yesilcam-studios 0.1.0 → 0.3.0

package/README.md

@@ -1,18 +1,37 @@
 # yesilcam-studios
 
-Yeşilçam Studios from your terminal (`yesilcam`) and from Claude (`yesilcam-mcp`). Same account, same token wallet as https://yesilcamstudios.com/app/.
+Every Yeşilçam Studios studio from your terminal (`yesilcam`) and from AI assistants over MCP (`yesilcam-mcp`): Image Studio, Film Studio, Animation Studio (25 styles, Ink Landscape, Inkmation, Custom), Cinema Studio, Design Studio, Website Studio, Website Promo, Assemble / Disassemble, Fashion Try-On, Maket and AI Influencer Studio (long videos, automations, Discover). Same account and token wallet as https://yesilcamstudios.com/app/.
 
 ```bash
 npm install -g yesilcam-studios
-yesilcam login                 # email + password, token saved to ~/.config/yesilcam/config.json (0600)
-yesilcam balance
-yesilcam image "a lighthouse at dusk, 35mm film" --tier standard --out lighthouse.png
-yesilcam video --from 1234 --duration 5 --wait
-yesilcam tryon --garment 88 --person 77 --out look.png
-yesilcam maket analyze plan.dxf      # local, free
-yesilcam maket save plan.dxf --title "Villa"
-yesilcam pricing
+yesilcam login                  # paste an API key from https://yesilcamstudios.com/app/account/developer
+yesilcam account show
+yesilcam image "a lighthouse at dusk, 35mm film" --tier draft --quote          # price only
+yesilcam image "a lighthouse at dusk, 35mm film" --tier draft --yes --out lighthouse.png
+yesilcam influencer video --mode talk --influencer-id 70 --text "Hello!" --yes --wait
+yesilcam longvideo plan --influencer-id 70 --topic "3 tips for phone photos" --seconds 60 --yes --wait
+yesilcam maket analyze plan.dxf                                               # local, free
+yesilcam --help        # all studios; yesilcam <studio> --help for actions
 ```
 
-Claude (MCP): `yesilcam mcp` prints the config snippet. Claude Code: `claude mcp add yesilcam -e YESILCAM_TOKEN=<token> -- yesilcam-mcp`.
-Get a token with `yesilcam login --json`, or set `YESILCAM_TOKEN` in the environment.
+Anything that spends tokens shows a quote first: interactive prompt, `--yes` to approve in scripts, `--max-tokens` as a ceiling, `--quote` to only price. `--json` for machine output, `--wait` / `--out` for long jobs. Exit codes: 3 quote not approved, 2 not signed in.
+
+## MCP (Claude Code, Claude Desktop, Cursor, VS Code, Windsurf …)
+
+```bash
+claude mcp add yesilcam -- yesilcam-mcp
+```
+
+```json
+{ "mcpServers": { "yesilcam": { "command": "yesilcam-mcp", "args": [] } } }
+```
+
+No secret in the config: the server uses the key saved by `yesilcam login` (or `YESILCAM_API_KEY`). `--studios image,film,influencer` loads fewer tools, `--read-only` only reading tools. Tools that spend tokens return a quote and charge nothing until called again with `confirm=true` after the user approves. `yesilcam mcp` prints the snippets.
+
+## Security
+
+- API keys: read-only or read-and-create, optional expiry, revocable in the app; they cannot delete the account, change password/email, pay, create keys or connect social accounts. Only a hash is stored on the server.
+- Credentials live in `~/.config/yesilcam/config.json` (0600) and are never printed. `yesilcam logout` removes them.
+- Legacy sign-in with email and password: `yesilcam login --password`.
+
+Docs: https://yesilcamstudios.com/developers

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yesilcam-studios",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Yeşilçam Studios CLI and MCP server: AI film, fashion try-on and Maket from your terminal or from Claude.",
   "license": "UNLICENSED",
   "type": "module",

package/src/cli.js

@@ -1,120 +1,212 @@
-import { Command } from 'commander'
-import { readFileSync, writeFileSync } from 'node:fs'
-import { basename, extname } from 'node:path'
-import { createInterface } from 'node:readline/promises'
-import { stdin as input, stdout as output } from 'node:process'
-import { login, makeClient, ApiError } from './client.js'
-import { readConfig, writeConfig, clearConfig, getUserToken, CONFIG_FILE } from './config.js'
-import { imageJob, videoJob, tryonJob, waitForJob, describeJob, TIERS, ASPECTS } from './jobs.js'
-import { analyzePlanText } from './maket/analyze.js'
-import { SITE_URL } from './constants.js'
+// yesilcam CLI: `yesilcam <stüdyo> <eylem>`; komutlar işlem kataloğundan türetilir (MCP araçlarıyla birebir).
+import { Command, Option } from 'commander'
+import { readFileSync } from 'node:fs'
+import { createInterface } from 'node:readline'
+import { z } from 'zod'
+import { login, makeClient, exchangeKey, isApiKey, ApiError, friendlyError } from './client.js'
+import { readConfig, writeConfig, clearConfig, getCredentials, permissionWarning, configFile } from './config.js'
+import { OPS } from './registry.js'
+import { execute } from './run.js'
+import { checkOnce } from './wait.js'
+import { VERSION, KEYS_URL, SITE_URL } from './constants.js'
 
-const out = (program, data, human) => { if (program.opts().json) console.log(JSON.stringify(data, null, 2)); else console.log(human ?? JSON.stringify(data, null, 2)) }
-const fmtInt = (n) => Number(n).toLocaleString('en-US')
-const client = () => { const t = getUserToken(); if (!t) { console.error('Not logged in. Run: yesilcam login'); process.exit(2) } return makeClient(t) }
-const MIME = { '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.webp': 'image/webp', '.mp4': 'video/mp4', '.mp3': 'audio/mpeg', '.wav': 'audio/wav' }
+export const GROUPS = {
+  account: 'Account, plan, balance, prices', jobs: 'Generation jobs', library: 'Your library: upload, download, share', wait: 'Wait for any job or project',
+  image: 'Image Studio', video: 'Film Studio videos (text, image, restyle, characters, lip sync)', characters: 'Characters and Character Bible', voices: 'Voices', prompt: 'Prompt help from Sam',
+  film: 'Film Studio: Story to Film and Flow', animation: 'Animation Studio (25 styles, Ink Landscape, Custom)', inkmation: 'Inkmation', cinema: 'Cinema Studio (video editor)',
+  design: 'Design Studio', website: 'Website Studio', promo: 'Website Promo', assemble: 'Assemble / Disassemble product videos', fashion: 'Fashion Try-On', maket: 'Maket (floor plan to 3D)',
+  influencer: 'AI Influencer Studio', discover: 'Discover ready-made influencers', longvideo: 'Long videos (15 s to 10 min)', automation: 'Influencer automations', social: 'Social media publishing',
+}
+const DEFAULT_ACTION = { wait: 'until', image: 'create', video: 'create', characters: 'list', jobs: 'list', library: 'list', voices: 'list' }
+
+// ── zod alan çözümleme
+function unwrap(s) { let t = s; let optional = false; let desc = s.description; while (['optional', 'default', 'nullable'].includes(t?._zod?.def?.type)) { optional = true; t = t._zod.def.innerType; desc = desc || t.description } return { t, optional, desc: desc || t.description } }
+export function fieldInfo(schema) {
+  const { t, optional, desc } = unwrap(schema)
+  const type = t._zod.def.type
+  const info = { optional, desc, type }
+  if (type === 'enum') info.choices = Object.values(t._zod.def.entries)
+  if (type === 'union') { const opts = t._zod.def.options.map((o) => o._zod.def); info.literals = opts.every((o) => o.type === 'literal') ? opts.flatMap((o) => o.values) : null; info.hasNumber = opts.some((o) => o.type === 'number'); info.hasString = opts.some((o) => o.type === 'string'); info.hasLiteral = opts.some((o) => o.type === 'literal'); info.numeric = opts.some((o) => o.type === 'number') || (info.literals || []).every((v) => typeof v === 'number') }
+  if (type === 'array') { const el = t._zod.def.element._zod.def; info.element = el.type === 'union' ? 'id' : el.type; if (el.type === 'enum') info.choices = Object.values(el.entries) }
+  return info
+}
+const kebab = (s) => s.replace(/_/g, '-')
+const camel = (s) => s.replace(/_([a-z])/g, (_, c) => c.toUpperCase())
+
+/** Komut satırı değeri → alan türü. JSON alanlar: '{...}' / '[...]' ya da @dosya.json */
+export function coerce(info, raw) {
+  if (raw === undefined) return undefined
+  const json = (v) => { const s = String(v); const txt = s.startsWith('@') ? readFileSync(s.slice(1), 'utf8') : s; try { return JSON.parse(txt) } catch { throw new Error(`invalid JSON: ${s.slice(0, 40)}`) } }
+  switch (info.type) {
+    case 'number': return Number(raw)
+    case 'boolean': return Boolean(raw)
+    case 'union': { const isNum = /^-?\d+(\.\d+)?$/.test(String(raw)); if (!isNum) return raw; if (info.literals) return info.literals.includes(Number(raw)) ? Number(raw) : raw; return info.hasNumber && !info.hasString ? Number(raw) : (info.hasNumber && info.hasLiteral ? Number(raw) : raw) }
+    case 'array':
+      if (['object', 'record'].includes(info.element) || String(raw).trim().startsWith('[') || String(raw).startsWith('@')) return json(raw)
+      return String(raw).split(',').map((x) => x.trim()).filter(Boolean).map((x) => (info.element === 'number' ? Number(x) : x))
+    case 'object': case 'record': return json(raw)
+    default: return raw
+  }
+}
 
-async function download(url, file) {
-  const res = await fetch(url); if (!res.ok) throw new Error(`download failed (${res.status})`)
-  writeFileSync(file, Buffer.from(await res.arrayBuffer())); return file
+// ── çıktı
+const fmt = (n) => (typeof n === 'number' ? n.toLocaleString('en-US') : n)
+const MONEY = /(token|balance|total|price|cost|charged|need|spent|cap|amount|per_run|per_month)/i
+const fmtKV = (k, v) => (typeof v === 'number' && MONEY.test(k) ? fmt(v) : v)
+const LINKY = /(url|thumb|poster|cover|preview|avatar|image)$/i
+export function human(v, indent = '') {
+  if (v == null) return `${indent}-`
+  if (Array.isArray(v)) {
+    if (!v.length) return `${indent}(none)`
+    return v.map((x) => (x && typeof x === 'object' ? `${indent}- ${Object.entries(x).filter(([k, y]) => y != null && typeof y !== 'object' && !LINKY.test(k)).slice(0, 7).map(([k, y]) => `${k}: ${fmtKV(k, y)}`).join('  ')}` : `${indent}- ${x}`)).join('\n')
+  }
+  if (typeof v === 'object') return Object.entries(v).filter(([, y]) => y != null).map(([k, y]) => (y && typeof y === 'object' ? `${indent}${k}:\n${human(y, indent + '  ')}` : `${indent}${k}: ${fmtKV(k, y)}`)).join('\n')
+  return `${indent}${v}`
+}
+export function quoteText(q) {
+  const lines = (q.items || []).map((i) => `  ${String(i.item).padEnd(44)} ${fmt(i.tokens).padStart(12)}`)
+  return [`Quote${q.approximate ? ' (estimate)' : ''}:`, ...lines, `  ${'Total'.padEnd(44)} ${fmt(q.total).padStart(12)} tokens`, q.balance != null ? `  Balance: ${fmt(q.balance)} tokens` : null, q.notes ? `  ${q.notes}` : null].filter(Boolean).join('\n')
 }
 
-async function runJob(program, c, payload, opts) {
-  const r = await c.createJob(payload)
-  const jobId = r?.job_id || r?.id || r?.job?.id
-  if (!jobId) { out(program, r); return }
-  if (!opts.wait) { out(program, { job_id: String(jobId), status: 'queued' }, `Job ${jobId} queued. Check: yesilcam jobs status ${jobId} --wait`); return }
-  const job = await waitForJob(c, jobId, { onTick: (j) => { if (!program.opts().json && j) process.stderr.write(`\r${j.status}${j.render_progress ? ` ${j.render_progress}%` : ''}   `) } })
-  if (!program.opts().json) process.stderr.write('\n')
-  const d = describeJob(job)
-  if (opts.out && d?.result?.url) { await download(d.result.url, opts.out); d.saved = opts.out }
-  out(program, d, d.result ? `Done: ${d.result.url}${d.saved ? `\nSaved: ${d.saved}` : ''}` : `Job ${d.id}: ${d.status}${d.error ? ` (${d.error})` : ''}`)
+function ask(question, { hidden = false } = {}) {
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: process.stdin, output: process.stderr, terminal: true })
+    if (hidden) { rl._writeToOutput = (s) => { if (s.includes(question)) rl.output.write(s) } }
+    rl.question(question, (ans) => { rl.close(); if (hidden) process.stderr.write('\n'); resolve(ans) })
+  })
+}
+const readStdin = async () => { let d = ''; for await (const ch of process.stdin) d += ch; return d.trim() }
+
+export function getClient() {
+  const cred = getCredentials()
+  if (!cred) throw new ApiError('not_logged_in')
+  const w = permissionWarning(); if (w) process.stderr.write(`${w}\n`)
+  return makeClient(cred)
+}
+
+function progressLine(st) {
+  if (!process.stderr.isTTY || !st) return
+  const pct = st.progress != null ? ` ${st.progress}%` : ''
+  process.stderr.write(`\r${String(st.status || '').padEnd(12)}${pct}${st.stage ? ` · ${st.stage}` : ''}`.padEnd(70).slice(0, 78))
+}
+
+/** Bir işlemi commander komutuna bağlar. */
+export function attachOp(cmd, op, program) {
+  const entries = Object.entries(op.input)
+  const posList = op.positional ? [].concat(op.positional) : []
+  for (const p of posList) { const info = fieldInfo(op.input[p]); cmd.argument(info.optional ? `[${p}]` : `<${p}>`, info.desc || p) }
+  for (const [name, schema] of entries) {
+    if (posList.includes(name)) continue
+    const info = fieldInfo(schema)
+    const flag = `--${kebab(name)}`
+    const hint = [info.desc, info.choices ? `(${info.choices.join('|')})` : null, info.literals ? `(${info.literals.join('|')})` : null, ['object', 'record'].includes(info.type) || ['object', 'record'].includes(info.element) ? '(JSON or @file.json)' : null, info.type === 'array' && !['object', 'record'].includes(info.element) ? '(comma-separated)' : null].filter(Boolean).join(' ')
+    if (info.type === 'boolean') { cmd.option(flag, hint); cmd.addOption(new Option(`--no-${kebab(name)}`).hideHelp()) }
+    else cmd.option(`${flag} <value>`, `${hint}${info.optional ? '' : ' (required)'}`)
+  }
+  if (op.kind === 'spend') cmd.option('-y, --yes', 'approve the quoted token cost without asking').option('--max-tokens <n>', 'refuse if the quote is above this').option('--quote', 'only show the price')
+  if (op.wait) cmd.option('-w, --wait', 'wait for the result').option('-o, --out <path>', 'download the result to a file or folder (implies --wait)').option('--timeout <seconds>', 'max wait (default 900)')
+  cmd.action(async (...argv) => {
+    const opts = argv[argv.length - 2] || {}
+    const json = program.opts().json
+    const args = {}
+    posList.forEach((p, i) => { if (argv[i] !== undefined && i < argv.length - 2) args[p] = coerce(fieldInfo(op.input[p]), argv[i]) })
+    for (const [name, schema] of entries) {
+      if (posList.includes(name)) continue
+      const v = opts[camel(name)]
+      if (v !== undefined) args[name] = coerce(fieldInfo(schema), v)
+    }
+    const parsed = z.object(op.input).safeParse(args)
+    if (!parsed.success) { const i = parsed.error.issues[0]; throw new Error(`--${kebab(String(i.path[0] || ''))}: ${i.message}`) }
+    const shared = { max_tokens: opts.maxTokens != null ? Number(opts.maxTokens) : undefined, wait: Boolean(opts.wait || opts.out), save_to: opts.out, max_wait_seconds: opts.timeout ? Number(opts.timeout) : undefined }
+    const c = op.kind === 'local' ? null : getClient()
+    const askConfirm = async (q) => {
+      if (opts.quote) return false
+      if (!process.stdin.isTTY || json) { return false }
+      process.stderr.write(`${quoteText(q)}\n`)
+      const ans = await ask(`Spend about ${fmt(q.total)} tokens? [y/N] `)
+      return /^y(es)?$/i.test(String(ans).trim())
+    }
+    const r = await execute(op, c, { ...parsed.data, ...shared }, { confirmed: Boolean(opts.yes) && !opts.quote, askConfirm, onProgress: json ? undefined : progressLine })
+    if (process.stderr.isTTY && shared.wait && !json) process.stderr.write('\n')
+    if (r.status === 'quote') {
+      if (json) console.log(JSON.stringify({ status: 'quote', quote: r.quote }, null, 2))
+      else { console.log(quoteText(r.quote)); console.log(opts.quote ? 'Nothing was charged.' : 'Nothing was charged. Re-run with --yes to approve.') }
+      process.exitCode = opts.quote ? 0 : 3; return
+    }
+    if (r.status !== 'done') { if (json) console.log(JSON.stringify(r, null, 2)); else { if (r.quote) console.log(quoteText(r.quote)); console.log(r.message || r.quote?.notes || r.status) } process.exitCode = 4; return }
+    if (json) { console.log(JSON.stringify({ result: r.result, ...(r.final ? { final: r.final } : {}), ...(r.track ? { track: r.track } : {}) }, null, 2)); return }
+    console.log(human(r.result))
+    if (r.final) { console.log(`\n${human({ status: r.final.status, url: r.final.url, saved: r.final.saved, error: r.final.error, next: r.final.needs_action || r.final.hint })}`) }
+    else if (r.track) console.log(`\nTrack: yesilcam wait ${r.track.kind} ${r.track.id}  (or add --wait next time)`)
+  })
+  return cmd
 }
 
 export function buildProgram() {
   const program = new Command()
-  program.name('yesilcam').description('Yeşilçam Studios: AI film, fashion try-on and Maket from your terminal.').version('0.1.0')
-    .option('--json', 'machine-readable output')
+  program.name('yesilcam').description(`Yeşilçam Studios ${VERSION}: AI film, image, animation, design, website, fashion, Maket and AI Influencer studios from your terminal.\nPrices are shown before anything is charged. Docs: ${SITE_URL}/developers`)
+    .version(VERSION).option('--json', 'machine-readable JSON output').showHelpAfterError()
 
-  program.command('login').description('Sign in with your Yeşilçam Studios account')
-    .option('--email <email>').option('--password <password>').option('--token <userToken>', 'use an existing user token')
+  // ── giriş
+  program.command('login').description(`Sign in. Default: paste an API key (create one at ${KEYS_URL}). Stored in ${configFile()} (owner-only), never printed.`)
+    .option('--key-stdin', 'read the API key from stdin (CI)').option('--password', 'sign in with email + password instead (legacy session)').option('--email <email>')
     .action(async (o) => {
-      if (o.token) { writeConfig({ ...readConfig(), token: o.token }); out(program, { ok: true }, `Token saved to ${CONFIG_FILE}`); return }
-      let { email, password } = o
-      if (!email || !password) {
-        const rl = createInterface({ input, output })
-        email = email || await rl.question('Email: ')
-        password = password || await rl.question('Password: ')
-        rl.close()
+      const json = program.opts().json
+      if (o.password) {
+        const email = o.email || await ask('Email: ')
+        const pw = process.env.YESILCAM_PASSWORD || await ask('Password: ', { hidden: true })
+        const r = await login(String(email).trim(), pw)
+        writeConfig({ token: r.token, user: r.user, method: 'password' })
+        const msg = `Signed in as ${r.user.name} ${r.user.lastname} <${r.user.email}> (session saved to ${configFile()}).`
+        console.log(json ? JSON.stringify({ ok: true, user: r.user, method: 'password' }) : msg); return
       }
-      const r = await login(email.trim(), password)
-      writeConfig({ token: r.token, user: r.user })
-      out(program, { ok: true, user: r.user }, `Signed in as ${r.user.name} ${r.user.lastname} <${r.user.email}>. Token saved to ${CONFIG_FILE}`)
+      const key = (o.keyStdin ? await readStdin() : (process.env.YESILCAM_API_KEY || await ask(`API key (from ${KEYS_URL}): `, { hidden: true }))).trim()
+      if (!isApiKey(key)) throw new ApiError('api_key_invalid')
+      const s = await exchangeKey(key)
+      writeConfig({ apiKey: key, user: s.user, key: s.key, scopes: s.scopes, method: 'api_key' })
+      const msg = `Signed in as ${s.user.name} ${s.user.lastname} <${s.user.email}> with key "${s.key.name}" (${s.key.prefix}…, scopes: ${s.scopes.join(', ')}). Saved to ${configFile()}.`
+      console.log(json ? JSON.stringify({ ok: true, user: s.user, key: s.key, scopes: s.scopes, method: 'api_key' }) : msg)
     })
-  program.command('logout').description('Remove the saved token').action(() => { clearConfig(); out(program, { ok: true }, 'Signed out.') })
-  program.command('whoami').description('Account and plan').action(async () => { const r = await client().me(); out(program, r, `${r.name} ${r.lastname} · plan: ${r.subscriptionPackageType || 'social-hive'}`) })
-  program.command('balance').description('Token balance').action(async () => { const r = await client().balance(); out(program, r, `${fmtInt(r.balance)} tokens`) })
-  program.command('pricing').description('Production costs (tokens) and token packs').action(async () => {
-    const c = client(); const [ops, packs] = await Promise.all([c.modulePricing(), c.tokenPackages()])
-    const rows = ops.filter((r) => ['ai-studio', 'fashion-tryon'].includes(r.module_key) && String(r.status ?? '1') === '1').map((r) => ({ module: r.module_key, operation: r.operation_key, tokens: Number(r.base_cost_tokens), free_per_month: Number(r.monthly_free_limit || 0) })).sort((a, b) => a.tokens - b.tokens)
-    const pk = packs.map((p) => ({ id: p.id, title: p.title, tokens: Number(p.token_amount), bonus_percent: Number(p.bonus_percentage), usd: Number(p.price_usd), usd_without_plan: p.price_usd_standard != null ? Number(p.price_usd_standard) : null, try: Number(p.price_tr), try_without_plan: p.price_tr_standard != null ? Number(p.price_tr_standard) : null }))
-    out(program, { operations: rows, packs: pk }, [...rows.map((r) => `${r.module.padEnd(14)} ${r.operation.padEnd(24)} ${fmtInt(r.tokens).padStart(10)} tokens${r.free_per_month ? `  (${r.free_per_month} free/month)` : ''}`), '', ...pk.map((p) => `${p.title.padEnd(14)} ${fmtInt(p.tokens).padStart(10)} tokens  $${p.usd} with plan / $${p.usd_without_plan ?? p.usd} without${p.bonus_percent ? `  +${p.bonus_percent}% bonus` : ''}`)].join('\n'))
+  program.command('logout').description('Remove the saved credentials from this computer').action(() => {
+    const had = readConfig(); clearConfig()
+    console.log(program.opts().json ? JSON.stringify({ ok: true }) : `Signed out.${had.apiKey ? ` The API key still works until you revoke it at ${KEYS_URL}` : ''}`)
   })
+  program.command('mcp').description('Show how to connect the MCP server to Claude Code, Claude Desktop, Cursor and others').action(() => {
+    console.log(`Sign in once with "yesilcam login"; the MCP server reads the same credentials (no secret in the config below).
 
-  const assets = program.command('assets').description('Your library (images, videos)')
-  assets.command('list').option('--kind <kind>', 'image|video').option('--limit <n>', '', '40').action(async (o) => {
-    const r = await client().assets({ kind: o.kind, limit: Number(o.limit) })
-    const list = r?.assets || r?.items || r || []
-    out(program, list, list.map((a) => `${String(a.id).padEnd(8)} ${String(a.kind).padEnd(6)} ${a.label || ''}  ${a.spaces_url || ''}`).join('\n') || 'No assets.')
-  })
-  assets.command('upload <file>').option('--kind <kind>', 'image|video|audio').option('--label <label>').action(async (file, o) => {
-    const ext = extname(file).toLowerCase(); const mime = MIME[ext] || 'application/octet-stream'
-    const kind = o.kind || (mime.startsWith('video') ? 'video' : mime.startsWith('audio') ? 'audio' : 'image')
-    const b64 = `data:${mime};base64,${readFileSync(file).toString('base64')}`
-    const r = await client().uploadAsset(b64, kind, o.label || basename(file))
-    out(program, r, `Uploaded asset ${r?.asset_id || r?.id || ''} ${r?.url || r?.spaces_url || ''}`)
-  })
-
-  const jobs = program.command('jobs').description('Generation jobs')
-  jobs.command('list').option('--limit <n>', '', '20').action(async (o) => { const r = await client().jobs({ limit: Number(o.limit) }); const list = r?.jobs || []; out(program, list, list.map((j) => `${String(j.id).padEnd(8)} ${String(j.job_type).padEnd(16)} ${String(j.status).padEnd(11)} ${j.quality_tier || ''}`).join('\n') || 'No jobs.') })
-  jobs.command('status <id>').option('--wait').option('--out <file>').action(async (id, o) => {
-    const c = client(); const job = o.wait ? await waitForJob(c, id) : (await c.jobStatus(Number(id))).job
-    const d = describeJob(job); if (o.out && d?.result?.url) { await download(d.result.url, o.out); d.saved = o.out }
-    out(program, d, `${d.id} ${d.type} ${d.status}${d.result ? ` ${d.result.url}` : ''}${d.saved ? `\nSaved: ${d.saved}` : ''}`)
-  })
+Claude Code:
+  claude mcp add yesilcam -- yesilcam-mcp
 
-  program.command('image <prompt>').description('Generate an image (text2image)')
-    .option('--tier <tier>', TIERS.join('|'), 'draft').option('--aspect <ratio>', ASPECTS.join('|'), '16:9').option('--framing <f>', 'waist_up|waist_down|full_body')
-    .option('--wait', 'wait for the result').option('--out <file>', 'download result (implies --wait)')
-    .action(async (prompt, o) => runJob(program, client(), imageJob({ prompt, tier: o.tier, aspect: o.aspect, framing: o.framing }), { wait: o.wait || Boolean(o.out), out: o.out }))
-  program.command('video [prompt]').description('Generate a video (text2video, or image2video with --from)')
-    .option('--from <assetId>', 'source image asset id').option('--tier <tier>', TIERS.join('|'), 'draft').option('--aspect <ratio>', '', '16:9').option('--duration <s>').option('--resolution <r>', '480p|720p|1080p').option('--audio', 'generate audio')
-    .option('--wait').option('--out <file>')
-    .action(async (prompt = '', o) => runJob(program, client(), videoJob({ prompt, tier: o.tier, aspect: o.aspect, sourceAssetId: o.from, duration: o.duration, resolution: o.resolution, generateAudio: o.audio }), { wait: o.wait || Boolean(o.out), out: o.out }))
-  program.command('tryon').description('Fashion try-on: garment on a person or character')
-    .requiredOption('--garment <assetId>').option('--person <assetId>').option('--character <id>').option('--prompt <text>', 'style note').option('--wait').option('--out <file>')
-    .action(async (o) => { if (!o.person && !o.character) { console.error('--person <assetId> or --character <id> is required'); process.exit(2) } return runJob(program, client(), tryonJob({ garmentAssetId: o.garment, personAssetId: o.person, characterId: o.character, prompt: o.prompt }), { wait: o.wait || Boolean(o.out), out: o.out }) })
-  program.command('characters').description('List your characters').action(async () => { const r = await client().characters(); const list = r?.characters || r || []; out(program, list, list.map((c) => `${String(c.id).padEnd(8)} ${c.name || ''}`).join('\n') || 'No characters.') })
+Claude Desktop (claude_desktop_config.json), Cursor (~/.cursor/mcp.json), Windsurf, VS Code and others:
+${JSON.stringify({ mcpServers: { yesilcam: { command: 'yesilcam-mcp', args: [] } } }, null, 2)}
 
-  const maket = program.command('maket').description('Floor plan → 3D (Maket)')
-  maket.command('analyze <file>').description('Analyze a DXF/JSON plan locally (free)').action((file) => { const a = analyzePlanText(readFileSync(file, 'utf8'), basename(file)); out(program, a, `${a.name}: ${a.stats.wallCount} walls, ${a.stats.doorCount} doors, ${a.stats.windowCount} windows, ${a.stats.roomCount} rooms, gross ${a.stats.grossArea?.toFixed?.(1)} m² (${a.units.name}${a.units.guessed ? ', guessed' : ''})\nlayers: ${a.layers.map((l) => `${l.name}=${l.role}`).join(', ')}`) })
-  maket.command('list').description('Saved Maket projects').action(async () => { const r = await client().maketList(); out(program, r.items, r.items.map((p) => `${String(p.id).padEnd(6)} ${p.title}  ${p.source_kind}  ${new Date(p.updated_date_time * 1000).toISOString().slice(0, 10)}`).join('\n') || 'No projects.') })
-  maket.command('save <file>').description('Save a plan as a Maket project').option('--title <title>').action(async (file, o) => {
-    const text = readFileSync(file, 'utf8'); const a = analyzePlanText(text, basename(file))
-    const r = await client().maketCreate({ title: o.title || basename(file, extname(file)), source_kind: a.source_kind, source_text: text, settings: { overrides: {}, wallHeight: 2.9 }, stats: a.stats })
-    out(program, r, `Saved project ${r.id}. Open it at ${SITE_URL}/app/maket`)
+Without a global install:  "command": "npx", "args": ["-y", "yesilcam-studios", "yesilcam-mcp"]
+Fewer tools:  "args": ["--studios", "image,film,influencer"]   ·   Read-only:  "args": ["--read-only"]
+On a server or CI, set YESILCAM_API_KEY in the environment instead of signing in.`)
   })
-  maket.command('get <id>').description('Download a project’s plan').option('--out <file>').action(async (id, o) => { const r = await client().maketGet(Number(id)); const p = r.project; const file = o.out || `${p.title || 'maket'}.${p.source_kind === 'json' ? 'json' : 'dxf'}`; writeFileSync(file, p.source_text); out(program, { id: p.id, title: p.title, saved: file }, `Saved: ${file}`) })
-  maket.command('delete <id>').action(async (id) => { await client().maketDelete(Number(id)); out(program, { ok: true }, 'Deleted.') })
 
-  program.command('mcp').description('Print the Claude MCP configuration snippet').action(() => {
-    console.log(JSON.stringify({ mcpServers: { yesilcam: { command: 'yesilcam-mcp', env: { YESILCAM_TOKEN: '<your token: yesilcam login --json>' } } } }, null, 2))
-  })
+  // ── katalogdan komutlar
+  const groups = new Map()
+  for (const op of OPS) {
+    if (!groups.has(op.group)) { const g = program.command(op.group).description(GROUPS[op.group] || op.group); groups.set(op.group, g); if (op.group === 'library') g.alias('assets') }
+    const g = groups.get(op.group)
+    const sub = g.command(op.action, { isDefault: DEFAULT_ACTION[op.group] === op.action }).description(`${op.summary}${op.kind === 'spend' ? ' [tokens]' : ''}`)
+    attachOp(sub, op, program)
+  }
+  // kısayollar (0.1 / 0.2 uyumu)
+  const byName = Object.fromEntries(OPS.map((o) => [o.name, o]))
+  for (const [alias, name] of [['balance', 'balance'], ['pricing', 'pricing'], ['whoami', 'account'], ['tryon', 'tryon']]) attachOp(program.command(alias).description(byName[name].summary), byName[name], program)
   return program
 }
 
 export async function main(argv) {
   const program = buildProgram()
   try { await program.parseAsync(argv) }
-  catch (e) { if (e instanceof ApiError || e?.message) { console.error(`Error: ${e.message}`); process.exit(1) } throw e }
+  catch (e) {
+    const msg = e instanceof ApiError ? friendlyError(e) : (e?.message || String(e))
+    if (program.opts().json) console.log(JSON.stringify({ error: e?.code || 'error', message: msg }))
+    else console.error(`Error: ${msg}`)
+    process.exitCode = e?.code === 'not_logged_in' ? 2 : 1
+  }
 }
+export { checkOnce }

package/src/client.js

@@ -1,16 +1,26 @@
-import { API_URL, APP_KEY, APP_SECRET, REGISTRATION_SOURCE } from './constants.js'
+// Apiollon istemcisi: POST <API>/flow/<uç>, JSON gövde, Bearer belirteç; yanıt { status, result } (hata da HTTP 200 + status:false).
+// Kimlik: (1) API anahtarı (ysk_…) → ys-apikey-exchange ile 1 saatlik oturum (bellekte; süresi dolunca yenilenir),
+//         (2) eski usul kullanıcı oturum belirteci (e-posta/şifre girişi). Gizli bilgiler hiçbir zaman yazdırılmaz.
+import { API_URL, APP_KEY, APP_SECRET } from './constants.js'
 
 const base = API_URL.replace(/\/+$/, '') + '/'
 let appTokenCache = null
 
-export class ApiError extends Error { constructor(message, data) { super(message); this.data = data } }
+export class ApiError extends Error {
+  constructor(message, data) { super(message); this.code = String(message || ''); this.data = data }
+}
 
 async function post(path, body, bearer, fetchImpl = globalThis.fetch) {
-  const headers = { 'Content-Type': 'application/json' }
+  const headers = { 'Content-Type': 'application/json', 'User-Agent': 'yesilcam-studios-cli' }
   if (bearer) headers.Authorization = `Bearer ${bearer}`
-  const res = await fetchImpl(base + path, { method: 'POST', headers, body: JSON.stringify(body || {}) })
+  let res
+  try { res = await fetchImpl(base + path, { method: 'POST', headers, body: JSON.stringify(body || {}) }) }
+  catch (e) { throw new ApiError('network_error', { cause: String(e?.message || e) }) }
   const data = await res.json().catch(() => null)
-  if (!data || data.status !== true) throw new ApiError((data && (data.message || data?.result?.error)) || `request_failed (${res.status})`, data)
+  if (!data || data.status !== true) {
+    const msg = (data && (data.message || data?.result?.error)) || `request_failed (${res.status})`
+    throw new ApiError(String(msg).split(' — ')[0], data)
+  }
   return data.result
 }
 
@@ -21,8 +31,9 @@ export async function getAppToken(fetchImpl) {
   appTokenCache = r.token
   return appTokenCache
 }
+export function _resetAppToken() { appTokenCache = null }
 
-/** E-posta + şifre → kullanıcı token'ı ve profil. */
+/** E-posta + şifre → kullanıcı oturum belirteci ve profil (eski yöntem; API anahtarı önerilir). */
 export async function login(email, password, fetchImpl) {
   const app = await getAppToken(fetchImpl)
   const r = await post('flow/user-login', { credential: email, password }, app, fetchImpl)
@@ -30,25 +41,84 @@ export async function login(email, password, fetchImpl) {
   return { token: r.token, user: { id: String(r.id), name: r.name || '', lastname: r.lastname || '', email: r.email || '' } }
 }
 
-export function makeClient(userToken, fetchImpl) {
-  if (!userToken) throw new ApiError('not_logged_in')
-  const flow = (name, body) => post(`flow/${name}`, body, userToken, fetchImpl)
+/** API anahtarı → kısa ömürlü oturum ({ token, expires_at, scopes, key, user }). */
+export async function exchangeKey(apiKey, fetchImpl) {
+  const app = await getAppToken(fetchImpl)
+  try { return await post('flow/ys-apikey-exchange', { key: apiKey }, app, fetchImpl) }
+  catch (e) {
+    if (/invalid method/i.test(e.message)) throw new ApiError('api_keys_not_enabled', e.data)
+    throw e
+  }
+}
+
+export const isApiKey = (s) => /^ysk_[a-f0-9]{48}$/.test(String(s || '').trim())
+
+const SESSION_ERRORS = /^(api_session_expired|api_session_invalid|invalid token)$/i
+
+/**
+ * makeClient({ apiKey } | { token }) ya da makeClient('<token>') (geriye uyum).
+ * c.call(uç, gövde) → result. c.session() → anahtar oturum bilgisi (kapsamlar, kullanıcı).
+ */
+export function makeClient(cred, fetchImpl) {
+  const creds = typeof cred === 'string' ? (isApiKey(cred) ? { apiKey: cred } : { token: cred }) : (cred || {})
+  if (!creds.apiKey && !creds.token) throw new ApiError('not_logged_in')
+  let session = null
+  const bearer = async (force = false) => {
+    if (!creds.apiKey) return creds.token
+    if (force || !session || session.expires_at * 1000 - Date.now() < 60_000) session = await exchangeKey(creds.apiKey, fetchImpl)
+    return session.token
+  }
+  const call = async (name, body = {}) => {
+    try { return await post(`flow/${name}`, body, await bearer(), fetchImpl) }
+    catch (e) {
+      if (creds.apiKey && SESSION_ERRORS.test(e.message)) return post(`flow/${name}`, body, await bearer(true), fetchImpl)
+      throw e
+    }
+  }
   return {
-    flow,
-    balance: () => flow('get-token-balance'),
-    me: () => flow('get-user-subscription-infos'),
-    modulePricing: () => flow('get-all-module-pricing'),
-    tokenPackages: () => flow('get-token-packages'),
-    routes: () => flow('aistudio-list-routes'),
-    assets: (p = {}) => flow('aistudio-asset-list', p),
-    uploadAsset: (fileBase64, kind = 'image', label = '') => flow('aistudio-upload-asset', { file_base64: fileBase64, kind, label }),
-    createJob: (p) => flow('aistudio-create-job', p),
-    jobStatus: (jobId) => flow('aistudio-job-status', { job_id: jobId }),
-    jobs: (p = {}) => flow('aistudio-job-list', p),
-    characters: () => flow('aistudio-character-list'),
-    maketList: () => flow('maket-list-projects'),
-    maketGet: (projectId) => flow('maket-get-project', { projectId }),
-    maketCreate: (p) => flow('maket-create-project', p),
-    maketDelete: (projectId) => flow('maket-delete-project', { projectId }),
+    call,
+    flow: call,
+    kind: creds.apiKey ? 'api_key' : 'token',
+    session: async () => { if (creds.apiKey) await bearer(); return session },
+    // geriye uyum kısayolları (0.2)
+    balance: () => call('get-token-balance'),
+    me: () => call('get-user-subscription-infos'),
+    jobStatus: (jobId) => call('aistudio-job-status', { job_id: Number(jobId) }),
   }
 }
+
+/** Sunucu hata kodu → sade İngilizce açıklama (bilinmeyen kod olduğu gibi döner). */
+const FRIENDLY = {
+  'Insufficient tokens': 'Not enough tokens. Top up or upgrade at https://yesilcamstudios.com/app/billing',
+  insufficient_tokens: 'Not enough tokens. Top up or upgrade at https://yesilcamstudios.com/app/billing',
+  subscription_required: 'This needs a Basic or Pro plan: https://yesilcamstudios.com/app/billing',
+  pro_required: 'This needs the Pro plan: https://yesilcamstudios.com/app/billing',
+  too_many_running: 'Too many jobs are running at once. Wait for one to finish and try again.',
+  minor_text: 'The text seems to describe a minor. Characters must be adults.',
+  public_figure_text: 'Real public figures cannot be used.',
+  unsafe_content: 'The request was blocked by the safety check.',
+  safety_filter: 'The request was blocked by the safety check.',
+  consent_required: 'Explicit consent is required for this upload (pass consent / --consent).',
+  not_logged_in: 'Not signed in. Run: yesilcam login',
+  api_keys_not_enabled: 'API keys are not enabled on the server yet. Use: yesilcam login --password',
+  api_key_invalid: 'The API key is not valid. Create a new one at https://yesilcamstudios.com/app/account/developer',
+  api_key_revoked: 'This API key was revoked. Create a new one at https://yesilcamstudios.com/app/account/developer',
+  api_key_expired: 'This API key has expired. Create a new one at https://yesilcamstudios.com/app/account/developer',
+  api_key_scope: 'This API key is read-only. Create a key with the "write" scope to create, edit or spend tokens.',
+  api_key_forbidden: 'API keys cannot do this (account, payment and key management stay in the web app).',
+  social_unavailable: 'Publishing to social media is coming soon.',
+  edit_unavailable: 'Long videos are not available on this account yet.',
+  auto_unavailable: 'Automations are not available on this account yet.',
+  network_error: 'Could not reach the Yeşilçam Studios API. Check your connection.',
+  quote_changed: 'The price changed since the quote. Get a fresh quote and confirm again.',
+  voice_not_set: 'Set a voice for this character first (influencer voice-set).',
+  edit_busy: 'The project is busy (planning or producing). Wait and try again.',
+  still_running: 'It is still running. Wait for it to finish first.',
+  'Invalid method': 'This feature is not available on the server yet.',
+}
+export function friendlyError(e) {
+  const code = String(e?.code || e?.message || e || '')
+  const extra = e?.data && typeof e.data === 'object' ? ['need', 'total', 'reason'].filter((k) => e.data[k] != null).map((k) => `${k}: ${e.data[k]}`).join(', ') : ''
+  const text = FRIENDLY[code] || code || 'Unknown error'
+  return extra ? `${text} (${extra})` : text
+}

package/src/config.js

@@ -1,18 +1,40 @@
-import { mkdirSync, readFileSync, writeFileSync, existsSync, unlinkSync, chmodSync } from 'node:fs'
+import { mkdirSync, readFileSync, writeFileSync, existsSync, unlinkSync, chmodSync, statSync } from 'node:fs'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
 
-export const CONFIG_DIR = process.env.YESILCAM_CONFIG_DIR || join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'yesilcam')
-export const CONFIG_FILE = join(CONFIG_DIR, 'config.json')
+// Yol çağrı anında çözülür (YESILCAM_CONFIG_DIR sonradan değişebilir: testler, birden çok hesap)
+export const configDir = () => process.env.YESILCAM_CONFIG_DIR || join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'yesilcam')
+export const configFile = () => join(configDir(), 'config.json')
+export const CONFIG_DIR = configDir()
+export const CONFIG_FILE = configFile()
 
 export function readConfig() {
-  try { return JSON.parse(readFileSync(CONFIG_FILE, 'utf8')) } catch { return {} }
+  try { return JSON.parse(readFileSync(configFile(), 'utf8')) } catch { return {} }
 }
+/** Yapılandırma dosyası yalnız sahibine açık (dizin 0700, dosya 0600). */
 export function writeConfig(cfg) {
-  mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 })
-  writeFileSync(CONFIG_FILE, JSON.stringify(cfg, null, 2) + '\n', { mode: 0o600 })
-  try { chmodSync(CONFIG_FILE, 0o600) } catch {}
+  const dir = configDir(); const file = configFile()
+  mkdirSync(dir, { recursive: true, mode: 0o700 })
+  try { chmodSync(dir, 0o700) } catch {}
+  writeFileSync(file, JSON.stringify(cfg, null, 2) + '\n', { mode: 0o600 })
+  try { chmodSync(file, 0o600) } catch {}
 }
-export function clearConfig() { if (existsSync(CONFIG_FILE)) unlinkSync(CONFIG_FILE) }
-/** Öncelik: YESILCAM_TOKEN env > config dosyası. */
-export function getUserToken() { return process.env.YESILCAM_TOKEN || readConfig().token || '' }
+export function clearConfig() { if (existsSync(configFile())) unlinkSync(configFile()) }
+/** Dosya başkalarınca okunabiliyorsa uyarı metni (Windows'ta izin bitleri anlamsız → null). */
+export function permissionWarning() {
+  const file = configFile()
+  if (process.platform === 'win32' || !existsSync(file)) return null
+  try { const m = statSync(file).mode & 0o077; return m ? `Warning: ${file} is readable by other users. Run: chmod 600 ${file}` : null } catch { return null }
+}
+
+/** Öncelik: YESILCAM_API_KEY > YESILCAM_TOKEN > yapılandırma dosyası (apiKey, sonra token). */
+export function getCredentials() {
+  if (process.env.YESILCAM_API_KEY) return { apiKey: process.env.YESILCAM_API_KEY.trim(), source: 'env' }
+  if (process.env.YESILCAM_TOKEN) return { token: process.env.YESILCAM_TOKEN.trim(), source: 'env' }
+  const c = readConfig()
+  if (c.apiKey) return { apiKey: c.apiKey, source: 'file' }
+  if (c.token) return { token: c.token, source: 'file' }
+  return null
+}
+/** Geriye uyum (0.2). */
+export function getUserToken() { const c = getCredentials(); return c ? (c.apiKey || c.token) : '' }

package/src/constants.js

@@ -1,6 +1,9 @@
-// Uygulama anahtarı: web uygulamasıyla aynı (get-token). Kullanıcı token'ı ayrı alınır ve diske yazılır.
+// Uygulama anahtarı web uygulamasıyla aynıdır (herkese açık istemci kimliği; get-token). Kullanıcı kimliği ayrıca alınır.
 export const API_URL = process.env.YESILCAM_API_URL || 'https://prod.apiollon.com/'
 export const APP_KEY = process.env.YESILCAM_APP_KEY || 'F0RRDrlPigAYTmOSweyhBmo6aYZOLpTA8qGCGQe2wkmDHJYBF9'
 export const APP_SECRET = process.env.YESILCAM_APP_SECRET || 'anHHiSHfgOZ5zJKxWGJPO2PPNdIgL2HwdgUchEuC7bh5BLU'
 export const REGISTRATION_SOURCE = 'yesilcam-web'
 export const SITE_URL = 'https://yesilcamstudios.com'
+export const APP_URL = `${SITE_URL}/app`
+export const KEYS_URL = `${APP_URL}/account/developer`
+export const VERSION = '0.3.0'