAnonKey(),
+            },
+            body: JSON.stringify({ refresh_token: session.refresh_token }),
+        });
+        if (!response.ok) {
+            await clearSession();
+            return null;
+        }
+        const data = await response.json();
+        const newSession = {
+            ...session,
+            access_token: data.access_token,
+            refresh_token: data.refresh_token,
+            expires_at: data.expires_at * 1000,
+            issued_at: Date.now(),
+            device_fingerprint: fingerprint,
+            user: {
+                id: data.user.id,
+                email: data.user.email,
+                username: data.user.user_metadata?.username || data.user.email.split('@')[0] || 'user',
+                plan: 'free',
+            },
+        };
+        await saveSession(newSession);
+        return newSession;
+    }
+    catch {
+        await clearSession();
+        return null;
+    }
+    finally {
+        release();
+    }
+}

package/dist/lib/auth/session.js

@@ -0,0 +1,34 @@
+import { storeSession, getSession, deleteSession } from './keychain.js';
+export async function loadSession() {
+    try {
+        const raw = await getSession();
+        if (!raw)
+            return null;
+        const session = JSON.parse(raw);
+        if (!session.session_id || !session.access_token) {
+            await deleteSession();
+            return null;
+        }
+        return session;
+    }
+    catch {
+        await deleteSession();
+        return null;
+    }
+}
+export async function saveSession(session) {
+    await storeSession(JSON.stringify(session));
+}
+export async function clearSession() {
+    await deleteSession();
+}
+export function isSessionExpired(session) {
+    return Date.now() >= session.expires_at;
+}
+export function shouldRefreshToken(session) {
+    const twoMinutes = 2 * 60 * 1000;
+    return (session.expires_at - Date.now()) <= twoMinutes;
+}
+export function getTimeUntilExpiry(session) {
+    return session.expires_at - Date.now();
+}

package/dist/lib/auth/ssp-handshake.js

@@ -0,0 +1,72 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { saveSession } from './session.js';
+import { computeDeviceFingerprint } from './fingerprint.js';
+import { SUPABASE_URL, getAnonKey } from './constants.js';
+function generateApiKey() {
+    return 'sqc_' + randomBytes(32).toString('hex');
+}
+function hashApiKey(key) {
+    const salt = randomBytes(16).toString('base64');
+    const saltBytes = Buffer.from(salt, 'base64');
+    const combined = Buffer.concat([saltBytes, Buffer.from(key)]);
+    const hash = createHash('sha256').update(combined).digest('hex');
+    return { hash, prefix: key.slice(0, 8), salt };
+}
+export async function performSSPHandshake(email, password) {
+    const response = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=password`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'apikey': getAnonKey(),
+        },
+        body: JSON.stringify({ email, password }),
+    });
+    if (!response.ok) {
+        const text = await response.text();
+        throw new Error(text || `Authentication failed (HTTP ${response.status})`);
+    }
+    const data = await response.json();
+    const fingerprint = computeDeviceFingerprint();
+    const apiKey = generateApiKey();
+    const { hash, prefix, salt } = hashApiKey(apiKey);
+    const createKeyResponse = await fetch(`${SUPABASE_URL}/rest/v1/api_keys`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'apikey': getAnonKey(),
+            'Authorization': `Bearer ${data.access_token}`,
+            'Prefer': 'return=minimal',
+        },
+        body: JSON.stringify({
+            user_id: data.user.id,
+            name: 'squidcloud-cli',
+            key_hash: hash,
+            key_prefix: prefix,
+            key_salt: salt,
+            scopes: ['all'],
+            is_active: true,
+        }),
+    });
+    if (!createKeyResponse.ok) {
+        const text = await createKeyResponse.text();
+        console.error('API key creation failed:', text);
+    }
+    const session = {
+        session_id: data.user.id + '-' + Date.now(),
+        access_token: data.access_token,
+        refresh_token: data.refresh_token,
+        refresh_token_id: '',
+        device_fingerprint: fingerprint,
+        issued_at: Date.now(),
+        expires_at: data.expires_at * 1000,
+        user: {
+            id: data.user.id,
+            email: data.user.email,
+            username: data.user.user_metadata?.username || data.user.email.split('@')[0] || 'user',
+            plan: 'free',
+        },
+        api_key: apiKey,
+    };
+    await saveSession(session);
+    return session;
+}