{ "generated_at": "2026-04-26T17:17:21.372Z", "total": 33, "ecosystems": { "zig": { "label": "Zig", "color": "#f7a41d", "install_template": "zig fetch --save git+https://github.com/{repo}.git", "registry_url_template": "https://zigistry.dev/package/{repo}", "icon": "zig" }, "rust": { "label": "Rust", "color": "#dea584", "install_template": "cargo add {crate_name}", "registry_url_template": "https://crates.io/crates/{crate_name}", "icon": "rust" }, "npm": { "label": "NPM", "color": "#cb3837", "install_template": "npm install {npm_name}", "registry_url_template": "https://www.npmjs.com/package/{npm_name}", "icon": "npm" }, "multi": { "label": "Multi", "color": "#6366f1", "icon": "layers" } }, "categories": [ { "id": "cryptography", "label": "Cryptography & Security", "description": "Cryptographic primitives, keychain access, FIDO2/WebAuthn" }, { "id": "systems", "label": "Systems & Platform", "description": "Desktop notifications, window management, OS integration" }, { "id": "scheduling", "label": "Scheduling & Payments", "description": "Appointment booking, payment integration, calendar sync" }, { "id": "auth", "label": "Authentication", "description": "PostgreSQL/Redis auth adapters, OAuth multiplexing" }, { "id": "ai-tools", "label": "AI & Developer Tools", "description": "MCP servers, transcript extraction, TUI dashboards" }, { "id": "integrations", "label": "Integrations", "description": "GSuite, Linear, third-party API bridges" }, { "id": "devex", "label": "Developer Experience", "description": "Documentation tools, accessibility, i18n, type utilities" }, { "id": "uncategorized", "label": "Other", "description": "Uncategorized packages" } ], "packages": [ { "slug": "jesssullivan-tinyland-cleanup", "name": "tinyland-cleanup", "repo": "jesssullivan/tinyland-cleanup", "org": "jesssullivan", "ecosystem": "multi", "category": "systems", "description": "Cross-platform disk cleanup daemon with graduated thresholds — Go, Nix, systemd/launchd", "featured": false, "tags": [ "disk", "cleanup", "daemon", "go" ], "version": "0.0.0", "release_date": "", "releases": [], "stars": 0, "topics": [ "cleanup", "daemon", "disk-management", "go", "launchd", "nix", "systemd" ], "languages": [ { "name": "Go", "color": "#00ADD8", "bytes": 445694 }, { "name": "Starlark", "color": "#76d275", "bytes": 4645 }, { "name": "Nix", "color": "#7e7eff", "bytes": 1636 }, { "name": "Shell", "color": "#89e051", "bytes": 588 } ], "primary_language": "Go", "readme_html": "

tinyland-cleanup

\n

tinyland-cleanup is a conservative disk-pressure cleanup daemon for developer\nmachines and CI hosts. It focuses on build-system and developer-tool caches\nwhere unmanaged disk pressure can break local work, remote runners, or\nhermetic build flows.

\n

The current production target is Darwin developer machines plus Linux/Rocky\nbuilder and runner machines.

\n

Safety Model

\n\n

Build And Test

\n

Fast local validation:

\n
env GOCACHE=/tmp/tinyland-cleanup-gocache GOFLAGS=-mod=vendor go test ./...\nenv GOCACHE=/tmp/tinyland-cleanup-gocache GOFLAGS=-mod=vendor go vet ./...\nenv GOCACHE=/tmp/tinyland-cleanup-gocache GOFLAGS=-mod=vendor go build ./...
\n

Nix package build:

\n
nix build .#default --no-link --print-build-logs
\n

Bazel build/test graph:

\n
nix shell nixpkgs#bazelisk --command bazelisk --output_user_root=/tmp/tinyland-cleanup-bazel test //...
\n

Shared-cache Bazel runners can use:

\n
BAZEL_REMOTE_CACHE=grpc://bazel-cache.nix-cache.svc.cluster.local:9092 \\\n  scripts/bazel-cache-backed.sh test //...
\n

Operator Review

\n

Review the cleanup plan before mutating a high-pressure machine:

\n
tinyland-cleanup --once --dry-run --level critical --output text
\n

Use JSON when another tool needs the stable report schema:

\n
tinyland-cleanup --once --dry-run --level critical --output json
\n

List available plugin names before constraining an evidence run:

\n
tinyland-cleanup --list-plugins
\n

Constrain review to specific plugins before scanning broad cache surfaces:

\n
tinyland-cleanup --once --dry-run --level critical --plugins bazel,nix --output text
\n

For a one-off run, override the configured maximum used-space target without\nediting the config file:

\n
tinyland-cleanup --once --dry-run --level critical --target-used-percent 82
\n

See docs/operator-workflow.md for the current\ndry-run, candidate policy tier, and host free-space accounting workflow.

\n

Podman on macOS needs extra care because applehv raw sparse images do not\nshrink from guest fstrim alone. See\ndocs/podman-darwin-compaction.md before\nenabling offline compaction.

\n

Darwin developer cache review is documented in\ndocs/darwin-dev-caches.md.

\n

Nix store and generation cleanup policy is documented in\ndocs/nix-cleanup-policy.md.

\n

Bazel cache and output-base review is documented in\ndocs/bazel-cache-policy.md.

\n

Distribution Status

\n

Current package authority is the Nix flake package .#tinyland-cleanup.\nRelease archives are produced from GitHub tags. No public tag has been cut yet.\nLinux RPM packaging is documented in\ndocs/rpm-packaging.md; the RPM installs a systemd unit\nbut leaves enable/start as an explicit operator action.

\n

Roadmap

\n

Open productionization work is tracked in GitHub issues:

\n\n

Recently completed productionization work:

\n\n

See docs/productionization-plan-2026-04-25.md\nfor the current productionization plan.

\n

Current validation notes are tracked in\ndocs/validation-status-2026-04-26.md.

\n
", "readme_excerpt": "tinyland-cleanup is a conservative disk-pressure cleanup daemon for developer\nmachines and CI hosts. It focuses on build-system and developer-tool caches\nwhere unmanaged disk pressure can break local work, remote runners, or\nhermetic build flows.\nThe current production target is Darwin developer machines plus Linux/Rocky\nbuilder and runner machines.\n- Dry-run behavior must stay useful enough for operator review.\n- Cleanup policy should explain what it plans to remove and why.\n- Host free-space...", "install_commands": {}, "repo_url": "https://github.com/jesssullivan/tinyland-cleanup", "website_url": null, "docs_url": null, "registry_url": null, "releases_url": "https://github.com/jesssullivan/tinyland-cleanup/releases", "og_image_url": "https://opengraph.githubassets.com/758127e5e9ac0f380a78d50b72873f187b985dda1eeb71cfede831c6d38e57e8/Jesssullivan/tinyland-cleanup", "license": "MIT", "pushed_at": "2026-04-26T17:14:49Z", "enriched_at": "2026-04-26T17:17:11.521Z", "gate": "override" }, { "slug": "jesssullivan-cmux", "name": "cmux", "repo": "jesssullivan/cmux", "org": "jesssullivan", "ecosystem": "multi", "category": "systems", "description": "de-attestation development work for cmux terminal; lets get this built for common linux DEs ^w^", "featured": true, "tags": [ "terminal", "multiplexer", "ghostty", "ai" ], "version": "lab-v0.75.0", "release_date": "2026-04-06T04:04:29Z", "releases": [ { "tag": "lab-v0.75.0", "date": "2026-04-06T04:04:29Z", "body": "Linux release packages for lab-v0.75.0" }, { "tag": "lab-v0.74.0", "date": "2026-04-05T20:33:29Z", "body": "Linux release packages for lab-v0.74.0" }, { "tag": "lab-v0.73.1", "date": "2026-04-04T01:03:15Z", "body": "Linux release packages for lab-v0.73.1" }, { "tag": "lab-v0.73.0-test3", "date": "2026-04-03T13:41:18Z", "body": "Linux release packages for lab-v0.73.0-test3" }, { "tag": "lab-v0.73.0", "date": "2026-03-29T14:10:03Z", "body": "Signed and notarized fork release with FIDO2/WebAuthn enterprise auth support.\n\n## Assets\n- **cmux-lab-macos.dmg** — signed macOS .app (trans-themed LAB branding, Developer ID)\n- **cmuxd-remote-{darwin,linux}-{arm64,amd64}** — cross-platform remote daemon binaries\n\n## Nix\n```bash\nnix run github:Jesssullivan/cmux/${TAG}\n```" }, { "tag": "lab-v0.72.0", "date": "2026-03-27T18:42:01Z", "body": "Signed and notarized fork release with FIDO2/WebAuthn enterprise auth support.\n\n## Assets\n- **cmux-lab-macos.dmg** — signed macOS .app (trans-themed LAB branding, Developer ID)\n\n## Nix\n```bash\nnix run github:Jesssullivan/cmux/${TAG}\n```" }, { "tag": "lab-v0.71.0", "date": "2026-03-27T17:16:46Z", "body": "Signed and notarized fork release with FIDO2/WebAuthn enterprise auth support.\n\n## Assets\n- **cmux-lab-macos.dmg** — signed macOS .app (trans-themed LAB branding, Developer ID)\n\n## Nix\n```bash\nnix run github:Jesssullivan/cmux/${TAG}\n```" }, { "tag": "lab-v0.70.0", "date": "2026-03-27T14:31:40Z", "body": "Signed and notarized fork release with FIDO2/WebAuthn enterprise auth support.\n\n## Assets\n- **cmux-lab-macos.dmg** — signed macOS .app (trans-themed LAB branding, Developer ID)\n\n## Nix\n```bash\nnix run github:Jesssullivan/cmux/${TAG}\n```" }, { "tag": "lab-v0.69.0", "date": "2026-03-27T13:09:14Z", "body": "Signed and notarized fork release with FIDO2/WebAuthn enterprise auth support.\n\n## Assets\n- **cmux-lab-macos.dmg** — signed macOS .app (trans-themed LAB branding, Developer ID)\n\n## Nix\n```bash\nnix run github:Jesssullivan/cmux/${TAG}\n```" }, { "tag": "lab-v0.68.0", "date": "2026-03-27T05:21:27Z", "body": "Signed and notarized fork release with FIDO2/WebAuthn enterprise auth support.\n\n## Assets\n- **cmux-lab-macos.dmg** — signed macOS .app (trans-themed LAB branding, Developer ID)\n\n## Nix\n```bash\nnix run github:Jesssullivan/cmux/${TAG}\n```" } ], "stars": 2, "topics": [ "attestation-compatibility", "ffi", "multiarch", "zig", "no-apple" ], "languages": [ { "name": "Swift", "color": "#F05138", "bytes": 9132655 }, { "name": "Python", "color": "#3572A5", "bytes": 1809390 }, { "name": "Zig", "color": "#ec915c", "bytes": 332730 }, { "name": "Shell", "color": "#89e051", "bytes": 302748 }, { "name": "TypeScript", "color": "#3178c6", "bytes": 283693 } ], "primary_language": "Swift", "readme_html": "

cmux

\n

A Ghostty-based macOS terminal with vertical tabs and notifications for AI coding agents

\n

\n \n \"Download\n \n

\n

\n English | 日本語 | Tiếng Việt | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | Polski | Русский | Bosanski | العربية | Norsk | Português (Brasil) | ไทย | Türkçe | ភាសាខ្មែរ | Українська\n

\n

\n \"X\n \"Discord\"\n \"GitHub\n

\n

\n \"cmux\n

\n

\n ▶ Demo video · The Zen of cmux\n

\n

Features

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

Notification rings

\nPanes get a blue ring and tabs light up when coding agents need your attention\n		\n\"Notification\n
\n

Notification panel

\nSee all pending notifications in one place, jump to the most recent unread\n		\n\"Sidebar\n
\n

In-app browser

\nSplit a browser alongside your terminal with a scriptable API ported from agent-browser\n		\n\"Built-in\n
\n

Vertical + horizontal tabs

\nSidebar shows git branch, linked PR status/number, working directory, listening ports, and latest notification text. Split horizontally and vertically.\n		\n\"Vertical\n
\n

SSH

\ncmux ssh user@remote creates a workspace for a remote machine. Browser panes route through the remote network so localhost just works. Drag an image into a remote session to upload via scp.\n		\n\"cmux\n
\n

Claude Code Teams

\ncmux claude-teams runs Claude Code's teammate mode with one command. Teammates spawn as native splits with sidebar metadata and notifications. No tmux required.\n		\n\"Claude\n
\n\n

Install

\n

DMG (recommended)

\n\n \"Download\n\n

Open the .dmg and drag cmux to your Applications folder. cmux auto-updates via Sparkle, so you only need to download once.

\n

Homebrew

\n
brew tap manaflow-ai/cmux\nbrew install --cask cmux
\n

To update later:

\n
brew upgrade --cask cmux
\n

On first launch, macOS may ask you to confirm opening an app from an identified developer. Click Open to proceed.

\n

Why cmux?

\n

I run a lot of Claude Code and Codex sessions in parallel. I was using Ghostty with a bunch of split panes, and relying on native macOS notifications to know when an agent needed me. But Claude Code's notification body is always just \"Claude is waiting for your input\" with no context, and with enough tabs open I couldn't even read the titles anymore.

\n

I tried a few coding orchestrators but most of them were Electron/Tauri apps and the performance bugged me. I also just prefer the terminal since GUI orchestrators lock you into their workflow. So I built cmux as a native macOS app in Swift/AppKit. It uses libghostty for terminal rendering and reads your existing Ghostty config for themes, fonts, and colors.

\n

The main additions are the sidebar and notification system. The sidebar has vertical tabs that show git branch, linked PR status/number, working directory, listening ports, and the latest notification text for each workspace. The notification system picks up terminal sequences (OSC 9/99/777) and has a CLI (cmux notify) you can wire into agent hooks for Claude Code, OpenCode, etc. When an agent is waiting, its pane gets a blue ring and the tab lights up in the sidebar, so I can tell which one needs me across splits and tabs. Cmd+Shift+U jumps to the most recent unread.

\n

The in-app browser has a scriptable API ported from agent-browser. Agents can snapshot the accessibility tree, get element refs, click, fill forms, and evaluate JS. You can split a browser pane next to your terminal and have Claude Code interact with your dev server directly.

\n

Everything is scriptable through the CLI and socket API — create workspaces/tabs, split panes, send keystrokes, open URLs in the browser.

\n

The Zen of cmux

\n

cmux is not prescriptive about how developers hold their tools. It's a terminal and browser with a CLI, and the rest is up to you.

\n

cmux is a primitive, not a solution. It gives you a terminal, a browser, notifications, workspaces, splits, tabs, and a CLI to control all of it. cmux doesn't force you into an opinionated way to use coding agents. What you build with the primitives is yours.

\n

The best developers have always built their own tools. Nobody has figured out the best way to work with agents yet, and the teams building closed products definitely haven't either. The developers closest to their own codebases will figure it out first.

\n

Give a million developers composable primitives and they'll collectively find the most efficient workflows faster than any product team could design top-down.

\n

Documentation

\n

For more info on how to configure cmux, head over to our docs.

\n

Keyboard Shortcuts

\n

Workspaces

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ShortcutAction
⌘ NNew workspace
⌘ 1–8Jump to workspace 1–8
⌘ 9Jump to last workspace
⌃ ⌘ ]Next workspace
⌃ ⌘ [Previous workspace
⌘ ⇧ WClose workspace
⌘ ⇧ RRename workspace
⌘ BToggle sidebar
\n

Surfaces

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ShortcutAction
⌘ TNew surface
⌘ ⇧ ]Next surface
⌘ ⇧ [Previous surface
⌃ TabNext surface
⌃ ⇧ TabPrevious surface
⌃ 1–8Jump to surface 1–8
⌃ 9Jump to last surface
⌘ WClose surface
\n

Split Panes

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ShortcutAction
⌘ DSplit right
⌘ ⇧ DSplit down
⌥ ⌘ ← → ↑ ↓Focus pane directionally
⌘ ⇧ HFlash focused panel
\n

Browser

\n

Browser developer-tool shortcuts follow Safari defaults and are customizable in Settings → Keyboard Shortcuts.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ShortcutAction
⌘ ⇧ LOpen browser in split
⌘ LFocus address bar
⌘ [Back
⌘ ]Forward
⌘ RReload page
⌥ ⌘ IToggle Developer Tools (Safari default)
⌥ ⌘ CShow JavaScript Console (Safari default)
\n

Notifications

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ShortcutAction
⌘ IShow notifications panel
⌘ ⇧ UJump to latest unread
\n

Find

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ShortcutAction
⌘ FFind
⌘ G / ⌘ ⇧ GFind next / previous
⌘ ⇧ FHide find bar
⌘ EUse selection for find
\n

Terminal

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ShortcutAction
⌘ KClear scrollback
⌘ CCopy (with selection)
⌘ VPaste
⌘ + / ⌘ -Increase / decrease font size
⌘ 0Reset font size
\n

Window

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ShortcutAction
⌘ ⇧ NNew window
⌘ ⇧ OReopen previous session
⌘ ,Settings
⌘ ⇧ ,Reload configuration
⌘ QQuit
\n

Nightly Builds

\n

Download cmux NIGHTLY

\n

cmux NIGHTLY is a separate app with its own bundle ID, so it runs alongside the stable version. Built automatically from the latest main commit and auto-updates via its own Sparkle feed.

\n

Report nightly bugs on GitHub Issues or in #nightly-bugs on Discord.

\n

Session restore

\n

Quitting cmux saves the current session. On relaunch, cmux restores:

\n\n

If you need to reapply the last saved snapshot manually, use:

\n\n

cmux does not restore arbitrary live terminal process state. tmux, vim, shells, and other tools without a cmux resume flow still reopen as normal terminals rather than resuming in-process state.

\n

Star History

\n\n \n \n \n \"Star\n \n\n

Contributing

\n

Ways to get involved:

\n\n

Community

\n\n

Founder's Edition

\n

cmux is free, open source, and always will be. If you'd like to support development and get early access to what's coming next:

\n

Get Founder's Edition

\n\n

License

\n

cmux is open source under GPL-3.0-or-later.

\n

If your organization cannot comply with GPL, a commercial license is available. Contact founders@manaflow.com for details.

\n
", "readme_excerpt": "

cmux

\n

A Ghostty-based macOS terminal with vertical tabs and notifications for AI coding agents

\n

\n \n \"Download\n \n

\n

\n English | 日本語 | Tiếng Việt | 简体中文 |

XoxdWM

\n

XoxdWM is an experimental Wayland compositor plus Emacs window-management layer with VR, eye-tracking, hand-tracking, and BCI research surfaces.

\n

This repository is the canonical public home for the compositor, packaging, releases, and status tracking. It is not a claim that every documented subsystem is proven on lab hardware today.

\n

Current State

\n

As of 2026-04-26:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
AreaStatusNotes
Release artifactsSmokev0.5.1 publishes RPM and DEB artifacts. The Rocky base compositor RPM is public and host-installable, and branch-scoped 0.5.4-1.el10 RPMs from Actions run 24768509226 are now installed and revalidated on yoga.
Headless compositor pathSmokeBuild and test surfaces exist, but not re-validated in this pass.
Rocky 10 package installSmokeyoga now has refreshed installed 0.5.4-1.el10 exwm-vr-* RPMs from the current branch, the real installed units pass a named-host bounded proof, and a controlled SDDM autologin run reached a real EXWM-VR Wayland user session on seat0. The packaged SuccessExitStatus=15 stop-path fix is now on-host; the remaining follow-on is repeatability and operator polish, not package repair.
honey compositor/substrate pathSmokehoney now has installed branch-scoped exwm-vr-0.5.4-1.el10 packages, a bounded named-host exwm-vr.target startup, and a direct-mode lease proof from the installed /usr/bin/ewwm-compositor after reinstalling the branch RPM artifact from run 24776900393.
honey VR sessionSmokeOn 2026-04-22, the installed ewwm-compositor on honey initialized wp_drm_lease_v1, reserved DP-2 via ~/.config/exwm-vr/compositor.env, and granted a real DRM lease to Monado. A repo-owned exwm-vr-monado.service then proved three runtime surfaces on the host: the older local /usr/local/bin/monado-service lane, a staged monado-beyond companion RPM tree from run 24804821792, and an installed monado-beyond host package from run 24807084915 using /usr/bin/monado-service with no MONADO_SERVICE_BIN override. The repo now has just honey-openxr-status, just honey-openxr-smoke, just honey-openxr-clean-cycle, and just honey-openxr-fresh-boot-check wrappers for the OpenXR client lane, and the exwm-vr-openxr-smoke-client RPM from run 24938791255 is installed on honey. On 2026-04-25 EDT, three bounded packaged-client smoke passes and three clean stop/start cycles selected /usr/libexec/exwm-vr/hello_xr -g Vulkan, reached Monado / Bigscreen Beyond, and created 3561x3561 eye swapchains. This is clean-cycle repeatability evidence, not yet proof of fresh-boot, in-goggles first-frame, or long-running operator stability; see Honey Substrate Proof and the Honey Fresh-Boot Runbook.
yoga desktop/dev targetSmokeyoga now has an installed 0.5.4 session proof with explicit drm backend and dedicated Emacs bootstrap, plus a one-time SDDM greeter-path proof via sddm-autologin on seat0. The remaining work is repeatability and session polish, not basic launch viability or packaged stop-path repair.
Eye tracking / hand tracking / BCIDesignDocumented and partially implemented, but not currently claimed as proven on named lab hosts.
\n

Start Here

\n\n

Scope

\n

The repo contains four different kinds of work:

\n\n

Use the reality check, status, and support matrix together as the current truth surface.\nSubsystem docs and feature inventories can still be more aspirational than present support.\nneo and other Darwin machines are control-plane surfaces only. Authoritative\nbuild and runtime validation belongs on Rocky / Linux remote lanes and named-host\nproof; see Remote Build Authority and\nRemote Proof Lanes.

\n

Shared self-hosted CI now runs from this canonical repo. Honey-backed hardware lanes remain explicit opt-in via USE_VR_HARDWARE rather than implicit fork-only behavior.

\n

Related repositories

\n

Platform-specific work for the Dell Precision 7810 (honey host) lives in\nJesssullivan/Dell-7810:

\n\n

XoxdWM proves that software works on a prepared host. Dell-7810 proves the\nhost is prepared.

\n

Releases

\n

Latest public release:

\n\n

Current public install artifacts:

\n\n

These artifacts currently package the compositor path. They do not, by themselves, establish a proven full VR deployment on honey, and they do not yet mean yoga has a polished or repeatedly exercised local login/session lane. Right now yoga has the installed session entry, refreshed packaged user units, an active SDDM greeter, and a one-time sddm-autologin Wayland user session proof on seat0. SELinux hardening, Monado integration, and the BrainFlow BCI virtualenv remain separate follow-on package or host-integration paths instead of blocking the base Rocky compositor release.

\n

Near-Term Goal

\n

The next 12 weeks are aimed at one honest, ordered MVP:

\n\n

Everything else remains secondary until those three named outcomes are green.

\n
", "readme_excerpt": "XoxdWM is an experimental Wayland compositor plus Emacs window-management layer with VR, eye-tracking, hand-tracking, and BCI research surfaces.\nThis repository is the canonical public home for the compositor, packaging, releases, and status tracking. It is not a claim that every documented subsystem is proven on lab hardware today.\nAs of 2026-04-26:\n| Area | Status | Notes |\n| --- | --- | --- |\n| Release artifacts | Smoke | v0.5.1 publishes RPM and DEB artifacts. The Rocky base compositor RPM...", "install_commands": { "nix": "nix run github:Jesssullivan/XoxdWM" }, "repo_url": "https://github.com/jesssullivan/XoxdWM", "website_url": null, "docs_url": null, "registry_url": null, "releases_url": "https://github.com/jesssullivan/XoxdWM/releases", "og_image_url": "https://opengraph.githubassets.com/a02c6a64ce530fce3865f4ff5a4991920a9b0c1ed3717830c086b9dc5e1a2ff1/Jesssullivan/XoxdWM", "license": "GPL-3.0", "pushed_at": "2026-04-26T05:02:22Z", "enriched_at": "2026-04-26T17:17:12.159Z", "gate": "override" }, { "slug": "jesssullivan-scheduling-bridge", "name": "scheduling-bridge", "repo": "jesssullivan/scheduling-bridge", "org": "jesssullivan", "ecosystem": "npm", "category": "scheduling", "description": "Why pay for an API to rebuild a closed source wizard when you *are* a wizard? Playwright-based Modal + container native middleware server for migrating off of Acuity scheduling, on mass with zero downtime.", "featured": false, "tags": [ "scheduling", "acuity", "playwright", "bridge" ], "version": "0.4.3", "release_date": "2026-04-25T07:16:14Z", "releases": [ { "tag": "0.4.3", "date": "2026-04-25T07:16:14Z", "body": "Release `@tummycrypt/scheduling-bridge@0.4.3`.\n\n- Adds RemoteAdapter custom header support for authenticated bridge calls.\n- Fixes cross-repo publish credential forwarding for npm and GitHub Packages.\n- Publishes the Bazel-built package artifact from the shared runner lane." }, { "tag": "0.3.1", "date": "2026-04-12T23:25:47Z", "body": "## Changes\n- deploy truth fixes for Modal and Docker entrypoints\n- shared Acuity service catalog for static JSON, BUSINESS extraction, and scraper fallback\n- handler and local wizard adapter now resolve services through the shared catalog\n- package version bump for release\n\n## Validation\n- CI green on PR #16 before merge" }, { "tag": "0.1.0", "date": "2026-03-24T20:46:00Z", "body": "## @tummycrypt/acuity-middleware v0.1.0\n\nPlaywright-based middleware server for migrating off Acuity Scheduling with zero downtime.\n\n### What's included\n\n- **16-method `SchedulingAdapter` interface** — services, availability, reservations, bookings, clients\n- **Effect TS wizard automation** — 7 step programs driving the Acuity booking wizard via headless Playwright\n- **CSS selector registry** — 30+ fallback chains for resilience against Emotion CSS hash instability\n- **Modal Labs deployment** — containerized Chromium with esbuild bundling, warm pools, serialized requests\n- **Standalone HTTP server** — Bearer auth, 8 endpoints replacing blocked Acuity REST API\n- **Remote adapter** — HTTP proxy client for offloading browser automation to Modal/Fly.io\n- **Dual effect system** — Effect TS for browser lifecycle, fp-ts `TaskEither` at adapter boundary\n\n### Install\n\n```bash\nnpm install @tummycrypt/acuity-middleware\n```\n\n### npm\n\nhttps://www.npmjs.com/package/@tummycrypt/acuity-middleware" } ], "stars": 0, "topics": [ "brute-force", "effect-ts", "functional-design", "modal-labs", "no-api-no-problem", "work-harder-not-smarter", "playwrite-in-production", "scheduling-lifecycle", "wip" ], "languages": [ { "name": "TypeScript", "color": "#3178c6", "bytes": 350757 }, { "name": "JavaScript", "color": "#f1e05a", "bytes": 27850 }, { "name": "Starlark", "color": "#76d275", "bytes": 9634 }, { "name": "Python", "color": "#3572A5", "bytes": 3158 }, { "name": "Nix", "color": "#7e7eff", "bytes": 1724 } ], "primary_language": "TypeScript", "readme_html": "

scheduling-bridge

\n\n

Backend-agnostic scheduling adapter hub. Currently bridges Acuity Scheduling via Playwright browser automation, with architecture designed to support additional scheduling backends.

\n
\n

Formerly acuity-middleware. Historical GitHub URLs may redirect, but the\ncanonical repo is Jesssullivan/scheduling-bridge.

\n
\n

Architecture

\n

An HTTP server wrapping Playwright wizard flows that automate the Acuity booking UI. The bridge uses Effect TS for resource lifecycle management (browser/page acquisition and release).

\n
HTTP Request\n  -> server/handler.ts (route matching, auth, JSON serialization)\n    -> acuity-service-catalog.ts (static env catalog -> BUSINESS -> scraper fallback)\n    -> steps/ (Effect TS programs for each wizard stage)\n      -> browser-service.ts (Playwright lifecycle via Effect Layer)\n        -> selectors.ts (CSS selector registry with fallback chains)\n
\n

Key Components

\n\n

Endpoints

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
MethodPathDescription
GET/healthHealth check (no auth required)
GET/servicesList appointment types via SERVICES_JSON -> BUSINESS -> scraper fallback
GET/services/:idGet a specific service
POST/availability/datesAvailable dates for a service
POST/availability/slotsTime slots for a specific date
POST/availability/checkCheck if a slot is available
POST/booking/createCreate a booking (standard)
POST/booking/create-with-paymentCreate booking with payment bypass (coupon)
\n

Health Contract

\n

GET /health is the stable downstream runtime-truth surface.

\n

In addition to basic runtime data, it now publishes:

\n\n

Downstream apps should use this tuple to assert which bridge release and protocol\nsurface they are talking to during beta validation and rollout claims.

\n

This tuple is the supported runtime truth surface for adopters. Downstream apps\nshould not infer bridge ownership from package metadata, branch names, or Modal\ndashboard state when /health is available.

\n

Environment Variables

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
VariableRequiredDefaultDescription
PORTNo3001Server port
ACUITY_BASE_URLNohttps://MassageIthaca.as.meAcuity scheduling page URL
AUTH_TOKENRecommended--Bearer token for all endpoints (except /health)
ACUITY_BYPASS_COUPONFor payment bypass--100% gift certificate code
PLAYWRIGHT_HEADLESSNotrueRun browser headless
PLAYWRIGHT_TIMEOUTNo30000Page operation timeout (ms)
CHROMIUM_EXECUTABLE_PATHNo--Custom Chromium path (for Lambda/serverless)
CHROMIUM_LAUNCH_ARGSNo--Comma-separated Chromium args
SERVICES_JSONNo--Optional static service catalog to bypass live Acuity reads
ACUITY_SERVICE_CACHE_TTL_MSNo300000TTL for cached live service catalogs before BUSINESS/scraper refresh
SCHEDULING_BRIDGE_SLOT_PROFILE_THRESHOLD_MSNo1500Threshold in ms for logging long-tail slot-read profile events
SCHEDULING_BRIDGE_PROFILE_SLOT_READSNofalseForce logging of slot-read profile events even when under threshold
MIDDLEWARE_RELEASE_SHANo--Release commit SHA exposed via /health
MIDDLEWARE_RELEASE_REFNo--Release ref/tag exposed via /health
MIDDLEWARE_RELEASE_VERSIONNo--Release version exposed via /health
MIDDLEWARE_RELEASE_BUILT_ATNo--Build timestamp exposed via /health
MIDDLEWARE_BUILD_TIMESTAMPNo--Legacy fallback build timestamp for /health
\n

Observability

\n

The bridge emits NDJSON logs to stdout/stderr for runtime analysis.

\n\n

Deployment

\n

Standalone Node.js

\n
pnpm install\npnpm dev           # Development with tsx against src/server/handler.ts\n# or\npnpm build && pnpm start  # Materialize Bazel-derived dist/ and start it
\n

Docker

\n
docker build -t scheduling-bridge .\ndocker run -p 3001:3001 \\\n  -e AUTH_TOKEN=your-secret-token \\\n  -e ACUITY_BASE_URL=https://YourBusiness.as.me \\\n  -e ACUITY_BYPASS_COUPON=your-coupon-code \\\n  scheduling-bridge
\n

Modal Labs

\n
# Set secrets in Modal dashboard first:\n#   AUTH_TOKEN, ACUITY_BASE_URL, ACUITY_BYPASS_COUPON\n# The Modal workflow materializes the Bazel-derived pkg/ before deploy.\nmodal deploy modal-app.py
\n

Supported deployment path

\n

The supported deployment path for the live Acuity bridge is:

\n
    \n
  1. merge to main
    2. \n
  2. let .github/workflows/deploy-modal.yml deploy modal-app.py
    3. \n
  3. inject MIDDLEWARE_RELEASE_SHA, MIDDLEWARE_RELEASE_REF,\nMIDDLEWARE_RELEASE_VERSION, and MIDDLEWARE_RELEASE_BUILT_AT
    4. \n
  4. verify the resulting bridge tuple via GET /health
    5. \n
\n

Operationally, this means:

\n\n

Nix

\n
nix develop   # Enter dev shell with Node.js + Playwright\npnpm install\npnpm dev
\n\n

Release Authority

\n

Current release authority:

\n\n

The current publish + deploy shape is:

\n
    \n
  1. release metadata declared once
    2. \n
  2. Bazel validates/builds the publishable artifact
    3. \n
  3. CI dry-runs the extracted Bazel package surface before release
    4. \n
  4. GitHub Actions publishes that extracted artifact
    5. \n
  5. GitHub Actions deploys the Modal runtime from main
    6. \n
  6. downstream apps consume the published package and verify the live runtime\ntuple via /health
    7. \n
\n

This repo is the sole owner of Acuity automation concerns. App repos and shared\npackages may consume the bridge and assert its runtime tuple, but they should\nnot duplicate bridge runtime ownership or release truth logic.

\n

Runner Authority

\n

Package CI and publish currently use the shared js-bazel-package workflow with\nrunner_mode: shared and publish_mode: same_runner.

\n

The concrete shared-runner labels come from repository Actions variables and\nmust be proven by green workflow runs before they are treated as operational\ntruth. Keep private runner topology and apply details out of this public repo.

\n

Development

\n
pnpm install      # Install dependencies\npnpm dev          # Start dev server with tsx\npnpm typecheck    # Run Bazel typecheck target\npnpm build        # Materialize local pkg/ and dist/ from bazel-bin/pkg\npnpm test         # Run Bazel test target\npnpm docs:generate
\n

License

\n

MIT

\n
", "readme_excerpt": "\nBackend-agnostic scheduling adapter hub. Currently bridges Acuity Scheduling via Playwright browser automation, with architecture designed to support additional scheduling backends.\n> Formerly acuity-middleware. Historical GitHub URLs may redirect, but the\n> canonical repo is Jesssullivan/scheduling-bridge.\nAn HTTP server wrapping Playwright wizard flows that automate the Acuity booking UI. The bridge uses Effect TS for resource lifecycle...", "install_commands": { "npm": "npm install @tummycrypt/scheduling-bridge" }, "repo_url": "https://github.com/jesssullivan/scheduling-bridge", "website_url": null, "docs_url": null, "registry_url": "https://www.npmjs.com/package/@tummycrypt/scheduling-bridge", "releases_url": "https://github.com/jesssullivan/scheduling-bridge/releases", "og_image_url": "https://opengraph.githubassets.com/3d508e58b48c4c1a934e77ec05d12dec5f4946557142afedca82b17160f6c40d/Jesssullivan/scheduling-bridge", "license": "MIT", "pushed_at": "2026-04-26T03:01:19Z", "enriched_at": "2026-04-26T17:17:12.499Z", "gate": "override" }, { "slug": "jesssullivan-scheduling-kit", "name": "scheduling-kit", "repo": "jesssullivan/scheduling-kit", "org": "jesssullivan", "ecosystem": "npm", "category": "scheduling", "description": "Backend-agnostic scheduling system with Acuity, CalCom, and homegrown adapters", "featured": true, "tags": [ "scheduling", "svelte", "payments", "effect-ts" ], "version": "0.6.1", "release_date": "2026-04-11T22:38:29Z", "releases": [ { "tag": "0.6.1", "date": "2026-04-11T22:38:29Z", "body": "Status helpers: getStripeSetupSteps, getPayPalSetupSteps, getOverallProgress + 17 tests." }, { "tag": "0.6.0", "date": "2026-04-11T17:02:51Z", "body": "New `@tummycrypt/scheduling-kit/onboarding` subpackage.\n\n## What's new\n- `CredentialStore` + `EncryptionProvider` interfaces for app-provided storage\n- Stripe Connect OAuth: `buildStripeAuthorizeUrl()`, `exchangeStripeCode()`\n- Stripe account status: `getStripeAccountStatus()`\n- Stripe key validation: `validateStripeKeys()`\n- Stripe webhook CRUD: `createStripeWebhook()`, `deleteStripeWebhooks()`\n- PayPal credential validation: `validatePayPalCredentials()`\n- PayPal webhook creation: `createPayPalWebhook()`\n- Bazel `//src/onboarding` target\n- `./onboarding` package.json export\n\n## Pattern\nLibrary defines interfaces + pure helpers. Application implements CredentialStore with its DB.\nSame DI pattern as HomegrownAdapter's getDb callback." }, { "tag": "0.5.2", "date": "2026-04-11T01:34:51Z", "body": "PayPal return URLs for proper popup flow. Fixes extra 2FA verification loops during Venmo checkout." }, { "tag": "0.5.1", "date": "2026-04-08T14:20:35Z", "body": "Add payeeEmail option to VenmoAdapterConfig. Routes payments to practitioner's PayPal account via purchase_units.payee.email_address." }, { "tag": "0.5.0", "date": "2026-04-07T21:05:02Z", "body": "## Breaking Changes\n\n- Removed `AcuityScraper` and `createScraperAdapter()` — scraper functionality now lives in `@tummycrypt/scheduling-bridge`\n- Removed middleware code (11,215 lines) — now in `@tummycrypt/scheduling-bridge`\n\n## Added\n\n- Bazel 8 configuration (MODULE.bazel, BUILD.bazel with subpackage targets)\n- `.bazelrc` with CI/debug/release configs\n- `.npmrc` with `hoist=false` for rules_js compatibility\n\n## Migration\n\nReplace `@tummycrypt/scheduling-kit` scraper imports with `@tummycrypt/scheduling-bridge`:\n\n```diff\n- import { createScraperAdapter } from '@tummycrypt/scheduling-kit/adapters'\n+ import { createScraperAdapter } from '@tummycrypt/scheduling-bridge'\n```" }, { "tag": "0.4.0", "date": "2026-04-06T00:20:10Z", "body": "BREAKING: Remove middleware code (11,215 lines). Middleware belongs in @tummycrypt/acuity-middleware. scheduling-kit is the homegrown backend, not the Acuity adapter." }, { "tag": "0.3.1", "date": "2026-04-05T17:33:03Z", "body": "Fix dark mode text contrast: 63 single-value color classes replaced with Skeleton light-dark pairings across 13 component files." }, { "tag": "0.3.0", "date": "2026-03-30T03:18:42Z", "body": "Middleware subsystem, Effect migration, test gate, npm provenance." }, { "tag": "0.2.1", "date": "2026-03-29T03:17:09Z", "body": "## What's Changed\n- **Fix 5 runtime crashes** from leftover fp-ts calling conventions that survived the Effect 3.x migration\n- **Fix parse error** in homegrown adapter `createBookingWithPaymentRef` (extra closing paren)\n- **Fix broken `getAvailableMethods()`** in PaymentRegistry — was always returning empty array\n- **Fix `CheckoutDrawer`** — all 5 data-loading functions now use `Effect.runPromise` instead of fp-ts thunks\n- **Remove dead re-export** of non-existent `fp-ts.js` test helper\n- **Fix `E.Either` type references** in deprecated acuity-scraper\n\n## Upgrading from 0.2.0\nNo API changes — this is a bugfix release. All consumers should upgrade:\n```bash\npnpm add @tummycrypt/scheduling-kit@0.2.1\n```" }, { "tag": "0.1.1", "date": "2026-03-24T20:57:31Z", "body": "## @tummycrypt/scheduling-kit v0.1.1\n\nBackend-agnostic scheduling system with Acuity, CalCom, and homegrown PostgreSQL adapters.\n\n### Install\n\n```bash\nnpm install @tummycrypt/scheduling-kit\n```\n\n### npm\n\nhttps://www.npmjs.com/package/@tummycrypt/scheduling-kit\n\n### Changes in v0.1.1\n\n- Updated repository URL after transfer to Jesssullivan/scheduling-kit" } ], "stars": 0, "topics": [ "acuity-scheduling", "calcom", "functional-design", "postgresql", "property-based-testing", "scheduling-system", "sveltekit", "zod-validation", "no-api-no-problem", "work-harder-not-smarter" ], "languages": [ { "name": "TypeScript", "color": "#3178c6", "bytes": 652061 }, { "name": "Svelte", "color": "#ff3e00", "bytes": 121992 }, { "name": "JavaScript", "color": "#f1e05a", "bytes": 14612 }, { "name": "Starlark", "color": "#76d275", "bytes": 11719 }, { "name": "Nix", "color": "#7e7eff", "bytes": 2794 } ], "primary_language": "TypeScript", "readme_html": "

@tummycrypt/scheduling-kit

\n

Backend-agnostic scheduling library with Svelte 5 components, pluggable\nscheduling adapters, alternative payment support, and Effect-powered workflow\ncomposition.

\n

This repo keeps two intentionally different build surfaces:

\n\n

The recommended local bootstrap path is the repo flake plus direnv, which\nmakes pnpm, bazel through Bazelisk, and the docs toolchain available from a\nclean shell.

\n

Features

\n\n

Installation

\n
pnpm add @tummycrypt/scheduling-kit
\n

Development Environment

\n
direnv allow\npnpm install
\n

If bazel is missing in your current shell, enter the flake environment with\nnix develop or let direnv load .envrc. The dev shell provides a bazel\nwrapper backed by Bazelisk and pinned by .bazelversion.

\n

Peer dependencies (install those you need):

\n
# Required\npnpm add svelte\n\n# Optional -- for UI components\npnpm add @skeletonlabs/skeleton @skeletonlabs/skeleton-svelte\n\n# Optional -- for E2E tests\npnpm add -D playwright-core
\n

Release Hygiene

\n
pnpm check:release-metadata\npnpm check:package\nbazel build //:pkg\nnpm pack --dry-run ./bazel-bin/pkg
\n

Those checks keep package.json, MODULE.bazel, and BUILD.bazel aligned,\nthen validate the Bazel-built package artifact before anything gets near a\nregistry.

\n

Documentation

\n
pnpm docs:generate      # Regenerate derived Markdown and llms surfaces\npnpm docs:check         # Validate generated docs and MkDocs config\npnpm docs:serve         # Local docs preview at http://127.0.0.1:8000\nnix build .#docs        # Build the static docs site as a derivation\nnix flake check         # Evaluate flake outputs and run lightweight checks
\n

Release Authority

\n

Current reality:

\n\n

Treat Jesssullivan/main as the release authority for package publication and\nmetadata changes. Do not assume both main branches are equivalent.

\n

Longer term, the intended publish shape is:

\n
    \n
  1. release metadata declared once
    2. \n
  2. Bazel defines and builds the publishable artifact
    3. \n
  3. GitHub Actions publishes that artifact to npm
    4. \n
  4. downstream apps consume the published package only
    5. \n
\n

Runner Authority

\n

Package CI and publish currently use the shared js-bazel-package workflow with\nrunner_mode: shared and labels from PRIMARY_LINUX_RUNNER_LABELS_JSON.

\n

Treat that runner contract as pending proof until the repo Actions runner API\nand green workflow runs confirm the lane. Keep private runner topology and\napply details out of this public repo.

\n

Quick Start

\n
import { Effect } from 'effect';\nimport {\n  createSchedulingKit,\n  createHomegrownAdapter,\n  createStripeAdapter,\n  createVenmoAdapter,\n} from '@tummycrypt/scheduling-kit';\n\n// Create a scheduling adapter\nconst scheduler = createHomegrownAdapter({\n  db: drizzleInstance,\n  timezone: 'America/New_York',\n});\n\n// Create payment adapters\nconst stripe = createStripeAdapter({\n  type: 'stripe',\n  secretKey: process.env.STRIPE_SECRET_KEY!,\n  publishableKey: process.env.STRIPE_PUBLISHABLE_KEY!,\n});\n\nconst venmo = createVenmoAdapter({\n  type: 'venmo',\n  clientId: process.env.PAYPAL_CLIENT_ID!,\n  clientSecret: process.env.PAYPAL_CLIENT_SECRET!,\n  environment: 'sandbox',\n});\n\n// Compose into a scheduling kit\nconst kit = createSchedulingKit(scheduler, [stripe, venmo]);\n\n// Complete a booking\nconst result = await Effect.runPromise(\n  kit.completeBooking(request, 'stripe')\n);
\n

Ownership Boundary

\n

This package owns reusable scheduling contracts, payment adapters, checkout UI,\nand Acuity REST plus iframe handoff primitives.

\n

It does not own:

\n\n

If your Acuity flow needs browser automation or remote bridge-backed booking\nsemantics, that ownership belongs to @tummycrypt/scheduling-bridge plus the\nadopter app that wires the handoff.

\n

Adapters

\n

HomegrownAdapter

\n

Direct PostgreSQL adapter using Drizzle ORM. Replaces third-party scheduling\nAPIs entirely.

\n
import { createHomegrownAdapter } from '@tummycrypt/scheduling-kit/adapters';\n\nconst adapter = createHomegrownAdapter({\n  db: drizzleInstance,\n  timezone: 'America/New_York',\n});\n\n// 16 methods: getServices, getAvailability, getSlots, book, cancel,\n// reschedule, ...
\n

AcuityAdapter

\n

API-based adapter for Acuity Scheduling (requires Powerhouse plan).\nFor browser automation and no-API migration flows, use\n@tummycrypt/scheduling-bridge.

\n
import { createAcuityAdapter } from '@tummycrypt/scheduling-kit/adapters';\n\nconst config = {\n  type: 'acuity' as const,\n  userId: process.env.ACUITY_USER_ID!,\n  apiKey: process.env['ACUITY_API_KEY']!,  // from Acuity Integrations page\n};\nconst adapter = createAcuityAdapter(config);
\n

CalComAdapter

\n

Stub adapter for future Cal.com integration.

\n
import { createCalComAdapter } from '@tummycrypt/scheduling-kit/adapters';\n\nconst adapter = createCalComAdapter({\n  type: 'calcom',\n  apiKey: process.env['CALCOM_API_KEY']!,\n  baseUrl: 'https://api.cal.com/v1',\n});
\n

Availability Engine

\n

Pure functions for slot generation. DST-safe, timezone-aware, fully tested.

\n
import {\n  getAvailableSlots,\n  isSlotAvailable,\n  getDatesWithAvailability,\n  getEffectiveHours,\n} from '@tummycrypt/scheduling-kit/adapters';\n\nconst slots = getAvailableSlots({\n  date: '2026-03-22',\n  timezone: 'America/New_York',\n  hours: [{ dayOfWeek: 6, startTime: '11:00', endTime: '16:00' }],\n  overrides: [],\n  occupied: [],\n  slotDuration: 60,\n  bufferMinutes: 15,\n});
\n

Components

\n

Svelte 5 components using runes syntax. Optional Skeleton 4 integration for styling.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ComponentDescription
ServicePickerService/appointment type selector
DateTimePickerCalendar date + time slot picker
ClientFormClient info form with Zod validation
PaymentSelectorPayment method chooser
ProviderPickerPractitioner/provider selector
BookingConfirmationPost-booking confirmation display
CheckoutDrawerFull checkout flow in a slide-out drawer
HybridCheckoutDrawerCheckout UI for adopter-provided Acuity handoff
VenmoButtonVenmo/PayPal payment button
VenmoCheckoutFull Venmo checkout flow
StripeCheckoutStripe Elements checkout
AcuityEmbedHandoffPrefilled Acuity iframe handoff with postMessage
\n
<script lang=\"ts\">\n  import {\n    ServicePicker,\n    DateTimePicker,\n    ClientForm,\n  } from '@tummycrypt/scheduling-kit/components';\n</script>\n\n<ServicePicker services={data.services} onselect={handleSelect} />\n<DateTimePicker slots={availableSlots} onselect={handleTimeSelect} />\n<ClientForm onsubmit={handleSubmit} />
\n

Payment Adapters

\n
import {\n  createStripeAdapter,\n  createVenmoAdapter,\n  createCashAdapter,\n  createZelleAdapter,\n  createCheckAdapter,\n  createVenmoDirectAdapter,\n} from '@tummycrypt/scheduling-kit/payments';
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
AdapterTypeDescription
createStripeAdapterstripeStripe Connect with Payment Intents
createVenmoAdaptervenmoPayPal SDK with Venmo button
createCashAdaptercashCash/in-person manual payment
createZelleAdapterzelleZelle manual payment
createCheckAdaptercheckCheck manual payment
createVenmoDirectAdaptervenmo-directVenmo deep link (no SDK)
\n

Reconciliation

\n

Match alt-payment transactions (Venmo, Zelle, cash) to bookings.

\n
import {\n  createReconciliationMatcher,\n} from '@tummycrypt/scheduling-kit/reconciliation';
\n

Stores

\n

Svelte 5 runes-based checkout state management.

\n
import { checkoutStore } from '@tummycrypt/scheduling-kit/stores';
\n

Testing

\n

Unit Tests

\n
pnpm test:unit           # Run all unit tests\npnpm test:coverage       # With coverage report
\n

Integration Tests

\n
pnpm test:integration    # Mocked backend integration tests
\n

Component Tests

\n
pnpm test:component      # jsdom-based component tests
\n

E2E Tests

\n
pnpm test:e2e            # Playwright browser tests (starts dev server)
\n

Live Tests

\n
# Copy .env.test.local.example to .env.test.local and fill in credentials\nRUN_LIVE_TESTS=true pnpm test:live
\n

Test Utilities

\n

The @tummycrypt/scheduling-kit/testing export provides cassette-based API\nrecording and playback for deterministic integration tests.

\n
import { CassetteRecorder, CassettePlayer } from '@tummycrypt/scheduling-kit/testing';
\n

Development

\n
pnpm install\npnpm dev              # Start dev server\npnpm build            # Build package\npnpm check            # TypeScript check\npnpm lint             # ESLint\npnpm test:all         # Run all test suites
\n

License

\n

MIT -- see LICENSE for details.

\n
", "readme_excerpt": "Backend-agnostic scheduling library with Svelte 5 components, pluggable\nscheduling adapters, alternative payment support, and Effect-powered workflow\ncomposition.\nThis repo keeps two intentionally different build surfaces:\n- pnpm is the local package-manager and script interface\n- Bazel defines and builds the publishable package artifact used by CI\nThe recommended local bootstrap path is the repo flake plus direnv, which\nmakes pnpm, bazel through Bazelisk, and the docs toolchain available from...", "install_commands": { "npm": "npm install @tummycrypt/scheduling-kit" }, "repo_url": "https://github.com/jesssullivan/scheduling-kit", "website_url": null, "docs_url": null, "registry_url": "https://www.npmjs.com/package/@tummycrypt/scheduling-kit", "releases_url": "https://github.com/jesssullivan/scheduling-kit/releases", "og_image_url": "https://opengraph.githubassets.com/66be7190fcfbe417c3a4a1a23fb0c2ed085b1cfb755a5bfa8c2f95a43e538807/Jesssullivan/scheduling-kit", "license": "MIT", "pushed_at": "2026-04-26T03:00:51Z", "enriched_at": "2026-04-26T17:17:12.838Z", "gate": "override" }, { "slug": "jesssullivan-darwinnicutil", "name": "DarwinNicUtil", "repo": "jesssullivan/DarwinNicUtil", "org": "jesssullivan", "ecosystem": "multi", "category": "systems", "description": "Extensible utility for dealing with out-of-band management / air gapped network devices, mostly for institutionalized Macs (ABR, Sophos, NIC precedence etc) ", "featured": false, "tags": [ "network", "oob", "mac", "enterprise" ], "version": "2.1.2", "release_date": "2026-04-25T20:41:54Z", "releases": [ { "tag": "2.1.2", "date": "2026-04-25T20:41:54Z", "body": "## What's Changed\n* Document live PyPI install by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/31\n* Polish final release surfaces by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/32\n* Improve docs install and Pages surfaces by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/33\n* Prepare v2.1.2 metadata release by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/34\n\n\n**Full Changelog**: https://github.com/Jesssullivan/DarwinNicUtil/compare/v2.1.1...v2.1.2" }, { "tag": "2.1.1", "date": "2026-04-25T19:49:34Z", "body": "## What's Changed\n* Restrict release asset globs by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/7\n* Clarify release artifact docs by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/8\n* Define agent integration surface by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/15\n* Track distribution follow-up surfaces by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/18\n* Defer Homebrew distribution by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/19\n* [codex] stage FlakeHub publication workflow by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/20\n* [codex] advertise proven FlakeHub release by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/21\n* [codex] record Bazel packaging decision by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/22\n* [codex] stage PyPI trusted publishing by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/23\n* [codex] align standalone binary entrypoint by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/24\n* Ratchet coverage gate to 50 percent by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/25\n* Draft public project spec by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/26\n* Document ABR and Sophos boundary decisions by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/27\n* Clarify PyPI cutover runbook by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/28\n* Add package metadata links by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/29\n* Prepare v2.1.1 PyPI release by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/30\n\n\n**Full Changelog**: https://github.com/Jesssullivan/DarwinNicUtil/compare/v2.1.0...v2.1.1" }, { "tag": "2.1.0", "date": "2026-04-25T15:22:13Z", "body": "## What's Changed\n* feat: Nix flake packaging + justfile + HM/SM modules by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/1\n* add bastion diagnostics for darwin nic by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/5\n* Prepare v2.1 release readiness by @Jesssullivan in https://github.com/Jesssullivan/DarwinNicUtil/pull/6\n\n## New Contributors\n* @Jesssullivan made their first contribution in https://github.com/Jesssullivan/DarwinNicUtil/pull/1\n\n**Full Changelog**: https://github.com/Jesssullivan/DarwinNicUtil/compare/v2.0.0...v2.1.0" } ], "stars": 1, "topics": [ "airgapped-security", "compliance", "developer-experience", "nat-punchthrough", "nat-traversal", "tui", "enterprise-bastion" ], "languages": [ { "name": "Python", "color": "#3572A5", "bytes": 352236 }, { "name": "Nix", "color": "#7e7eff", "bytes": 18217 }, { "name": "Just", "color": "#384d54", "bytes": 6787 }, { "name": "Shell", "color": "#89e051", "bytes": 5524 } ], "primary_language": "Python", "readme_html": "

Darwin Management NIC Configurator

\n

Configure a USB Ethernet adapter for out-of-band management without letting it\ntake over normal Wi-Fi or tailnet connectivity.

\n

darwin-nic is aimed at bastion and bench workflows where a Mac needs a\ntemporary management link to network gear while keeping its primary network\npath intact.

\n

Status

\n\n

Quick Start

\n
# Recommended CLI install\nuv tool install darwin-mgmt-nic-configurator\ndarwin-nic status\ndarwin-nic init-config\ndarwin-nic configure --profile homelab --preserve-wifi\n\n# Run without installing, using the stable FlakeHub release\nnix run \"https://flakehub.com/f/Jesssullivan/DarwinNicUtil/v2.1.2\" -- status
\n

For a one-off setup without a saved profile:

\n
darwin-nic configure \\\n  --device-ip <device-ipv4> \\\n  --laptop-ip <usb-nic-ipv4> \\\n  --mgmt-network <cidr> \\\n  --preserve-wifi
\n

Install

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
PathUse WhenCommand
PyPIYou want the normal CLI on your PATHuv tool install darwin-mgmt-nic-configurator
FlakeHubYou want a stable Nix releasenix profile install \"https://flakehub.com/f/Jesssullivan/DarwinNicUtil/v2.1.2\"
GitHub flakeYou want the current repository flakenix profile install github:Jesssullivan/DarwinNicUtil
Source checkoutYou are developing or testing local changesuv sync --extra dev && uv run darwin-nic status
\n

Wheel and source distribution files are attached to GitHub Releases and\npublished to PyPI. Standalone binary downloads are not supported yet.

\n

Home Manager and System Manager modules are available under nix/modules/.\nFor the release shape and productionization summary, see\ndocs/project-spec.md.

\n

Commands

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CommandDescription
darwin-nic setupInteractive guided setup wizard
darwin-nic configureConfigure a USB NIC
darwin-nic statusShow interfaces, routes, and bastion diagnostics
darwin-nic dashboardShow network monitoring status
darwin-nic testRun basic connectivity checks
darwin-nic restoreRestore saved network service order
darwin-nic configShow resolved settings and profiles
darwin-nic profilesList available profiles
darwin-nic init-configCreate a starter config file
\n

Configuration

\n

Settings are loaded in this order, with later sources overriding earlier ones:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
LocationPurpose
/etc/darwin-nic/config.tomlSystem-wide defaults
~/.config/darwin-nic/config.tomlUser defaults
~/.darwin-nic.tomlLegacy user config
./.darwin-nic.tomlDirectory-local override
./darwin-nic.tomlAlternate directory-local override
DARWIN_NIC_*Environment overrides
\n

Example:

\n
default_profile = \"homelab\"\n\n[defaults]\npreserve_wifi = true\n\n[profiles.homelab]\ndevice_ip = \"192.168.88.1\"\nlaptop_ip = \"192.168.88.100\"\nmgmt_network = \"192.168.88.0/24\"\ndevice_name = \"Lab Management Device\"\ndevice_type = \"network\"
\n

See examples/config.toml for a fuller profile example.

\n

Bastion Notes

\n

For a generic tailnet -> bastion host -> USB OOB NIC -> managed network device flow:

\n\n

On macOS, status includes scutil --nwi, Tailscale system-extension state,\nand recent NECP socket-drop hints when available.

\n

Device-specific hostnames, credentials, OOB MAC addresses, and switch policy\nbelong in downstream operator repositories, not in this generic tool.

\n

Safety

\n\n

Requirements

\n\n

Development

\n
just dev\njust check\njust test\njust docs-build\nuv build
\n

Run just with no arguments to see all recipes.

\n

Artifacts

\n

Current release artifacts are:

\n\n

GitHub Release, PyPI, FlakeHub, and docs workflows are present for tag-based\npublication. Standalone binary distribution remains a tracked release follow-up.

\n

Public artifact URLs:

\n\n
", "readme_excerpt": "Configure a USB Ethernet adapter for out-of-band management without letting it\ntake over normal Wi-Fi or tailnet connectivity.\ndarwin-nic is aimed at bastion and bench workflows where a Mac needs a\ntemporary management link to network gear while keeping its primary network\npath intact.\n- macOS is the primary supported platform.\n- Linux support is experimental and currently limited.\n- Release artifacts are PyPI distributions, GitHub Release wheel/source\n files, Nix packages, and FlakeHub...", "install_commands": {}, "repo_url": "https://github.com/jesssullivan/DarwinNicUtil", "website_url": null, "docs_url": null, "registry_url": null, "releases_url": "https://github.com/jesssullivan/DarwinNicUtil/releases", "og_image_url": "https://opengraph.githubassets.com/c92f2ef076c3573813327495c89a91f024d86c0b33f4ffeb255b3a73f427c632/Jesssullivan/DarwinNicUtil", "license": "Zlib", "pushed_at": "2026-04-25T20:41:27Z", "enriched_at": "2026-04-26T17:17:13.165Z", "gate": "override" }, { "slug": "jesssullivan-zig-notify", "name": "zig-notify", "repo": "jesssullivan/zig-notify", "org": "jesssullivan", "ecosystem": "zig", "category": "systems", "description": "Cross-platform notifications in Zig with C FFI — macOS osascript / Linux libnotify", "featured": false, "tags": [ "notifications", "desktop", "ffi", "cross-platform" ], "version": "0.1.0", "release_date": "2026-04-25T18:50:20Z", "releases": [ { "tag": "0.1.0", "date": "2026-04-25T18:50:20Z", "body": "## What's Changed\n* fix(build): add Fedora/Rocky/Arch glib-2.0 include paths by @Jesssullivan in https://github.com/Jesssullivan/zig-notify/pull/1\n* Productionize: build.zig.zon, autodoc, examples, agent metadata by @Jesssullivan in https://github.com/Jesssullivan/zig-notify/pull/2\n* Add autodoc CI job and release workflow by @Jesssullivan in https://github.com/Jesssullivan/zig-notify/pull/3\n* Fix: run release workflow on macOS by @Jesssullivan in https://github.com/Jesssullivan/zig-notify/pull/4\n\n## New Contributors\n* @Jesssullivan made their first contribution in https://github.com/Jesssullivan/zig-notify/pull/1\n\n**Full Changelog**: https://github.com/Jesssullivan/zig-notify/commits/v0.1.0" } ], "stars": 0, "topics": [ "abstraction", "d-bus", "libnotify", "notificationcenter", "c-interop", "ffi", "linux", "macos", "notifications", "zig" ], "languages": [ { "name": "Python", "color": "#3572A5", "bytes": 38397 }, { "name": "Zig", "color": "#ec915c", "bytes": 13391 }, { "name": "C", "color": "#555555", "bytes": 2164 }, { "name": "Nix", "color": "#7e7eff", "bytes": 1002 }, { "name": "Shell", "color": "#89e051", "bytes": 21 } ], "primary_language": "Python", "readme_html": "

zig-notify

\n

Cross-platform notification abstraction in Zig with C FFI -- macOS (osascript) and Linux (libnotify).

\n

License: Zlib OR MIT

\n

Why

\n

Desktop notifications have completely different APIs on macOS (UNUserNotificationCenter or osascript) and Linux (libnotify/D-Bus). This library provides a single C API that works on both platforms, with urgency level support and proper lifecycle management.

\n

Features

\n\n

Installation

\n

Zig Package Manager (recommended)

\n
zig fetch --save git+https://github.com/Jesssullivan/zig-notify.git
\n

Then in your build.zig:

\n
const dep = b.dependency(\"zig-notify\", .{ .target = target, .optimize = optimize });\nexe.root_module.addImport(\"zig-notify\", dep.module(\"zig-notify\"));
\n

Git Submodule (C FFI consumers)

\n
git submodule add https://github.com/Jesssullivan/zig-notify.git vendor/notify\ncd vendor/notify && zig build -Doptimize=ReleaseFast
\n

Link (macOS): -lzig-notify (no frameworks; uses osascript binary).\nLink (Linux): -lzig-notify -lnotify -lglib-2.0 -lgobject-2.0.\nInclude: #include \"zig_notify.h\".

\n

Requirements

\n\n

Architecture

\n
\n
\n
\n 
graph TD\n    A[Application] -->|C FFI| B[ffi.zig<br/>4 exported functions]\n    B --> C[notify.zig<br/>Platform dispatch]\n    C -->|macOS| D[notify_macos.zig<br/>osascript]\n    C -->|Linux| E[notify_linux.zig<br/>libnotify]\n\n    D --> F[osascript -e<br/>display notification]\n    E --> G[notify_notification_new<br/>notify_notification_show]\n\n    style B fill:#48c,stroke:#269\n    style D fill:#a6d,stroke:#84b\n    style E fill:#6a4,stroke:#483\n
\n
\n
\n \n \n Loading\n\n \n
\n\n

Build

\n
# Static library (libzig-notify.a)\nzig build -Doptimize=ReleaseFast\n\n# Run unit tests\nzig build test
\n

With Nix:

\n
nix develop       # dev shell\nnix build         # build library package
\n

Platform Support

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
PlatformBackendPackagesStatus
macOS 13+ (arm64/x86_64)osascript (AppleScript)NoneTested
Linux (x86_64/arm64)libnotify (GLib)libnotify-dev (apt) / libnotify-devel (dnf)Supported
Cross-compilation--Libs linked at final buildSupported
\n

C FFI API Reference

\n

Header: include/zig_notify.h

\n

Types

\n
typedef enum {\n    ZIG_NOTIFY_URGENCY_LOW = 0,\n    ZIG_NOTIFY_URGENCY_NORMAL = 1,\n    ZIG_NOTIFY_URGENCY_CRITICAL = 2,\n} zig_notify_urgency_t;
\n

Initialize

\n
// Initialize the notification system.\n// Must be called before zig_notify_send on Linux (calls notify_init).\n// No-op on macOS.\n// Returns: 0 on success, -1 on failure\nint zig_notify_init(const char *app_name, size_t app_name_len);
\n

Send Notification

\n
// Send a desktop notification.\n// body may be NULL (body_len = 0) for title-only notifications.\n// Returns: 0 on success, -1 on failure\n//\n// macOS: osascript \"display notification\" (urgency ignored)\n// Linux: notify_notification_new + notify_notification_show\nint zig_notify_send(\n    const char *title, size_t title_len,\n    const char *body, size_t body_len,\n    zig_notify_urgency_t urgency\n);
\n

Request Permission

\n
// Request notification permission (macOS only, no-op on Linux).\n// Returns: 0 if granted, -1 if denied, -2 on error\n//\n// Currently returns 0 on all platforms (osascript does not require permission).\nint zig_notify_request_permission(void);
\n

Cleanup

\n
// Clean up notification resources.\n// Should be called on app exit on Linux (calls notify_uninit).\n// No-op on macOS.\nvoid zig_notify_deinit(void);
\n

Zig API Reference

\n

For direct Zig usage (not via C FFI):

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ModulePublic APIDescription
notify.zigsend(title, body, urgency) !voidSend a notification (platform-dispatched)
notify.ziginit(app_name) !voidInitialize (Linux: notify_init)
notify.zigdeinit()Cleanup (Linux: notify_uninit)
notify.zigUrgency (enum: low, normal, critical)Notification urgency level
\n

Integration

\n

As a Git Submodule

\n
git submodule add https://github.com/Jesssullivan/zig-notify.git vendor/notify\ncd vendor/notify && zig build -Doptimize=ReleaseFast
\n

Link (macOS): -lzig-notify (no frameworks needed; osascript is a system binary)

\n

Link (Linux): -lzig-notify -lnotify -lglib-2.0 -lgobject-2.0

\n

Include: #include \"zig_notify.h\" (path: vendor/notify/include/)

\n

Swift via Bridging Header

\n
#include \"zig_notify.h\"\n\n// Send a notification\nlet title = \"Download Complete\"\nlet body = \"file.zip has been saved\"\nzig_notify_send(title, title.utf8.count, body, body.utf8.count, ZIG_NOTIFY_URGENCY_NORMAL)
\n

License

\n

Dual-licensed under Zlib and MIT. Choose whichever you prefer.

\n
", "readme_excerpt": "Cross-platform notification abstraction in Zig with C FFI -- macOS (osascript) and Linux (libnotify).\nLicense: Zlib OR MIT\nDesktop notifications have completely different APIs on macOS (UNUserNotificationCenter or osascript) and Linux (libnotify/D-Bus). This library provides a single C API that works on both platforms, with urgency level support and proper lifecycle management.\n- Send notifications: Title, body, and urgency level\n- Permission handling: Request notification permission (macOS),...", "install_commands": { "zig": "zig fetch --save git+https://github.com/jesssullivan/zig-notify.git" }, "repo_url": "https://github.com/jesssullivan/zig-notify", "website_url": "http://transscendsurvival.org/zig-notify/", "docs_url": "https://jesssullivan.github.io/zig-notify/", "registry_url": "https://zigistry.dev/package/{repo}", "releases_url": "https://github.com/jesssullivan/zig-notify/releases", "og_image_url": "https://opengraph.githubassets.com/ea19b432c1d980e16792ed94df39b3d139f2d6e4877bcd1e9a66a20fbeeaaa87/Jesssullivan/zig-notify", "license": "NOASSERTION", "pushed_at": "2026-04-25T18:49:45Z", "enriched_at": "2026-04-26T17:17:13.472Z", "gate": "pages" }, { "slug": "jesssullivan-zig-keychain", "name": "zig-keychain", "repo": "jesssullivan/zig-keychain", "org": "jesssullivan", "ecosystem": "zig", "category": "cryptography", "description": "Cross-platform keychain abstraction in Zig with C FFI — macOS SecItem / Linux libsecret", "featured": false, "tags": [ "keychain", "secrets", "ffi", "cross-platform" ], "version": "0.1.0", "release_date": "2026-04-25T18:50:26Z", "releases": [ { "tag": "0.1.0", "date": "2026-04-25T18:50:26Z", "body": "## What's Changed\n* Use linkSystemLibrary for distro-agnostic include paths by @Jesssullivan in https://github.com/Jesssullivan/zig-keychain/pull/3\n* Productionize: build.zig.zon, autodoc, examples, agent metadata by @Jesssullivan in https://github.com/Jesssullivan/zig-keychain/pull/4\n* Add autodoc CI and release workflow by @Jesssullivan in https://github.com/Jesssullivan/zig-keychain/pull/5\n* Fix: run release workflow on macOS by @Jesssullivan in https://github.com/Jesssullivan/zig-keychain/pull/6\n\n## New Contributors\n* @Jesssullivan made their first contribution in https://github.com/Jesssullivan/zig-keychain/pull/3\n\n**Full Changelog**: https://github.com/Jesssullivan/zig-keychain/commits/v0.1.0" } ], "stars": 0, "topics": [ "attestation-compatibility", "ffi", "libsecret", "secitem", "c-interop", "keychain", "secrets", "zig", "zig-package" ], "languages": [ { "name": "Python", "color": "#3572A5", "bytes": 37765 }, { "name": "Zig", "color": "#ec915c", "bytes": 18276 }, { "name": "C", "color": "#555555", "bytes": 7214 }, { "name": "Nix", "color": "#7e7eff", "bytes": 1187 }, { "name": "Shell", "color": "#89e051", "bytes": 21 } ], "primary_language": "Python", "readme_html": "

zig-keychain

\n

Cross-platform keychain/secrets abstraction in Zig with C FFI -- macOS Keychain (SecItem) and Linux Secret Service (libsecret).

\n

License: Zlib OR MIT

\n

Why

\n

Applications need to store credentials, tokens, and other secrets securely. Platform APIs differ significantly: macOS uses Security.framework (SecItemAdd/CopyMatching/Delete), Linux uses the D-Bus Secret Service API via libsecret. This library provides a single C API that works on both platforms.

\n

Features

\n\n

Installation

\n

Zig Package Manager (recommended)

\n
zig fetch --save git+https://github.com/Jesssullivan/zig-keychain.git
\n

Then in your build.zig:

\n
const dep = b.dependency(\"zig-keychain\", .{ .target = target, .optimize = optimize });\nexe.root_module.addImport(\"zig-keychain\", dep.module(\"zig-keychain\"));
\n

Git Submodule (C FFI consumers)

\n
git submodule add https://github.com/Jesssullivan/zig-keychain.git vendor/keychain\ncd vendor/keychain && zig build -Doptimize=ReleaseFast
\n

Link (macOS): -lzig-keychain -framework Security -framework CoreFoundation

\n

Link (Linux): -lzig-keychain $(pkg-config --libs libsecret-1 glib-2.0)

\n

Include #include \"zig_keychain.h\".

\n

Requirements

\n\n

Architecture

\n
\n
\n
\n 
graph TD\n    A[Application] -->|C FFI| B[ffi.zig<br/>4 exported functions]\n    B --> C[keychain.zig<br/>Platform dispatch]\n    C -->|macOS| D[keychain_macos.zig<br/>Security.framework<br/>SecItem API]\n    C -->|Linux| E[keychain_linux.zig<br/>libsecret<br/>D-Bus Secret Service]\n\n    D --> F[SecItemAdd<br/>SecItemCopyMatching<br/>SecItemDelete]\n    E --> G[secret_password_store_binary_sync<br/>secret_password_lookup_binary_sync<br/>secret_password_clear_sync]\n\n    style B fill:#48c,stroke:#269\n    style D fill:#a6d,stroke:#84b\n    style E fill:#6a4,stroke:#483\n
\n
\n
\n \n \n Loading\n\n \n
\n\n

Build

\n
# Static library (libzig-keychain.a)\nzig build -Doptimize=ReleaseFast\n\n# Run unit tests\nzig build test
\n

With Nix:

\n
nix develop       # dev shell\nnix build         # build library package
\n

Platform Support

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
PlatformBackendPackagesStatus
macOS 13+ (arm64/x86_64)Security.framework (SecItem)NoneTested
Linux (x86_64/arm64)libsecret (D-Bus Secret Service)libsecret-1-dev (apt) / libsecret-devel (dnf)Supported
Cross-compilation--Frameworks/libs linked at final buildSupported
\n

C FFI API Reference

\n

Header: include/zig_keychain.h

\n

Store

\n
// Store a generic secret in the system keychain/secret store.\n// Uses upsert semantics: existing item with same service+account is replaced.\n// Returns: 0 on success, -1 on failure\n//\n// macOS: SecItemDelete + SecItemAdd (kSecClassGenericPassword)\n// Linux: secret_password_store_binary_sync\nint zig_keychain_store(\n    const char *service, size_t service_len,\n    const char *account, size_t account_len,\n    const uint8_t *data, size_t data_len\n);
\n

Lookup

\n
// Look up a generic secret from the system keychain/secret store.\n// Returns: bytes written on success, -1 on not found, -2 on error\n//\n// macOS: SecItemCopyMatching (kSecReturnData)\n// Linux: secret_password_lookup_binary_sync\nint zig_keychain_lookup(\n    const char *service, size_t service_len,\n    const char *account, size_t account_len,\n    uint8_t *out, size_t out_capacity\n);
\n

Delete

\n
// Delete a generic secret from the system keychain/secret store.\n// Returns: 0 on success (including not-found), -1 on error\n//\n// macOS: SecItemDelete\n// Linux: secret_password_clear_sync\nint zig_keychain_delete(\n    const char *service, size_t service_len,\n    const char *account, size_t account_len\n);
\n

Search

\n
// Search for keychain items matching an account name.\n// Writes matching service names as null-separated strings to out.\n// Returns: number of matches found, -1 on error\n//\n// macOS: SecItemCopyMatching (kSecMatchLimitAll, kSecReturnAttributes)\n// Linux: secret_service_search_sync\nint zig_keychain_search(\n    const char *account, size_t account_len,\n    char *out, size_t out_capacity\n);
\n

Note: zig_keychain_search is declared in the C header but the FFI implementation is pending.

\n

Zig API Reference

\n

For direct Zig usage (not via C FFI):

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ModulePublic APIDescription
keychain.zigstore(service, account, data) !voidStore a secret (platform-dispatched)
keychain.ziglookup(service, account) !ResultLookup a secret (returns .success, .not_found, or .err)
keychain.zigdelete(service, account) !voidDelete a secret (platform-dispatched)
keychain.zigResult (union: success/not_found/err)Lookup result type
\n

Integration

\n

As a Git Submodule

\n
git submodule add https://github.com/Jesssullivan/zig-keychain.git vendor/keychain\ncd vendor/keychain && zig build -Doptimize=ReleaseFast
\n

Link (macOS): -lzig-keychain -framework Security -framework CoreFoundation

\n

Link (Linux): -lzig-keychain -lsecret-1 -lglib-2.0

\n

Include: #include \"zig_keychain.h\" (path: vendor/keychain/include/)

\n

Swift via Bridging Header

\n
#include \"zig_keychain.h\"\n\n// Store\nlet data: [UInt8] = Array(\"my-token\".utf8)\nzig_keychain_store(\"MyApp\", 5, \"user@example.com\", 16, data, data.count)\n\n// Lookup\nvar buf = [UInt8](repeating: 0, count: 256)\nlet len = zig_keychain_lookup(\"MyApp\", 5, \"user@example.com\", 16, &buf, buf.count)\nif len > 0 {\n    let token = String(bytes: buf[0..<Int(len)], encoding: .utf8)\n}
\n

License

\n

Dual-licensed under Zlib and MIT. Choose whichever you prefer.

\n
", "readme_excerpt": "Cross-platform keychain/secrets abstraction in Zig with C FFI -- macOS Keychain (SecItem) and Linux Secret Service (libsecret).\nLicense: Zlib OR MIT\nApplications need to store credentials, tokens, and other secrets securely. Platform APIs differ significantly: macOS uses Security.framework (SecItemAdd/CopyMatching/Delete), Linux uses the D-Bus Secret Service API via libsecret. This library provides a single C API that works on both platforms.\n- Store: Save secrets to the system keychain (upsert...", "install_commands": { "zig": "zig fetch --save git+https://github.com/jesssullivan/zig-keychain.git" }, "repo_url": "https://github.com/jesssullivan/zig-keychain", "website_url": "http://transscendsurvival.org/zig-keychain/", "docs_url": "https://jesssullivan.github.io/zig-keychain/", "registry_url": "https://zigistry.dev/package/{repo}", "releases_url": "https://github.com/jesssullivan/zig-keychain/releases", "og_image_url": "https://opengraph.githubassets.com/7e27457f9ea26b684dc975b90712262fb41869f595a8ef58c6f0525b0f31d5b1/Jesssullivan/zig-keychain", "license": "NOASSERTION", "pushed_at": "2026-04-25T18:49:34Z", "enriched_at": "2026-04-26T17:17:13.743Z", "gate": "pages" }, { "slug": "jesssullivan-zig-ctap2", "name": "zig-ctap2", "repo": "jesssullivan/zig-ctap2", "org": "jesssullivan", "ecosystem": "zig", "category": "cryptography", "description": "Portable FIDO2/WebAuthn in Zig with C FFI — direct USB HID, no Apple entitlements needed", "featured": true, "tags": [ "fido2", "ctap2", "webauthn", "usb-hid", "yubikey" ], "version": "0.4.0", "release_date": "2026-04-25T18:41:24Z", "releases": [ { "tag": "0.4.0", "date": "2026-04-25T18:41:24Z", "body": "## What's Changed\n* Add keepalive callback FFI for dock touch indicator by @Jesssullivan in https://github.com/Jesssullivan/zig-ctap2/pull/22\n* Fix ctap2_get_assertion_with_keepalive arg mismatch by @Jesssullivan in https://github.com/Jesssullivan/zig-ctap2/pull/23\n* Fix Linux build: platform IOReturn guard + Zig 0.15 ArrayList by @Jesssullivan in https://github.com/Jesssullivan/zig-ctap2/pull/24\n* fix(security): harden hidraw enumeration and FFI bounds by @Jesssullivan in https://github.com/Jesssullivan/zig-ctap2/pull/25\n* fix: add DevicesNotAccessible to macOS error set by @Jesssullivan in https://github.com/Jesssullivan/zig-ctap2/pull/26\n* productionize: package metadata, module export, docs by @Jesssullivan in https://github.com/Jesssullivan/zig-ctap2/pull/27\n* Add autodoc CI job and release workflow by @Jesssullivan in https://github.com/Jesssullivan/zig-ctap2/pull/28\n\n\n**Full Changelog**: https://github.com/Jesssullivan/zig-ctap2/compare/v0.3.1...v0.4.0" } ], "stars": 0, "topics": [ "ctap2", "ffi", "fido2", "library", "webauthn", "c-interop", "zig", "zig-package" ], "languages": [ { "name": "Zig", "color": "#ec915c", "bytes": 159340 }, { "name": "Python", "color": "#3572A5", "bytes": 34474 }, { "name": "C", "color": "#555555", "bytes": 10791 }, { "name": "Just", "color": "#384d54", "bytes": 2013 }, { "name": "Nix", "color": "#7e7eff", "bytes": 1808 } ], "primary_language": "Zig", "readme_html": "

zig-ctap2

\n

Portable CTAP2/FIDO2 library in Zig — direct USB HID communication with security keys (YubiKey, SoloKeys, etc.), no Apple entitlements or platform authentication frameworks needed.

\n

License: Zlib OR MIT

\n

Why

\n

Apple's ASAuthorizationController requires a restricted entitlement + provisioning profile for WebAuthn in general-purpose browsers. This library talks directly to FIDO2 devices over USB HID via IOKit (macOS) and hidraw (Linux), bypassing platform authentication frameworks entirely.

\n

Features

\n\n

Requirements

\n\n

Installation

\n

Zig Package Manager (recommended)

\n
zig fetch --save git+https://github.com/Jesssullivan/zig-ctap2.git
\n

Then in your build.zig:

\n
const dep = b.dependency(\"zig-ctap2\", .{ .target = target, .optimize = optimize });\nexe.root_module.addImport(\"zig-ctap2\", dep.module(\"zig-ctap2\"));
\n

Git Submodule (C FFI consumers)

\n
git submodule add https://github.com/Jesssullivan/zig-ctap2.git vendor/ctap2\ncd vendor/ctap2 && zig build -Doptimize=ReleaseFast
\n

Link -lctap2 and include ctap2.h. At final link time, add platform frameworks:

\n\n

Build

\n
# Static library (libctap2.a)\nzig build -Doptimize=ReleaseFast\n\n# Run unit tests\nzig build test\n\n# Run property-based tests\nzig build test-pbt\n\n# Run hardware tests (requires YubiKey connected)\nYUBIKEY_TESTS=1 zig build test-hardware
\n

With just (recommended):

\n
just test-all     # unit + PBT tests\njust build        # ReleaseFast static library\njust info         # show library stats\njust              # list all recipes
\n

With Nix:

\n
nix develop       # dev shell (zig, just, detect-secrets, pre-commit)\nnix build         # build library package
\n

Architecture

\n
\n
\n
\n 
graph TD\n    A[Application / Browser] -->|C FFI| B[ffi.zig]\n    B --> C[ctap2.zig<br/>Commands + Response Parsing]\n    B --> D[pin.zig<br/>PIN Protocol v2]\n    C --> E[cbor.zig<br/>CBOR Codec]\n    D --> E\n    C --> F[ctaphid.zig<br/>HID Framing]\n    D --> F\n    F --> G{Platform}\n    G -->|macOS| H[hid_macos.zig<br/>IOKit HID]\n    G -->|Linux| I[hid_linux.zig<br/>hidraw]\n
\n
\n
\n \n \n Loading\n\n \n
\n\n

Registration Flow

\n
\n
\n
\n 
sequenceDiagram\n    participant App\n    participant FFI as ffi.zig\n    participant CTAP as ctap2.zig\n    participant CBOR as cbor.zig\n    participant HID as ctaphid.zig\n    participant Key as YubiKey\n\n    App->>FFI: ctap2_make_credential_parsed()\n    FFI->>CTAP: encodeMakeCredential()\n    CTAP->>CBOR: CBOR encode request\n    CBOR-->>CTAP: bytes\n    CTAP->>HID: CTAPHID_CBOR (fragmented)\n    HID->>Key: USB HID packets\n    Note over Key: User touches key\n    Key-->>HID: Response packets\n    HID-->>CTAP: Reassembled CBOR\n    CTAP->>CTAP: parseMakeCredentialResponse()\n    CTAP-->>FFI: credential_id, attestation_object\n    FFI-->>App: Structured result\n
\n
\n
\n \n \n Loading\n\n \n
\n\n

Error Handling

\n
\n
\n
\n 
graph TD\n    E[CTAP2 Status Byte] -->|0x00| OK[Success]\n    E -->|0x2E| NC[No Credentials<br/>for this site]\n    E -->|0x27| OD[Operation Denied<br/>by user]\n    E -->|0x31| IP[Incorrect PIN]\n    E -->|0x32| PB[PIN Blocked]\n    E -->|0x35| PNS[PIN Not Set]\n    E -->|0x36| PV[PIN Policy<br/>Violation]\n\n    style OK fill:#2d5,stroke:#1a3\n    style NC fill:#d52,stroke:#a31\n    style OD fill:#d52,stroke:#a31\n    style IP fill:#d85,stroke:#a63\n    style PB fill:#d52,stroke:#a31\n    style PNS fill:#d85,stroke:#a63\n    style PV fill:#d85,stroke:#a63\n
\n
\n
\n \n \n Loading\n\n \n
\n\n

C API

\n

All functions are blocking (with timeouts) and thread-safe. See include/ctap2.h for full signatures.

\n

Core Operations

\n
#include \"ctap2.h\"\n\n// Enumerate connected FIDO2 devices\nint count = ctap2_device_count();\n\n// Register a credential (raw CBOR response)\nint bytes = ctap2_make_credential(\n    client_data_hash, rp_id, rp_name,\n    user_id, user_id_len, user_name, user_display_name,\n    alg_ids, alg_count, resident_key,\n    result_buf, result_buf_len\n);\n\n// Authenticate (raw CBOR response)\nint bytes = ctap2_get_assertion(\n    client_data_hash, rp_id,\n    allow_list_ids, allow_list_id_lens, allow_list_count,\n    result_buf, result_buf_len\n);\n\n// Get device capabilities\nint bytes = ctap2_get_info(result_buf, result_buf_len);
\n

Parsed Responses

\n

These perform the CTAP2 command AND parse the CBOR, returning structured fields:

\n
// Register + parse → credential_id, attestation_object\nint status = ctap2_make_credential_parsed(\n    client_data_hash, rp_id, rp_name,\n    user_id, user_id_len, user_name, user_display_name,\n    alg_ids, alg_count, resident_key,\n    out_credential_id, &out_credential_id_len,\n    out_attestation_object, &out_attestation_object_len\n);\n\n// Authenticate + parse → credential_id, auth_data, signature, user_handle\nint status = ctap2_get_assertion_parsed(\n    client_data_hash, rp_id,\n    allow_list_ids, allow_list_id_lens, allow_list_count,\n    out_credential_id, &out_credential_id_len,\n    out_auth_data, &out_auth_data_len,\n    out_signature, &out_signature_len,\n    out_user_handle, &out_user_handle_len\n);
\n

Pure Parsing (no I/O)

\n

Parse raw CTAP2 response bytes you already have:

\n
ctap2_parse_make_credential_response(response, len, ...);\nctap2_parse_get_assertion_response(response, len, fallback_cred, ...);
\n

PIN Protocol

\n
// Check remaining PIN retries\nint retries;\nctap2_get_pin_retries(&retries);\n\n// Get PIN token (ECDH + AES-256-CBC handshake)\nuint8_t pin_token[32];\nctap2_get_pin_token(\"123456\", pin_token, 32);\n\n// PIN-authenticated registration\nctap2_make_credential_with_pin(\n    client_data_hash, rp_id, rp_name, ...,\n    pin_token, 2,  // pin_protocol = 2\n    out_credential_id, &out_credential_id_len,\n    out_attestation_object, &out_attestation_object_len\n);\n\n// PIN-authenticated assertion\nctap2_get_assertion_with_pin(\n    client_data_hash, rp_id, ...,\n    pin_token, 2,\n    out_credential_id, &out_credential_id_len, ...\n);
\n

Utilities

\n
// Human-readable error messages\nconst char *msg = ctap2_status_message(0x35);\n// → \"PIN not set - configure a PIN on your security key first\"\n\n// Debug: last IOKit return code\nint ioret = ctap2_debug_last_ioreturn();
\n

Status Codes

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CodeMeaning
CTAP2_OK (0)Success
CTAP2_ERR_NO_DEVICE (-1)No FIDO2 device connected
CTAP2_ERR_TIMEOUT (-2)Device communication timeout
CTAP2_ERR_PROTOCOL (-3)CTAPHID protocol error
CTAP2_ERR_BUFFER_TOO_SMALL (-4)Output buffer too small
CTAP2_ERR_OPEN_FAILED (-5)Failed to open HID device
CTAP2_ERR_WRITE_FAILED (-6)USB write failed
CTAP2_ERR_READ_FAILED (-7)USB read failed
CTAP2_ERR_CBOR (-8)CBOR encoding/decoding error
CTAP2_ERR_DEVICE (-9)CTAP2 device error (check status byte)
CTAP2_ERR_PIN (-10)PIN protocol error
\n

Entitlements

\n

On macOS with hardened runtime, add to your entitlements:

\n
<key>com.apple.security.device.usb</key>\n<true/>
\n

The user must grant Input Monitoring permission in System Settings > Privacy & Security.

\n

No other entitlements needed — no com.apple.developer.web-browser.public-key-credential, no provisioning profile, no Apple Developer portal configuration.

\n

Integration with cmux

\n

This library powers the FIDO2/WebAuthn support in cmux (fork), integrated as a git submodule at vendor/ctap2. The JS bridge in WKWebView intercepts navigator.credentials.create/get and routes to libctap2 via Swift C FFI.

\n

Tested Devices

\n\n

Status

\n\n

License

\n

Dual-licensed under Zlib and MIT. Choose whichever you prefer.

\n
", "readme_excerpt": "Portable CTAP2/FIDO2 library in Zig — direct USB HID communication with security keys (YubiKey, SoloKeys, etc.), no Apple entitlements or platform authentication frameworks needed.\nLicense: Zlib OR MIT\nApple's ASAuthorizationController requires a restricted entitlement + provisioning profile for WebAuthn in general-purpose browsers. This library talks directly to FIDO2 devices over USB HID via IOKit (macOS) and hidraw (Linux), bypassing platform authentication frameworks entirely.\n- CTAP2...", "install_commands": { "zig": "zig fetch --save git+https://github.com/jesssullivan/zig-ctap2.git" }, "repo_url": "https://github.com/jesssullivan/zig-ctap2", "website_url": "http://transscendsurvival.org/zig-ctap2/", "docs_url": "https://jesssullivan.github.io/zig-ctap2/", "registry_url": "https://zigistry.dev/package/{repo}", "releases_url": "https://github.com/jesssullivan/zig-ctap2/releases", "og_image_url": "https://opengraph.githubassets.com/dc7e068042a483fe04565a726405cc25e437cd991c827a6290873c4898ccec4a/Jesssullivan/zig-ctap2", "license": "NOASSERTION", "pushed_at": "2026-04-25T18:40:26Z", "enriched_at": "2026-04-26T17:17:14.048Z", "gate": "pages" }, { "slug": "jesssullivan-zig-crypto", "name": "zig-crypto", "repo": "jesssullivan/zig-crypto", "org": "jesssullivan", "ecosystem": "zig", "category": "cryptography", "description": "Portable cryptographic primitives in Zig with C FFI — SHA-256, AES, ECDH, Ed25519, HMAC, PBKDF2. No OpenSSL.", "featured": true, "tags": [ "crypto", "ffi", "c-api", "cross-platform" ], "version": "0.1.0", "release_date": "2026-04-25T18:41:15Z", "releases": [ { "tag": "0.1.0", "date": "2026-04-25T18:41:15Z", "body": "## What's Changed\n* Productionize: build.zig.zon, autodoc, examples, agent metadata by @Jesssullivan in https://github.com/Jesssullivan/zig-crypto/pull/1\n\n## New Contributors\n* @Jesssullivan made their first contribution in https://github.com/Jesssullivan/zig-crypto/pull/1\n\n**Full Changelog**: https://github.com/Jesssullivan/zig-crypto/commits/v0.1.0" } ], "stars": 0, "topics": [ "attestation-compatibility", "cryptography-algorithms", "primitives", "c-interop", "cryptography", "ffi", "zig", "zig-package" ], "languages": [ { "name": "Zig", "color": "#ec915c", "bytes": 43100 }, { "name": "Python", "color": "#3572A5", "bytes": 37626 }, { "name": "C", "color": "#555555", "bytes": 6130 }, { "name": "Just", "color": "#384d54", "bytes": 1551 }, { "name": "Nix", "color": "#7e7eff", "bytes": 1449 } ], "primary_language": "Zig", "readme_html": "

zig-crypto

\n

Portable cryptographic primitives in Zig with C FFI -- SHA-256, HMAC-SHA-256, AES-CBC, PBKDF2, ECDH P-256, Ed25519, and CSPRNG.

\n

License: Zlib OR MIT

\n

Why

\n

A minimal, zero-dependency crypto library that compiles to a static C library from Zig. No OpenSSL, no CommonCrypto, no system dependencies. Provides the cryptographic primitives needed by CTAP2 PIN protocol, Sparkle update signing, and general-purpose credential management.

\n

Features

\n\n

Installation

\n

Zig Package Manager (recommended)

\n
zig fetch --save git+https://github.com/Jesssullivan/zig-crypto.git
\n

Then in your build.zig:

\n
const dep = b.dependency(\"zig-crypto\", .{ .target = target, .optimize = optimize });\nexe.root_module.addImport(\"zig-crypto\", dep.module(\"zig-crypto\"));
\n

Git Submodule (C FFI consumers)

\n
git submodule add https://github.com/Jesssullivan/zig-crypto.git vendor/crypto\ncd vendor/crypto && zig build -Doptimize=ReleaseFast
\n

Link -lzig-crypto and include #include \"zig_crypto.h\".

\n

Requirements

\n\n

Architecture

\n
\n
\n
\n 
graph TD\n    A[Application] -->|C FFI| B[ffi.zig<br/>19 exported functions]\n    B --> C[sha256.zig]\n    B --> D[hmac.zig]\n    B --> E[aes.zig]\n    B --> F[pbkdf2.zig]\n    B --> G[ecdh.zig]\n    B --> H[ed25519.zig]\n    B --> I[random.zig]\n    C --> Z[std.crypto]\n    D --> Z\n    E --> Z\n    F --> Z\n    G --> Z\n    H --> Z\n    I --> Z\n
\n
\n
\n \n \n Loading\n\n \n
\n\n

Build

\n
zig build -Doptimize=ReleaseFast   # static library\nzig build test                      # unit tests\nzig build test-pbt                  # property-based tests
\n

With just: just test-all, just build, just info.

\n

Platform Support

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
PlatformStatusNotes
macOS (arm64/x86_64)TestedNo frameworks needed
Linux (x86_64/arm64)SupportedNo system libraries needed
Cross-compilationSupportedPure Zig, no platform dependencies
\n

C API Reference

\n

Header: include/zig_crypto.h. All functions are thread-safe and stateless.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FunctionReturnsDescription
zig_crypto_sha256voidSHA-256 hash (out: 32 bytes)
zig_crypto_sha256_hexsize_t (64)SHA-256 as hex (out: 64 bytes)
zig_crypto_hmac_sha256voidHMAC-SHA-256 (out: 32 bytes)
zig_crypto_aes128_cbc_encryptintAES-128-CBC encrypt, PKCS#7
zig_crypto_aes128_cbc_decryptintAES-128-CBC decrypt, PKCS#7
zig_crypto_aes256_cbc_encryptintAES-256-CBC encrypt, PKCS#7
zig_crypto_aes256_cbc_decryptintAES-256-CBC decrypt, PKCS#7
zig_crypto_aes256_cbc_encrypt_rawintAES-256-CBC no padding (CTAP2)
zig_crypto_aes256_cbc_decrypt_rawintAES-256-CBC no unpadding (CTAP2)
zig_crypto_pbkdf2_sha1voidPBKDF2-HMAC-SHA1 key derivation
zig_crypto_p256_generateint (0/-1)Generate P-256 key pair
zig_crypto_p256_ecdhint (0/-1)ECDH shared secret
zig_crypto_ed25519_generatevoidGenerate Ed25519 key pair
zig_crypto_ed25519_from_seedint (0/-1)Deterministic key from seed
zig_crypto_ed25519_signint (0/-1)Sign message (sig: 64 bytes)
zig_crypto_ed25519_verifyboolVerify signature
zig_crypto_randomboolFill with secure random bytes
\n

Integration

\n
git submodule add https://github.com/Jesssullivan/zig-crypto.git vendor/crypto\ncd vendor/crypto && zig build -Doptimize=ReleaseFast
\n

Link: -lzig-crypto. Include: #include \"zig_crypto.h\".

\n

License

\n

Dual-licensed under Zlib and MIT. Choose whichever you prefer.

\n
", "readme_excerpt": "Portable cryptographic primitives in Zig with C FFI -- SHA-256, HMAC-SHA-256, AES-CBC, PBKDF2, ECDH P-256, Ed25519, and CSPRNG.\nLicense: Zlib OR MIT\nA minimal, zero-dependency crypto library that compiles to a static C library from Zig. No OpenSSL, no CommonCrypto, no system dependencies. Provides the cryptographic primitives needed by CTAP2 PIN protocol, Sparkle update signing, and general-purpose credential management.\n- SHA-256: Single-shot and incremental hashing, hex output\n- HMAC-SHA-256:...", "install_commands": { "zig": "zig fetch --save git+https://github.com/jesssullivan/zig-crypto.git" }, "repo_url": "https://github.com/jesssullivan/zig-crypto", "website_url": "http://transscendsurvival.org/zig-crypto/", "docs_url": "https://jesssullivan.github.io/zig-crypto/", "registry_url": "https://zigistry.dev/package/{repo}", "releases_url": "https://github.com/jesssullivan/zig-crypto/releases", "og_image_url": "https://opengraph.githubassets.com/5da519295725192da7baf8a217d843d0693618728da805646475c1c97f0bf76e/Jesssullivan/zig-crypto", "license": "NOASSERTION", "pushed_at": "2026-04-25T18:39:57Z", "enriched_at": "2026-04-26T17:17:14.338Z", "gate": "pages" }, { "slug": "jesssullivan-betterkvm", "name": "betterkvm", "repo": "jesssullivan/betterkvm", "org": "jesssullivan", "ecosystem": "multi", "category": "systems", "description": "The converged multiarch KVM for Tinyland NoneX86 contributions", "featured": false, "tags": [ "kvm", "pikvm", "multiarch" ], "version": "0.0.0", "release_date": "", "releases": [], "stars": 0, "topics": [ "pikvm", "remote-development", "riscv", "serial-over-ip", "nonex86" ], "languages": [ { "name": "Python", "color": "#3572A5", "bytes": 42987 }, { "name": "Just", "color": "#384d54", "bytes": 34129 }, { "name": "Nix", "color": "#7e7eff", "bytes": 17631 }, { "name": "Shell", "color": "#89e051", "bytes": 13239 } ], "primary_language": "Python", "readme_html": "
Hey!  This is a work in progress.\n\nThis project spawned from the need to expand remote developement to support NoneX86 initiatives.\n\n\nThis project converges tinyland.dev KVM hardware via a HKS1601A1U 16-port KVM; this allows us\nto provide Risc-V hardware (musebooks and V300, Spacemit K1 dev boards etc), ARM boards,\nx86 servers, and their debug interfaces to folks outside of the lab.\n\n16-port machine mapping:\n  1: honey           9: sdr-1\n  2: bumble (ATX)   10: g2-1\n  3: petting-zoo    11: g2-2\n  4: xoxd-bates     12: t-deck\n  5: yoga           13: tdeck-pro\n  6: mbp-13         14-16: (unassigned)\n  7: betsy\n  8: musey\n\n\nTinyland folk\n    |\n    | Tailscale VPN (WireGuard)\n    | mTLS admin mgmt (Nebula)\n    |\n+---+---------------------------------+\n|   Tailscale Subnet & local DERP     |  Pi #2 (NixOS)\n|   serial-console                    |  advertises <ipv4>/24\n+---+---------------------------------+\n    |\n    | IoT Management Network (<ipv4>/24)\n    |\n+---+--------+----------+------+----------+\n|            |          |      |          |\nv            v          v      v          v\nPi #1        TESmart    Gearmo Smart     Lab\n(PiKVM A3)   HKS1601A1U 16-port PDU     Machines\n             KVM Switch Serial (NUT)     (16 ports)\n             16-port    Hub\n             + RS232\n
", "readme_excerpt": "Hey! This is a work in progress.\nThis project spawned from the need to expand remote developement to support NoneX86 initiatives.\nThis project converges tinyland.dev KVM hardware via a HKS1601A1U 16-port KVM; this allows us\nto provide Risc-V hardware (musebooks and V300, Spacemit K1 dev boards etc), ARM boards,\nx86 servers, and their debug interfaces to folks outside of the lab.\n16-port machine mapping:\n 1: honey 9: sdr-1\n 2: bumble (ATX) 10: g2-1\n 3: petting-zoo 11: g2-2\n ...", "install_commands": {}, "repo_url": "https://github.com/jesssullivan/betterkvm", "website_url": null, "docs_url": null, "registry_url": null, "releases_url": "https://github.com/jesssullivan/betterkvm/releases", "og_image_url": "https://opengraph.githubassets.com/4db589b54b6d0a58bb6bb9f66e57851ac8080a4c47ae9719771b13dac501a63f/tinyland-inc/betterkvm", "license": "MIT", "pushed_at": "2026-04-25T04:06:49Z", "enriched_at": "2026-04-26T17:17:14.757Z", "gate": "override" }, { "slug": "jesssullivan-prompt-pulse-tui", "name": "prompt-pulse-tui", "repo": "jesssullivan/prompt-pulse-tui", "org": "jesssullivan", "ecosystem": "rust", "category": "ai-tools", "description": "Ratatui terminal dashboard for prompt-pulse system monitoring", "featured": false, "tags": [ "tui", "ratatui", "monitoring", "tailscale" ], "version": "0.0.0", "release_date": "", "releases": [], "stars": 0, "topics": [ "dashboard", "monitoring", "ratatui", "rust", "terminal", "tui" ], "languages": [ { "name": "Rust", "color": "#dea584", "bytes": 239611 }, { "name": "Shell", "color": "#89e051", "bytes": 487 } ], "primary_language": "Rust", "readme_html": "

prompt-pulse-tui

\n

Canonical writable source for the Rust prompt-pulse-tui application.

\n

This repo owns the Rust TUI source. tinyland-inc/lab owns packaging, pinned\nconsumption, shell-start integration, and the wider workstation/runtime\ncontract.

\n

Authority

\n\n

Canonical Home

\n\n

The older tinyland-inc/prompt-pulse-tui repo is archive/history only. It is\nnot the active writable source.

\n

Contribution Flow

\n
    \n
  1. Edit source here.
    2. \n
  2. Validate source here.
    3. \n
  3. Test integration from lab.
    4. \n
  4. Repin lab to the landed upstream revision.
    5. \n
\n

Local Remote Policy

\n\n
", "readme_excerpt": "Canonical writable source for the Rust prompt-pulse-tui application.\nThis repo owns the Rust TUI source. tinyland-inc/lab owns packaging, pinned\nconsumption, shell-start integration, and the wider workstation/runtime\ncontract.\n- Rust TUI source authority: this repo\n- Go app authority: tinyland-inc/prompt-pulse\n- Fleet/runtime integration authority: tinyland-inc/lab\n- canonical repo: https://github.com/Jesssullivan/prompt-pulse-tui\nThe older tinyland-inc/prompt-pulse-tui repo is archive/history...", "install_commands": { "rust": "cargo add prompt-pulse-tui" }, "repo_url": "https://github.com/jesssullivan/prompt-pulse-tui", "website_url": "https://tinyland.dev", "docs_url": null, "registry_url": "https://crates.io/crates/prompt-pulse-tui", "releases_url": "https://github.com/jesssullivan/prompt-pulse-tui/releases", "og_image_url": "https://opengraph.githubassets.com/08ac37583942f5dcb71f156a8badc1eec07dcb7cb329309093374ff06aa5e08c/Jesssullivan/prompt-pulse-tui", "license": "", "pushed_at": "2026-04-23T18:14:53Z", "enriched_at": "2026-04-26T17:17:14.994Z", "gate": "homepage" }, { "slug": "jesssullivan-tinyland-auth-pg", "name": "tinyland-auth-pg", "repo": "jesssullivan/tinyland-auth-pg", "org": "jesssullivan", "ecosystem": "npm", "category": "auth", "description": "PostgreSQL storage adapter for @tummycrypt/tinyland-auth (Neon + Drizzle)", "featured": false, "tags": [ "auth", "postgres", "drizzle", "sessions" ], "version": "0.2.1", "release_date": "2026-04-22T22:14:39Z", "releases": [ { "tag": "0.2.1", "date": "2026-04-22T22:14:39Z", "body": "## v0.2.1\n\n### Added\n- first-class `NodePgStorageAdapter`\n- `createNodePgStorageAdapter({ connectionString, poolConfig?, closeOnDispose? })`\n- Docker-backed node-postgres smoke coverage\n\n### Fixed\n- shared package now has a truthful self-hosted PostgreSQL path for CNPG/local PG without requiring consumer-local adapter hacks\n- CI/publish workflow now publishes to npm without the stale GitHub Packages branch\n\n### Notes\n- this release preserves the tenant-scoped `0.2.x` API introduced in `v0.2.0`\n- self-hosted consumers can now use node-postgres directly through the shared package\n" }, { "tag": "0.2.0", "date": "2026-04-17T19:14:11Z", "body": "Breaking release. Every adapter method now takes `tenantId: string` as its first parameter. Every row-bearing table carries `tenant_id uuid NOT NULL`.\n\n**Full migration guide:** [CHANGELOG.md](./CHANGELOG.md#020--2026-04-17)\n\n## Highlights\n\n- **Driver-agnostic construction** via `createPgStorageAdapter({ db })` — accepts any drizzle client (`drizzle-orm/neon-http`, `drizzle-orm/postgres-js`, `drizzle-orm/node-postgres`). Callers own the client lifecycle. PgBouncer-compatible with `postgres.js` and `{ prepare: false }`.\n- **Pattern B tenant isolation** — `tenant_id` on every row-bearing table, composite uniques scoped to `(tenant_id, )`, `TenantScoped` return types.\n- **Construction-time validation** on both `{ db }` and `{ connectionString }` branches.\n- **Driver-agnostic delete counts** via `.returning({...}).length` (fixes silent zero on postgres.js).\n- **29 unit tests + 3 testcontainers smoke tests** exercising the postgres.js path end-to-end.\n\n## New exports\n\n- `Database` — union of supported drizzle client types\n- `TenantScoped` — widens a domain type with `{ tenantId: string }`\n- `PgStorageConfig` — discriminated union accepted by the factory\n\n## Deprecated\n\n`createPgStorageAdapter({ connectionString })` still works but only resolves to neon-http. Prefer `{ db }` for all new code — required for PgBouncer, node-postgres, and self-hosted Postgres." }, { "tag": "0.1.1", "date": "2026-03-30T03:13:47Z", "body": "Fix publishConfig access, add test gate to publish workflow." } ], "stars": 0, "topics": [], "languages": [ { "name": "TypeScript", "color": "#3178c6", "bytes": 111251 }, { "name": "Nix", "color": "#7e7eff", "bytes": 871 }, { "name": "Starlark", "color": "#76d275", "bytes": 650 } ], "primary_language": "TypeScript", "readme_html": "

@tummycrypt/tinyland-auth-pg

\n

PostgreSQL storage adapter for @tummycrypt/tinyland-auth, backed by Drizzle ORM with driver-agnostic construction and multi-tenant scoping.

\n

Supports Neon HTTP, postgres.js, and node-postgres. Use createNodePgStorageAdapter()\nwhen you want the package to own a pg.Pool, or createPgStorageAdapter({ db })\nwhen you already have a pre-built Drizzle client.

\n
\n

0.2.0 is a breaking release. Every adapter method now takes tenantId: string\nas its first parameter. Every row-bearing table has tenant_id uuid NOT NULL.\nSee CHANGELOG.md for the full migration guide.

\n
\n

Installation

\n
npm install @tummycrypt/tinyland-auth-pg\n# or\npnpm add @tummycrypt/tinyland-auth-pg
\n

Peer Dependencies

\n
npm install @tummycrypt/tinyland-auth
\n

Quick Start (0.2.0+)

\n

With node-postgres (owned pool; recommended for CNPG / local PG)

\n
import { createNodePgStorageAdapter } from '@tummycrypt/tinyland-auth-pg';\n\nconst adapter = createNodePgStorageAdapter({\n  connectionString: process.env.DATABASE_URL!,\n  poolConfig: { max: 10 },\n});\n\nconst user = await adapter.getUser('<tenant-uuid>', '<user-id>');
\n

With postgres.js (recommended for PgBouncer transaction mode)

\n
import postgres from 'postgres';\nimport { drizzle } from 'drizzle-orm/postgres-js';\nimport { createPgStorageAdapter } from '@tummycrypt/tinyland-auth-pg';\nimport * as schema from '@tummycrypt/tinyland-auth-pg/schema';\n\n// prepare: false is required when talking to PgBouncer in transaction mode\nconst sql = postgres(process.env.DATABASE_URL!, { prepare: false, max: 10 });\nconst db = drizzle(sql, { schema });\n\nconst storage = createPgStorageAdapter({ db });\n\n// Every method takes tenantId first\nconst user = await storage.getUser('<tenant-uuid>', '<user-id>');
\n

With Neon HTTP (legacy, still supported)

\n
import { createPgStorageAdapter } from '@tummycrypt/tinyland-auth-pg';\n\nconst storage = createPgStorageAdapter({\n  connectionString: process.env.DATABASE_URL!,\n  sessionMaxAge: 7 * 24 * 60 * 60 * 1000, // 7 days (default)\n});\n\nconst user = await storage.getUser('<tenant-uuid>', '<user-id>');
\n

Row-Level Security recommended pattern

\n

Pair the adapter with a withTenant wrapper at the app-layer so every query\nalso flows through an RLS SET LOCAL. The explicit tenantId param is your\nfirst line of defense; the SET LOCAL is belt-and-suspenders if a call-site\never forgets to scope.

\n
await sql.begin(async (tx) => {\n  await tx`SELECT set_config('app.tenant_id', ${tenantId}, true)`;\n  return storage.getUser(tenantId, userId);\n});
\n

Schema Overview

\n

The package exports six Drizzle schema modules, each targeting a specific domain:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ExportSchemaTablesPurpose
./schemaauthusers, sessions, totp_secrets, backup_codes, invitations, audit_eventsAuthentication and authorization
./content-schemapublicbusiness_profile, services, business_hours, reviews, practitionersCMS content
./booking-schemapublicclients, bookings, time_blocks, business_hours_overrides, slot_reservationsScheduling and appointments
./giftcert-schemapublicgift_certificates, gift_certificate_redemptionsGift certificate tracking
./intake-schemapublicintake_submissionsPatient intake forms
./business-schemapublic(composite re-export)Business domain aggregation
\n

Auth Schema (auth.*)

\n
    \n
  • users -- Admin users with roles (viewer, editor, business_owner, developer), PIN hashes, TOTP state, onboarding tracking
    • \n
  • sessions -- DB-backed sessions with HMAC-signed UUIDs, metadata (IP, user agent), configurable TTL
    • \n
  • totp_secrets -- AES-encrypted TOTP secrets, linked to users
    • \n
  • backup_codes -- Bcrypt-hashed one-time recovery codes
    • \n
  • invitations -- Email-based user invitations with token + expiry
    • \n
  • audit_events -- Timestamped auth event log (login, logout, failed attempts, role changes)
    • \n
\n

Booking Schema (public.*)

\n
    \n
  • clients -- Client directory (name, email, phone, notes)
    • \n
  • bookings -- Appointment records with status (confirmed, cancelled, completed, no_show), payment tracking
    • \n
  • time_blocks -- Practitioner availability blocks (break, vacation, hold)
    • \n
  • business_hours_overrides -- Date-specific hour overrides
    • \n
  • slot_reservations -- Temporary slot holds during booking flow (TTL-based)
    • \n
\n

Drizzle Migrations

\n

Push schema changes directly (development):

\n
# Auth schema\nDATABASE_URL=\"postgresql://...\" pnpm db:push\n\n# Public schema (booking, content)\nDATABASE_URL=\"postgresql://...\" npx drizzle-kit push --config=drizzle.public.config.ts
\n

Generate migration files (production):

\n
DATABASE_URL=\"postgresql://...\" pnpm db:generate\nDATABASE_URL=\"postgresql://...\" pnpm db:migrate
\n

API Reference

\n

createPgStorageAdapter(config: PgStorageConfig): PgStorageAdapter

\n

Factory function that returns a Pattern B tenant-scoped adapter.

\n
type PgStorageConfig =\n  | { db: Database; sessionMaxAge?: number }       // driver injection (recommended)\n  | { connectionString: string; sessionMaxAge?: number }; // legacy neon-http\n\ntype Database =\n  | NeonHttpDatabase<typeof schema>\n  | NodePgDatabase<typeof schema>\n  | PostgresJsDatabase<typeof schema>;
\n

Both branches validate their input at construction time and throw loudly on\nnullish db or empty connectionString rather than deferring to the first\nquery.

\n

createNodePgStorageAdapter(config: NodePgStorageConfig): NodePgStorageAdapter

\n

Factory function that constructs and owns a pg.Pool for standard PostgreSQL.

\n
interface NodePgStorageConfig {\n  connectionString: string;\n  sessionMaxAge?: number;\n  poolConfig?: PoolConfig;\n  closeOnDispose?: boolean; // default true\n}
\n

PgStorageAdapter

\n

Every method accepts tenantId: string as its first parameter and returns\nTenantScoped<T> where the domain type carries tenantId. Key methods:

\n

User Management

\n
    \n
  • getUser(tenantId, id): Promise<TenantScoped<AdminUser> | null>
    • \n
  • getUserByHandle(tenantId, handle): Promise<TenantScoped<AdminUser> | null>
    • \n
  • getUserByEmail(tenantId, email): Promise<TenantScoped<AdminUser> | null>
    • \n
  • createUser(tenantId, user): Promise<TenantScoped<AdminUser>>
    • \n
  • updateUser(tenantId, id, updates): Promise<TenantScoped<AdminUser>>
    • \n
  • deleteUser(tenantId, id): Promise<void>
    • \n
  • getAllUsers(tenantId): Promise<TenantScoped<AdminUser>[]>
    • \n
  • hasUsers(tenantId): Promise<boolean>
    • \n
\n

Session Management

\n
    \n
  • createSession(tenantId, userId, metadata?): Promise<TenantScoped<Session>>
    • \n
  • getSession(tenantId, sessionId): Promise<TenantScoped<Session> | null>
    • \n
  • updateSession(tenantId, sessionId, updates): Promise<TenantScoped<Session>>
    • \n
  • deleteSession(tenantId, sessionId): Promise<void>
    • \n
  • deleteUserSessions(tenantId, userId): Promise<void>
    • \n
  • getSessionsByUser(tenantId, userId): Promise<TenantScoped<Session>[]>
    • \n
  • getAllSessions(tenantId): Promise<TenantScoped<Session>[]>
    • \n
  • cleanupExpiredSessions(tenantId): Promise<number>
    • \n
\n

TOTP / Backup Codes

\n
    \n
  • saveTOTPSecret(tenantId, handle, secret): Promise<void>
    • \n
  • getTOTPSecret(tenantId, handle): Promise<EncryptedTOTPSecret | null>
    • \n
  • deleteTOTPSecret(tenantId, handle): Promise<void>
    • \n
  • saveBackupCodes(tenantId, userId, codes): Promise<void>
    • \n
  • getBackupCodes(tenantId, userId): Promise<BackupCodeSet | null>
    • \n
  • deleteBackupCodes(tenantId, userId): Promise<void>
    • \n
\n

Invitations

\n
    \n
  • createInvitation(tenantId, invitation): Promise<TenantScoped<Invitation>>
    • \n
  • getInvitation(tenantId, token): Promise<TenantScoped<Invitation> | null>
    • \n
  • getInvitationById(tenantId, id): Promise<TenantScoped<Invitation> | null>
    • \n
  • getAllInvitations(tenantId): Promise<TenantScoped<Invitation>[]>
    • \n
  • getPendingInvitations(tenantId): Promise<TenantScoped<Invitation>[]>
    • \n
  • updateInvitation(tenantId, token, updates): Promise<TenantScoped<Invitation>>
    • \n
  • deleteInvitation(tenantId, token): Promise<void>
    • \n
  • cleanupExpiredInvitations(tenantId): Promise<number>
    • \n
\n

Audit Log

\n
    \n
  • logAuditEvent(tenantId, event): Promise<void>
    • \n
  • getAuditEvents(tenantId, filters?): Promise<AuditEvent[]>
    • \n
\n
\n

Interface note: the class does not implements IStorageAdapter from\n@tummycrypt/tinyland-auth@0.2.x because the peer package predates Pattern B.\nAn interface uplift will ship with tinyland-auth 0.3.0 and this adapter will\nre-implement it then. Until then, consume the concrete class or type against\nthe exported method signatures directly.

\n
\n

NodePgStorageAdapter

\n

Subclass of PgStorageAdapter that exposes its owned pool: Pool and closes\nthat pool by default when adapter.close() is called.

\n

Environment Variables

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
VariableRequiredDescription
DATABASE_URLYesPostgreSQL connection string for Neon, CNPG, local PG, or other supported deployments
\n

Development

\n
pnpm install\npnpm test          # Run tests\npnpm build         # Compile TypeScript\npnpm test:watch    # Watch mode
\n

Nix

\n
nix develop        # Enter dev shell with Node 20 + pnpm + tsc
\n

License

\n

MIT

\n
", "readme_excerpt": "PostgreSQL storage adapter for @tummycrypt/tinyland-auth, backed by Drizzle ORM with driver-agnostic construction and multi-tenant scoping.\nSupports Neon HTTP, postgres.js, and node-postgres. Use createNodePgStorageAdapter()\nwhen you want the package to own a pg.Pool, or createPgStorageAdapter({ db })\nwhen you already have a pre-built Drizzle client.\n> 0.2.0 is a breaking release. Every adapter method now takes tenantId: string\n> as its first parameter. Every row-bearing table has tenantid uuid...", "install_commands": { "npm": "npm install @tummycrypt/tinyland-auth-pg" }, "repo_url": "https://github.com/jesssullivan/tinyland-auth-pg", "website_url": null, "docs_url": null, "registry_url": "https://www.npmjs.com/package/@tummycrypt/tinyland-auth-pg", "releases_url": "https://github.com/jesssullivan/tinyland-auth-pg/releases", "og_image_url": "https://opengraph.githubassets.com/59053bec1ddd122bcdb4fb66c1f3d53863d6262a481008df92d5a8356d03f83f/tinyland-inc/tinyland-auth-pg", "license": "", "pushed_at": "2026-04-22T22:14:39Z", "enriched_at": "2026-04-26T17:17:15.372Z", "gate": "override" }, { "slug": "jesssullivan-pixelwise-research", "name": "pixelwise-research", "repo": "jesssullivan/pixelwise-research", "org": "jesssullivan", "ecosystem": "multi", "category": "ai-tools", "description": "WIP, danger be lurking! Novel glyph compositor research with Futhark webGPU investigating vectorized gradient direction monads", "featured": false, "tags": [ "boundary-detection", "wasm", "research" ], "version": "0.0.0", "release_date": "", "releases": [], "stars": 1, "topics": [ "boundary-detection", "emscripten", "esdt", "futhark", "just-for-fun", "skeleton-ui", "sobel-gradient", "sveltekit", "wasm", "dangerous-permissions" ], "languages": [ { "name": "TypeScript", "color": "#3178c6", "bytes": 1086545 }, { "name": "JavaScript", "color": "#f1e05a", "bytes": 176024 }, { "name": "Svelte", "color": "#ff3e00", "bytes": 160937 }, { "name": "HTML", "color": "#e34c26", "bytes": 38865 }, { "name": "Starlark", "color": "#76d275", "bytes": 37995 } ], "primary_language": "TypeScript", "readme_html": "

Pixelwise

\n

ESDT-based WCAG contrast computation research implementation in Futhark targeting WebGPU.

\n

Research Paper (PDF) -- Mathematical foundations with verification status.

\n

Pixelwise originally used precomputed WGSL shaders for GPU contrast computation with\nFuthark WASM multicore as the reference implementation. I am now working toward\na unified Futhark WebGPU backend that generates both GPU (WebGPU/WGSL) and CPU\n(WASM multicore) code from a single source.

\n

Foundation: Sebastian Paarmann's MSc Thesis (2024)\nintroduced the Futhark WebGPU backend as part of his research at DIKU.

\n

Current Status: Experimental fork at jesssullivan/futhark\n(branch development-webgpu) with Emscripten 4.x compatibility patches.

\n
\n

Why Offset Vectors Matter

\n

The Problem with Scalar Distance Transforms

\n

Classical distance transforms store d^2 (squared distance to nearest edge) for each pixel.\nThis is efficient but loses information: you know how far but not which direction.

\n

For WCAG contrast enhancement, we need to sample background colors outward from text.\nWith only d^2, you need a separate gradient computation pass (Sobel filter, finite differences).

\n

The ESDT Solution: Track Offset Vectors

\n

Instead of storing d^2 = dx^2 + dy^2, ESDT stores the offset vector (dx, dy) directly.

\n

What you get for free:

\n
    \n
  • Distance: d = sqrt(dx^2 + dy^2) -- same as before
    • \n
  • Gradient direction: (dx, dy) / d -- the direction to the nearest edge
    • \n
  • Background sampling: Follow the gradient outward to find background pixels
    • \n
\n

This eliminates one pipeline pass and provides mathematically correct gradients.

\n

Anti-Aliased Text: The Gray Pixel Trap

\n

Anti-aliased fonts produce \"gray pixels\" at edges where opacity L in (0, 1) encodes\nsub-pixel edge position. A common mistake is to add the gray offset as:

\n
d^2 = x^2 + y^2 + (L - 0.5)^2    // WRONG: This is 3D distance!\n
\n

This treats opacity as a third spatial dimension. Instead, ESDT applies the offset\nalong the 2D gradient direction during initialization:

\n
offset = L - 0.5\n(dx, dy) = (offset * gx, offset * gy)  // where (gx, gy) is normalized gradient\n
\n

This maintains correct 2D geometry.

\n

Visual Intuition

\n
Traditional EDT (scalar d^2):          ESDT (offset vectors):\n+---------------------+               +---------------------------------+\n| 9  4  1  0  1  4  9 |               | (-3,0) (-2,0) (-1,0) (0,0) ... |\n| 4  1  0  0  0  1  4 |  Only         | (-2,0) (-1,0)  (0,0) (0,0) ... |  Distance\n| 1  0  0  0  0  0  1 |  distances    | (-1,0)  (0,0)  (0,0) (0,0) ... |  AND direction\n+---------------------+               +---------------------------------+\n     v Need Sobel pass                      v Gradient = normalize(dx,dy)\n     for gradient                           (no extra pass needed)\n
\n

Comparison

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
AspectScalar d^2Offset Vectors (dx, dy)
Storage1 float2 floats
Distancesqrt(d^2)sqrt(dx^2 + dy^2)
GradientRequires Sobel/FD pass(dx, dy) / d (free)
Gray pixelsOften incorrect (3D)Correct 2D displacement
Pipeline passes7+6
\n
\n

Core Algorithm

\n

Exact Signed Distance Transform (ESDT)

\n

ESDT computes offset vectors (dx, dy) to the nearest edge for each pixel.

\n

Distance:

\n
d = sqrt(dx^2 + dy^2)\n
\n

Gradient (direction to nearest edge):

\n
grad(d) = (dx, dy) / d    when d > epsilon\n
\n

Gray pixel initialization (Definition 2.3 in paper):

\n
offset = L - 0.5\n
\n

Where L in (0, 1) is pixel opacity. The offset is applied in the Sobel gradient direction.

\n

WCAG 2.1 Formulas

\n

sRGB Linearization:

\n
C_lin = C / 12.92                        if C <= 0.03928\nC_lin = ((C + 0.055) / 1.055)^2.4        otherwise\n
\n

Relative Luminance:

\n
L = 0.2126 * R_lin + 0.7152 * G_lin + 0.0722 * B_lin\n
\n

Contrast Ratio:

\n
CR = (L_lighter + 0.05) / (L_darker + 0.05)\n
\n

Bounds: CR in [1, 21]. Black/white yields CR ~ 21.

\n

Edge Weight

\n
w = 4 * alpha * (1 - alpha)\n
\n

Where alpha = clamp(1 - d/d_max, 0, 1). Peaks at alpha = 0.5 (glyph boundaries).

\n
\n

Architecture

\n

Backend Priority

\n
1. Futhark WebGPU (GPU)   -> Fastest, requires GPU adapter + WebGPU browser\n2. Futhark WASM (CPU)     -> Multicore, requires COOP/COEP headers\n3. JavaScript Fallback    -> Single-threaded, always works\n
\n

Both GPU and CPU backends are generated from a single Futhark source\n(futhark/pipeline.fut), ensuring algorithmic equivalence.

\n

6-Pass Pipeline

\n
Pass 1: Grayscale -> Sobel gradient computation\nPass 2: ESDT X-pass (horizontal propagation, O(w) per row)\nPass 3: ESDT Y-pass (vertical propagation, O(h) per column)\nPass 4: Glyph extraction (distance < threshold)\nPass 5: Background sampling (outward along grad(d))\nPass 6: WCAG contrast check + luminance adjustment\n
\n

WebGPU Shader Pipeline

\n

When WebGPU is available, a 6-pass GPU compute pipeline is used:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
PassShaderWorkgroupPurpose
0CPU-sRGB -> Linear, grayscale, Sobel
1esdt-x-pass.wgsl256Horizontal distance propagation
2esdt-y-pass.wgsl256Vertical distance propagation
3esdt-extract-pixels.wgsl8x8Glyph pixel extraction
4esdt-background-sample.wgsl256Background color sampling
5esdt-contrast-analysis.wgsl256WCAG ratio computation
6esdt-color-adjust.wgsl256Hue-preserving adjustment
\n
\n

Quick Start

\n
nix develop          # Enter environment (includes Futhark, Emscripten, Node 22)\npnpm install         # Install dependencies\njust dev             # Start server at localhost:5175 (with COOP/COEP headers)
\n

Commands

\n

Development

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CommandDescription
just devStart dev server (port 5175, rebuilds research PDF on start)
just dev-bazelStart dev server via Bazel (full reproducible builds)
just dev-containerStart dev server in container with HMR
\n

Testing

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CommandDescription
just test-quickRun vitest directly (fast iteration)
just testRun all tests via Bazel
just test-unitUnit tests only (Bazel)
just test-pbtProperty-based tests (Bazel)
just test-futharkFuthark algorithm tests (Bazel)
just test-wgsl-quickWGSL shader tests (pnpm, fast)
just test-e2eEnd-to-end Playwright tests
just checkTypeScript + Svelte type check
\n

Build

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CommandDescription
just buildBuild all targets via Bazel
just build-prodProduction build (release config)
just build-futharkBuild Futhark WASM modules (Bazel)
just futhark-rebuildRebuild Futhark WASM directly (bypasses Bazel, fast)
\n

Futhark

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CommandDescription
just futhark-checkType check all Futhark sources
just futhark-test-allRun Futhark built-in tests (C backend)
just futhark-benchBenchmark ESDT (C backend)
just futhark-esdtCompile ESDT to WASM multicore
just futhark-pipelineCompile pipeline to WASM multicore
just futhark-watchWatch and rebuild on changes
\n

Futhark WebGPU

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CommandDescription
just futhark-webgpu-checkCheck if WebGPU compiler is available
just futhark-webgpu-buildBuild Futhark from source with WebGPU backend
just futhark-webgpu-compileCompile pipeline to WebGPU and install
just test-futhark-webgpuRun WebGPU equivalence tests
just bench-webgpuBenchmark WebGPU vs WASM backends
\n

Research Paper

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CommandDescription
just texCompile research paper PDF (latexmk)
just docs-watchWatch and rebuild paper on changes
just docs-viewOpen the compiled PDF
\n

Container & Cache

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CommandDescription
just container-buildBuild all container tarballs (Bazel + nix2container)
just container-pushPush production container to registry
just cache-pushPush Nix build outputs to Attic cache
just infoShow build tool versions
\n
\n

Demos

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
RouteDescription
/demo/compositorFull 6-pass ESDT pipeline with Screen Capture API
/demo/gradient-directionESDT offset vector visualization
/demo/contrast-analysisWCAG 2.1 contrast ratio computation
/demo/performanceReal-time pipeline benchmarks
/demo/before-afterSide-by-side contrast enhancement comparison
\n
\n

Key Files

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
PathPurpose
futhark/esdt.futESDT algorithm (Def 2.1, 2.3, Thm 2.4)
futhark/wcag.futWCAG formulas (Sec 3.1)
futhark/pipeline.fut6-pass pipeline composition
futhark/MakefileWASM build targets
src/lib/core/ComputeDispatcher.tsBackend selection + WebGPU pipeline
src/lib/futhark/WASM module exports
src/lib/futhark-webgpu/Futhark-generated WebGPU pipeline
src/lib/pixelwise/shaders/WGSL compute shaders (6 passes)
tests/theorem-verification/Property-based tests for formulas
vite.config.tsDev server config, COOP/COEP headers
\n
\n

Verification

\n

Tests in tests/theorem-verification/ verify:

\n
    \n
  • Linearization threshold 0.03928 (not 0.04045)
    • \n
  • Gamma exponent 2.4 (not 2.5)
    • \n
  • CR bounds [1, 21]
    • \n
  • Edge weight peak at alpha = 0.5
    • \n
  • Offset vector distance/gradient derivation
    • \n
\n

Run: pnpm test tests/theorem-verification/

\n
\n

COOP/COEP Headers

\n

Futhark's WASM multicore backend uses SharedArrayBuffer for parallel execution.\nBrowsers require Cross-Origin Isolation headers:

\n
Cross-Origin-Opener-Policy: same-origin\nCross-Origin-Embedder-Policy: credentialless
\n

These are configured in vite.config.ts (dev), src/hooks.server.ts (production),\nand nginx ingress annotations (Kubernetes).

\n
\n

Paper

\n

Mathematical foundations with verification status in tex source; not finalized.

\n

Originally developed with Rust SIMD as a project to learn Rust SIMD; this project\nreceived autonomous assistance with PBT constraining, fuzzing, verification and\nfunction composition as well as some GPU integration work performed within Tinyland\nwith the xoxd.ai stack.

\n

License

\n

zlib

\n

Author

\n

Jess Sullivan jess@sulliwood.org

\n

Citations

\n
@software{pixelwise2026,\n  author = {Sullivan, Jess},\n  title = {Pixelwise: ESDT-Based WCAG Contrast Enhancement},\n  year = {2026},\n  url = {https://github.com/Jesssullivan/pixelwise-research}\n}
\n

References:

\n
    \n
  • Danielsson, P.E. (1980). Euclidean Distance Mapping. CGIP 14(3):227-248.
    • \n
  • Meijster, A. et al. (2000). A General Algorithm for Computing Distance Transforms in Linear Time.
    • \n
  • Wittens, S. (2023). Subpixel Distance Transform. https://acko.net/blog/subpixel-distance-transform/
    • \n
  • Henriksen, T. et al. (2017). Futhark: Purely Functional GPU-Programming. PLDI '17.
    • \n
  • Paarmann, S. (2024). A WebGPU Backend for Futhark. MSc Thesis, DIKU.
    • \n
\n
", "readme_excerpt": "ESDT-based WCAG contrast computation research implementation in Futhark targeting WebGPU.\nResearch Paper (PDF) -- Mathematical foundations with verification status.\nPixelwise originally used precomputed WGSL shaders for GPU contrast computation with\nFuthark WASM multicore as the reference implementation. I am now working toward\na unified Futhark WebGPU backend that generates both GPU (WebGPU/WGSL) and CPU\n(WASM multicore) code from a single source.\nFoundation: Sebastian Paarmann's MSc Thesis...", "install_commands": {}, "repo_url": "https://github.com/jesssullivan/pixelwise-research", "website_url": "https://pixelwise.ephemera.xoxd.ai/", "docs_url": null, "registry_url": null, "releases_url": "https://github.com/jesssullivan/pixelwise-research/releases", "og_image_url": "https://opengraph.githubassets.com/87f480a06628bd3ca3355f5b7ff11baa8d52a97377fa0c73df9f4d4984795811/Jesssullivan/pixelwise-research", "license": "NOASSERTION", "pushed_at": "2026-04-22T18:43:34Z", "enriched_at": "2026-04-26T17:17:15.682Z", "gate": "homepage" }, { "slug": "jesssullivan-hiberpower-ntfs", "name": "hiberpower-ntfs", "repo": "jesssullivan/hiberpower-ntfs", "org": "jesssullivan", "ecosystem": "zig", "category": "systems", "description": "ASM2362 NVMe recovery experiments and research around FTL corruption", "featured": false, "tags": [ "ntfs", "firmware", "usb", "nvme" ], "version": "0.0.0", "release_date": "", "releases": [], "stars": 5, "topics": [ "opcode-analysis", "opcode-manipulation", "frida-capture", "queue-attack", "xram-injection" ], "languages": [ { "name": "Zig", "color": "#ec915c", "bytes": 200008 }, { "name": "Shell", "color": "#89e051", "bytes": 71467 }, { "name": "JavaScript", "color": "#f1e05a", "bytes": 59560 }, { "name": "Python", "color": "#3572A5", "bytes": 25856 }, { "name": "PowerShell", "color": "#012456", "bytes": 16142 } ], "primary_language": "Zig", "readme_html": "

ASM2362 NVMe Research Toys

\n

Experimental research into recovering NVMe SSDs exhibiting firmware-level write protection after FTL corruption. This is a project

\n

BLog posts:

\n\n

I used this nvme stick and the ASM2362 every day all day between 2017 and 2020 for all my laptop computing. It happpily ran Tails, ubuntu budgie, and even windows via a little usb 3 enclosure velcroed to my laptop during this time. I haven't thrown it away because it kept me safe under political duress, because I am stubborn, and because I think that it should continue to work forever.

\n
    \n
  • 256GB Silicon Power NVMe SSD connected via ASMedia ASM2362 USB bridge now exhibits silent write failure after a Windows hibernate + power loss event.
    • \n
  • It is impossible to write zeros to this drive. Amazing! Never seen this before.
    • \n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
OperationReportsActual
dd if=/dev/zero of=/dev/sdbSuccessData unchanged
wipefs --allSuccessSignatures remain
SCSI READSuccessData readable
SCSI WRITESuccessSilent failure
NVMe admin commandsFail\"Medium not present\" (ASC=0x3A)
\n

Standard Linux disk tools (fdisk, gdisk, blkdiscard, sg_format) all fail to modify the drive despite reporting success.

\n
\n

Hardware Stack

\n
+---------------------------------------------+\n|  NVMe SSD: Silicon Power 256GB              |\n|  Controller: Phison PS5012-E12              |\n|  State: FTL corrupted, read-only mode       |\n+----------------------+----------------------+\n                       | M.2 PCIe\n+----------------------+----------------------+\n|  USB Bridge: ASMedia ASM2362                |\n|  VID:PID = 0x174c:0x2362                    |\n|  Passthrough: 0xe6 CDB (NVMe tunneling)     |\n+----------------------+----------------------+\n                       | USB 3.1 Gen 2\n+----------------------+----------------------+\n|  Linux: UAS driver -> /dev/sdb              |\n+---------------------------------------------+\n
\n
\n

Technical Reference

\n

SMART Critical Warning Bits

\n

The NVMe SMART/Health log contains critical warning flags at byte offset 0:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
BitMaskMeaning
00x01Available spare capacity below threshold
10x02Temperature exceeded threshold
20x04NVM subsystem reliability degraded
30x08Media placed in read-only mode
40x10Volatile memory backup failed
\n

Bit 3 (0x08) is our target. When set, the controller has entered firmware-level protection mode. Per NVMe spec:

\n
\n

\"The media has been placed in read only mode. Vendor specific recovery may be required.\"

\n
\n

SCSI Sense Data

\n

When NVMe admin commands fail through the USB bridge:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FieldValueMeaning
Sense Key0x02NOT READY
ASC0x3AMEDIUM NOT PRESENT
ASCQ0x00-
\n

This is generated by the USB bridge, not the NVMe controller. The bridge returns this SCSI error when the NVMe controller doesn't respond as expected during initialization.

\n

ASM2362 Passthrough Protocol

\n

The ASMedia ASM2362 uses a proprietary 16-byte CDB with opcode 0xe6 to tunnel NVMe commands:

\n
Byte 0:     0xe6        ASMedia passthrough opcode\nByte 1:     NVMe opcode (0x06=Identify, 0x02=GetLog, etc.)\nByte 2:     Reserved\nByte 3:     CDW10[7:0]\nByte 4-5:   Reserved\nByte 6:     CDW10[23:16]\nByte 7:     CDW10[31:24]\nBytes 8-11: CDW13 (big-endian)\nBytes 12-15: CDW12 (big-endian)\n
\n

Limitation: CDW11, CDW14, CDW15 cannot be passed, restricting some admin commands.

\n

NVMe Opcodes via 0xe6 Passthrough

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
OpcodeCommandStatus
0x02Get Log PageWorks
0x06IdentifyWorks
0x09Set FeaturesBlocked by whitelist
0x0AGet FeaturesBlocked by whitelist
0x80Format NVMBlocked by whitelist
0x81Security ReceiveBlocked by whitelist
0x82Security SendBlocked by whitelist
0x84SanitizeBlocked by whitelist
\n

Blocked opcodes can be sent via XRAM injection (0xE4/0xE5) instead. See docs/archive/dead-ends-e6-whitelist.md for details.

\n

Write Protection Feature (FID 0x84)

\n

NVMe 1.4+ namespace write protection states:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ValueStatePersistence
0x00No Write ProtectN/A
0x01Write ProtectSurvives power cycles
0x02Write Protect Until Power CycleClears on reboot
0x03Permanent Write ProtectIrreversible
\n

Security Protocols

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ProtocolPurpose
0x00Discovery - list supported protocols
0xEFATA Device Server Password
0x01-0x06TCG Opal
\n

ASM2362 Vendor SCSI Commands (Beyond 0xe6)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
OpcodeDirectionCommandPurpose
0xE0ReadRead Config128 bytes bridge configuration
0xE1WriteWrite ConfigModify bridge configuration
0xE2ReadFlash ReadRead SPI flash contents
0xE3WriteFirmware WriteFlash firmware (from address 0x80)
0xE4ReadXDATA ReadRead up to 255 bytes from bridge XRAM
0xE5WriteXDATA WriteWrite single byte to bridge XRAM
0xE6ReadNVMe AdminNVMe passthrough (only 0x02, 0x06)
0xE8NoneReset0x00=CPU reset, 0x01=PCIe/soft reset
\n

ASM2362 XRAM Memory Map

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
AddressSizeContents
0x07F0-0x07F56BFirmware version string
0xA000-0xAFFF4KBNVMe I/O Submission Queue
0xB000-0xB1FF512BNVMe Admin Submission Queue (depth=4, slots 0-3 active)
0xB200-0xB296~150BPCIe TLP engine registers
0xB800-0xBBFF1KBNVMe I/O Completion Queue
0xBC00-0xBFFF1KBNVMe Admin Completion Queue
0xF000-0xFFFF4KBNVMe data buffer (Identify cache)
\n

ASM2362 Hardware

\n
    \n
  • CPU: 8051-compatible core, ~114.3 MHz
    • \n
  • XRAM: 64KB mapped memory
    • \n
  • No firmware signature verification
    • \n
  • UART debug: 921600 8N1, 3.3V (pins 62/63)
    • \n
\n

Source: cyrozap/usb-to-pcie-re

\n
\n

Recovery (Completed 2026-03-04)

\n

The drive was successfully recovered via XRAM-based NVMe command injection. Sanitize Block Erase (SANACT=2), injected directly into the Admin Submission Queue at XRAM 0xB000 and triggered via PCIe TLP doorbell, cleared the FTL corruption and restored full write capability.

\n

What Worked

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ApproachResult
XRAM SQ injection + PCIe TLP doorbellSanitize Block Erase succeeded, FTL rebuilt
Sanitize Block Erase (opcode 0x84, SANACT=2)Cleared write protection
BOT mode (usb-storage quirks)Required for 0xE4/0xE5 vendor commands
\n

What Didn't Work

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ApproachWhy
0xE6 passthrough for Format/SanitizeSilently dropped by bridge firmware whitelist
Format NVM via injectionAccepted by controller but didn't clear FTL corruption
Sanitize Crypto EraseNot supported (SANICAP=0x02, block erase only)
Wine + SP ToolboxWine lacks IOCTL_SCSI_PASS_THROUGH_DIRECT
Set Features 0x84Separate mechanism from firmware read-only mode
Injection to SQ slots 4-7Admin SQ depth is 4, not 8 — slots beyond 3 are ignored
\n

Key Discovery: Admin SQ Depth

\n

The XRAM buffer at 0xB000-0xB1FF has room for 8 entries (512 bytes), but the firmware configures a queue depth of 4. Commands must be injected into slots 0-3 only. The SQHD field in the Completion Queue reveals the actual depth.

\n

See docs/research/deep-research-synthesis.md for the full research history.

\n
\n

Building

\n

Requires Zig 0.13.0 or later.

\n
zig build
\n

Diagnostic Commands (read-only, safe)

\n
sudo ./zig-out/bin/asm2362-tool probe /dev/sdX        # Detect bridge type\nsudo ./zig-out/bin/asm2362-tool identify /dev/sdX      # NVMe Identify Controller\nsudo ./zig-out/bin/asm2362-tool smart /dev/sdX --json  # SMART log (JSON output)
\n

XRAM Commands (bridge-level access)

\n
# Read-only probe — tests 0xE4 support, dumps Admin SQ, MMIO, data buffer\nsudo ./zig-out/bin/asm2362-tool xram-probe /dev/sdX\n\n# Raw XRAM read/write\nsudo ./zig-out/bin/asm2362-tool xram-read --addr=0xB000 --len=64 /dev/sdX\nsudo ./zig-out/bin/asm2362-tool xram-dump --addr=0xB000 --len=512 /dev/sdX\nsudo ./zig-out/bin/asm2362-tool xram-write --addr=0xB000 --byte=0x00 /dev/sdX\n\n# NVMe command injection via XRAM (dry-run by default)\nsudo ./zig-out/bin/asm2362-tool inject --inject-cmd=format /dev/sdX         # dry-run\nsudo ./zig-out/bin/asm2362-tool inject --inject-cmd=format --force /dev/sdX  # live\n\n# Bridge reset\nsudo ./zig-out/bin/asm2362-tool reset --reset-type=1 /dev/sdX  # PCIe soft reset
\n

Running Tests

\n
zig build test       # main.zig tests\nzig build test-all   # all module tests (sg_io, sense, passthrough, replay, xram)
\n

Implementation Status

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ComponentStatus
SCSI SG_IO layerComplete
ASM2362 0xe6 passthroughComplete (Identify + SMART work; others blocked by whitelist)
XRAM access (0xE4/0xE5/0xE8)Complete
XRAM NVMe command injectionComplete (dry-run default, doorbell via PCIe reset)
NVMe Identify + SMARTComplete
Format NVM / Sanitize (via 0xe6)Archived — dead end
Frida hooks for WindowsComplete
Command replayComplete
\n

~4,000 lines of Zig with 35 unit tests.

\n
\n

Project Structure

\n
src/\n  main.zig             CLI entry point\n  scsi/                SG_IO wrapper, sense parsing\n  asm2362/\n    passthrough.zig    0xe6 CDB passthrough (Identify, SMART only)\n    xram.zig           0xE4/0xE5/0xE8 XRAM access, NVMe SQ injection, PCIe TLP doorbell\n    commands.zig       NVMe command helpers (SMART log parsing)\n  nvme/                NVMe command implementations (identify)\n  frida/               Windows DeviceIoControl hooks + replay\n  analysis/            Capability probing\n\ndocs/\n  blog/                Blog posts (mdsvex-compatible .md)\n  paper/               LaTeX technical paper\n  notes/               Research findings\n  research/            Deep research synthesis\n  archive/             Dead-end code + writeups (format.zig, sanitize.zig)\n
\n

See docs/INDEX.md for full documentation navigation.

\n
\n

References

\n\n

License

\n

Research code - use at your own risk. No warranty implied.

\n
", "readme_excerpt": "Experimental research into recovering NVMe SSDs exhibiting firmware-level write protection after FTL corruption. This is a project\n- xram injection technical blog post\n- overview / storytime blog post\n- Full paper - and tell your friends to also write papers for fun\nI used this nvme stick and the ASM2362 every day all day between 2017 and 2020 for all my laptop computing. It happpily ran Tails, ubuntu budgie, and even windows via a little usb 3 enclosure velcroed to my laptop during this time....", "install_commands": { "zig": "zig fetch --save git+https://github.com/jesssullivan/hiberpower-ntfs.git" }, "repo_url": "https://github.com/jesssullivan/hiberpower-ntfs", "website_url": "https://transscendsurvival.org/blog/xram-injection-bypassing-usb-bridge-whitelists-to-recover-nvme-drives", "docs_url": null, "registry_url": "https://zigistry.dev/package/{repo}", "releases_url": "https://github.com/jesssullivan/hiberpower-ntfs/releases", "og_image_url": "https://opengraph.githubassets.com/4eab5096441a20ccea4169263849bf62923d40b602e045da6446f5ada499f200/Jesssullivan/hiberpower-ntfs", "license": "", "pushed_at": "2026-04-22T04:13:49Z", "enriched_at": "2026-04-26T17:17:15.937Z", "gate": "homepage" }, { "slug": "jesssullivan-tummycrypt", "name": "tummycrypt", "repo": "jesssullivan/tummycrypt", "org": "jesssullivan", "ecosystem": "rust", "category": "cryptography", "description": "Self-hosted encrypted file sync with on-demand hydration and fleet sync. FOSS odrive replacement.", "featured": true, "tags": [ "crypto", "filesystem", "sync", "monorepo" ], "version": "0.12.2", "release_date": "2026-04-16T14:21:24Z", "releases": [ { "tag": "0.12.2", "date": "2026-04-16T14:21:24Z", "body": "## tcfs v0.12.2\n\n### Quick Install\n\n**macOS (.pkg installer — recommended):**\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.2/tcfs-0.12.2-macos-aarch64.pkg\nsudo installer -pkg tcfs-0.12.2-macos-aarch64.pkg -target /\n```\n\n**Linux / macOS (shell script):**\n```bash\ncurl -fsSL https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.2/install.sh | sh\n```\n\n**Homebrew:**\n```bash\nbrew tap --custom-remote Jesssullivan/tummycrypt https://github.com/Jesssullivan/tummycrypt.git\ngit -C \"$(brew --repo Jesssullivan/tummycrypt)\" fetch origin homebrew-tap\ngit -C \"$(brew --repo Jesssullivan/tummycrypt)\" checkout homebrew-tap\nbrew install Jesssullivan/tummycrypt/tcfs\n```\n\n**Container image:**\n```bash\npodman pull ghcr.io/jesssullivan/tcfsd:v0.12.2\n```\n\n**Debian/Ubuntu:**\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.2/tcfsd-0.12.2-amd64.deb\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.2/tcfs-0.12.2-amd64.deb\nsudo dpkg -i tcfsd-0.12.2-amd64.deb tcfs-0.12.2-amd64.deb\n```\n\n**RPM (Fedora/RHEL/Rocky, daemon-only today):**\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.2/tcfsd-0.12.2-x86_64.rpm\nsudo rpm -i tcfsd-0.12.2-x86_64.rpm\n```\n\n### Verify checksums\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.2/SHA256SUMS.txt\nsha256sum -c SHA256SUMS.txt\n```\n\n### Verify signature (Sigstore Cosign)\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.2/SHA256SUMS.txt.sig\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.2/SHA256SUMS.txt.pem\ncosign verify-blob \\\n --signature SHA256SUMS.txt.sig \\\n --certificate SHA256SUMS.txt.pem \\\n --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n --certificate-identity-regexp 'github.com/Jesssullivan/tummycrypt' \\\n SHA256SUMS.txt\n```\n\n### macOS artifacts\nmacOS CLI binaries are Developer ID signed when Apple credentials are configured.\nFileProvider and `.pkg` notarization is attempted for Apple artifacts, but release\npublication does not fail if Apple's notarization service or account agreements are unavailable.\n\n### Binaries included\n| Binary | Purpose |\n|--------|---------|\n| `tcfs` | CLI: push, pull, sync-status, mount, unsync |\n| `tcfsd` | Daemon: gRPC socket, FUSE, Prometheus metrics |\n| `tcfs-tui` | Terminal UI for interactive management |\n| `tcfs-mcp` | MCP server for AI agent integration |\n\n\n## What's Changed\n* [codex] Build release FileProvider staticlib with grpc backend by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/274\n* [codex] Vendor OpenSSL for macOS arm64 release artifacts by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/282\n* [codex] Pin gitleaks in Secret Scan CI by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/284\n* feat(greptile): add review configuration and coding standards by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/286\n* [codex] Ignore flaky Apple FileProvider API link in docs check by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/287\n* [codex] Correct Homebrew tap flow documentation by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/283\n* [codex] Define neo-honey live acceptance contract by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/285\n* [codex] Preserve state keying after delete by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/288\n* [codex] Define distribution smoke matrix for releases by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/289\n* [codex] Guard macOS release tcfsd linkage by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/291\n* [codex] Align Apple support claims with current evidence by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/292\n* [codex] Define macOS Finder and FileProvider reality by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/294\n* [codex] Define active iOS surface posture by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/293\n* [codex] Refresh odrive parity analysis for v0.12.1 by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/295\n* [codex] Prepare v0.12.2 metadata by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/296\n\n\n**Full Changelog**: https://github.com/Jesssullivan/tummycrypt/compare/v0.12.1...v0.12.2" }, { "tag": "0.12.1", "date": "2026-04-15T21:00:45Z", "body": "## tcfs v0.12.1\n\n### Quick Install\n\n**macOS (.pkg installer — recommended):**\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.1/tcfs-0.12.1-macos-aarch64.pkg\nsudo installer -pkg tcfs-0.12.1-macos-aarch64.pkg -target /\n```\n\n**Linux / macOS (shell script):**\n```bash\ncurl -fsSL https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.1/install.sh | sh\n```\n\n**Homebrew:**\n```bash\nbrew tap Jesssullivan/tummycrypt https://github.com/Jesssullivan/tummycrypt --branch homebrew-tap\nbrew install tcfs\n```\n\n**Container image:**\n```bash\npodman pull ghcr.io/jesssullivan/tcfsd:v0.12.1\n```\n\n**Debian/Ubuntu:**\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.1/tcfs-0.12.1-amd64.deb\nsudo dpkg -i tcfs-0.12.1-amd64.deb\n```\n\n**RPM (Fedora/RHEL/Rocky):**\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.1/tcfsd-0.12.1-x86_64.rpm\nsudo rpm -i tcfsd-0.12.1-x86_64.rpm\n```\n\n### Verify checksums\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.1/SHA256SUMS.txt\nsha256sum -c SHA256SUMS.txt\n```\n\n### Verify signature (Sigstore Cosign)\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.1/SHA256SUMS.txt.sig\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.1/SHA256SUMS.txt.pem\ncosign verify-blob \\\n --signature SHA256SUMS.txt.sig \\\n --certificate SHA256SUMS.txt.pem \\\n --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n --certificate-identity-regexp 'github.com/Jesssullivan/tummycrypt' \\\n SHA256SUMS.txt\n```\n\n### macOS artifacts\nmacOS CLI binaries are Developer ID signed when Apple credentials are configured.\nFileProvider and `.pkg` notarization is attempted for Apple artifacts, but release\npublication does not fail if Apple's notarization service or account agreements are unavailable.\n\n### Binaries included\n| Binary | Purpose |\n|--------|---------|\n| `tcfs` | CLI: push, pull, sync-status, mount, unsync |\n| `tcfsd` | Daemon: gRPC socket, FUSE, Prometheus metrics |\n| `tcfs-tui` | Terminal UI for interactive management |\n| `tcfs-mcp` | MCP server for AI agent integration |\n\n\n## What's Changed\n* fix(sync): P0 sync engine — empty files, permissions, delete by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/176\n* feat(sync): symlink handling with cycle detection by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/177\n* feat(sync): streaming chunker for large files (>64MB) by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/178\n* fix(nats): sync_always documentation + stream health verification by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/181\n* fix(sync): eliminate panics — unwrap, bounds check, parse validation by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/182\n* fix(daemon): race guards for FileDeleted, deferred vclock, active-file protection by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/184\n* fix(fuse): implement flush via VFS fsync + improve error-to-errno mapping by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/187\n* fix(vfs): OOM prevention, RwLock for concurrent reads, bounded negative cache by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/188\n* feat: unsync dehydration + auto-unsync with disk pressure by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/191\n* feat: selective sync policies + D-Bus gRPC backend by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/192\n* feat(sync): sync trash + bandwidth throttling by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/193\n* feat(cli): tcfs trash list/restore/purge commands by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/194\n* fix(storage): centralize prefix resolution, fix 5 namespace bugs by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/195\n* fix(sync): recursive remote index listing + ListFiles fallback by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/196\n* feat(daemon): hydration state in ListFiles + macOS watcher disable by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/197\n* feat(daemon): periodic reconciliation loop by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/198\n* feat(fileprovider): badge decorations + custom actions, remove FinderSync by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/199\n* fix(security): NATS TLS default, trash path traversal, auth bypass warning by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/215\n* fix(sync): clear both conflict and status on resolution by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/211\n* fix(sync): sync empty directories via .tcfs_dir markers by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/212\n* feat(menubar): TCFSStatus.app conflict monitor by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/200\n* test(sync): unit tests for engine, NATS serialization, reconcile by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/213\n* fix(sync): retry chunk upload/download with exponential backoff by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/214\n* chore: repo hygiene — stale advisories + unreachable!() by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/216\n* fix(secrets): unified credential discovery, AWS file support by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/217\n* test(fileprovider): 9 functional tests with memory backend by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/218\n* test(daemon): 8 gRPC unit tests + fix production unwraps by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/219\n* fix(cli): replace bare unwrap() with expect() by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/220\n* test(fuzz): cargo-fuzz targets + proptest for manifest, crypto, paths by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/221\n* [codex] Reject traversal paths in gRPC push by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/239\n* [codex] Persist and recover StateCache metadata by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/240\n* [codex] Converge toolchain and CI by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/242\n* [codex] Align canonical home and release surfaces by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/244\n* [codex] Retry manifest reads during download by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/241\n* [codex] Add recovery-aware manifest/index publish durability by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/243\n* [codex] Add failure-injection retry coverage by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/245\n* [codex] Expand tcfsd gRPC coverage by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/246\n* [codex] Add tcfs-mcp tool coverage by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/247\n* [codex] Add resilience replay simulation coverage by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/248\n* [codex] Fix PathLocks cleanup under contention by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/249\n* [codex] Add orphaned chunk visibility by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/250\n* [codex] Add orphan chunk grace-period cleanup by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/251\n* [codex] Prevent upload TOCTOU races by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/252\n* [codex] Normalize Unicode rel paths by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/254\n* [codex] Make key rotation resumable by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/253\n* [codex] Cover NATS retry delivery decisions by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/255\n* [codex] Add CLI workflow coverage by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/256\n* [codex] Wire orphan chunk cleanup into reconcile surfaces by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/257\n* [codex] Add guarded FUSE mount roundtrip coverage by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/258\n* [codex] Cover live NATS durable replay semantics by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/259\n* [codex] Expand FUSE lifecycle coverage across rename and delete by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/260\n* [codex] Cover live storage outage recovery by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/261\n* [codex] Add named neo-honey live smoke lane by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/268\n* [codex] Sign release container image by digest by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/266\n* [codex] Record Apple surfaces as experimental by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/270\n* [codex] Backfill changelog through v0.12.0 by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/269\n* [codex] Reduce overstatement in platform support docs by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/267\n* [codex] Let manual release dispatch exercise tag-gated jobs by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/271\n* [codex] Harden release proof dispatch and Apple notarization by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/272\n* [codex] Prepare v0.12.1 release metadata by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/273\n\n\n**Full Changelog**: https://github.com/Jesssullivan/tummycrypt/compare/v0.12.0...v0.12.1" }, { "tag": "0.12.0", "date": "2026-04-08T21:00:52Z", "body": "## tcfs v0.12.0\n\n### Quick Install\n\n**macOS (.pkg installer — recommended):**\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.0/tcfs-0.12.0-macos-aarch64.pkg\nsudo installer -pkg tcfs-0.12.0-macos-aarch64.pkg -target /\n```\n\n**Linux / macOS (shell script):**\n```bash\ncurl -fsSL https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.0/install.sh | sh\n```\n\n**Homebrew:**\n```bash\nbrew install tinyland-inc/tap/tcfs\n```\n\n**Container image:**\n```bash\npodman pull ghcr.io/tcfsd:v0.12.0\n```\n\n**Debian/Ubuntu:**\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.0/tcfs-0.12.0-amd64.deb\nsudo dpkg -i tcfs-0.12.0-amd64.deb\n```\n\n**RPM (Fedora/RHEL/Rocky):**\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.0/tcfsd-0.12.0-x86_64.rpm\nsudo rpm -i tcfsd-0.12.0-x86_64.rpm\n```\n\n### Verify checksums\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.0/SHA256SUMS.txt\nsha256sum -c SHA256SUMS.txt\n```\n\n### Verify signature (Sigstore Cosign)\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.0/SHA256SUMS.txt.sig\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.12.0/SHA256SUMS.txt.pem\ncosign verify-blob \\\n --signature SHA256SUMS.txt.sig \\\n --certificate SHA256SUMS.txt.pem \\\n --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n --certificate-identity-regexp 'github.com/tinyland-inc/tummycrypt' \\\n SHA256SUMS.txt\n```\n\n### macOS binaries\nAll macOS binaries are signed with Developer ID and notarized by Apple.\nThe FileProvider extension (`TCFSProvider.app`) is stapled for offline verification.\n\n### Binaries included\n| Binary | Purpose |\n|--------|---------|\n| `tcfs` | CLI: push, pull, sync-status, mount, unsync |\n| `tcfsd` | Daemon: gRPC socket, FUSE, Prometheus metrics |\n| `tcfs-tui` | Terminal UI for interactive management |\n| `tcfs-mcp` | MCP server for AI agent integration |\n\n\n**Full Changelog**: https://github.com/Jesssullivan/tummycrypt/compare/v0.11.1...v0.12.0" }, { "tag": "0.11.1", "date": "2026-04-08T20:21:49Z", "body": "## tcfs v0.11.1\n\n### Quick Install\n\n**macOS (.pkg installer — recommended):**\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.11.1/tcfs-0.11.1-macos-aarch64.pkg\nsudo installer -pkg tcfs-0.11.1-macos-aarch64.pkg -target /\n```\n\n**Linux / macOS (shell script):**\n```bash\ncurl -fsSL https://github.com/Jesssullivan/tummycrypt/releases/download/v0.11.1/install.sh | sh\n```\n\n**Homebrew:**\n```bash\nbrew install tinyland-inc/tap/tcfs\n```\n\n**Container image:**\n```bash\npodman pull ghcr.io/tcfsd:v0.11.1\n```\n\n**Debian/Ubuntu:**\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.11.1/tcfs-0.11.1-amd64.deb\nsudo dpkg -i tcfs-0.11.1-amd64.deb\n```\n\n**RPM (Fedora/RHEL/Rocky):**\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.11.1/tcfsd-0.11.1-x86_64.rpm\nsudo rpm -i tcfsd-0.11.1-x86_64.rpm\n```\n\n### Verify checksums\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.11.1/SHA256SUMS.txt\nsha256sum -c SHA256SUMS.txt\n```\n\n### Verify signature (Sigstore Cosign)\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.11.1/SHA256SUMS.txt.sig\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.11.1/SHA256SUMS.txt.pem\ncosign verify-blob \\\n --signature SHA256SUMS.txt.sig \\\n --certificate SHA256SUMS.txt.pem \\\n --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n --certificate-identity-regexp 'github.com/tinyland-inc/tummycrypt' \\\n SHA256SUMS.txt\n```\n\n### macOS binaries\nAll macOS binaries are signed with Developer ID and notarized by Apple.\nThe FileProvider extension (`TCFSProvider.app`) is stapled for offline verification.\n\n### Binaries included\n| Binary | Purpose |\n|--------|---------|\n| `tcfs` | CLI: push, pull, sync-status, mount, unsync |\n| `tcfsd` | Daemon: gRPC socket, FUSE, Prometheus metrics |\n| `tcfs-tui` | Terminal UI for interactive management |\n| `tcfs-mcp` | MCP server for AI agent integration |\n\n\n**Full Changelog**: https://github.com/Jesssullivan/tummycrypt/commits/v0.11.1" }, { "tag": "0.11.0", "date": "2026-04-07T23:51:06Z", "body": "## tcfs v0.11.0\n\n### Quick Install\n\n**macOS (.pkg installer — recommended):**\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.11.0/tcfs-0.11.0-macos-aarch64.pkg\nsudo installer -pkg tcfs-0.11.0-macos-aarch64.pkg -target /\n```\n\n**Linux / macOS (shell script):**\n```bash\ncurl -fsSL https://github.com/Jesssullivan/tummycrypt/releases/download/v0.11.0/install.sh | sh\n```\n\n**Homebrew:**\n```bash\nbrew install tinyland-inc/tap/tcfs\n```\n\n**Container image:**\n```bash\npodman pull ghcr.io/jesssullivan/tcfsd:v0.11.0\n```\n\n**Debian/Ubuntu:**\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.11.0/tcfs-0.11.0-amd64.deb\nsudo dpkg -i tcfs-0.11.0-amd64.deb\n```\n\n**RPM (Fedora/RHEL/Rocky):**\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.11.0/tcfsd-0.11.0-x86_64.rpm\nsudo rpm -i tcfsd-0.11.0-x86_64.rpm\n```\n\n### Verify checksums\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.11.0/SHA256SUMS.txt\nsha256sum -c SHA256SUMS.txt\n```\n\n### Verify signature (Sigstore Cosign)\n```bash\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.11.0/SHA256SUMS.txt.sig\ncurl -LO https://github.com/Jesssullivan/tummycrypt/releases/download/v0.11.0/SHA256SUMS.txt.pem\ncosign verify-blob \\\n --signature SHA256SUMS.txt.sig \\\n --certificate SHA256SUMS.txt.pem \\\n --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n --certificate-identity-regexp 'github.com/tinyland-inc/tummycrypt' \\\n SHA256SUMS.txt\n```\n\n### macOS binaries\nAll macOS binaries are signed with Developer ID and notarized by Apple.\nThe FileProvider extension (`TCFSProvider.app`) is stapled for offline verification.\n\n### Binaries included\n| Binary | Purpose |\n|--------|---------|\n| `tcfs` | CLI: push, pull, sync-status, mount, unsync |\n| `tcfsd` | Daemon: gRPC socket, FUSE, Prometheus metrics |\n| `tcfs-tui` | Terminal UI for interactive management |\n| `tcfs-mcp` | MCP server for AI agent integration |\n\n\n## What's Changed\n* fix(fileprovider): add TcfsChangeEvent to cbindgen exports by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/72\n* fix(fileprovider): fix EDEADLK hydration deadlock + CLI pull prefix by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/73\n* feat(ios): QR enrollment view for alpha onboarding by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/74\n* fix(ios): wrap conditional body in Group for sheet modifier by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/75\n* feat(ios): fix QR enrollment + encryption + deep links by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/76\n* chore(ios): bump build number to 5 by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/77\n* fix(ios): ATS exception + credential form + TOTP handoff by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/78\n* feat(auth): credential broker for zero-touch enrollment by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/79\n* fix(ios): use build setting variables for version in Info.plist by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/80\n* fix(ios): add version + ATS to xcodegen properties by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/81\n* chore(ios): auto-skip encryption compliance prompt by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/82\n* feat(ios): build info section with git SHA by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/83\n* fix(ios): auto-unlock keychain in pipeline for SSH by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/84\n* chore(ios): bump to v1.1.0 build 9 by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/85\n* feat(auth): compact QR encoding for device enrollment by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/86\n* refactor(tcfs): retire FUSE crates — remove 11,418 LOC by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/87\n* style: cargo fmt by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/89\n* fix(tcfsd): skip directories in watcher push path by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/88\n* fix(nfs): use sudo for NFS mount on Linux by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/90\n* fix(grpc): run NFS mount in-process instead of subprocess by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/91\n* fix(nfs): add diagnostic logging for NFS server exit by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/92\n* fix(nfs): detect task panics via JoinHandle watcher by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/93\n* fix(nfs): add 10s timeout to VFS/S3 calls in NFS adapter by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/94\n* feat(mount): resurrect FUSE3 as default, NFS as fallback by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/95\n* chore: regenerate Cargo.lock with fuse3 dependency by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/96\n* chore: regenerate Cargo.lock with fuse3 dependency by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/97\n* fix(vfs): add diagnostic logging to hydration path by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/98\n* fix(vfs): diagnostic logging for hydration path by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/99\n* fix(vfs): version bump 0.9.1 + hydration diagnostics by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/100\n* fix(vfs): parse JSON v2 manifests in hydration path by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/101\n* fix(flake): disable stale attic binary cache by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/102\n* fix(flake): disable stale attic cache by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/103\n* fix: add missing serde_json to Cargo.lock by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/104\n* fix: add missing serde_json to Cargo.lock by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/105\n* feat(vfs): read-write FUSE support by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/106\n* fix: add blake3 to Cargo.lock by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/107\n* fix: add blake3 to Cargo.lock by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/108\n* feat(vfs): FastCDC chunking for FUSE writes by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/109\n* feat(vfs): FastCDC chunking for FUSE writes by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/110\n* fix(daemon): index-first auto-pull (skip FUSE mount writes) by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/111\n* feat: NATS publish on FUSE write + index-first auto-pull by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/112\n* feat(vfs): make .tc suffix transparent to userspace by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/113\n* fix(sync): prevent orphaned index entries on skipped uploads by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/114\n* fix(flake): remove stale fuse-t feature flag for Darwin by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/115\n* feat(vfs): mkdir, rename, rmdir for FUSE directory ops by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/116\n* feat(vfs): wire vector clock conflict detection into FUSE writes by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/117\n* fix(nats): use create_or_update_stream to apply subject filter changes by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/118\n* fix(nats): include storage prefix in FUSE flush manifest_path by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/119\n* ci: add Cargo.lock freshness check by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/120\n* fix(sync): resolve pull 404 for files pushed with absolute paths (#122) by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/123\n* fix(daemon): write index entry on gRPC push + normalize rel_path by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/124\n* fix(sync): fallback filename search for cross-host pull by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/134\n* fix(crypto): enable crypto feature flag + wire EncryptionContext into all push paths by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/132\n* fix(fileprovider): enumerate immediate children for subdirectory navigation by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/133\n* fix(daemon): update state cache on NATS auto-pull events by @Jesssullivan in https://github.com/Jesssullivan/tummycrypt/pull/135\n\n\n**Full Changelog**: https://github.com/Jesssullivan/tummycrypt/compare/v0.9.3...v0.11.0" }, { "tag": "0.10.0", "date": "2026-04-05T22:03:39Z", "body": "## tcfs v0.10.0\n\n### Quick Install\n\n**macOS (.pkg installer — recommended):**\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.10.0/tcfs-0.10.0-macos-aarch64.pkg\nsudo installer -pkg tcfs-0.10.0-macos-aarch64.pkg -target /\n```\n\n**Linux / macOS (shell script):**\n```bash\ncurl -fsSL https://github.com/tinyland-inc/tummycrypt/releases/download/v0.10.0/install.sh | sh\n```\n\n**Homebrew:**\n```bash\nbrew install tinyland-inc/tap/tcfs\n```\n\n**Container image:**\n```bash\npodman pull ghcr.io/tinyland-inc/tcfsd:v0.10.0\n```\n\n**Debian/Ubuntu:**\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.10.0/tcfs-0.10.0-amd64.deb\nsudo dpkg -i tcfs-0.10.0-amd64.deb\n```\n\n**RPM (Fedora/RHEL/Rocky):**\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.10.0/tcfsd-0.10.0-x86_64.rpm\nsudo rpm -i tcfsd-0.10.0-x86_64.rpm\n```\n\n### Verify checksums\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.10.0/SHA256SUMS.txt\nsha256sum -c SHA256SUMS.txt\n```\n\n### Verify signature (Sigstore Cosign)\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.10.0/SHA256SUMS.txt.sig\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.10.0/SHA256SUMS.txt.pem\ncosign verify-blob \\\n --signature SHA256SUMS.txt.sig \\\n --certificate SHA256SUMS.txt.pem \\\n --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n --certificate-identity-regexp 'github.com/tinyland-inc/tummycrypt' \\\n SHA256SUMS.txt\n```\n\n### macOS binaries\nAll macOS binaries are signed with Developer ID and notarized by Apple.\nThe FileProvider extension (`TCFSProvider.app`) is stapled for offline verification.\n\n### Binaries included\n| Binary | Purpose |\n|--------|---------|\n| `tcfs` | CLI: push, pull, sync-status, mount, unsync |\n| `tcfsd` | Daemon: gRPC socket, FUSE, Prometheus metrics |\n| `tcfs-tui` | Terminal UI for interactive management |\n| `tcfs-mcp` | MCP server for AI agent integration |\n\n\n## What's Changed\n* fix(fileprovider): add TcfsChangeEvent to cbindgen exports by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/72\n* fix(fileprovider): fix EDEADLK hydration deadlock + CLI pull prefix by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/73\n* feat(ios): QR enrollment view for alpha onboarding by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/74\n* fix(ios): wrap conditional body in Group for sheet modifier by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/75\n* feat(ios): fix QR enrollment + encryption + deep links by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/76\n* chore(ios): bump build number to 5 by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/77\n* fix(ios): ATS exception + credential form + TOTP handoff by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/78\n* feat(auth): credential broker for zero-touch enrollment by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/79\n* fix(ios): use build setting variables for version in Info.plist by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/80\n* fix(ios): add version + ATS to xcodegen properties by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/81\n* chore(ios): auto-skip encryption compliance prompt by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/82\n* feat(ios): build info section with git SHA by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/83\n* fix(ios): auto-unlock keychain in pipeline for SSH by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/84\n* chore(ios): bump to v1.1.0 build 9 by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/85\n* feat(auth): compact QR encoding for device enrollment by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/86\n* refactor(tcfs): retire FUSE crates — remove 11,418 LOC by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/87\n* style: cargo fmt by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/89\n* fix(tcfsd): skip directories in watcher push path by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/88\n* fix(nfs): use sudo for NFS mount on Linux by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/90\n* fix(grpc): run NFS mount in-process instead of subprocess by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/91\n* fix(nfs): add diagnostic logging for NFS server exit by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/92\n* fix(nfs): detect task panics via JoinHandle watcher by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/93\n* fix(nfs): add 10s timeout to VFS/S3 calls in NFS adapter by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/94\n* feat(mount): resurrect FUSE3 as default, NFS as fallback by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/95\n* chore: regenerate Cargo.lock with fuse3 dependency by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/96\n* chore: regenerate Cargo.lock with fuse3 dependency by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/97\n* fix(vfs): add diagnostic logging to hydration path by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/98\n* fix(vfs): diagnostic logging for hydration path by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/99\n* fix(vfs): version bump 0.9.1 + hydration diagnostics by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/100\n* fix(vfs): parse JSON v2 manifests in hydration path by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/101\n* fix(flake): disable stale attic binary cache by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/102\n* fix(flake): disable stale attic cache by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/103\n* fix: add missing serde_json to Cargo.lock by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/104\n* fix: add missing serde_json to Cargo.lock by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/105\n* feat(vfs): read-write FUSE support by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/106\n* fix: add blake3 to Cargo.lock by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/107\n* fix: add blake3 to Cargo.lock by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/108\n* feat(vfs): FastCDC chunking for FUSE writes by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/109\n* feat(vfs): FastCDC chunking for FUSE writes by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/110\n* fix(daemon): index-first auto-pull (skip FUSE mount writes) by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/111\n* feat: NATS publish on FUSE write + index-first auto-pull by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/112\n\n\n**Full Changelog**: https://github.com/tinyland-inc/tummycrypt/compare/v0.9.3...v0.10.0" }, { "tag": "0.9.3", "date": "2026-03-09T23:18:42Z", "body": "## tcfs v0.9.3\n\n### Quick Install\n\n**macOS (.pkg installer — recommended):**\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.3/tcfs-0.9.3-macos-aarch64.pkg\nsudo installer -pkg tcfs-0.9.3-macos-aarch64.pkg -target /\n```\n\n**Linux / macOS (shell script):**\n```bash\ncurl -fsSL https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.3/install.sh | sh\n```\n\n**Homebrew:**\n```bash\nbrew install tinyland-inc/tap/tcfs\n```\n\n**Container image:**\n```bash\npodman pull ghcr.io/tinyland-inc/tcfsd:v0.9.3\n```\n\n**Debian/Ubuntu:**\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.3/tcfs-0.9.3-amd64.deb\nsudo dpkg -i tcfs-0.9.3-amd64.deb\n```\n\n**RPM (Fedora/RHEL/Rocky):**\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.3/tcfsd-0.9.3-x86_64.rpm\nsudo rpm -i tcfsd-0.9.3-x86_64.rpm\n```\n\n### Verify checksums\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.3/SHA256SUMS.txt\nsha256sum -c SHA256SUMS.txt\n```\n\n### Verify signature (Sigstore Cosign)\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.3/SHA256SUMS.txt.sig\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.3/SHA256SUMS.txt.pem\ncosign verify-blob \\\n --signature SHA256SUMS.txt.sig \\\n --certificate SHA256SUMS.txt.pem \\\n --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n --certificate-identity-regexp 'github.com/tinyland-inc/tummycrypt' \\\n SHA256SUMS.txt\n```\n\n### macOS binaries\nAll macOS binaries are signed with Developer ID and notarized by Apple.\nThe FileProvider extension (`TCFSProvider.app`) is stapled for offline verification.\n\n### Binaries included\n| Binary | Purpose |\n|--------|---------|\n| `tcfs` | CLI: push, pull, sync-status, mount, unsync |\n| `tcfsd` | Daemon: gRPC socket, FUSE, Prometheus metrics |\n| `tcfs-tui` | Terminal UI for interactive management |\n| `tcfs-mcp` | MCP server for AI agent integration |\n\n\n**Full Changelog**: https://github.com/tinyland-inc/tummycrypt/compare/v0.9.2...v0.9.3" }, { "tag": "0.9.2", "date": "2026-03-09T22:55:56Z", "body": "## tcfs v0.9.2\n\n### Quick Install\n\n**macOS (.pkg installer — recommended):**\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.2/tcfs-0.9.2-macos-aarch64.pkg\nsudo installer -pkg tcfs-0.9.2-macos-aarch64.pkg -target /\n```\n\n**Linux / macOS (shell script):**\n```bash\ncurl -fsSL https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.2/install.sh | sh\n```\n\n**Homebrew:**\n```bash\nbrew install tinyland-inc/tap/tcfs\n```\n\n**Container image:**\n```bash\npodman pull ghcr.io/tinyland-inc/tcfsd:v0.9.2\n```\n\n**Debian/Ubuntu:**\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.2/tcfs-0.9.2-amd64.deb\nsudo dpkg -i tcfs-0.9.2-amd64.deb\n```\n\n**RPM (Fedora/RHEL/Rocky):**\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.2/tcfsd-0.9.2-x86_64.rpm\nsudo rpm -i tcfsd-0.9.2-x86_64.rpm\n```\n\n### Verify checksums\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.2/SHA256SUMS.txt\nsha256sum -c SHA256SUMS.txt\n```\n\n### Verify signature (Sigstore Cosign)\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.2/SHA256SUMS.txt.sig\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.2/SHA256SUMS.txt.pem\ncosign verify-blob \\\n --signature SHA256SUMS.txt.sig \\\n --certificate SHA256SUMS.txt.pem \\\n --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n --certificate-identity-regexp 'github.com/tinyland-inc/tummycrypt' \\\n SHA256SUMS.txt\n```\n\n### macOS binaries\nAll macOS binaries are signed with Developer ID and notarized by Apple.\nThe FileProvider extension (`TCFSProvider.app`) is stapled for offline verification.\n\n### Binaries included\n| Binary | Purpose |\n|--------|---------|\n| `tcfs` | CLI: push, pull, sync-status, mount, unsync |\n| `tcfsd` | Daemon: gRPC socket, FUSE, Prometheus metrics |\n| `tcfs-tui` | Terminal UI for interactive management |\n| `tcfs-mcp` | MCP server for AI agent integration |\n\n\n## What's Changed\n* fix(ci): resolve remaining release build failures by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/71\n\n\n**Full Changelog**: https://github.com/tinyland-inc/tummycrypt/compare/v0.9.1...v0.9.2" }, { "tag": "0.9.1", "date": "2026-03-09T22:20:11Z", "body": "## tcfs v0.9.1\n\n### Quick Install\n\n**macOS (.pkg installer — recommended):**\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.1/tcfs-0.9.1-macos-aarch64.pkg\nsudo installer -pkg tcfs-0.9.1-macos-aarch64.pkg -target /\n```\n\n**Linux / macOS (shell script):**\n```bash\ncurl -fsSL https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.1/install.sh | sh\n```\n\n**Homebrew:**\n```bash\nbrew install tinyland-inc/tap/tcfs\n```\n\n**Container image:**\n```bash\npodman pull ghcr.io/tinyland-inc/tcfsd:v0.9.1\n```\n\n**Debian/Ubuntu:**\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.1/tcfs-0.9.1-amd64.deb\nsudo dpkg -i tcfs-0.9.1-amd64.deb\n```\n\n**RPM (Fedora/RHEL/Rocky):**\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.1/tcfsd-0.9.1-x86_64.rpm\nsudo rpm -i tcfsd-0.9.1-x86_64.rpm\n```\n\n### Verify checksums\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.1/SHA256SUMS.txt\nsha256sum -c SHA256SUMS.txt\n```\n\n### Verify signature (Sigstore Cosign)\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.1/SHA256SUMS.txt.sig\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.1/SHA256SUMS.txt.pem\ncosign verify-blob \\\n --signature SHA256SUMS.txt.sig \\\n --certificate SHA256SUMS.txt.pem \\\n --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n --certificate-identity-regexp 'github.com/tinyland-inc/tummycrypt' \\\n SHA256SUMS.txt\n```\n\n### macOS binaries\nAll macOS binaries are signed with Developer ID and notarized by Apple.\nThe FileProvider extension (`TCFSProvider.app`) is stapled for offline verification.\n\n### Binaries included\n| Binary | Purpose |\n|--------|---------|\n| `tcfs` | CLI: push, pull, sync-status, mount, unsync |\n| `tcfsd` | Daemon: gRPC socket, FUSE, Prometheus metrics |\n| `tcfs-tui` | Terminal UI for interactive management |\n| `tcfs-mcp` | MCP server for AI agent integration |\n\n\n## What's Changed\n* fix(ci): resolve release workflow build failures by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/70\n\n\n**Full Changelog**: https://github.com/tinyland-inc/tummycrypt/compare/v0.9.0...v0.9.1" }, { "tag": "0.9.0", "date": "2026-03-09T21:25:38Z", "body": "## tcfs v0.9.0\n\n### Quick Install\n\n**macOS (.pkg installer — recommended):**\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.0/tcfs-0.9.0-macos-aarch64.pkg\nsudo installer -pkg tcfs-0.9.0-macos-aarch64.pkg -target /\n```\n\n**Linux / macOS (shell script):**\n```bash\ncurl -fsSL https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.0/install.sh | sh\n```\n\n**Homebrew:**\n```bash\nbrew install tinyland-inc/tap/tcfs\n```\n\n**Container image:**\n```bash\npodman pull ghcr.io/tinyland-inc/tcfsd:v0.9.0\n```\n\n**Debian/Ubuntu:**\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.0/tcfs-0.9.0-amd64.deb\nsudo dpkg -i tcfs-0.9.0-amd64.deb\n```\n\n**RPM (Fedora/RHEL/Rocky):**\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.0/tcfsd-0.9.0-x86_64.rpm\nsudo rpm -i tcfsd-0.9.0-x86_64.rpm\n```\n\n### Verify checksums\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.0/SHA256SUMS.txt\nsha256sum -c SHA256SUMS.txt\n```\n\n### Verify signature (Sigstore Cosign)\n```bash\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.0/SHA256SUMS.txt.sig\ncurl -LO https://github.com/tinyland-inc/tummycrypt/releases/download/v0.9.0/SHA256SUMS.txt.pem\ncosign verify-blob \\\n --signature SHA256SUMS.txt.sig \\\n --certificate SHA256SUMS.txt.pem \\\n --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n --certificate-identity-regexp 'github.com/tinyland-inc/tummycrypt' \\\n SHA256SUMS.txt\n```\n\n### macOS binaries\nAll macOS binaries are signed with Developer ID and notarized by Apple.\nThe FileProvider extension (`TCFSProvider.app`) is stapled for offline verification.\n\n### Binaries included\n| Binary | Purpose |\n|--------|---------|\n| `tcfs` | CLI: push, pull, sync-status, mount, unsync |\n| `tcfsd` | Daemon: gRPC socket, FUSE, Prometheus metrics |\n| `tcfs-tui` | Terminal UI for interactive management |\n| `tcfs-mcp` | MCP server for AI agent integration |\n\n\n## What's Changed\n* feat: UniFFI bindings for iOS FileProvider (Phase 7a) by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/62\n* feat(ios): scaffold iOS FileProvider project (Phase 7b) by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/63\n* feat(ios): end-to-end xcodebuild pipeline via xcodegen by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/64\n* feat(ios): progress reporting + sync status (Phase 7e) by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/65\n* feat(ios): TestFlight pipeline + simulator fixes by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/66\n* feat(fuse): FUSE-T support for macOS by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/67\n* feat(vfs): extract VirtualFilesystem trait + NFS loopback server by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/68\n* chore: bump workspace version to 0.9.0 by @Jesssullivan in https://github.com/tinyland-inc/tummycrypt/pull/69\n\n\n**Full Changelog**: https://github.com/tinyland-inc/tummycrypt/compare/v0.8.1...v0.9.0" } ], "stars": 3, "topics": [ "encryption", "nats", "rust", "seaweedfs", "self-hosted", "sync", "cleanroom-engineering" ], "languages": [ { "name": "Rust", "color": "#dea584", "bytes": 1689288 }, { "name": "Swift", "color": "#F05138", "bytes": 214544 }, { "name": "Shell", "color": "#89e051", "bytes": 93021 }, { "name": "HCL", "color": "#844FBA", "bytes": 50310 }, { "name": "C", "color": "#555555", "bytes": 33641 } ], "primary_language": "Rust", "readme_html": "

tummycrypt / tcfs

\n
\n

Under active development. Not yet stable. Expect breaking changes.

\n
\n

Self-hosted encrypted file sync with on-demand hydration. Mounts SeaweedFS as a local directory — files appear as zero-byte .tc stubs until accessed, then transparently download and decrypt. FOSS odrive/Dropbox replacement.

\n

Canonical Home

\n

Jesssullivan/tummycrypt is the canonical source repository for tcfs.\nIf tinyland-inc/tummycrypt exists, treat it as a fork or downstream\ndistribution surface rather than the source of truth for planning, issues,\nreleases, or contributor workflow.

\n

Operational policy: docs/ops/remote-governance.md.

\n

Features

\n
    \n
  • On-demand hydration: Files appear as .tc stubs, hydrate transparently on open
    • \n
  • E2E encryption: XChaCha20-Poly1305 per-chunk, Argon2id KDF, BIP-39 recovery keys
    • \n
  • Fleet sync: Multi-machine sync via NATS JetStream with vector clock conflict detection
    • \n
  • Content-addressed storage: FastCDC chunking, BLAKE3 hashing, zstd compression
    • \n
  • Git-safe: Syncs .git/ directories as atomic bundles with lock detection
    • \n
  • Cross-platform: Linux is the best-supported runtime; macOS has packaged but still experimental desktop surfaces; Windows remains planned
    • \n
\n

Quick Start

\n
# Nix devShell (recommended)\nnix develop\n# Or auto-load the committed devShell + env on cd\ndirenv allow\n\n# Or manual: install the pinned Rust 1.93.0 toolchain, protobuf compiler, fuse3 (Linux)\n\n# Start local dev infrastructure (SeaweedFS + NATS + Prometheus + Grafana)\ntask dev\n\n# Build + test\ntask check
\n

Installation

\n
# Linux/macOS tarball convenience installer\n# Fast CLI install, but not part of the canonical release-proof surface.\ncurl -fsSL https://github.com/Jesssullivan/tummycrypt/releases/latest/download/install.sh | sh\n\n# macOS (Homebrew, current manual tap flow)\nbrew tap --custom-remote Jesssullivan/tummycrypt https://github.com/Jesssullivan/tummycrypt.git\ngit -C \"$(brew --repo Jesssullivan/tummycrypt)\" fetch origin homebrew-tap\ngit -C \"$(brew --repo Jesssullivan/tummycrypt)\" checkout homebrew-tap\nbrew install Jesssullivan/tummycrypt/tcfs\n\n# Debian/Ubuntu\nsudo dpkg -i tcfsd-*.deb tcfs-*.deb\n\n# RPM (Fedora/RHEL/Rocky, daemon-only today)\nsudo rpm -i tcfsd-*.rpm\n\n# Container (K8s worker mode)\npodman pull ghcr.io/jesssullivan/tcfsd:latest\n\n# Nix\nnix build github:Jesssullivan/tummycrypt
\n

For the supported post-release proof contract across Homebrew, .pkg, .deb,\n.rpm, container, and Nix, see\ndocs/ops/distribution-smoke-matrix.md.

\n

CLI

\n
tcfs status                    # Daemon status, device identity, NATS connection\ntcfs push <path>               # Upload with encryption + vector clock tick\ntcfs pull <manifest> <local>   # Download with conflict detection + decryption\ntcfs mount <remote> <target>   # FUSE mount with on-demand hydration\ntcfs unsync <path>             # Convert hydrated file back to .tc stub\ntcfs device enroll             # Register device with age keypair\ntcfs device list               # Show enrolled fleet devices
\n

Binaries

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
BinaryPurpose
tcfsCLI: push, pull, mount, unsync, device management
tcfsdDaemon: gRPC, FUSE mounts, NATS fleet sync, Prometheus metrics
tcfs-tuiTerminal UI: dashboard with sync status, conflicts, mounts
tcfs-mcpMCP server: AI agent integration (8 tools, stdio transport)
\n

Architecture

\n

18 workspace crates organized in layers:

\n
crates/\n├── tcfs-core/           # Shared types, config, protobuf (gRPC service)\n├── tcfs-crypto/         # XChaCha20-Poly1305, Argon2id, HKDF, BIP-39\n├── tcfs-secrets/        # SOPS/age decryption, KeePassXC, device identity\n├── tcfs-storage/        # OpenDAL S3/SeaweedFS operator + health checks\n├── tcfs-chunks/         # FastCDC chunking, BLAKE3 hashing, zstd compression\n├── tcfs-sync/           # Sync engine, vector clocks, NATS JetStream, reconciliation\n├── tcfs-auth/           # TOTP, WebAuthn/FIDO2, device enrollment\n├── tcfs-vfs/            # Virtual filesystem: hydration, disk cache, negative cache\n├── tcfs-fuse/           # Linux FUSE3 driver\n├── tcfs-nfs/            # NFS loopback mount (no kernel modules)\n├── tcfs-cloudfilter/    # Windows Cloud Files API (planned)\n├── tcfs-file-provider/  # macOS/iOS FileProvider FFI (cbindgen + UniFFI)\n├── tcfs-sops/           # SOPS+age fleet secret propagation\n├── tcfs-dbus/           # D-Bus integration (Linux)\n├── tcfsd/               # Daemon binary (gRPC + metrics + systemd)\n├── tcfs-cli/            # CLI binary\n├── tcfs-tui/            # Terminal UI (ratatui)\n└── tcfs-mcp/            # MCP server (rmcp, stdio transport)\n
\n

See docs/ARCHITECTURE.md for the full system design.

\n

For packaged release proof across Homebrew, .pkg, .deb, .rpm, container,\nand Nix surfaces, see docs/ops/distribution-smoke-matrix.md.\nFor the bar after install succeeds, see\ndocs/ops/packaged-install-first-use.md.

\n

Platform Support

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FeatureLinuxmacOSWindowsiOS
CLI (push/pull/reconcile)FullFullPlanned-
Daemon (gRPC + metrics)FullAvailable, lightly validatedPlanned-
Filesystem mountFull (FUSE3, NFS fallback)ExperimentalCloud Files API (skeleton)-
FileProvider-Experimental-Proof-of-concept, read-only
Finder/Explorer badges-Experimental--
D-Bus integrationFull---
Fleet sync (NATS)FullCore path available, not continuously acceptance-testedPlanned-
E2E encryptionFullFullPlannedCore crypto path available
\n

See docs/platform-support.md for details.\nFor the dated Apple posture, see\ndocs/ops/apple-surface-status.md.

\n

Development

\n
task build          # Build all crates\ntask test           # Run all tests (424 tests)\ntask lint           # Clippy + rustfmt\ntask deny           # License + advisory check\ntask check          # All of the above
\n

See docs/CONTRIBUTING.md for setup details and PR workflow.

\n

Credential Setup

\n
task sops:init       # Generate age key + configure .sops.yaml\ntask sops:migrate    # Migrate credentials to SOPS-encrypted files
\n

License

\n

MIT OR Apache-2.0

\n
", "readme_excerpt": "> Under active development. Not yet stable. Expect breaking changes.\nSelf-hosted encrypted file sync with on-demand hydration. Mounts SeaweedFS as a local directory — files appear as zero-byte .tc stubs until accessed, then transparently download and decrypt. FOSS odrive/Dropbox replacement.\nJesssullivan/tummycrypt is the canonical source repository for tcfs.\nIf tinyland-inc/tummycrypt exists, treat it as a fork or downstream\ndistribution surface rather than the source of truth for planning,...", "install_commands": { "rust": "cargo add tummycrypt" }, "repo_url": "https://github.com/jesssullivan/tummycrypt", "website_url": "https://tinyland-inc.github.io/tummycrypt", "docs_url": null, "registry_url": "https://crates.io/crates/tummycrypt", "releases_url": "https://github.com/jesssullivan/tummycrypt/releases", "og_image_url": "https://opengraph.githubassets.com/14b8de50aa9e1a473d43e19cec8ca28cf8bc823e521ac024fbe6562296d8a481/Jesssullivan/tummycrypt", "license": "Apache-2.0", "pushed_at": "2026-04-18T14:39:58Z", "enriched_at": "2026-04-26T17:17:16.321Z", "gate": "homepage" }, { "slug": "jesssullivan-tinyland-huskycat", "name": "tinyland-huskycat", "repo": "jesssullivan/tinyland-huskycat", "org": "jesssullivan", "ecosystem": "multi", "category": "ai-tools", "description": "A multimodal, deterministic verification middleware for unsupervised, domain-driven iteration", "featured": false, "tags": [ "testing", "tdd", "automation" ], "version": "0.0.0", "release_date": "", "releases": [], "stars": 0, "topics": [ "asychronous", "autoverification", "domain-driven-design", "githook", "parallel-tests", "tdd", "validator" ], "languages": [ { "name": "Python", "color": "#3572A5", "bytes": 1504987 }, { "name": "Shell", "color": "#89e051", "bytes": 101742 }, { "name": "Nix", "color": "#7e7eff", "bytes": 24572 }, { "name": "Just", "color": "#384d54", "bytes": 4626 }, { "name": "HTML", "color": "#e34c26", "bytes": 4026 } ], "primary_language": "Python", "readme_html": "

huskycat

\n

Universal Code Validation Platform with MCP Server Integration.

\n

Install

\n
pip install huskycat
\n

License

\n

Apache-2.0

\n
", "readme_excerpt": "Universal Code Validation Platform with MCP Server Integration.\nbash\npip install huskycat\nApache-2.0", "install_commands": {}, "repo_url": "https://github.com/jesssullivan/tinyland-huskycat", "website_url": "https://gitlab.com/tinyland/ai/huskycat", "docs_url": null, "registry_url": null, "releases_url": "https://github.com/jesssullivan/tinyland-huskycat/releases", "og_image_url": "https://opengraph.githubassets.com/a303ac7749e9468d32320f6f35a3b0712b54409c416157d6b7598af97897ea63/Jesssullivan/tinyland-huskycat", "license": "Zlib", "pushed_at": "2026-04-15T15:00:43Z", "enriched_at": "2026-04-26T17:17:16.629Z", "gate": "override" }, { "slug": "jesssullivan-tinyland-auth-redis", "name": "tinyland-auth-redis", "repo": "jesssullivan/tinyland-auth-redis", "org": "jesssullivan", "ecosystem": "npm", "category": "auth", "description": "Redis storage adapter for @tummycrypt/tinyland-auth (Upstash)", "featured": false, "tags": [ "auth", "redis", "upstash", "sessions" ], "version": "0.1.1", "release_date": "2026-03-30T03:13:50Z", "releases": [ { "tag": "0.1.1", "date": "2026-03-30T03:13:50Z", "body": "Fix publishConfig access, add release trigger, test gate, npm provenance." } ], "stars": 0, "topics": [], "languages": [ { "name": "TypeScript", "color": "#3178c6", "bytes": 62114 }, { "name": "Nix", "color": "#7e7eff", "bytes": 810 }, { "name": "Starlark", "color": "#76d275", "bytes": 667 } ], "primary_language": "TypeScript", "readme_html": "

@tummycrypt/tinyland-auth-redis

\n

Redis storage adapter for @tummycrypt/tinyland-auth, backed by Upstash Redis (@upstash/redis).

\n

Implements the full IStorageAdapter interface: users, sessions, TOTP secrets, backup codes, invitations, and audit events.

\n

Installation

\n
npm install @tummycrypt/tinyland-auth-redis\n# or\npnpm add @tummycrypt/tinyland-auth-redis
\n

Peer dependency:

\n
npm install @tummycrypt/tinyland-auth
\n

Quick Start

\n
import { createRedisStorageAdapter } from '@tummycrypt/tinyland-auth-redis';\n\nconst storage = createRedisStorageAdapter({\n  url: process.env.KV_REST_API_URL,\n  token: process.env.KV_REST_API_TOKEN,\n  prefix: 'auth',           // optional, default: 'auth'\n  sessionMaxAge: 7 * 24 * 60 * 60 * 1000, // optional, default: 7 days\n});\n\nawait storage.init(); // verifies connectivity with PING
\n

Using an Existing Redis Instance

\n
import { Redis } from '@upstash/redis';\nimport { createRedisStorageAdapter } from '@tummycrypt/tinyland-auth-redis';\n\nconst redis = new Redis({\n  url: process.env.KV_REST_API_URL!,\n  token: process.env.KV_REST_API_TOKEN!,\n});\n\nconst storage = createRedisStorageAdapter({ redis });
\n

Graceful Fallback

\n

When Redis is unavailable (e.g., local development without Upstash credentials), fall back to an in-memory Map:

\n
import { createRedisStorageAdapter } from '@tummycrypt/tinyland-auth-redis';\n\nconst createStorage = () => {\n  const url = process.env.KV_REST_API_URL;\n  const token = process.env.KV_REST_API_TOKEN;\n\n  if (url && token) {\n    return createRedisStorageAdapter({ url, token });\n  }\n\n  console.warn('Redis not configured, using in-memory fallback');\n  // Use your own in-memory adapter or the one from tinyland-auth\n  return createInMemoryAdapter();\n};
\n

Key Namespacing

\n

All keys are namespaced under a configurable prefix (default: auth). This allows multiple applications to share a single Redis instance without collisions.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
PatternExamplePurpose
{prefix}:user:{id}auth:user:abc-123User entity
{prefix}:user:handle:{handle}auth:user:handle:jenHandle lookup index
{prefix}:user:email:{email}auth:user:email:jen@example.comEmail lookup index
{prefix}:users:allauth:users:allSet of all user IDs
{prefix}:session:{id}auth:session:sess-1Session entity
{prefix}:sessions:user:{userId}auth:sessions:user:abc-123Sorted set of session IDs by expiry
{prefix}:totp:{handle}auth:totp:jenEncrypted TOTP secret
{prefix}:backup:{userId}auth:backup:abc-123Backup codes
{prefix}:invite:{token}auth:invite:tok-abcInvitation entity
{prefix}:invite:id:{id}auth:invite:id:inv-1Invitation ID to token index
{prefix}:invites:allauth:invites:allSet of all invitation tokens
{prefix}:invites:pendingauth:invites:pendingSet of pending invitation tokens
{prefix}:audit:{id}auth:audit:evt_123_abcAudit event entity
{prefix}:audit:logauth:audit:logSorted set of audit event IDs by timestamp
\n

API Reference

\n

createRedisStorageAdapter(config: RedisStorageConfig): RedisStorageAdapter

\n

Factory function. Accepts:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
OptionTypeDefaultDescription
redisRedis-Existing Upstash Redis instance
urlstring-Upstash REST URL (used if redis not provided)
tokenstring-Upstash REST token (used if redis not provided)
prefixstring'auth'Key namespace prefix
sessionMaxAgenumber604800000Session TTL in milliseconds (7 days)
\n

RedisStorageAdapter (implements IStorageAdapter)

\n

Lifecycle:

\n
    \n
  • init() - Verify Redis connectivity (PING)
    • \n
  • close() - No-op (Upstash uses HTTP, no persistent connection)
    • \n
\n

Users: getUser, getUserByHandle, getUserByEmail, getAllUsers, createUser, updateUser, deleteUser, hasUsers

\n

Sessions: getSession, getSessionsByUser, getAllSessions, createSession, updateSession, deleteSession, deleteUserSessions, cleanupExpiredSessions

\n

TOTP: getTOTPSecret, saveTOTPSecret, deleteTOTPSecret

\n

Backup Codes: getBackupCodes, saveBackupCodes, deleteBackupCodes

\n

Invitations: getInvitation, getInvitationById, getAllInvitations, getPendingInvitations, createInvitation, updateInvitation, deleteInvitation, cleanupExpiredInvitations

\n

Audit: logAuditEvent, getAuditEvents, getRecentAuditEvents

\n

Serialization Utilities

\n

Exported for advanced use cases:

\n
import { serialize, deserialize, toHashFields, fromHashFields } from '@tummycrypt/tinyland-auth-redis';
\n
    \n
  • serialize<T>(value: T): string - Safe JSON.stringify wrapper
    • \n
  • deserialize<T>(value: string | null): T | null - Safe JSON.parse with null handling
    • \n
  • toHashFields(obj: Record<string, unknown>): Record<string, string> - Convert to Redis HSET-compatible flat map
    • \n
  • fromHashFields<T>(hash: Record<string, string> | null): T | null - Parse Redis HGETALL result back to typed object
    • \n
\n

Key Generators

\n
import { createKeys } from '@tummycrypt/tinyland-auth-redis';\n\nconst keys = createKeys('myapp');\nkeys.user('abc-123');      // 'myapp:user:abc-123'\nkeys.session('sess-1');    // 'myapp:session:sess-1'\nkeys.auditLog();           // 'myapp:audit:log'
\n

Environment Variables

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
VariableRequiredDescription
KV_REST_API_URLYesUpstash Redis REST URL
KV_REST_API_TOKENYesUpstash Redis REST token
\n

These are the standard environment variable names used by Vercel KV (Upstash integration).

\n

License

\n

MIT

\n
", "readme_excerpt": "Redis storage adapter for @tummycrypt/tinyland-auth, backed by Upstash Redis (@upstash/redis).\nImplements the full IStorageAdapter interface: users, sessions, TOTP secrets, backup codes, invitations, and audit events.\nbash\nnpm install @tummycrypt/tinyland-auth-redis\npnpm add @tummycrypt/tinyland-auth-redis\nPeer dependency:\nbash\nnpm install @tummycrypt/tinyland-auth\ntypescript\nimport { createRedisStorageAdapter } from '@tummycrypt/tinyland-auth-redis';\nconst storage =...", "install_commands": { "npm": "npm install @tummycrypt/tinyland-auth-redis" }, "repo_url": "https://github.com/jesssullivan/tinyland-auth-redis", "website_url": null, "docs_url": null, "registry_url": "https://www.npmjs.com/package/@tummycrypt/tinyland-auth-redis", "releases_url": "https://github.com/jesssullivan/tinyland-auth-redis/releases", "og_image_url": "https://opengraph.githubassets.com/c8efdff71adda5cad1e49ec9dd565dbe36ad5534a6af5cdb635de5739669a366/tinyland-inc/tinyland-auth-redis", "license": "", "pushed_at": "2026-04-06T17:51:54Z", "enriched_at": "2026-04-26T17:17:17.014Z", "gate": "override" }, { "slug": "jesssullivan-dsa-study-asi", "name": "DSA-study-ASI", "repo": "jesssullivan/DSA-study-ASI", "org": "jesssullivan", "ecosystem": "multi", "category": "devex", "description": "", "featured": false, "tags": [ "algorithms", "study" ], "version": "0.0.0", "release_date": "", "releases": [], "stars": 0, "topics": [ "study-guide", "leetcode", "optout", "study-materials" ], "languages": [ { "name": "Python", "color": "#3572A5", "bytes": 378556 }, { "name": "Just", "color": "#384d54", "bytes": 8301 }, { "name": "Nix", "color": "#7e7eff", "bytes": 1547 }, { "name": "Shell", "color": "#89e051", "bytes": 43 } ], "primary_language": "Python", "readme_html": "
\n

Quick Start

\n
direnv allow        # nix devshell + python 3.14 venv\njust test           # 628 tests\njust lint           # ruff + mypy strict\njust docs           # mkdocs site at localhost:8000
\n
just challenge arrays two_sum     # strip solution → implement\njust study arrays                 # watch mode — tests re-run on save\njust solution arrays two_sum      # peek if stuck\njust challenge-done arrays two_sum\njust challenge-progress
\n

Core 42

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Topic#Drill set
arrays3two_sum, group_anagrams, product_except_self
two_pointers2three_sum, trapping_rain_water
sliding_window2min_window_substring, longest_substring_no_repeat
stacks_queues2valid_parentheses, daily_temperatures
searching2binary_search, search_rotated_array
linked_lists2reverse_linked_list, lru_cache
trees3validate_bst, level_order_traversal, trie
graphs7dijkstra, a_star, bellman_ford, topo_sort, islands, MST, course_schedule
dp5coin_change, edit_distance, knapsack, LIS, LCS
heaps2kth_largest, merge_k_sorted_lists
backtracking3subsets, combination_sum, n_queens
greedy2merge_intervals, jump_game
strings2valid_palindrome, longest_palindromic_substring
recursion2generate_parentheses, flatten_nested_list
bit_manipulation1single_number
sorting1quickselect
\n

The remaining 27 implementations stay in the repo as extended practice and reference.

\n

Commands

\n
just                              # list all commands\n\n# ── Testing ──\njust test                         # all 628 tests\njust practice <topic>             # one topic\njust study <topic>                # watch mode\njust test-concepts                # concept modules (numpy/scipy/flask/pydantic)\n\n# ── Challenge ──\njust challenge <topic> <problem>  # strip solution, show failing tests\njust solution <topic> <problem>   # restore solution\njust challenge-done <t> <p>       # mark complete\njust challenge-progress           # show progress\n\n# ── Quality ──\njust lint                         # ruff + mypy strict\njust fmt                          # auto-format\n\n# ── Docs ──\njust docs                         # mkdocs serve\njust pdf-booklet                  # printable reference booklet
\n

Structure

\n
src/algo/         69 implementations, 15 topics (42 core + 27 extended)\nsrc/concepts/     6 modules: t-strings, typing, hypothesis, FFT, Flask, Pydantic\nsrc/practice/     3 code reading + 3 decomposition exercises\ntests/            628 tests (pytest + hypothesis)\nreference-sheets/ 9 printable reference sheets\ndocs/             mkdocs site\n
\n

Reference

\n\n
", "readme_excerpt": "----|---|-----------|\n| arrays | 3 | twosum, groupanagrams, productexceptself |\n| twopointers | 2 | threesum, trappingrainwater |\n| slidingwindow | 2 | minwindowsubstring, longestsubstringnorepeat |\n| stacksqueues | 2 | validparentheses, dailytemperatures |\n| searching | 2 | binarysearch, searchrotatedarray |\n| linkedlists | 2 | reverselinkedlist, lrucache |\n| trees | 3 | validatebst, levelordertraversal, trie |\n| graphs | 7 | dijkstra, astar, bellmanford, toposort, islands, MST, courseschedule...", "install_commands": {}, "repo_url": "https://github.com/jesssullivan/DSA-study-ASI", "website_url": "http://transscendsurvival.org/DSA-study-ASI/", "docs_url": null, "registry_url": null, "releases_url": "https://github.com/jesssullivan/DSA-study-ASI/releases", "og_image_url": "https://opengraph.githubassets.com/f67125389321c4464328a98fcd86ffaab451ea7963bf3d88a9de4f51eedc5e1d/Jesssullivan/DSA-study-ASI", "license": "", "pushed_at": "2026-04-03T12:49:02Z", "enriched_at": "2026-04-26T17:17:17.267Z", "gate": "pages" }, { "slug": "jesssullivan-gnucashr", "name": "gnucashr", "repo": "jesssullivan/gnucashr", "org": "jesssullivan", "ecosystem": "multi", "category": "integrations", "description": "A high performance accounting and financial modeling R package and MCP tool surface for GNUCash, for people and robots", "featured": false, "tags": [ "gnucash", "mcp", "plaid", "finance" ], "version": "0.2.0", "release_date": "2026-01-26T16:37:57Z", "releases": [ { "tag": "0.2.0", "date": "2026-01-26T16:37:57Z", "body": "**Full Changelog**: https://github.com/Jesssullivan/gnucashr/commits/v0.2.0" } ], "stars": 1, "topics": [ "agent-skills", "finops", "gnucash", "mcp", "plaid" ], "languages": [ { "name": "C++", "color": "#f34b7d", "bytes": 1722990 }, { "name": "R", "color": "#198CE7", "bytes": 659046 }, { "name": "Dhall", "color": "#dfafff", "bytes": 29878 }, { "name": "Nix", "color": "#7e7eff", "bytes": 14782 }, { "name": "Just", "color": "#384d54", "bytes": 10831 } ], "primary_language": "C++", "readme_html": "", "readme_excerpt": "", "install_commands": {}, "repo_url": "https://github.com/jesssullivan/gnucashr", "website_url": null, "docs_url": null, "registry_url": null, "releases_url": "https://github.com/jesssullivan/gnucashr/releases", "og_image_url": "https://opengraph.githubassets.com/5e7a6e8761ba03b76e3c1b7566211a7ca99f1975b2a019534e091096ab039b70/Jesssullivan/gnucashr", "license": "", "pushed_at": "2026-03-20T05:23:47Z", "enriched_at": "2026-04-26T17:17:17.571Z", "gate": "override" }, { "slug": "jesssullivan-winrm-molecule-forkbomb-demo", "name": "winrm-molecule-forkbomb-demo", "repo": "jesssullivan/winrm-molecule-forkbomb-demo", "org": "jesssullivan", "ecosystem": "multi", "category": "systems", "description": "Fast and dirty demo of winrm molecule fork bomb behavior; when trying to go fast goes wrong", "featured": false, "tags": [ "ansible", "molecule", "windows" ], "version": "0.0.0", "release_date": "", "releases": [], "stars": 0, "topics": [], "languages": [ { "name": "Jinja", "color": "#a52a22", "bytes": 13138 }, { "name": "Shell", "color": "#89e051", "bytes": 12262 }, { "name": "Python", "color": "#3572A5", "bytes": 10332 }, { "name": "Dhall", "color": "#dfafff", "bytes": 8178 }, { "name": "Just", "color": "#384d54", "bytes": 7715 } ], "primary_language": "Jinja", "readme_html": "

winrm-molecule-forkbomb-demo

\n

Research project demonstrating how Ansible's WinRM connection model causes a \"forkbomb\"\nof authentication failures that exhaust Windows shell quotas and trigger Active Directory\naccount lockouts.

\n

The Problem

\n
Ansible forks=50 × 15 tasks/role = 750 WinRM shell attempts\nWindows MaxShellsPerUser = 30 → 720 failures\nEach failure = failed NTLM auth → AD lockout after 5 failures\n
\n

The Fix

\n
    \n
  1. Admin toggle: Raise WinRM quotas before parallel testing (winrm_quota_config role)
    2. \n
  2. Session cleanup: Auto-terminate stale WinRM shells (winrm_session_cleanup role)
    3. \n
  3. Use pypsrp: Better connection pooling via PowerShell Remoting Protocol
    4. \n
\n

Quick Start

\n
direnv allow                 # Enter nix dev shell\njust setup                   # Install deps + collections\nsops secrets/winrm-creds.enc.yaml  # Configure credentials\njust tunnel-start            # SSH tunnel to win-target\njust audit                   # Verify connectivity + baseline quotas\n\n# Demo the forkbomb\njust benchmark-safe          # forks=5, works fine\njust benchmark-unsafe        # forks=50, demonstrates the problem\njust deploy-quotas           # Apply the fix (raise quotas)\njust benchmark-unsafe        # forks=50, now works!\njust benchmark-psrp          # Compare pypsrp connection behavior
\n

Stack

\n
    \n
  • Nix flake + direnv - Reproducible dev shell
    • \n
  • UV + pyproject.toml - Python 3.13 dependency management
    • \n
  • Dhall - Type-safe configuration generation (quotas, benchmarks, role manifests)
    • \n
  • SOPS + age - Encrypted credential management
    • \n
  • Ansible + Molecule - Infrastructure automation and testing
    • \n
  • just - Task orchestration
    • \n
\n

Roles

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
RolePurposeTags
winrm_quota_configRaise WinRM shell quotas (admin toggle)winrm-quota
winrm_session_cleanupDetect + terminate stale sessionswinrm-cleanup
firewall_rulesWindows firewall for IIS/WinRMfirewall
iis_siteDemo IIS site displaying repo contentsiis-site
\n

Documentation

\n\n

Upstream Issues

\n\n
", "readme_excerpt": "Research project demonstrating how Ansible's WinRM connection model causes a \"forkbomb\"\nof authentication failures that exhaust Windows shell quotas and trigger Active Directory\naccount lockouts.\nAnsible forks=50 × 15 tasks/role = 750 WinRM shell attempts\nWindows MaxShellsPerUser = 30 → 720 failures\nEach failure = failed NTLM auth → AD lockout after 5 failures\n1. Admin toggle: Raise WinRM quotas before parallel testing (winrmquotaconfig role)\n2. Session cleanup: Auto-terminate stale WinRM...", "install_commands": {}, "repo_url": "https://github.com/jesssullivan/winrm-molecule-forkbomb-demo", "website_url": "http://transscendsurvival.org/winrm-molecule-forkbomb-demo/", "docs_url": null, "registry_url": null, "releases_url": "https://github.com/jesssullivan/winrm-molecule-forkbomb-demo/releases", "og_image_url": "https://opengraph.githubassets.com/6515983a34de4aa60ab6d1ada15950ad8e06f435b3d073d445cde70c68baba2d/Jesssullivan/winrm-molecule-forkbomb-demo", "license": "", "pushed_at": "2026-03-13T22:40:37Z", "enriched_at": "2026-04-26T17:17:17.925Z", "gate": "pages" }, { "slug": "jesssullivan-tinyland-hexstrunk", "name": "tinyland-hexstrunk", "repo": "jesssullivan/tinyland-hexstrunk", "org": "jesssullivan", "ecosystem": "multi", "category": "ai-tools", "description": "Formal, tracable, auditable tool surface for playing the bad guy", "featured": false, "tags": [ "mcp", "formal-methods" ], "version": "0.0.0", "release_date": "", "releases": [], "stars": 0, "topics": [ "formal-methods", "mcp", "tailscale-aperture" ], "languages": [ { "name": "Python", "color": "#3572A5", "bytes": 239495 }, { "name": "OCaml", "color": "#ef7a08", "bytes": 151950 }, { "name": "Go", "color": "#00ADD8", "bytes": 49625 }, { "name": "Dhall", "color": "#dfafff", "bytes": 40692 }, { "name": "F*", "color": "#572e30", "bytes": 11925 } ], "primary_language": "Python", "readme_html": "

HexStrunk ^w^

\n

Auditable, provable cybersecurity tool surface for agents and humans. 42 tools across 13 domains, with verified dispatch, hash-chain audit, and grants-as-capabilities policy enforcement. Inspired by HexStrike.

\n

Architecture

\n
AI Agent (Claude, GPT, etc.)\n    | MCP Protocol (stdio or SSE)\n    v\nGo Gateway (hexstrike-gateway)\n    |-- tsnet: Tailscale identity authentication\n    |-- Dhall policies: grants-as-capabilities enforcement\n    |-- Aperture: token metering + circuit breaking\n    | JSON-RPC stdio\n    v\nOCaml MCP Server (hexstrike-mcp)\n    |-- F*-verified dispatch, sanitization, audit\n    |-- Hash-chain audit log\n    |-- Futhark C FFI: GPU-accelerated analysis\n    | subprocess\n    v\nSecurity Tools (nmap, nuclei, trivy, curl, etc.)\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
LayerTechnologyPurpose
ConfigurationDhallTool schemas, typed policies
VerificationF*Proved dispatch, sanitization, audit integrity
AccelerationFutharkGPU-parallel batch analysis (sequential C fallback)
MCP ServerOCamlF*-extracted core, JSON-RPC 2.0 stdio
GatewayGotsnet auth, policy, metering, Prometheus
Build SystemNixReproducible builds, devShells, OCI container
\n

Tool Inventory (42 tools, 13 domains)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
DomainToolsCount
WebSecuritydir_discovery, vuln_scan, sqli_test, xss_test, waf_detect, web_crawl6
NetworkReconport_scan, host_discovery, nmap_scan, network_posture4
CloudSecuritycloud_posture, container_vuln, iac_scan, k8s_audit4
CredentialAuditcredential_scan, sops_rotation, brute_force, hash_crack4
BinaryAnalysisdisassemble, debug_tool, gadget_search, firmware_analyze4
Forensicsmemory_forensics, file_carving, steganography, metadata_extract4
SMBEnumsmb_enum, network_exec, rpc_enum3
Intelligencecve_monitor, exploit_gen, threat_correlate3
APITestingapi_fuzz, graphql_scan, jwt_analyze3
DNSReconsubdomain_enum, dns_recon2
Orchestrationsmart_scan, analyze_target2
Metaserver_health, execute_command2
CryptoAnalysistls_check1
\n

Tool names are canonical in dhall/policies/constants/tools.dhall. An OCaml parity test catches drift.

\n

Quick Start

\n
# Enter dev shell (OCaml, Go, Dhall, Futhark, security tools)\nnix develop\n\n# Build everything\njust build\n\n# Run all tests\njust test\n\n# Fast feedback (type-check + vet)\njust check\n\n# Start MCP server on stdio\njust serve
\n

F* verification (optional)

\n
nix develop .#fstar    # shell with F* + Z3\njust fstar-verify      # verify all modules
\n

MCP Client Configuration

\n

Claude Desktop / Cursor

\n
{\n  \"mcpServers\": {\n    \"hexstrike-ai\": {\n      \"command\": \"nix\",\n      \"args\": [\"run\", \"github:tinyland-inc/hexstrike-ai\"],\n      \"description\": \"HexStrike-AI cybersecurity platform\"\n    }\n  }\n}
\n

Container

\n
nix build .#container\ndocker load < result\ndocker run -v /workspace:/workspace ghcr.io/tinyland-inc/hexstrike-ai:edge
\n

The container image includes all 42 tools and their runtime dependencies (~2.9 GB).

\n

Project Structure

\n
dhall/           Dhall tool schemas + grants-as-capabilities policies\nfstar/           F* verified modules (dispatch, policy, sanitize, audit)\nfuthark/         GPU-parallel analysis kernels (scan, pattern, graph)\nocaml/           OCaml MCP server (42 tools, audit, policy, FFI bridge)\ngateway/         Go gateway (tsnet, Aperture, credential broker)\nflake.nix        Nix build system (packages, devShells, OCI container)\njustfile         Task runner recipes\n
\n

Security Model

\n
    \n
  • Authentication: Tailscale identity (tsnet) at the gateway
    • \n
  • Authorization: Dhall-compiled grants-as-capabilities policies
    • \n
  • Input sanitization: F*-proved sanitization rejects shell metacharacters
    • \n
  • Audit: Hash-chain log with SHA-256 integrity verification
    • \n
  • Binary allowlisting: Only declared binaries can be executed
    • \n
  • No arbitrary execution: File ops, Python exec, and payload generation removed from legacy
    • \n
\n

License

\n

MIT

\n
", "readme_excerpt": "Auditable, provable cybersecurity tool surface for agents and humans. 42 tools across 13 domains, with verified dispatch, hash-chain audit, and grants-as-capabilities policy enforcement. Inspired by HexStrike.\nAI Agent (Claude, GPT, etc.)\n | MCP Protocol (stdio or SSE)\n v\nGo Gateway (hexstrike-gateway)\n |-- tsnet: Tailscale identity authentication\n |-- Dhall policies: grants-as-capabilities enforcement\n |-- Aperture: token metering + circuit breaking\n | JSON-RPC stdio\n ...", "install_commands": {}, "repo_url": "https://github.com/jesssullivan/tinyland-hexstrunk", "website_url": null, "docs_url": null, "registry_url": null, "releases_url": "https://github.com/jesssullivan/tinyland-hexstrunk/releases", "og_image_url": "https://opengraph.githubassets.com/64e0a8bddfc0fd956c10fda2e4754a2b555cca89f4bd3312358f42ec1c8b2250/Jesssullivan/tinyland-hexstrunk", "license": "", "pushed_at": "2026-02-27T05:49:47Z", "enriched_at": "2026-04-26T17:17:18.231Z", "gate": "override" }, { "slug": "jesssullivan-aperture-bootstrap", "name": "aperture-bootstrap", "repo": "jesssullivan/aperture-bootstrap", "org": "jesssullivan", "ecosystem": "multi", "category": "systems", "description": "Bootstrap Tailscale Aperture config from tagged devices using tsnet — How to resolve WhoIs identity gap", "featured": false, "tags": [ "tailscale", "aperture", "networking" ], "version": "0.0.0", "release_date": "", "releases": [], "stars": 0, "topics": [ "dhall", "nix", "tailscale", "tailscale-aperture", "tsnet", "demo", "ephemera" ], "languages": [ { "name": "Go", "color": "#00ADD8", "bytes": 4144 }, { "name": "Dhall", "color": "#dfafff", "bytes": 3379 }, { "name": "Just", "color": "#384d54", "bytes": 2731 }, { "name": "Nix", "color": "#7e7eff", "bytes": 1072 } ], "primary_language": "Go", "readme_html": "

aperture-bootstrap

\n

Demo Bootstrap Tailscale Aperture config from tagged devices using tsnet.

\n

Aperture uses Tailscale WhoIs to identify who's connecting. If your devices are tagged (as most K8s workloads are), Aperture doesn't recognize the literal string \"tagged-devices\" or tag names like \"tag:dev\" in its temp_grants config. Only explicit user emails and the \"*\" wildcard match.

\n

This creates a chicken-and-egg: you can't access the config API to fix the grants because you don't have a grant.

\n
\n
\n
\n 
graph LR\n    subgraph \"Tailnet\"\n        Yoga[\"Yoga<br/><small>tag:dev, tag:dollhouse</small>\"]\n        K8s[\"K8s Agents<br/><small>tag:k8s, tag:k8s-operator</small>\"]\n        AI[\"Aperture<br/><small>ai.example.ts.net</small>\"]\n    end\n\n    Yoga -->|\"curl http://ai/api/config\"| AI\n    K8s -->|\"ANTHROPIC_BASE_URL\"| AI\n\n    AI -->|\"WhoIs: tagged-devices\"| X[\"403 no role granted\"]\n\n    style X fill:#f66,stroke:#900,color:white\n    style AI fill:#4a9,stroke:#2a7,color:white\n
\n
\n
\n \n \n Loading\n\n \n
\n\n

The solution

\n

Spin up an ephemeral, user-owned tsnet node — no tags, proper user identity. Aperture's WhoIs sees the real user email, grants access, and you push the config.

\n
\n
\n
\n 
sequenceDiagram\n    participant API as Tailscale API\n    participant Boot as tsnet node<br/>(ephemeral)\n    participant AI as Aperture\n\n    Note over API: 1. Create auth key (no tags)\n    API->>Boot: Auth key (user-owned)\n    Boot->>AI: GET /api/config\n    AI-->>Boot: {config, hash}\n    Note over Boot: 2. Modify temp_grants\n    Boot->>AI: PUT /api/config {config, hash}\n    AI-->>Boot: {success, new_hash}\n    Note over Boot: 3. Ephemeral node auto-cleans up\n
\n
\n
\n \n \n Loading\n\n \n
\n\n

After bootstrapping, the network looks like this:

\n
\n
\n
\n 
graph TB\n    subgraph \"Kubernetes Cluster\"\n        IC[\"IronClaw Agent\"]\n        PC[\"PicoClaw Agent\"]\n        HS[\"HexStrike Agent\"]\n        Egress[\"Egress Proxy<br/><small>aperture.fuzzy-dev.svc</small>\"]\n    end\n\n    subgraph \"Tailnet\"\n        AI[\"Aperture<br/><small>ai.example.ts.net</small>\"]\n        GW[\"rj-gateway\"]\n    end\n\n    Anthropic[\"Anthropic API\"]\n\n    IC -->|\"ANTHROPIC_BASE_URL\"| Egress\n    PC -->|\"ANTHROPIC_BASE_URL\"| Egress\n    HS -->|\"ANTHROPIC_BASE_URL\"| Egress\n    Egress -->|\"Tailscale tunnel\"| AI\n    AI -->|\"Proxied + metered\"| Anthropic\n    AI -->|\"Webhook\"| GW\n\n    style AI fill:#4a9,stroke:#2a7,color:white\n    style Anthropic fill:#d4a,stroke:#a27,color:white\n
\n
\n
\n \n \n Loading\n\n \n
\n\n

Quick start

\n
# Enter dev shell (Go, Dhall, just, jq)\nnix develop\n\n# Or install dependencies manually:\n#   go 1.22+, just, dhall, dhall-json, jq, curl\n\n# 1. Create an ephemeral auth key\nexport TS_KEY   # set to your Tailscale management key (tskey-api-...)\nexport TAILNET      # set to your tailnet name (e.g. example.ts.net)\nexport TS_AUTHKEY=$(just key)\n\n# 2. Read current config\njust read\n# Prints JSON to stdout, hash to stderr\n\n# 3. Edit config/default.dhall, then render\njust render\n\n# 4. Push the rendered config\njust write config/rendered.json <hash-from-step-2>
\n

Full bootstrap (one command)

\n
export TS_KEY   # set to your Tailscale management key\nexport TAILNET      # set to your tailnet name\njust bootstrap
\n

Config management with Dhall

\n

The config/ directory uses Dhall for type-safe config:

\n
    \n
  • config/types.dhall — Aperture config type definitions
    • \n
  • config/default.dhall — Your config template (edit this)
    • \n
  • just render — Compiles Dhall to config/rendered.json
    • \n
  • just check — Type-checks without producing output
    • \n
\n

Why tsnet?

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
MethodIdentity seen by ApertureWorks?
curl from tagged device(empty / tagged-devices)No
SOCKS proxy in container(empty / tagged-devices)No
tsnet.Server.HTTPClient()jess@example.comYes
\n

Aperture's WhoIs only recognizes user login names (emails) and the \"*\" wildcard. Tagged devices don't have a login name — they have tags. tsnet creates a proper user-owned node whose HTTPClient() presents the correct WhoIs identity.

\n

Blog posts

\n\n
", "readme_excerpt": "Demo Bootstrap Tailscale Aperture config from tagged devices using tsnet.\nAperture uses Tailscale WhoIs to identify who's connecting. If your devices are tagged (as most K8s workloads are), Aperture doesn't recognize the literal string \"tagged-devices\" or tag names like \"tag:dev\" in its tempgrants config. Only explicit user emails and the \"\" wildcard match.\nThis creates a chicken-and-egg: you can't access the config API to fix the grants because you don't have a grant.\nmermaid\ngraph LR\n ...", "install_commands": {}, "repo_url": "https://github.com/jesssullivan/aperture-bootstrap", "website_url": null, "docs_url": null, "registry_url": null, "releases_url": "https://github.com/jesssullivan/aperture-bootstrap/releases", "og_image_url": "https://opengraph.githubassets.com/1c403c4cf6b397a54bc8aa03d43144292256b4907de4a9b9e456c26697ae8140/Jesssullivan/aperture-bootstrap", "license": "", "pushed_at": "2026-02-26T14:26:27Z", "enriched_at": "2026-04-26T17:17:18.535Z", "gate": "override" }, { "slug": "jesssullivan-la-mesh", "name": "LA-Mesh", "repo": "jesssullivan/LA-Mesh", "org": "jesssullivan", "ecosystem": "multi", "category": "systems", "description": "LoRa infrastructure projects for Southern Maine.", "featured": false, "tags": [ "lora", "mesh", "firmware", "svelte" ], "version": "la-mesh-v2.7.15.567b8ea", "release_date": "2026-02-13T05:53:38Z", "releases": [ { "tag": "la-mesh-v2.7.15.567b8ea", "date": "2026-02-13T05:53:38Z", "body": "## LA-Mesh Custom Firmware v2.7.15.567b8ea\n\nCustom Meshtastic firmware with LA-Mesh boot splash and network defaults.\nBased on [Meshtastic v2.7.15.567b8ea](https://github.com/meshtastic/firmware/releases/tag/v2.7.15.567b8ea).\n\n### Changes from Stock Firmware\n- Custom boot splash: Maine state silhouette + \"LA-Mesh\" text (5s after default splash)\n- Default LoRa region: US\n- Default owner: LA-Mesh / LAM\n\n### Downloads\n\n| Binary | SHA256 |\n|--------|--------|\n| firmware-station-g2-2.7.15.567b8ea-lamesh.bin | `d49ec0afb3adfd475c4b7b25e0e280cab4b218e5cdfeef53af5beb010aecdb06` |\n| firmware-t-deck-2.7.15.567b8ea-lamesh.bin | `7af26345fb24eedf2a9f578d5c011854f7b513cd7fe0c3d110bf00ff74259cc0` |\n| firmware-t-deck-pro-2.7.15.567b8ea-lamesh.bin | `0c4d06bf16bb0b9403c58fcdd6cf4c8cca08469842fef6cdfd91c320e713aa30` |\n\n\n### Verify Downloads\n\n```bash\n# Download checksums file\ncurl -fSLO https://github.com/Jesssullivan/LA-Mesh/releases/download/la-mesh-v2.7.15.567b8ea/SHA256SUMS.txt\n\n# Verify all binaries\nsha256sum -c SHA256SUMS.txt\n```\n\n### Flash\n\n```bash\njust fetch-firmware --source custom\njust flash-g2\n```\n\nBLE OTA and LittleFS partitions use stock Meshtastic binaries (unchanged).\nOnly the main firmware binary includes LA-Mesh customizations." } ], "stars": 0, "topics": [ "comms", "curriculum", "lora", "sdr", "infrastructure" ], "languages": [ { "name": "Svelte", "color": "#ff3e00", "bytes": 158392 }, { "name": "Shell", "color": "#89e051", "bytes": 63477 }, { "name": "Python", "color": "#3572A5", "bytes": 43472 }, { "name": "Just", "color": "#384d54", "bytes": 28622 }, { "name": "Nix", "color": "#7e7eff", "bytes": 3268 } ], "primary_language": "Svelte", "readme_html": "

LA-Mesh

\n

Work in progress LoRa mesh network and encrypted communication bridge infrastructure for Southern Maine.

\n

Community-driven encrypted mesh communications covering the Lewiston-Auburn area, supporting Meshtastic, MeshCore, and LoRa radio education.

\n

What is LA-Mesh?

\n

LA-Mesh deploys a resilient, encrypted mesh network using LoRa radio technology. Our goals:

\n
    \n
  • Encrypted communications for community members via Meshtastic mesh devices; 3 private encrypted channels plus the default public Meshtastic channel (LongFast) so LA-Mesh nodes also participate in the broader Meshtastic network.
    • \n
  • Infrastructure relay nodes We aspire to distribute, establish and help maintain high quality router nodes on rooftops and towers for wide coverage!
    • \n
  • Education We aspire to meet fortnightly in the LA area
    • \n
  • Bridges, eventually Jess wants to connect SMS, email, and internet to the mesh network
    • \n
\n

Supported Devices

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
DeviceRoleDescription
Station G2Base station / relayHigh-power (up to 4.46W), rooftop/tower deployment (want one? have a roof, pole or sunny spot? We'll giev you one)
T-Deck ProMobile clientFull keyboard, GPS, portable encrypted comms; turn key (want one and in the LA area? We'll give you one)
T-Deck Pro (E-Ink)Low-power clientBattery-optimized, sunlight-readable
FireElmo-SDRCustom PCB + Pi HAT gatewaySMS/email bridge, runs meshtasticd on Linux (custom PCB/software project)
HackRF H4MSDR spectrum analysis for teachingJess has curricula for basic TEMPEST attacks, packet capture, interference and range testing.
\n

Device Provisioning

\n

Three commands to go from a blank device to a deployed mesh node:

\n
# 1. Flash firmware (interactive — prompts for bootloader mode)\njust flash-g2\n\n# 2. Configure everything: LoRa, channels, owner name\njust configure-g2 \"LA-Mesh RTR-01\" \"R01\"\n\n# 3. Set ROUTER role (final step — kills USB serial on ESP32-S3)\njust mesh-set-role ROUTER
\n

Step 2 reads PSK values from .env if you are into that life. (auto-sourced by justfile). Generate\nfresh keys with just generate-psks and store them in KeePassXC. We reccomend using a proper secret\nmanagment system, not .env.

\n

Port is auto-detected (/dev/ttyACM0 > ttyUSB0). Pass explicitly if\nneeded: just flash-g2 /dev/ttyACM1.

\n

Development

\n

Prerequisites: Nix with flakes enabled, or manually install: Node.js 22, pnpm, just, meshtastic CLI, esptool

\n
# Clone and enter dev shell\ngit clone https://github.com/Jesssullivan/LA-Mesh.git\ncd LA-Mesh\nnix develop\n\n# First-time setup\njust setup\n\n# Build documentation site\njust build
\n
", "readme_excerpt": "Work in progress LoRa mesh network and encrypted communication bridge infrastructure for Southern Maine.\nCommunity-driven encrypted mesh communications covering the Lewiston-Auburn area, supporting Meshtastic, MeshCore, and LoRa radio education.\nLA-Mesh deploys a resilient, encrypted mesh network using LoRa radio technology. Our goals:\n- Encrypted communications for community members via Meshtastic mesh devices; 3 private encrypted channels plus the default public Meshtastic channel (LongFast)...", "install_commands": {}, "repo_url": "https://github.com/jesssullivan/LA-Mesh", "website_url": "http://la-mesh.me/", "docs_url": null, "registry_url": null, "releases_url": "https://github.com/jesssullivan/LA-Mesh/releases", "og_image_url": "https://opengraph.githubassets.com/51fd1d3c0cd2c523cb6ea11f19e52a607d66493c59dcbfb99285ed73077d1748/Jesssullivan/LA-Mesh", "license": "MIT", "pushed_at": "2026-02-13T15:27:10Z", "enriched_at": "2026-04-26T17:17:18.870Z", "gate": "homepage" }, { "slug": "jesssullivan-gis_shortcuts", "name": "GIS_Shortcuts", "repo": "jesssullivan/GIS_Shortcuts", "org": "jesssullivan", "ecosystem": "multi", "category": "devex", "description": "Jess's miscellaneous GIS notes and related tomfoolery ", "featured": false, "tags": [ "gis", "r", "spatial" ], "version": "0.0.0", "release_date": "", "releases": [], "stars": 1, "topics": [ "gdal", "gis", "esri", "wsl", "rscript", "virtualbox", "ebird-api", "rshiny" ], "languages": [ { "name": "R", "color": "#198CE7", "bytes": 5475 }, { "name": "HTML", "color": "#e34c26", "bytes": 1369 }, { "name": "CSS", "color": "#663399", "bytes": 958 }, { "name": "Stylus", "color": "#ff6347", "bytes": 860 }, { "name": "JavaScript", "color": "#f1e05a", "bytes": 681 } ], "primary_language": "R", "readme_html": "

GIS Shortcuts

\n

\n
\n

Miscellaneous gis notes, mostly derived from my blog over here

\n
\n

Index:

\n

eBird API stuff
\nR / Shiny Web Experiments
\nShell macros from R
\nWhen it must be Windows
\nWindows WSL - Ubuntu GDAL setup
\nUbuntu & Jupyter cartopy setup
\nMac OSX - GDAL setup
\nBash Example - DEM stitching
\nLink to rJDK management info

\n
\n

\n

eBird regionCode

\n

The Ebird dataset is awesome. While directly handling data as a massive delimited file- as distributed by the eBird people- is cumbersome at best, the ebird api offers a fairly straightforward and efficient alternative for a few choice bits and batches of data.

\n
    \n
  • \n

    The eBird AWK tool for filtering the actual delimited data can be found over here:

    \n

    install.packages(\"auk\")

    \n
    • \n
\n

It is worth noting R + auk (or frankly any R centered filtering method) will quickly become limited by the single-threaded approach of R, and how you're managing memory as you iterate. Working and querying the data from a proper database quickly becomes necessary.

\n

Most conveniently, the eBird API already exists.

\n

...The API package for R is over here:
\ninstall.packages(\"rebird\")

\n

...There is also a neat Python wrapper over here:
\npip3 install ebird-api

\n

Region Codes:

\n

I'm not sure why, but some methods use normal latitude / longitude in decimal degrees while some others use \"regionCode\", which seems to be some kind of eBird special. Only ever seen this format in ebird data.

\n

For example, recent observations uses regionCode:

\n
# GET Recent observations in a region:\n# https://api.ebird.org/v2/data/obs/{{regionCode}}/recent
\n

...But nearby recent observations uses latitude / longitude:

\n
# GET Recent nearby observations:\n# https://api.ebird.org/v2/data/obs/geo/recent?lat={{lat}}&lng={{lng}}\n
\n

Regardless, lets just write a function to convert decimal degrees to this regionCode thing. Here's mine:

\n
#!/usr/bin/env python3\n\"\"\"\n# provide latitude & longitude, return eBird \"regionCode\"\nWritten by Jess Sullivan\n@ https://transscendsurvival.org/\n\"\"\"\nimport requests\nimport json\n\n\ndef get_regioncode(lat, lon):\n\n    # this municipal api is a publicly available, no keys needed afaict\n    census_url = str('https://geo.fcc.gov/api/census/area?lat=' +\n                     str(lat) +\n                     '&lon=' +\n                     str(lon) +\n                     '&format=json')\n\n    # send out a GET request:\n    payload = {}\n    get = requests.request(\"GET\", census_url, data=payload)\n\n    # parse the response, all api values are contained in list 'results':\n    response = json.loads(get.content)['results'][0]\n\n    # use the last three digits from the in-state fips code as the \"subnational 2\" identifier:\n    fips = response['county_fips']\n\n    # assemble and return the \"subnational type 2\" code:\n    regioncode = 'US-' + response['state_code'] + '-' + fips[2] + fips[3] + fips[4]\n    print('formed region code: ' + regioncode)\n    return regioncode
\n
\n

\n

GIS Wigdets, Web Apps & R/ Shiny

\n

Some experiments with simple web utilities for GIS tasks.

\n

Process manager experiments for R threads in /Flask-Manager.

\n

Visit the single threaded example here; (Not load balanced, just for an example view). These are wrapped in a Node.JS application on Heroku, which loads each utility through shinyapps.io. These functions are hosted entirely through (Heroku / shinyapps) free tiers.

\n

See /Docker-App for deployment in the GCP app engine.

\n
    \n
  • Raster2stl - converts raster data (image- a .jpg taken from a DEM file for instance) to a 3d STL file showing exagerated terrain. (added 3/6/19)
    • \n
  • KML2SHP_Converter - generates a zip archive of shape files based on KML file layers
    • \n
  • Centroid_KML - \"KML-Centroid-Generator\"
    • \n
  • KML2CSV - converts KML (XML) to .csv spreadsheet format
    • \n
  • KMLSubsetFilter - from a KML file, this tool returns a subset KML based on two query strings (searches the description field of the KML)
    • \n
\n

Some more Bits, Bobs, Widgets & R / Shiny demos:

\n\n\n\n\n\n\n\n
\"\"
\n
\n

Some GDAL shell macros from R instead of rgdal

\n

Visit this blog post

\n

it's not R sacrilege if nobody knows

\n

\n

Even the little stuff benefits from some organizational scripting, even if it’s just to catalog one’s actions. Here are some examples for common tasks.

\n

Get all the source data into a R-friendly format like csv. ogr2ogr has a nifty option -lco GEOMETRY=AS_WKT (Well-Known-Text) to keep track of spatial data throughout abstractions- we can add the WKT as a cell until it is time to write the data out again.

\n
# define a shapefile conversion to csv from system's shell:\nsys_SHP2CSV <- function(shp) {\n  csvfile <- paste0(shp, '.csv')\n  shpfile <-paste0(shp, '.shp')\n  if (!file.exists(csvfile)) {\n    # use -lco GEOMETRY to maintain location\n    # for reference, shp --> geojson would look like:\n    # system('ogr2ogr -f geojson output.geojson input.shp')\n    # keeps geometry as WKT:\n    cmd <- paste('ogr2ogr -f CSV', csvfile, shpfile, '-lco GEOMETRY=AS_WKT')\n    system(cmd)  # executes command\n  } else {\n    print(paste('output file already exists, please delete', csvfile, 'before converting again'))\n  }\n  return(csvfile)\n}\n
\n

Read the new csv into R:

\n
# for file 'foo.shp':\nfoo_raw <- read.csv(sys_SHP2CSV(shp='foo'), sep = ',')\n
\n

One might do any number of things now, some here lets snag some columns and rename them:

\n
# rename the subset of data \"foo\" we want in a data.frame:\nfoo <- data.frame(foo_raw[1:5])\ncolnames(foo) <- c('bar', 'eggs', 'ham', 'hello', 'world')\n
\n

We could do some more careful parsing too, here a semicolon in cell strings can be converted to a comma:

\n
# replace ` ; ` to ` , ` in col \"bar\":\nfoo$bar <- gsub(pattern=\";\", replacement=\",\", foo$bar)\n
\n

Do whatever you do for an output directory:

\n
# make a output file directory if you're into that\n# my preference is to only keep one set of output files per run\n# here, we'd reset the directory before adding any new output files\nredir <- function(outdir) {\n  if (dir.exists(outdir)) {\n    system(paste('rm -rf', outdir))\n  }\n  dir.create(outdir)\n}\n\n
\n

Of course, once your data is in R there are countless \"R things\" one could do...

\n
# iterate to fill empty cells with preceding values\nfor (i in 1:length(foo[,1])) {\n  if (nchar(foo$bar[i]) < 1) {\n    foo$bar[i] <- foo$bar[i-1]\n  }\n  # fill incomplete rows with NA values:\n  if (nchar(foo$bar[i]) < 1) {\n    foo[i,] <- NA  \n  }\n}\n\n# remove NA rows if there is nothing better to do:\nnewfoo <- na.omit(foo)\n
\n

Even though this is totally adding a level of complexity to what could be a single ogr2ogr command, I've decided it is still worth it- I'd definitely rather keep track of everything I do over forget what I did.... xD

\n
# make some methods to write out various kinds of files via gdal:\nto_GEO <- function(target) {\n  print(paste('converting', target, 'to geojson .... '))\n  system(paste('ogr2ogr -f', \" geojson \",  paste0(target, '.geojson'), paste0(target, '.csv')))\n}\n\nto_SHP <- function(target) {\n  print(paste('converting ', target, ' to ESRI Shapefile .... '))\n  system(paste('ogr2ogr -f', \" 'ESRI Shapefile' \",  paste0(target, '.shp'), paste0(target, '.csv')))\n}\n\n# name files:\nfoo_name <- 'output_foo'\n\n# for table data 'foo', first:\nwrite.csv(foo, paste0(foo_name, '.csv'))\n\n# convert with the above csv:\nto_SHP(foo_name)\n
\n
\n

\n

Using Ubuntu GDAL on Windows w/ WSL

\n

LINK: get the WSL shell from Microsoft

\n
# In the WSL shell:\n\nsudo apt-get install python3.6-dev -y\nsudo add-apt-repository ppa:ubuntugis/ppa && sudo apt-get update\nsudo apt-get install libgdal-dev -y\nsudo apt-get install gdal-bin -y\n\n# See here for more notes including Python bindings:\n# https://mothergeo-py.readthedocs.io/en/latest/development/how-to/gdal-ubuntu-pkg.html\n
\n

In a new Shell:

\n
# Double check the shell does indeed have GDAL in $PATH:\ngdalinfo --version\n\n
\n
\n

Ubuntu & Jupyter: cartopy setup

\n

\n
# install libraries:\nsudo apt install libproj-dev proj-data proj-bin\nsudo apt install libgeos-dev\n
\n
# install cython, cartopy:\npip3 install cython \npip3 install cartopy\n
\n
# fix shapely:\npip3 uninstall shapely\npip3 install shapely --no-binary shapely\n
\n
\n

Using GDAL on Mac OSX

\n

\n

Visit this blog post

\n

Note: in my opinion, homebrew and macPorts are good ideas- try them! If you don’t have Homebrew, get it now:

\n
/usr/bin/ruby -e \"$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)\"\n
\n

(….However, port or brew installing QGIS and GDAL (primarily surrounding the delicate links between QGIS / GDAL / Python 2 & 3 / OSX local paths) can cause baffling issues. If possible, don’t do that. Use QGIS installers from the official site or build from source!)

\n

if you need to resolve issues with your GDAL packages via removal:\non MacPorts, try similar:

\n
sudo port uninstall qgis py37-gdal\n\n# on homebrew, list then remove (follow its instructions):\n\nbrew list\nbrew uninstall gdal geos gdal2  \n
\n

!!! NOTE: I am investigating more reliable built-from-source solutions for gdal on mac.

\n

Really!

\n

There are numerous issues with brew-installed gdal. Those I have run into include:

\n
    \n
  • linking issues with the crucial directory “gdal-data” (libraries)
    • \n
  • linking issues Python bindings and python 2 vs. 3 getting confused
    • \n
  • internal raster library conflicts against the gdal requirements
    • \n
  • Proj.4 inconsistencies (see source notes below)
    • \n
  • OSX Framework conflicts with source / brew / port (http://www.kyngchaos.com/software/frameworks/)
    • \n
  • Linking conflicts with old, qgis default / LTR libraries against new ones
    • \n
  • Major KML discrepancies: expat standard vs libkml.
    • \n
\n
brew install gdal\n#\n# brew install qgis can work well too.  At least you can unbrew it!\n#\n
\n

Next, assuming your GDAL is not broken (on Mac OS this is rare and considered a miracle):

\n
# double check CLI is working:\ngdalinfo --version\n# “GDAL 2.4.0, released 2018/12/14”\ngdal_merge.py\n# list of args\n
\n
\n
\n

\n

Regarding Windows-specific software, such as ArcMap

\n

Remote Desktop:
\nThe greatest solution I've settled on for ArcMap use continues to be Chrome Remote Desktop, coupled with an IT Surplus desktop purchased for ~$50. Once Chrome is good to go on the remote Windows computer, one can operate everything from a web browser from anywhere else (even reboot and share files to and from the remote computer). While adding an additional, dedicated computer like this may not be possible for many students, it is certainly the simplest and most dependable solution.

\n

VirtualBox, Bootcamp, etc:
\nOracle's VirtualBox is a longstanding (and free!) virtualization software. A Windows virtual machine is vastly preferable over Bootcamp or further partition tomfoolery.\nOne can start / stop the VM only when its needed, store it on a usb stick, avoid insane pmbr issues, etc.

\n
    \n
  • Bootcamp will consume at least 40gb of space at all times before even attempting to function, whereas even a fully configured Windows VirtualBox VDI will only consume ~22gb, and can be moved elsewhere if not in use.
    • \n
  • There are better (not free) virtualization tools such as Parallels, though any way you slice it a dedicated machine will almost always be a better solution.
    • \n
\n
\n

Setup & Configure VirtualBox:

\n\n

There are numerous sites with VirtualBox guides, so I will not go into detail here.

\n

Extra bits on setup-

\n
    \n
  • \n

    Guest Additions are not necessary, despite what some folks may suggest.

    \n
    • \n
  • \n

    Dynamically Allocated VDI is the way to go as a virtual disk. There is no reason not to set the allocated disk size to the biggest value allowed, as it will never consume any more space than the virtual machine actually needs.

    \n
    • \n
  • \n

    Best to click through all the other machine settings just to see what is available, it is easy enough to make changes over time.

    \n
    • \n
  • \n

    There are many more levels of convoluted not worth stooping to, ranging from ArcMap via AWS EC2 or openstack to KVM/QEMU to WINE. Take it from me

    \n
    • \n
\n
\n

Using ESRI ArcGIS / ArcMap on Macs, continued...

\n

I need to run ESRI products on my MacBook Pro.   QGIS is always the prefered solution- open source, excellent free plugins, works on mac natively- but in a college / research environment, the only option that supports other people and school machines is ESRI.  Despite the annoying bureaucracy and expense of the software, some things are faster (but not better!) in ESRI, like dealing with raster / multiband data.

\n

First, you need a license.

\n

I went about this two ways;

\n

My first solution was to buy an ESRI Press textbook on amazon.  A 180 day trial for $50- when taken as a college course, this isn't to bad.  :)   The book is slow and recursive, but a 180 days to play with all the plugins and whistles allows for way deeper learning via the internet.   :)\"\"

\n

Do know there is a little-documented limit to the number of license transfers you may perform before getting either lock in or out of your software.  I hit this limit, as I was also figuring out my virtual machine situation, which would occasionally need a re-installation.

\n

My current solution is “just buy a student license”.   $100 per year is less than any adobe situation- so really not that bad.  

\n

Now you need a windows ISO.  

\n

https://www.microsoft.com/en-us/software-download/windows10ISO

\n

Follow that link for the window 10, 64 bit ISO.  YOU DO NOT NEED TO BUY WINDOWS.  It will sometimes complain about not having an  authentication, but in the months of using windows via VMs, never have I been prohibited to do... anything.  When prompted for a license when configuring your VM, click the button that says \"I don't have a license\".  Done.

\n

 

\n

Option one:  VirtualBox VM on a thumbdrive

\n

https://www.virtualbox.org/wiki/Downloads - VirtualBox downloads- the VM will take up most of a 128gb flash drive- ~70 gb just for windows and all the stuff you'll want from a PC.  Add ESRI software and allocated space for a cache (where your GIS project works!), bigger is better.   Format all drives in disk utility as ExFat!  this is important, any other file system either won't fly or could wreak havoc (other FAT based ones may have too small file allocations!

\n

I used two drives, a 128 and a 64- this is great because I can store all my work on the 64, so I can easily plug it into other (school) machines running windows ArcMap and keep going, without causing issues with the massive VM in the 128.  

\n

Installation is straightforward- added more screenshots of the process in vmsetup

\n

\"\" \"\"

\n

Problems:   Stability.   Crashes, and python / some other script modules do not work well.  This is a problem.  ArcAdministrator gets confused about all kinds of things- FWIW, if you are googling to delete the FLEXnet folder to solve authentication file issues, move to option 2 :)

\n

Speed is down, but actually the ~same speed as our school \"super\" PCs- (though I happened to know they are essentially glorified \"hybrid\" VMs too!) .

\n

\"\"

\n

Option two: OSX Bootcamp 

\n

https://support.apple.com/boot-camp

\n

https://support.apple.com/en-us/HT201468

\n

This way, you will hit \"option/alt\" each time you restart/boot your computer to choose from win/osx.   This is easy to install, as it is mac and mac = easy.

\n

Big Caveat:  it is much harder to install windows externally  (on a usb, etc) from bootcamp.  I didn't succeed in my efforts, but there could be a way....   The thing is, it really wants to run everything like a normal intel based PC, with all installations in the usual place.  This is good for the mac performance, but terrible for the tiny SSD hard drives we get as mac users.  I have a 256gb SSD.  I have an average of < 15 gb wiggle room here, and use every cloud service in the book.

\n

If you need to manage your cloud storage because of a itsy mac SSD, my solution is still ODrive.   https://www.odrive.com/

\n
\n

Example DEM stiching from GDAL

\n

\n

To begin- try a recent GIS assignment that would otherwise rely on the ESRI mosaic system:

\n

Data source: ftp://ftp.granit.sr.unh.edu/pub/GRANIT_Data/Vector_Data/Elevation_and_Derived_Products/d-elevationdem/d-10m/

\n
# wget is great, and is included in many distributions- it is not installed by default on Mac OSX however.\n\nbrew install wget\n
\n

make some folders

\n
mkdir GIS_Projects && cd GIS_Projects\n
\n

use wget to download every .dem file (-A .dem) from the specified folder and sub-folders (-r)

\n
wget -r -A .dem ftp://ftp.granit.sr.unh.edu/pub/GRANIT_Data/Vector_Data/Elevation_and_Derived_Products/d-elevationdem/\n\ncd ftp.granit.sr.unh.edu/pub/GRANIT_Data/Vector_Data/Elevation_and_Derived_Products/d-elevationdem\n
\n

make an index file of only .dem files.
\n(If we needed to download other files and keep them from our wget (more common)\nthis way we can still sort the various files for .dem)

\n
ls -1 *.dem > dem_list.txt\n
\n

use gdal to make state-plane referenced “Output_merged.tif” from the list of files in the index we made.\nWe will use a single generic \"0 0 255\" band to show gradient.

\n
gdal_merge.py -init \"0 0 255\" -o Output_Merged.tif --optfile dem_list.txt\n
\n

copy the resulting file to desktop, then return home

\n
cp Output_Merged.tif ~/desktop && cd\n
\n

if you want (recommended):

\n
rm -rf GIS_Projects  # remove .dem files.  Some are huge!\n
\n

In Finder at in ~/desktop, open the new file with QGIS. A normal photo viewer will NOT show any detail.

\n

Need to make something like this a reusable script? In Terminal, just a few extra steps:

\n
mkdir GIS_Scripts && cd GIS_Scripts\n
\n

open an editor + filename. Nano is generally pre-installed on OSX.

\n
nano GDAL_LiveMerge.sh\n
\n

COPY + PASTE THE SCRIPT FROM ABOVE INTO THE WINDOW

\n
    \n
  • ctrl+X , then Y for yes
    • \n
\n

make your file runnable:

\n
chmod u+x GDAL_LiveMerge.sh\n
\n

run with ./

\n
./GDAL_LiveMerge.sh\n
\n

You can now copy + paste your script anywhere you want and run it there. scripts like this should not be exported to your global path / bashrc and will only work if they are in the directory you are calling them: If you need a global script, there are plenty of ways to do that too.

\n

See /Notes_GDAL/README.md for notes on building GDAL from source on OSX

\n

\n
", "readme_excerpt": "\n \nMiscellaneous gis notes, mostly derived from my blog over here\n \nIndex:
\neBird API stuff
\nR / Shiny Web Experiments
\nShell macros from R
\nWhen it must be Windows
\nWindows WSL - Ubuntu GDAL setup
\nUbuntu & Jupyter cartopy setup
\nMac OSX - GDAL setup
\nBash Example - DEM stitching
\nLink to rJDK management info
\n- - -\n

\nThe Ebird dataset is...", "install_commands": {}, "repo_url": "https://github.com/jesssullivan/GIS_Shortcuts", "website_url": "https://transscendsurvival.org/GIS_Shortcuts/", "docs_url": null, "registry_url": null, "releases_url": "https://github.com/jesssullivan/GIS_Shortcuts/releases", "og_image_url": "https://opengraph.githubassets.com/70bea8545b1df236af9c510e399d92a868a8e60e5cce44f12c0bd6f49c451933/Jesssullivan/GIS_Shortcuts", "license": "MIT", "pushed_at": "2026-02-10T02:59:48Z", "enriched_at": "2026-04-26T17:17:19.115Z", "gate": "pages" }, { "slug": "jesssullivan-ansible-dag-harness", "name": "Ansible-DAG-Harness", "repo": "jesssullivan/Ansible-DAG-Harness", "org": "jesssullivan", "ecosystem": "multi", "category": "ai-tools", "description": "A disposable self-bootstrapping LangGraph DAG harness for boxing up Ansible iteration cycles in GitLab", "featured": false, "tags": [ "langgraph", "dag", "ansible" ], "version": "0.0.0", "release_date": "", "releases": [], "stars": 0, "topics": [ "ansible-role", "dag", "gitlab", "harness", "langgraph", "minutae" ], "languages": [ { "name": "Python", "color": "#3572A5", "bytes": 2868546 }, { "name": "Shell", "color": "#89e051", "bytes": 37690 }, { "name": "Just", "color": "#384d54", "bytes": 9106 }, { "name": "Jinja", "color": "#a52a22", "bytes": 3840 }, { "name": "Nix", "color": "#7e7eff", "bytes": 2675 } ], "primary_language": "Python", "readme_html": "

DAG Harness

\n

LangGraph DAG orchestration for Ansible role deployments with GitLab integration.

\n

Features

\n
    \n
  • 17-node workflow with parallel testing, HITL gates, recovery subgraph
    • \n
  • 30 MCP tools across 9 categories for Claude Code integration
    • \n
  • HOTL mode - Human Out of The Loop autonomous operation
    • \n
  • Checkpointing - Resume from any node with SQLite persistence
    • \n
\n

Installation

\n
# From source (recommended)\ngit clone https://github.com/Jesssullivan/dag-harness.git\ncd dag-harness/harness\nuv sync\n\n# Or via pip\npip install git+https://github.com/Jesssullivan/dag-harness.git#subdirectory=harness
\n

Usage

\n
harness init                    # Initialize in repo\nharness box-up-role <role>      # Execute workflow\nharness status                  # Show status\nharness hotl start              # Autonomous mode
\n

Workflow

\n
validate_role → analyze_deps → check_reverse_deps → create_worktree\n                                                          ↓\nrun_molecule ─┬─→ merge_test_results → validate_deploy → create_commit\nrun_pytest  ──┘                                              ↓\n                push_branch → create_issue → create_mr → human_approval\n                                                              ↓\n                              add_to_merge_train → report_summary\n                                        ↓\n                               [recovery subgraph on failure]\n
\n

17 nodes: validate_role, analyze_deps, check_reverse_deps, create_worktree, run_molecule, run_pytest, merge_test_results, validate_deploy, create_commit, push_branch, create_issue, create_mr, human_approval, add_to_merge_train, report_summary, notify_failure, recovery

\n

MCP Tools

\n

30 tools defined in harness/mcp/server.py:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CategoryCount
role_management7
workflow5
agent6
worktree3
costs3
testing2
search2
credentials1
merge_train1
\n

Configuration

\n
# harness.yml\ndb_path: harness.db\nrepo_root: /path/to/ansible/roles\n\ngitlab:\n  project_path: group/project\n  default_assignee: username\n\nworktree:\n  base_path: /path/to/worktrees\n  branch_prefix: feature/
\n

Requirements

\n
    \n
  • Python 3.11+
    • \n
  • Git with worktree support
    • \n
  • GitLab API access (GITLAB_TOKEN)
    • \n
\n

Tests

\n
cd harness\nuv run pytest                           # 1667 tests\nuv run pytest -m \"not integration\"      # Unit tests only\nuv run pytest -m pbt                    # Property-based tests
\n

Documentation

\n\n

License

\n

MIT

\n
", "readme_excerpt": "LangGraph DAG orchestration for Ansible role deployments with GitLab integration.\n- 17-node workflow with parallel testing, HITL gates, recovery subgraph\n- 30 MCP tools across 9 categories for Claude Code integration\n- HOTL mode - Human Out of The Loop autonomous operation\n- Checkpointing - Resume from any node with SQLite persistence\nbash\ngit clone https://github.com/Jesssullivan/dag-harness.git\ncd dag-harness/harness\nuv sync\npip install...", "install_commands": {}, "repo_url": "https://github.com/jesssullivan/Ansible-DAG-Harness", "website_url": "https://jesssullivan.github.io/Ansible-DAG-Harness/", "docs_url": null, "registry_url": null, "releases_url": "https://github.com/jesssullivan/Ansible-DAG-Harness/releases", "og_image_url": "https://opengraph.githubassets.com/bcdbcb3ccafdd38a9e6eff0ef32698faad60fbfd7002a295ef93dade489e1f65/Jesssullivan/Ansible-DAG-Harness", "license": "MIT", "pushed_at": "2026-02-08T20:44:11Z", "enriched_at": "2026-04-26T17:17:19.376Z", "gate": "homepage" }, { "slug": "jesssullivan-quickchpl", "name": "quickchpl", "repo": "jesssullivan/quickchpl", "org": "jesssullivan", "ecosystem": "multi", "category": "devex", "description": "Simple Property-Based Testing for Chapel Language", "featured": false, "tags": [ "chapel", "pbt", "testing" ], "version": "1.0.2", "release_date": "2026-01-15T08:14:03Z", "releases": [ { "tag": "1.0.2", "date": "2026-01-15T08:14:03Z", "body": "## quickchpl 1.0.2\r\n\r\n## [1.0.2] - 2026-01-15\r\n\r\n### Fixed\r\n- Generic type warnings: Added `Property(?)` syntax for generic formal parameters\r\n- Unstable symbol warnings: Replaced `_unused` loop variables with bare `for 1..n` syntax\r\n- Mason main module check: Restructured to proper submodule convention\r\n\r\n### Changed\r\n- Moved submodules to `src/quickchpl/` directory per Mason package conventions\r\n- Updated `quickchpl.chpl` to use `include module` statements before `public use`\r\n- Test files now import via `use quickchpl` instead of direct submodule imports\r\n- Fix UnusedFormal: extract helper procs with @chplcheck.ignore\r\n- Fix LineLength: break long lines under 80 chars\r\n- Update CI threshold to 7 (acceptable API design violations)\r\n- Chapel version compatibility extended to 2.8.0\r\n\r\n### Infrastructure\r\n- Updated GitHub Actions and GitLab CI paths for new module structure\r\n- Fixed Mason.toml trailing newline (Mason bug workaround)\r\n\r\n[1.0.2]: https://github.com/Jesssullivan/quickchpl/releases/tag/v1.0.2" }, { "tag": "1.0.1", "date": "2026-01-12T23:44:39Z", "body": "## quickchpl 1.0.1\n\n\n\n### Installation\n\n#### Via Mason (Recommended)\n```bash\nmason add quickchpl@1.0.1\n```\n\n#### Manual\n```bash\ngit clone https://github.com/Jesssullivan/quickchpl.git\ngit checkout v1.0.1\nexport CHPL_MODULE_PATH=$CHPL_MODULE_PATH:$PWD/quickchpl/src\n```\n\n### Documentation\n- [README](https://github.com/Jesssullivan/quickchpl/blob/main/README.md)\n- [Examples](https://github.com/Jesssullivan/quickchpl/tree/main/examples)\n- [API Documentation](https://github.com/Jesssullivan/quickchpl/tree/main/docs)\n" } ], "stars": 2, "topics": [ "chapel-language", "mason", "property-based-testing", "parl" ], "languages": [ { "name": "Chapel", "color": "#8dc63f", "bytes": 129066 }, { "name": "Shell", "color": "#89e051", "bytes": 4692 }, { "name": "Dockerfile", "color": "#384d54", "bytes": 944 } ], "primary_language": "Chapel", "readme_html": "

quickchpl

\n

Simple Property-Based Testing for Chapel

\n

\"Chapel\"\n\"License:\n\"GitLab\"

\n

Inspired by QuickCheck and my father ^w^

\n
use quickchpl;\n\nproc main() {\n  // Test that addition is commutative\n  var gen = tupleGen(intGen(-100, 100), intGen(-100, 100));\n  var prop = property(\n    \"addition is commutative\",\n    gen,\n    proc(args: (int, int)) {\n      const (a, b) = args;\n      return a + b == b + a;\n    }\n  );\n\n  var result = check(prop);\n  if result.passed {\n    writeln(\"✓ \", prop.name, \" passed \", result.numTests, \" tests\");\n  } else {\n    writeln(\"✗ \", prop.name, \" FAILED\");\n    writeln(\"  Counterexample: \", result.failureInfo);\n  }\n}
\n

Compile and run:

\n
chpl my_test.chpl -M path/to/quickchpl/src\n./my_test
\n

Output:

\n
✓ addition is commutative passed 100 tests\n
\n

Generators

\n

Primitive Generators

\n
// Integers\nvar intG = intGen(-100, 100);           // Range [-100, 100]\nvar natG = natGen(1000);                 // Natural numbers [0, 1000]\nvar posG = positiveIntGen(1000);         // Positive [1, 1000]\n\n// Real numbers\nvar realG = realGen(0.0, 1.0);           // Uniform [0, 1)\nvar normalG = realGen(0.0, 1.0, Distribution.Normal);\n\n// Booleans\nvar boolG = boolGen(0.5);                // 50% true probability\n\n// Strings\nvar strG = stringGen(0, 50);             // Length 0-50, alphanumeric\nvar alphaG = alphaGen(5, 10);            // Alphabetic only
\n

Composite Generators

\n
// Tuples\nvar pairG = tupleGen(intGen(), stringGen());\nvar tripleG = tupleGen(intGen(), intGen(), intGen());\n\n// Lists\nvar listG = listGen(intGen(), 0, 10);    // List of 0-10 integers\n\n// Fixed values\nvar constG = constantGen(42);
\n

Generator Combinators

\n
// Transform output\nvar doubledG = map(intGen(), proc(x: int) { return x * 2; });\n\n// Filter values\nvar evenG = filter(intGen(), proc(x: int) { return x % 2 == 0; });\n\n// Combine generators\nvar zippedG = zip(intGen(), stringGen());\n\n// Random choice\nvar choiceG = oneOf(intGen(0, 10), intGen(100, 200));\n\n// Weighted choice\nvar weightedG = frequency(9, intGen(0, 10), 1, intGen(1000, 2000));
\n

Properties

\n

Basic Properties

\n
var prop = property(\n  \"absolute value is non-negative\",\n  intGen(),\n  proc(x: int) { return abs(x) >= 0; }\n);\n\nvar result = check(prop);\nassert(result.passed);
\n

Conditional Properties (Implication)

\n
// Property only checked when condition is true\n// (implies is available from quickchpl module)\nvar prop = property(\n  \"division by non-zero\",\n  tupleGen(intGen(), intGen()),\n  proc(args: (int, int)) {\n    const (a, b) = args;\n    return implies(b != 0, a / b * b == a - a % b);\n  }\n);
\n

Convenience Functions

\n
// Quick one-liner check\nassert(quickCheck(intGen(), proc(x: int) { return x + 0 == x; }));\n\n// forAll syntax\nvar result = forAll(intGen(), proc(x: int) { return x * 1 == x; });
\n

Property Patterns

\n

The Patterns module provides reusable predicate functions for testing common properties.\nAll pattern predicates are available when you use quickchpl;.

\n

Algebraic Patterns

\n
// Test that addition is commutative\nvar prop = property(\n  \"addition is commutative\",\n  tupleGen(intGen(-100, 100), intGen(-100, 100)),\n  proc(args: (int, int)) {\n    const (a, b) = args;\n    return isCommutative(a, b, proc(x: int, y: int) { return x + y; });\n  }\n);\n\n// Or use ready-made predicates for integers\nvar commProp = property(\n  \"integer addition commutes\",\n  tupleGen(intGen(), intGen()),\n  proc(args: (int, int)) {\n    const (a, b) = args;\n    return intAddCommutative(a, b);\n  }\n);\n\n// Test associativity\nvar assocProp = property(\n  \"addition is associative\",\n  tupleGen(intGen(), intGen(), intGen()),\n  proc(args: (int, int, int)) {\n    const (a, b, c) = args;\n    return intAddAssociative(a, b, c);\n  }\n);\n\n// Test identity element\nvar idProp = property(\n  \"zero is additive identity\",\n  intGen(),\n  proc(a: int) { return intAddIdentity(a); }\n);
\n

Functional Patterns

\n
// Idempotence: f(f(x)) = f(x)\nvar idempProp = property(\n  \"abs is idempotent\",\n  intGen(),\n  proc(x: int) {\n    return isIdempotent(x, proc(n: int) { return abs(n); });\n  }\n);\n\n// Involution: f(f(x)) = x\nvar invProp = property(\n  \"negation is involution\",\n  intGen(),\n  proc(x: int) {\n    return isInvolution(x, proc(n: int) { return -n; });\n  }\n);\n\n// Round-trip: decode(encode(x)) = x\nvar roundTripProp = property(\n  \"int<->string round-trip\",\n  intGen(),\n  proc(x: int) {\n    return isRoundTrip(x,\n      proc(n: int) { return n:string; },\n      proc(s: string): int { return try! s:int; catch { return 0; } }\n    );\n  }\n);
\n

Shrinking

\n

When a property fails, quickchpl automatically shrinks the counterexample to find the minimal failing case:

\n
// Property fails for x >= 50\nvar prop = property(\n  \"x is small\",\n  intGen(0, 1000),\n  proc(x: int) { return x < 50; }\n);\n\nvar result = check(prop);\n// result.failureInfo might be \"847\"\n// result.shrunkInfo will be \"50\" (minimal failing case)
\n

Shrinking Strategies

\n
    \n
  • Integers: Binary search towards 0
    • \n
  • Reals: Try 0, truncated, rounded values
    • \n
  • Strings: Try empty, remove chars, simplify to 'a'
    • \n
  • Lists: Try empty, remove elements, shrink elements
    • \n
  • Tuples: Shrink each component
    • \n
\n

GitLab CI

\n
include:\n  - remote: 'https://gitlab.com/tinyland/projects/quickchpl/-/raw/main/ci/.gitlab-ci.yml'\n\nproperty_tests:\n  extends: .property_test_template\n  script:\n    - chpl tests/my_properties.chpl -M quickchpl/src -o /tmp/props\n    - /tmp/props --numTests=1000
\n

GitHub Actions

\n
- name: Run property tests\n  run: |\n    chpl tests/my_properties.chpl -M quickchpl/src -o /tmp/props\n    /tmp/props --numTests=1000
\n

Configuration

\n
export CHPL_MODULE_PATH=$CHPL_MODULE_PATH:$PWD/quickchpl/src
\n
./my_tests --numTests=1000 --maxShrinkSteps=500 --verbose=true
\n

...Or in code:

\n
var runner = new PropertyRunner(\n  numTests = 1000,\n  maxShrinkSteps = 500,\n  verboseMode = true\n);\nvar result = runner.check(prop);
\n

API

\n

Core Types

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
TypeDescription
IntGeneratorGenerates random integers
RealGeneratorGenerates random real numbers
BoolGeneratorGenerates random booleans
StringGeneratorGenerates random strings
PropertyDefines a property to test
PropertyRunnerExecutes property tests
TestResultContains test results
\n

Functions

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FunctionDescription
intGen(min, max)Create integer generator
property(name, gen, pred)Define a property
check(prop)Run property test
quickCheck(gen, pred)One-liner property check
shrink(value)Generate shrink candidates
\n

Todos & Future work:

\n
    \n
  • Integrate with Chapel Mason package repo (in progress)
    • \n
  • Integrate Outbot Harness
    • \n
  • Integrate with (and [ ] publish) sister projects, chapel-k8s-mail, chapel-git, tinymachines, mariolex)
    • \n
  • Add IDE and LLM friendly text and code completions (docs in the works)
    • \n
  • Provide public demo (aoc-2025 done! one is good for now)
    • \n
\n
\n

Notes:

\n
    \n
  • module include statements are not yet stable <-- this is expected
    • \n
  • list.parSafe is unstable <-- this is expected
    • \n
  • use of routines as values is unstable <-- routines are necessary AFAICT to achieve this familiar PBT structure
    • \n
\n
", "readme_excerpt": "Simple Property-Based Testing for Chapel\n[](https://chapel-lang.org/)\n[](https://opensource.org/licenses/MIT)\n[](https://gitlab.com/tinyland/projects/quickchpl)\nInspired by QuickCheck and my father ^w^\nchapel\nuse quickchpl;\nproc main() {\n // Test that addition is commutative\n var gen = tupleGen(intGen(-100, 100), intGen(-100, 100));\n var prop = property(\n \"addition is commutative\",\n gen,\n proc(args: (int, int)) {\n const (a, b) = args;\n return a + b == b + a;\n }\n );\n ...", "install_commands": {}, "repo_url": "https://github.com/jesssullivan/quickchpl", "website_url": null, "docs_url": null, "registry_url": null, "releases_url": "https://github.com/jesssullivan/quickchpl/releases", "og_image_url": "https://opengraph.githubassets.com/9176ab1b95da586e4dc557f1fa4ace81e1c8afb7eb28d4786f148265fc04540e/Jesssullivan/quickchpl", "license": "MIT", "pushed_at": "2026-01-17T19:12:31Z", "enriched_at": "2026-04-26T17:17:19.676Z", "gate": "override" }, { "slug": "jesssullivan-fastphotoapi", "name": "FastPhotoAPI", "repo": "jesssullivan/FastPhotoAPI", "org": "jesssullivan", "ecosystem": "multi", "category": "uncategorized", "description": "An efficient, flexible, flask-based image server using Lanczos resampling ", "featured": false, "tags": [ "flask", "lanczos", "docker", "koyeb", "static-api" ], "version": "0.0.0", "release_date": "", "releases": [], "stars": 1, "topics": [ "flask", "lanczos", "docker", "koyeb", "static-api" ], "languages": [ { "name": "Python", "color": "#3572A5", "bytes": 9848 }, { "name": "HTML", "color": "#e34c26", "bytes": 2470 }, { "name": "CSS", "color": "#663399", "bytes": 1157 }, { "name": "Dockerfile", "color": "#384d54", "bytes": 436 } ], "primary_language": "Python", "readme_html": "

FastPhotoAPI

\n

An efficient, flexible, flask-based image server that uses lanczos resampling to serve optimized cached photos.

\n
python3.12 -m venv fast_photo_venv\nsource fast_photo_venv/bin/activate\npip install -r requirements.txt
\n

Usage:

\n
    \n
  • Resample & fetch a cached image /image/<yourimage>
    • \n
  • Resample and fetch an image with a specific max dimension:\n
      \n
    • /image/<yourimage>?w=69 or
      • \n
    • /image/<yourimage?h=69> or
      • \n
    • /image/<yourimage>?w=69&h=42
      • \n
    \n
    • \n
  • Fetch the original, unmodified image /full/<yourimage>
    • \n
\n

Structure:

\n

This application adopts the factory pattern; flask run instantiates the built-in development server by executing create_app() at the root of the app/ package, while python application.py creates a new production application, served by waitress.

\n
.\n├── app\n          ├── __init__.py  #  create and serve development application\n          └── main\n              ├── config\n│             │         ├── conf.py  # Utility configs and methods \n│             │         └── config.cfg  # set directories, max image dimensions, etc\n│             ├── fullsize\n│             │         └── routes.py  # Blueprint routing for serving verbatim image files \n│             ├── __init__.py  # `create_app()` entrypoint\n│             ├── resampled\n│             │         ├── model.py  # Image resampling methods\n│             │         ├── trashd.py  # garbage collector daemon \n│             │         └── routes.py  # Blueprint routing for `/image/`  \n│             └── static\n│                 └── routes.py  # Blueprint routing for `/static/` \n├── application.py  # create and serve production application w/ waitress\n├── cache  # resampled images are dynamically generated adn stored here \n├── Dockerfile  # currently deployed at Koyeb  \n├── pictures # full res pictures go here\n├── README.md  # you are here\n├── static\n│         └── style.css  # index styling\n└── templates\n    ├── index.html  \n    └── upload.html
\n

Build

\n

Locally:

\n
flask run # 0.0.0.0:5000\n
\n
flask run # 0.0.0.0:8000\n
\n

Production via Docker:

\n
## build production docker image:\ndocker build -t <srv> .\n\n## serve production docker image locally:\ndocker run -d -p 8000:8000 <srv>:latest\n\n## stop local image:\n# docker ps\n# docker stop \n\n## push image to a container registery: \n# docker push <srv>
\n
", "readme_excerpt": "An efficient, flexible, flask-based image server that uses lanczos resampling to serve optimized cached photos.\nshell\npython3.12 -m venv fastphotovenv\nsource fastphotovenv/bin/activate\npip install -r requirements.txt\n- Resample & fetch a cached image /image/\n- Resample and fetch an image with a specific max dimension:\n - /image/?w=69 or\n - /image/ or\n - /image/?w=69&h=42\n- Fetch the original, unmodified image /full/\nThis application...", "install_commands": {}, "repo_url": "https://github.com/jesssullivan/FastPhotoAPI", "website_url": null, "docs_url": null, "registry_url": null, "releases_url": "https://github.com/jesssullivan/FastPhotoAPI/releases", "og_image_url": "https://opengraph.githubassets.com/73f974263ffc78e88b1a979591d0e0a3281318170fe7034e4e200258f03e0a08/Jesssullivan/FastPhotoAPI", "license": "Apache-2.0", "pushed_at": "2024-12-20T20:45:58Z", "enriched_at": "2026-04-26T17:17:19.921Z", "gate": "auto" }, { "slug": "jesssullivan-timberbuddy", "name": "timberbuddy", "repo": "jesssullivan/timberbuddy", "org": "jesssullivan", "ecosystem": "npm", "category": "uncategorized", "description": "Archive of Control Package work for Amish Sawmill", "featured": false, "tags": [ "i2c", "raspberry-pi", "robotics", "sveltekit" ], "version": "0.0.0", "release_date": "", "releases": [], "stars": 1, "topics": [ "i2c", "raspberry-pi", "robotics", "sveltekit" ], "languages": [ { "name": "TypeScript", "color": "#3178c6", "bytes": 25013 }, { "name": "Svelte", "color": "#ff3e00", "bytes": 15769 }, { "name": "Jinja", "color": "#a52a22", "bytes": 5159 }, { "name": "Cython", "color": "#fedf5b", "bytes": 2485 }, { "name": "Python", "color": "#3572A5", "bytes": 1232 } ], "primary_language": "TypeScript", "readme_html": "

Timber Buddy Controller

\n

Thesis:

\n

Wouldn't it be cool to use a familiar, modern web stack for commercial automation or robotics?

\n

\"\"

\n

Read on to understand the architecture of this project, why it is built this way and how to build and bend this fun project into your cool product.

\n

User input:

\n
    \n
  • Operator interacts with the controller with any of the following inputs:\n
      \n
    • the Touch screen UI
      • \n
    • physical front panel buttons
      • \n
    • Graphically via the web (pi connect, web console or with wireguard / port forwarding)
      • \n
    • Via SSH
      • \n
    \n
    • \n
\n

HID transmission to hardware:

\n
    \n
  • Touch screen button presses are communicated via websocket to the node server;\n
      \n
    • socket communications pass along a boolean value that is treated like an atomic state;
      • \n
    • This allows different / concurrent / incidental requests from the hardware to be made by any number of connected clients (though of course, as a PLC there will only ever by one connected client), with messages only getting accepted if the requested routine is not already active. This means we do not have to deal with message queues or masquerade what are fundamentally synchronous routines (move the saw up or down by however much, home the machine, toggle a mode etc) as faux asynchronous jobs. This is the opposite if how most server / client communications would be setup, but is important to understand because the job executed by the server is literally a single set of sensors, lights, solenoids connected to the pi.
      • \n
    \n
    • \n
  • Physical button presses are also communicated via websocket on the active client connection.
    • \n
\n

Data transmission and storage:

\n
    \n
  • we use a flat json file to store and ultimately log / rotate data as well as browser localStorage to actively handle data, where the localStorage values are managed via a SvelteKit store. The use of browserStorage allows the touch UI to display, modify and cache data being used by each type of client (stack, core) as well as removes load on the http API and thus the filesystem.
    • \n
  • In the case of timberbuddy, we store Cut size, stack size and total cut count in a static json file.
    • \n
  • Changes to data values to the filesystem are completed via the node POST API.
    • \n
  • If there is a disagreement between client and server about values, the static file values take presidence
    • \n
  • Jobs executed by the server (ie moving a saw) read from the static file directly.
    • \n
\n

Type of client (core / stack in the case of the timberbuddy):

\n
    \n
  • Because actions are communicated via active websocket connection, we identify the kind of client and thus kind of job (stack or core, which ingest different cut sizes for example) with the referrer's slug in the socket handshake header.
    • \n
\n

Pi Node Server:

\n
    \n
  • The compiled sveltekit application (client + server) is served using a custom express node application.\n
      \n
    • The sveltkit application uses the node-adapter as part of the vite build process to make this possible.
      • \n
    • The Sveltekit application is responsible for handling the POST API and creating and writing to the static json data file. The Sveltekit application is responsible for all http communication.
      • \n
    \n
    • \n
  • The node server is responsible for pi GPIO connections (buttons!) websocket connections, managing atomic hardware state and i2c bus and for reading the static json file during routine execution.
    • \n
  • includes keyboard support and does its best to allow for graceful socket, GPIO and fs exit (allowing for the systemd service to properly keep the service alive)
    • \n
\n

About The Darwin Server:

\n
    \n
  • I also wrote a development node server for macos that uses keyboard presses as a stand-in for hardware GPIO buttons. This does not allow for i2c bus communication, but does help troubleshoot socket / http development.
    • \n
\n

Can I use a Vite Server?

\n
    \n
  • Yes. Use the traditional vite dev server for UI development.
    • \n
\n

The i2c bus:

\n
    \n
  • Encoder io and relay IO is done via the i2c bus. I've written drivers for two M5 i2c devices in Typescript depending solely on the raspi-i2c library. These are modeled after the example C++ classes shared by M5 stack on github. Synchronous methods are used wherever possible.
    • \n
\n

Deployment:

\n
    \n
  • Leverages pi connect for initial remote connection and the initial tailscale / wiregaurd daemon setup for SSH.
    • \n
  • Uses ansible to deploy and build the entire application- roles include:\n
      \n
    • kiosk: sets up vanilla bookworm image with:\n
        \n
      • tailscale daemon, gh & git tokens, custom wayland config, wayfire kiosk mode and executable kiosk mode.
        • \n
      \n
      • \n
    • pi-setup:\n
        \n
      • enable i2c, linger support, splashboot configs, support for waveshare DSI display on wayland
        • \n
      • establishes network uptime cron daemon, network logging, wlan config, network depends
        • \n
      \n
      • \n
    • waveshare-dsi:\n
        \n
      • sets up OEM brightness control utility for waveshare DSI display
        • \n
      \n
      • \n
    • node-server:\n
        \n
      • sets up all kinds of node server related stuff
        • \n
      • fetches source from git w/ token, sets up nodegyp, pnpm
        • \n
      • Compiles sveltekit application and installs as the complete node application as a systemd service
        • \n
      \n
      • \n
    • splash-kernel:\n
        \n
      • began work on custom kernel and splash animation (pending completion by local artist) for virtualized dev environment
        • \n
      \n
      • \n
    \n
    • \n
\n

Touchscreen / UI:

\n
    \n
  • SvelteKit web application;\n
      \n
    • Pages use the edge runtime
      • \n
    \n
    • \n
  • Runs directly in a browser in kiosk mode\n
      \n
    • Utilizes the Skeleton UI component library
      • \n
    • Utilizes Lucide Iconography
      • \n
    \n
    • \n
\n

Testing

\n
    \n
  • I've included both python and cython implementations of the i2c example c++ classes provided by m5 stack.
    • \n
  • demo encoder logging and relay toggling implementations are included with the typescript class files.
    • \n
  • Currently, demo routines in the node server file are using timers for demo the atomic socket behavior while the saw is moving; switching this to read from the encoder and wait to reach a desired encoder reading is trivial. Similarly, moving these actual machine to class files is inevitable, all the functionality is there and ready to go.
    • \n
\n

Why this way? Doesn't this seem way more complicated than it should be?

\n
    \n
  • In order to satisfy the requirements of fully remote development, a network enabled device with well documented GPIO, i2c IO, touchscreen IO etc really calls for a raspberry pi or similarly full-blown SBC.
    • \n
  • Being able to clone SD cards interoperability with long term support from the pi foundation was identified as a plus by collaborators.
    • \n
  • The customer / collaborators indicated a desire for over the air updates or modifications.
    • \n
  • The recent (at the time) beta release of pi connect and wayland screen sharing on pi made boot strapping the setup of a pi completely remotely without needing to coach anyone through major technical hurdles pretty easy.
    • \n
  • Jess is familiar with sveltekit in her professional work. Using a modern web stack for UI UX as well as robotics with real hardware is sort of a holy grail for her. There are lots of web engineers, and this stack is not tied to any particular vendor or mutable license.
    • \n
  • My use of a combination of socket / http API protocols and data transmission solutions (localStorage, svelte writable store, flat file) can surely be simplified and improved upon, this is just the solution I've come up with.
    • \n
  • Find some pictures associated with this project in the /media directory.
    • \n
\n
\n

Setup from scratch:

\n

What you need:

\n
    \n
  • A raspberry pi 5 running the latest pi os using wayland. (at the time of writing, this is the Bookworm release)\n
      \n
    • If you are doing 100% remote development, you'll need a free pi connect account and a tailnet (or any similar vpn solution with a public control plane)
      • \n
    \n
    • \n
  • this waveshare DSI display: SKU 21229
    • \n
  • this i2c relay bank module: SKU U097
    • \n
  • this i2c encoder module SKU U161
    • \n
  • 4x momentary push buttons
    • \n
  • 4x 10k resistors (for GPIO buttons)
    • \n
  • 4x 1k resistors (for GPIO buttons)
    • \n
  • a 5v power supply for the pi (I used a 5v meanwell din module I converted to work as a variable supply)
    • \n
  • a power supply for your solenoids (in my case a 12v meanwell din unit)
    • \n
  • some stuff to toggle (in my dev unit, I used these 12v pilot lamps to simulate hydrolytic solenoids firing)
    • \n
  • an encoder to read from
    • \n
\n

Most importantly:

\n

Expertise in typescript, sveltekit, postcss, websocket programming, tailwind, vite adapters, ansible deployment strategies, node server development, express applications, debugging with cython, i2c bus programming, atomic execution paradigms, linux init systems, wayland for HID implementations, NIC and SOC power management on SBCs and shell scripting. This project is not done. This repo is provided as an as-is archive of work.

\n

How to build it:

\n

for development:

\n
    \n
  • local depends:\n
      \n
    • you'll need node v20 and pnpm, npx, tsx installed.
      • \n
    \n
    • \n
\n
git clone https://github.com/jesssullivan/timberbuddy && cd timberbuddy\npnpm i\npnpm run build\n\n# just sveltekit applications; live reload:\npnpm run dev\n\n# on macos with node server; no hot reload, no i2c:\npnpm run darwin-start\n\n# on pi with production server:\npnpm run pi-start
\n

for deployment:

\n
# from your local machine:\ngit clone https://github.com/jesssullivan/timberbuddy && cd timberbuddy/deploy\nsudo chmod +x scripts/setup_venv.sh\n./scripts/setup_venv.sh && source timber_venv/bin/activate
\n

over pi connect in it's remote shell:

\n
# once tailscale is setup, we can ansible the rest of the things:\ncurl -L https://pkgs.tailscale.com/stable/raspbian/$(lsb_release -cs).noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null && \\\n  echo \"deb [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg] https://pkgs.tailscale.com/stable/raspbian $(lsb_release -cs) main\" | sudo tee  /etc/apt/sources.list.d/tailscale.list && \n  sudo apt update && sudo apt install tailscale \n\n ## log in:\nsudo tailscale up -ssh # use your local machine to login into to control plane with the generated url
\n

from controller:

\n
# run like any ansible playbook; you'll be prompted for a github key for the remote clone / build / install\n\n# something to the tune of:\nansible-playbook -i inventory_remote_dev -K services.yml --extra-vars \"host=remote-dev\" -l \"remote-dev\" -u \"TimberBuddy\"
\n

connect / tailscale troubleshooting:

\n
# for pi connect upon local kiosk role run:\nrpi-connect signin\n\n# upon reprovisioning, you may need to play keys time:\nssh-copy-id <TimberBuddy>@<pi-ipv4>
\n

\"\"

\n
", "readme_excerpt": "Wouldn't it be cool to use a familiar, modern web stack for commercial automation or robotics?\nRead on to understand the architecture of this project, why it is built this way and how to build and bend this fun project into your cool product.\n- A raspberry pi 5 running the latest pi os using wayland. (at the time of writing, this is the Bookworm release)\n - If you are doing 100% remote development, you'll need a free pi connect account and a tailnet (or any similar vpn solution with a public...", "install_commands": { "npm": "npm install timberbuddy" }, "repo_url": "https://github.com/jesssullivan/timberbuddy", "website_url": null, "docs_url": null, "registry_url": "https://www.npmjs.com/package/timberbuddy", "releases_url": "https://github.com/jesssullivan/timberbuddy/releases", "og_image_url": "https://opengraph.githubassets.com/05164d8e594961f7c1fb5187d4d96480ea4269078dc9cba1362900f2bb134245/Jesssullivan/timberbuddy", "license": "", "pushed_at": "2024-12-07T19:42:40Z", "enriched_at": "2026-04-26T17:17:20.203Z", "gate": "auto" }, { "slug": "tinyland-inc-tinyvectors", "name": "tinyvectors", "repo": "tinyland-inc/tinyvectors", "org": "tinyland-inc", "ecosystem": "npm", "category": "devex", "description": "Lightweight vector math for physics simulations and blob animations", "featured": false, "tags": [ "math", "vectors", "animation" ], "version": "0.0.0", "release_date": "", "releases": [], "stars": 0, "topics": [], "languages": [ { "name": "TypeScript", "color": "#3178c6", "bytes": 116445 }, { "name": "Svelte", "color": "#ff3e00", "bytes": 13068 }, { "name": "Starlark", "color": "#76d275", "bytes": 6872 }, { "name": "CSS", "color": "#663399", "bytes": 6244 }, { "name": "HTML", "color": "#e34c26", "bytes": 2453 } ], "primary_language": "TypeScript", "readme_html": "

@tummycrypt/tinyvectors

\n

Animated vector blob backgrounds with lil physics for Svelte 5.

\n

This package is what powers the moving background layer on transscendsurvival.org, but it is meant to be useful outside that site too. It ships a small set of Svelte components plus the lower-level motion, theme, and core utilities that drive them.

\n

Install

\n
pnpm add @tummycrypt/tinyvectors
\n

Peer dependency:

\n
    \n
  • svelte@^5
    • \n
\n

Quick Start

\n
<script lang=\"ts\">\n\timport { TinyVectors } from '@tummycrypt/tinyvectors';\n\n\tconst colors = [\n\t\t'rgba(26,188,156,0.35)',\n\t\t'rgba(22,160,133,0.30)',\n\t\t'rgba(39,174,96,0.25)',\n\t\t'rgba(52,152,219,0.20)',\n\t];\n</script>\n\n<div class=\"fixed inset-0 -z-10 pointer-events-none\" aria-hidden=\"true\">\n\t<TinyVectors\n\t\ttheme=\"custom\"\n\t\tcolors={colors}\n\t\tblobCount={5}\n\t\topacity={0.4}\n\t\tenableScrollPhysics={true}\n\t\tenableDeviceMotion={false}\n\t/>\n</div>
\n

Entry Points

\n

The package exports these public entry points:

\n
    \n
  • @tummycrypt/tinyvectors
    • \n
  • @tummycrypt/tinyvectors/core
    • \n
  • @tummycrypt/tinyvectors/motion
    • \n
  • @tummycrypt/tinyvectors/themes
    • \n
  • @tummycrypt/tinyvectors/themes/css
    • \n
  • @tummycrypt/tinyvectors/svelte
    • \n
\n

Use the top-level entry point when you just want the packaged component surface. Reach for the lower-level paths if you are composing your own vector layer, motion handling, or theme primitives.

\n

Local Development

\n
pnpm install\npnpm check\npnpm test\npnpm build
\n

Useful extra commands:

\n
    \n
  • pnpm dev runs the local Vite demo app
    • \n
  • pnpm dev:watch rebuilds the library on change
    • \n
  • pnpm test:pbt runs the property-based invariants only
    • \n
  • pnpm check:release-metadata verifies package.json, BUILD.bazel, and MODULE.bazel stay aligned
    • \n
  • pnpm check:package runs publint
    • \n
\n

Release Truth

\n

The supported consumer path today is the published npm package.

\n

This repo also carries Bazel metadata because the broader package ecosystem around it uses Bazel package targets and registry generation. That standalone Bazel surface is being tightened up, but the release metadata in this repo is expected to stay aligned with the published package either way.

\n

License

\n

This repository is distributed under the zlib/libpng license. See LICENSE.

\n
", "readme_excerpt": "Animated vector blob backgrounds with lil physics for Svelte 5.\nThis package is what powers the moving background layer on transscendsurvival.org, but it is meant to be useful outside that site too. It ships a small set of Svelte components plus the lower-level motion, theme, and core utilities that drive them.\nbash\npnpm add @tummycrypt/tinyvectors\nPeer dependency:\n- svelte@^5\nsvelte\n