@bike4mind/cli 0.18.3 → 0.18.5

package/dist/{utils-fqhJmuB8.mjs → utils-Cdktpk_k.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { timingSafeEqual } from "crypto";
+import { createHash, timingSafeEqual } from "crypto";
 import speakeasy from "speakeasy";
 import QRCode from "qrcode";
 //#region ../../b4m-core/auth/dist/mfaService/utils.mjs
@@ -35,8 +35,18 @@ function verifyTOTPToken(secret, token, window = 1) {
 	});
 }
 /**
-* Generate cryptographically secure backup codes for MFA
-* Using speakeasy's secure random generation to be consistent with TOTP secrets
+* Hash a backup code for at-rest storage.
+* Codes are high-entropy random strings (speakeasy base32, ~50 bits), so a
+* fast SHA-256 is appropriate — no dictionary attack risk, and the migration
+* backfill over thousands of users stays instantaneous.
+*/
+function hashBackupCode(code) {
+	return createHash("sha256").update(code.trim().toUpperCase()).digest("hex");
+}
+/**
+* Generate cryptographically secure backup codes for MFA.
+* Returns plaintext codes for display to the user; callers are responsible for
+* hashing them (via hashBackupCode) before storing in the database.
 */
 function generateBackupCodes(count = 10) {
 	return Array.from({ length: count }, () => {
@@ -44,15 +54,17 @@ function generateBackupCodes(count = 10) {
 	});
 }
 /**
-* Verify a backup code against the user's backup codes
+* Verify a backup code against stored hashes.
+* Hashes the provided code and compares against stored SHA-256 hashes using
+* constant-time comparison to prevent timing attacks.
 */
 function verifyBackupCode(userBackupCodes, providedCode) {
 	if (!userBackupCodes || !providedCode) return { isValid: false };
-	const cleanProvidedCode = providedCode.trim().toUpperCase();
-	const providedBuf = Buffer.from(cleanProvidedCode, "utf8");
+	const providedHash = hashBackupCode(providedCode);
+	const providedBuf = Buffer.from(providedHash, "utf8");
 	let matchIdx = -1;
 	for (let i = 0; i < userBackupCodes.length; i++) {
-		const storedBuf = Buffer.from(userBackupCodes[i].trim().toUpperCase(), "utf8");
+		const storedBuf = Buffer.from(userBackupCodes[i], "utf8");
 		if (storedBuf.length === providedBuf.length && timingSafeEqual(storedBuf, providedBuf)) {
 			matchIdx = i;
 			break;
@@ -75,7 +87,7 @@ function userRequiresMFA(user, enforceMFASetting) {
 * Check if a user has MFA configured
 */
 function userHasMFAConfigured(user) {
-	return !!(user.mfa && user.mfa.totpEnabled && user.mfa.totpSecret);
+	return !!(user.mfa && user.mfa.totpEnabled);
 }
 /**
 * Server-side attempt tracking to prevent bypass via refresh/cancel
@@ -143,4 +155,4 @@ function userCanDisableMFA(user, enforceMFASetting) {
 	return !enforceMFASetting;
 }
 //#endregion
-export { isUserLockedOut as a, userCanDisableMFA as c, userRequiresMFA as d, verifyBackupCode as f, getLockoutTimeRemaining as i, userEligibleForMFA as l, generateBackupCodes as n, recordFailedAttempt as o, verifyTOTPToken as p, generateTOTPSetup as r, shouldResetFailedAttempts as s, clearFailedAttempts as t, userHasMFAConfigured as u };
+export { hashBackupCode as a, shouldResetFailedAttempts as c, userHasMFAConfigured as d, userRequiresMFA as f, getLockoutTimeRemaining as i, userCanDisableMFA as l, verifyTOTPToken as m, generateBackupCodes as n, isUserLockedOut as o, verifyBackupCode as p, generateTOTPSetup as r, recordFailedAttempt as s, clearFailedAttempts as t, userEligibleForMFA as u };

package/dist/utils-DEizxshI.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { m as verifyTOTPToken } from "./utils-Cdktpk_k.mjs";
+export { verifyTOTPToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bike4mind/cli",
-  "version": "0.18.3",
+  "version": "0.18.5",
   "type": "module",
   "description": "Interactive CLI tool for Bike4Mind with ReAct agents",
   "license": "UNLICENSED",
@@ -96,7 +96,7 @@
     "tree-sitter-wasms": "^0.1.13",
     "turndown": "^7.2.4",
     "undici": "^7.28.0",
-    "unpdf": "^0.10.0",
+    "unpdf": "^1.6.2",
     "uuid": "^13.0.2",
     "voyageai": "^0.4.0",
     "web-tree-sitter": "0.25.10",
@@ -107,8 +107,8 @@
     "zod": "^4.4.3",
     "zod-validation-error": "^5.0.0",
     "zustand": "^5.0.13",
-    "@bike4mind/fab-pipeline": "0.4.7",
-    "@bike4mind/llm-adapters": "0.8.0",
+    "@bike4mind/fab-pipeline": "0.5.0",
+    "@bike4mind/llm-adapters": "0.9.1",
     "@bike4mind/observability": "0.2.0"
   },
   "devDependencies": {
@@ -124,11 +124,11 @@
     "tsx": "^4.22.3",
     "typescript": "^5.9.3",
     "vitest": "^4.1.9",
-    "@bike4mind/agents": "0.18.1",
-    "@bike4mind/common": "2.118.1",
-    "@bike4mind/mcp": "1.40.1",
-    "@bike4mind/services": "2.102.0",
-    "@bike4mind/utils": "2.26.1"
+    "@bike4mind/common": "2.120.0",
+    "@bike4mind/agents": "0.18.3",
+    "@bike4mind/mcp": "1.40.3",
+    "@bike4mind/services": "2.104.0",
+    "@bike4mind/utils": "2.28.0"
   },
   "optionalDependencies": {
     "@vscode/ripgrep": "^1.18.0"

package/dist/utils-CLjLKvqQ.mjs

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import { p as verifyTOTPToken } from "./utils-fqhJmuB8.mjs";
-export { verifyTOTPToken };