@chfischerx/puttry 0.1.0

package/dist-server/cli.js

@@ -0,0 +1,1750 @@
+#!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/server/logger.ts
+import winston from "winston";
+function getLogger() {
+  if (logger) return logger;
+  const level = process.env.VERBOSE === "1" || process.env.VERBOSE === "true" ? "debug" : "info";
+  const fmt = printf(
+    ({ level: level2, message, timestamp: timestamp2 }) => `${timestamp2} [${level2}] ${message}`
+  );
+  logger = winston.createLogger({
+    level,
+    format: combine(timestamp({ format: "YYYY-MM-DD HH:mm:ss" }), fmt),
+    transports: [new winston.transports.Console()]
+  });
+  if (level === "debug") {
+    logger.debug("[logger] Debug level logging ENABLED");
+  }
+  return logger;
+}
+var combine, timestamp, printf, logger, logger_default;
+var init_logger = __esm({
+  "src/server/logger.ts"() {
+    ({ combine, timestamp, printf } = winston.format);
+    logger = null;
+    logger_default = new Proxy(
+      {},
+      {
+        get(_target, prop) {
+          return getLogger()[prop];
+        }
+      }
+    );
+  }
+});
+
+// src/server/settings-api.ts
+var settings_api_exports = {};
+__export(settings_api_exports, {
+  SETTINGS_REGISTRY: () => SETTINGS_REGISTRY,
+  config: () => config,
+  getEnvFilePath: () => getEnvFilePath,
+  initializeConfig: () => initializeConfig,
+  parseEnvFile: () => parseEnvFile,
+  updateSetting: () => updateSetting,
+  writeEnvFile: () => writeEnvFile
+});
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+function getEnvFilePath() {
+  const localPath = join(import.meta.dirname, "../../.env.local");
+  if (existsSync(localPath)) {
+    return localPath;
+  }
+  return join(homedir(), ".puttry", ".env");
+}
+function parseEnvFile(filePath) {
+  if (!existsSync(filePath)) {
+    return {};
+  }
+  const content = readFileSync(filePath, "utf-8");
+  const result = {};
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed && !trimmed.startsWith("#")) {
+      const [key, ...valueParts] = trimmed.split("=");
+      if (key) {
+        result[key] = valueParts.join("=");
+      }
+    }
+  }
+  return result;
+}
+function writeEnvFile(filePath, data) {
+  const lines = Object.entries(data).map(([key, value]) => `${key}=${value}`).join("\n");
+  writeFileSync(filePath, lines + "\n", "utf-8");
+}
+function initializeConfig() {
+  config.AUTH_DISABLED = process.env.AUTH_DISABLED === "1" || process.env.AUTH_DISABLED === "true";
+  config.SHOW_AUTH_DISABLED_WARNING = process.env.SHOW_AUTH_DISABLED_WARNING === "1" || process.env.SHOW_AUTH_DISABLED_WARNING === "true";
+  config.TOTP_ENABLED = process.env.TOTP_ENABLED === "1" || process.env.TOTP_ENABLED === "true";
+  config.SESSION_PASSWORD_TYPE = process.env.SESSION_PASSWORD_TYPE ?? "xkcd";
+  config.SESSION_PASSWORD_LENGTH = Number(process.env.SESSION_PASSWORD_LENGTH ?? 4);
+  config.LOG_SESSION_PASSWORD = process.env.LOG_SESSION_PASSWORD !== "0";
+  config.PASSKEY_RP_ORIGIN = process.env.PASSKEY_RP_ORIGIN ?? "";
+  config.RATE_LIMIT_GLOBAL_MAX = Number(process.env.RATE_LIMIT_GLOBAL_MAX ?? 500);
+  config.RATE_LIMIT_SESSION_PASSWORD_MAX = Number(process.env.RATE_LIMIT_SESSION_PASSWORD_MAX ?? 10);
+  config.SCROLLBACK_LINES = Number(process.env.SCROLLBACK_LINES ?? 1e4);
+}
+function updateSetting(key, value) {
+  if (!(key in config)) {
+    return { success: false, error: `Unknown setting: ${key}` };
+  }
+  const configKey = key;
+  const metadata = SETTINGS_REGISTRY[configKey];
+  if (!metadata) {
+    return { success: false, error: `Setting not registered: ${key}` };
+  }
+  let convertedValue = value;
+  if (metadata.type === "boolean") {
+    convertedValue = value === "true" || value === "1" ? true : false;
+  } else if (metadata.type === "number") {
+    convertedValue = Number(value);
+    if (isNaN(convertedValue)) {
+      return { success: false, error: `Invalid number for ${key}` };
+    }
+  } else if (metadata.type === "enum" && "values" in metadata) {
+    const validValues = metadata.values;
+    if (!validValues.includes(value)) {
+      return { success: false, error: `Invalid value for ${key}. Must be one of: ${validValues.join(", ")}` };
+    }
+    convertedValue = value;
+  }
+  ;
+  config[configKey] = convertedValue;
+  if (metadata.type === "boolean") {
+    process.env[configKey] = convertedValue ? "1" : "0";
+  } else {
+    process.env[configKey] = String(convertedValue);
+  }
+  try {
+    const envPath = getEnvFilePath();
+    const envData = parseEnvFile(envPath);
+    envData[configKey] = process.env[configKey];
+    writeEnvFile(envPath, envData);
+    logger_default.info(`[settings] Updated ${configKey} = ${process.env[configKey]}`);
+  } catch (err) {
+    logger_default.error(`[settings] Failed to persist ${configKey}:`, err);
+    return { success: false, error: `Failed to persist setting: ${err}` };
+  }
+  return {
+    success: true,
+    requiresRestart: false,
+    note: metadata.note
+  };
+}
+var config, SETTINGS_REGISTRY;
+var init_settings_api = __esm({
+  "src/server/settings-api.ts"() {
+    init_logger();
+    config = {
+      AUTH_DISABLED: false,
+      SHOW_AUTH_DISABLED_WARNING: false,
+      TOTP_ENABLED: false,
+      SESSION_PASSWORD_TYPE: "xkcd",
+      SESSION_PASSWORD_LENGTH: 4,
+      LOG_SESSION_PASSWORD: true,
+      PASSKEY_RP_ORIGIN: "",
+      RATE_LIMIT_GLOBAL_MAX: 500,
+      RATE_LIMIT_SESSION_PASSWORD_MAX: 10,
+      SCROLLBACK_LINES: 1e4
+    };
+    SETTINGS_REGISTRY = {
+      AUTH_DISABLED: { type: "boolean", live: true, requiresRestart: false, note: "Users must reload" },
+      SHOW_AUTH_DISABLED_WARNING: { type: "boolean", live: true, requiresRestart: false },
+      TOTP_ENABLED: { type: "boolean", live: true, requiresRestart: false, note: "Affects next login attempt" },
+      SESSION_PASSWORD_TYPE: { type: "enum", values: ["xkcd", "random"], live: true, requiresRestart: false },
+      SESSION_PASSWORD_LENGTH: { type: "number", live: true, requiresRestart: false },
+      LOG_SESSION_PASSWORD: { type: "boolean", live: true, requiresRestart: false },
+      PASSKEY_RP_ORIGIN: { type: "string", live: true, requiresRestart: false },
+      RATE_LIMIT_GLOBAL_MAX: { type: "number", live: true, requiresRestart: false },
+      RATE_LIMIT_SESSION_PASSWORD_MAX: { type: "number", live: true, requiresRestart: false },
+      SCROLLBACK_LINES: { type: "number", live: true, requiresRestart: false, note: "Affects new sessions" }
+    };
+  }
+});
+
+// src/lib/password-gen.ts
+function generateXkcdPassword(wordCount = 4) {
+  const selected = [];
+  for (let i = 0; i < wordCount; i++) {
+    const idx = Math.floor(Math.random() * WORDS.length);
+    selected.push(WORDS[idx]);
+  }
+  const digit = Math.floor(Math.random() * 10);
+  return `${selected.join("-")}-${digit}`;
+}
+function generateRandomPassword(length = 16) {
+  const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+  const bytes = new Uint8Array(length);
+  crypto.getRandomValues(bytes);
+  let password = "";
+  for (let i = 0; i < length; i++) {
+    password += chars[bytes[i] % chars.length];
+  }
+  return password;
+}
+var WORDS;
+var init_password_gen = __esm({
+  "src/lib/password-gen.ts"() {
+    WORDS = [
+      "apple",
+      "baked",
+      "beach",
+      "bench",
+      "bikes",
+      "birds",
+      "black",
+      "blade",
+      "blank",
+      "blend",
+      "block",
+      "blood",
+      "blown",
+      "board",
+      "boats",
+      "books",
+      "boots",
+      "bound",
+      "boxes",
+      "bread",
+      "break",
+      "brick",
+      "bride",
+      "brief",
+      "bring",
+      "brink",
+      "broke",
+      "brown",
+      "build",
+      "built",
+      "cable",
+      "calls",
+      "cards",
+      "cargo",
+      "carol",
+      "carry",
+      "cases",
+      "catch",
+      "cause",
+      "caves",
+      "chain",
+      "chair",
+      "charm",
+      "chart",
+      "chase",
+      "cheap",
+      "check",
+      "chess",
+      "chest",
+      "chief",
+      "child",
+      "china",
+      "chose",
+      "claim",
+      "class",
+      "clean",
+      "clear",
+      "click",
+      "cliff",
+      "climb",
+      "clock",
+      "close",
+      "cloud",
+      "coach",
+      "coast",
+      "codes",
+      "coins",
+      "comet",
+      "comic",
+      "coral",
+      "cords",
+      "cores",
+      "craft",
+      "crash",
+      "cream",
+      "creek",
+      "crime",
+      "crops",
+      "cross",
+      "crowd",
+      "crown",
+      "crude",
+      "curve",
+      "cycle",
+      "daily",
+      "dance",
+      "darts",
+      "dated",
+      "deals",
+      "death",
+      "decks",
+      "delay",
+      "delta",
+      "dense",
+      "depth",
+      "derby",
+      "dials",
+      "diary",
+      "diced",
+      "diner",
+      "dirty",
+      "disco",
+      "ditch",
+      "diver",
+      "dodge",
+      "donor",
+      "doors",
+      "doubt",
+      "dough",
+      "draft",
+      "drain",
+      "drake",
+      "drank",
+      "drawn",
+      "dread",
+      "dream",
+      "dress",
+      "dried",
+      "drift",
+      "drill",
+      "drink",
+      "drive",
+      "drown",
+      "drugs",
+      "drums",
+      "drunk",
+      "ducks",
+      "dunes",
+      "eager",
+      "early",
+      "earth",
+      "easel",
+      "eaten",
+      "eater",
+      "edges",
+      "eight",
+      "elite",
+      "empty",
+      "endow",
+      "enemy",
+      "enjoy",
+      "enter",
+      "entry",
+      "epoch",
+      "equal",
+      "error",
+      "essay",
+      "ethos",
+      "event",
+      "every",
+      "exact",
+      "excel",
+      "exist",
+      "extra",
+      "fable",
+      "faced",
+      "facts",
+      "faded",
+      "fails",
+      "fairy",
+      "faith",
+      "falls",
+      "false",
+      "famed",
+      "fancy",
+      "farms",
+      "fatal",
+      "fault",
+      "fauna",
+      "favor",
+      "feast",
+      "feats",
+      "feeds",
+      "feels",
+      "fence",
+      "ferry",
+      "fetch",
+      "fever",
+      "fewer",
+      "fiber",
+      "field",
+      "fiend",
+      "fiery",
+      "fifth",
+      "fifty",
+      "fight",
+      "filed",
+      "files",
+      "fills",
+      "films",
+      "final",
+      "finds",
+      "fined",
+      "finer",
+      "fires",
+      "first",
+      "fists",
+      "fixed",
+      "flags",
+      "flame",
+      "flank",
+      "flaps",
+      "flash",
+      "flask",
+      "flats",
+      "flaws",
+      "fleas",
+      "fleet",
+      "flesh",
+      "flies",
+      "flint",
+      "float",
+      "flock",
+      "flood",
+      "floor",
+      "flour",
+      "flows",
+      "fluid",
+      "flush",
+      "foams",
+      "focal",
+      "focus",
+      "foggy",
+      "folds",
+      "folks",
+      "fonts",
+      "foods",
+      "fools",
+      "force",
+      "forge",
+      "forms",
+      "forth",
+      "forty",
+      "forum",
+      "fouls",
+      "found",
+      "fount",
+      "frame",
+      "frank",
+      "fraud",
+      "freak",
+      "fresh",
+      "fried",
+      "fries",
+      "frock",
+      "front",
+      "frost",
+      "frown",
+      "froze",
+      "fruit",
+      "fuels",
+      "fully",
+      "funds",
+      "fungi",
+      "funky",
+      "funny",
+      "fuzzy",
+      "gains",
+      "games",
+      "gangs",
+      "gates",
+      "gauge",
+      "gazed",
+      "gears",
+      "genus",
+      "ghost",
+      "giant",
+      "gifts",
+      "girls",
+      "given",
+      "gives",
+      "gland",
+      "glare",
+      "glass",
+      "glaze",
+      "gleam",
+      "glean",
+      "glide",
+      "glint",
+      "globe",
+      "gloom",
+      "glory",
+      "gloss",
+      "glove",
+      "glows",
+      "glued",
+      "gnome",
+      "goals",
+      "goats",
+      "going",
+      "golds",
+      "golfs",
+      "goose",
+      "gorge",
+      "gowns",
+      "grace",
+      "grade",
+      "graft",
+      "grain",
+      "grand",
+      "grant",
+      "grape",
+      "graph",
+      "grasp",
+      "grass",
+      "grate",
+      "grave",
+      "gravy",
+      "graze",
+      "great",
+      "greed",
+      "greek",
+      "green",
+      "greet",
+      "grief",
+      "grill",
+      "grime",
+      "grind",
+      "grins",
+      "gripe",
+      "grips",
+      "grist",
+      "grits",
+      "groan",
+      "groom",
+      "grope",
+      "gross",
+      "group",
+      "grove",
+      "growl",
+      "grown",
+      "grows",
+      "guard",
+      "guess",
+      "guest",
+      "guide",
+      "guild",
+      "guilt",
+      "guise",
+      "gulfs",
+      "gulps",
+      "gummy",
+      "gusts",
+      "gutsy",
+      "habit",
+      "hails",
+      "hairs",
+      "halts",
+      "halve",
+      "hands",
+      "handy",
+      "hangs",
+      "happy",
+      "hardy",
+      "harem",
+      "harks",
+      "harms",
+      "harps",
+      "harsh",
+      "haste",
+      "hasty",
+      "hatch",
+      "hated",
+      "hater",
+      "hauls",
+      "haunt",
+      "haven",
+      "hawks",
+      "heads",
+      "heals",
+      "heaps",
+      "heard",
+      "hears",
+      "heart",
+      "heats",
+      "heavy",
+      "hedge",
+      "heeds",
+      "heels",
+      "heirs",
+      "heist",
+      "hello",
+      "helps",
+      "hence",
+      "herbs",
+      "herds",
+      "heron",
+      "hides",
+      "highs",
+      "hiked",
+      "hiker",
+      "hikes",
+      "hills",
+      "hinds",
+      "hinge",
+      "hints",
+      "hippo",
+      "hired",
+      "hires",
+      "hitch",
+      "hoard",
+      "hoary",
+      "hobby",
+      "hoist",
+      "holds",
+      "holes",
+      "holly",
+      "homes",
+      "honed",
+      "hones",
+      "honey",
+      "honks",
+      "hoods",
+      "hoofs",
+      "hooks",
+      "hoops",
+      "hoots",
+      "hoped",
+      "hopes",
+      "horns",
+      "horse",
+      "hosed",
+      "hoses",
+      "hosts",
+      "hotly",
+      "hound",
+      "hours",
+      "house",
+      "hovel",
+      "hover",
+      "howdy",
+      "howls",
+      "hubby",
+      "huffs",
+      "hulks",
+      "hulls",
+      "human",
+      "humid",
+      "humor",
+      "humps",
+      "hunks",
+      "hunts",
+      "hurls",
+      "hurry",
+      "hurts",
+      "husks",
+      "husky",
+      "hutch",
+      "hydro",
+      "hyena",
+      "hyper",
+      "icing",
+      "icons",
+      "ideal",
+      "ideas",
+      "idiom",
+      "idiot",
+      "idles",
+      "idols",
+      "igloo",
+      "image",
+      "imbue",
+      "imply",
+      "inbox",
+      "incur",
+      "index",
+      "inept",
+      "inert",
+      "infer",
+      "infos",
+      "ingot",
+      "inlet",
+      "inner",
+      "input",
+      "inset",
+      "inter",
+      "intro",
+      "irons",
+      "irony",
+      "issue",
+      "items",
+      "itchy",
+      "ivory",
+      "jacks",
+      "jails",
+      "james",
+      "jamps",
+      "japan",
+      "jared",
+      "jarred",
+      "jawed",
+      "jazzy",
+      "jeans",
+      "jeeps",
+      "jeers",
+      "jello",
+      "jelly",
+      "jenny",
+      "jerks",
+      "jerry",
+      "jesse",
+      "jests",
+      "jetty",
+      "jewel",
+      "jiffy",
+      "jihad",
+      "jimmy",
+      "jingo",
+      "jinks",
+      "jived",
+      "jiver",
+      "jives",
+      "jocks",
+      "joeys",
+      "joins",
+      "joint",
+      "joist",
+      "joked",
+      "joker",
+      "jokes",
+      "jolly",
+      "jonah",
+      "jones",
+      "joust",
+      "jowls",
+      "joyed",
+      "judge",
+      "juice",
+      "juicy",
+      "jumbo",
+      "jumps",
+      "jumpy",
+      "junco",
+      "junks",
+      "junky",
+      "juror",
+      "kails",
+      "karma",
+      "kayak",
+      "keels",
+      "keend",
+      "keens",
+      "keeps",
+      "kefir",
+      "keira",
+      "keith",
+      "kelly",
+      "kelps",
+      "kendo",
+      "kenny",
+      "kenya",
+      "kerns",
+      "kevin",
+      "khaki",
+      "kicks",
+      "kills",
+      "kilns",
+      "kilos",
+      "kilts",
+      "kinds",
+      "kinks",
+      "kirks",
+      "kites",
+      "kiths",
+      "kitty",
+      "knack",
+      "knave",
+      "knead",
+      "kneel",
+      "knelt",
+      "knife",
+      "knits",
+      "knobs",
+      "knock",
+      "knoll",
+      "knots",
+      "known",
+      "knows",
+      "koala",
+      "kraft",
+      "krill",
+      "label",
+      "labor",
+      "laced",
+      "laces",
+      "lacks",
+      "lager",
+      "lakes",
+      "lambs",
+      "lamed",
+      "lames",
+      "lamps",
+      "lance",
+      "lands",
+      "lanes",
+      "lanky",
+      "lapse",
+      "larch",
+      "lards",
+      "large",
+      "larks",
+      "laser",
+      "lasso",
+      "latch",
+      "laths",
+      "lathe",
+      "latte",
+      "lauds",
+      "laugh",
+      "laura",
+      "laved",
+      "laves",
+      "lawns",
+      "layer",
+      "layed",
+      "layne",
+      "leads",
+      "leafs",
+      "leafy",
+      "leaks",
+      "leaky",
+      "leans",
+      "leant",
+      "leaps",
+      "learn",
+      "lease",
+      "leash",
+      "least",
+      "leapt",
+      "leave",
+      "ledge",
+      "leech",
+      "leeds",
+      "leeks",
+      "leers",
+      "leery",
+      "lefts",
+      "lefty",
+      "legal",
+      "legit",
+      "legos",
+      "lemon",
+      "lemur",
+      "lends",
+      "lenis",
+      "lenos",
+      "leper",
+      "lepus",
+      "level",
+      "lever",
+      "lewis",
+      "libra",
+      "licks",
+      "lidos",
+      "liege",
+      "liens",
+      "lifes",
+      "lifts",
+      "light",
+      "likes",
+      "lilac",
+      "limbs",
+      "limey",
+      "limit",
+      "limns",
+      "limos",
+      "linas",
+      "lined",
+      "linen",
+      "liner",
+      "lines",
+      "lingo",
+      "lings",
+      "links",
+      "linos",
+      "lints",
+      "linty",
+      "lions",
+      "lipid",
+      "lisps",
+      "lists",
+      "litas",
+      "lithe",
+      "lived",
+      "liven",
+      "liver",
+      "lives",
+      "livre",
+      "loads",
+      "loafs",
+      "loams",
+      "loamy",
+      "loans",
+      "loath",
+      "lobby",
+      "lobed",
+      "lobes",
+      "lobos",
+      "local",
+      "lochs",
+      "locks",
+      "locus",
+      "loden",
+      "lodes",
+      "lodge",
+      "lofts",
+      "lofty",
+      "logan",
+      "logas",
+      "logic",
+      "logos",
+      "logue",
+      "loins",
+      "loire",
+      "loked",
+      "loken",
+      "loken",
+      "lokey",
+      "lolas",
+      "lolly",
+      "loman",
+      "lonas",
+      "loned",
+      "loner",
+      "lones",
+      "longa",
+      "longe",
+      "longs",
+      "loona",
+      "loons",
+      "loony",
+      "loops",
+      "loopy",
+      "loose",
+      "loosh",
+      "loots",
+      "looty",
+      "loped",
+      "loper",
+      "lopes",
+      "lopey",
+      "lopht",
+      "lopia",
+      "lopin",
+      "lopko",
+      "lopod",
+      "loppa",
+      "loppy",
+      "lopsy",
+      "loral",
+      "loran",
+      "loras",
+      "lorch",
+      "lords",
+      "lordy",
+      "lorem",
+      "lorer",
+      "lores",
+      "loret",
+      "lorey",
+      "loria",
+      "lorik",
+      "loris",
+      "lorna",
+      "lorne",
+      "lorns",
+      "lorny",
+      "loro",
+      "loron",
+      "loros",
+      "lorox",
+      "lorry",
+      "lorsa",
+      "lorsi",
+      "lorsy",
+      "lorta",
+      "lorto",
+      "lorty",
+      "lorus",
+      "lorva",
+      "lorve",
+      "lorvy",
+      "lorza",
+      "losah",
+      "losak",
+      "losar",
+      "losba",
+      "losca",
+      "losda",
+      "losde",
+      "losdy",
+      "losea",
+      "loseb",
+      "losec",
+      "losed",
+      "losee",
+      "losel",
+      "losem",
+      "losen",
+      "loser",
+      "loses",
+      "loset",
+      "losev",
+      "losew",
+      "losex",
+      "losey",
+      "losez",
+      "losfa",
+      "losfd",
+      "losfe",
+      "losfh",
+      "losfi",
+      "losfk",
+      "losfl",
+      "losfm",
+      "losfn",
+      "losfo",
+      "losfp",
+      "losfq",
+      "losfr",
+      "losfs",
+      "losft",
+      "losfu",
+      "losfv",
+      "losfw",
+      "losfx",
+      "losfy",
+      "losfz"
+    ];
+  }
+});
+
+// src/server/auth-state.ts
+var auth_state_exports = {};
+__export(auth_state_exports, {
+  cleanupAuthState: () => cleanupAuthState,
+  clear2FAState: () => clear2FAState,
+  get2FAState: () => get2FAState,
+  getSessionPassword: () => getSessionPassword,
+  initAuthState: () => initAuthState,
+  on2FAStateChange: () => on2FAStateChange,
+  onPasswordRotated: () => onPasswordRotated,
+  rotateSessionPassword: () => rotateSessionPassword,
+  save2FAState: () => save2FAState
+});
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync, existsSync as existsSync2, watchFile, unlinkSync } from "node:fs";
+import { join as join2 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { EventEmitter } from "node:events";
+async function initAuthState() {
+  await authState.init();
+}
+function getSessionPassword() {
+  return authState.getSessionPassword();
+}
+function rotateSessionPassword() {
+  return authState.rotateSessionPassword();
+}
+function get2FAState() {
+  return authState.get2FAState();
+}
+function save2FAState(state) {
+  authState.save2FAState(state);
+}
+function clear2FAState() {
+  authState.clear2FAState();
+}
+function onPasswordRotated(callback) {
+  authState.onPasswordRotated(callback);
+}
+function on2FAStateChange(callback) {
+  authState.on2FAStateChange(callback);
+}
+function cleanupAuthState() {
+  authState.cleanup();
+}
+var STATE_DIR, SESSION_PASSWORD_PATH, TOTP_STATE_PATH, AuthState, authState;
+var init_auth_state = __esm({
+  "src/server/auth-state.ts"() {
+    init_password_gen();
+    init_logger();
+    STATE_DIR = join2(homedir2(), ".puttry");
+    SESSION_PASSWORD_PATH = join2(STATE_DIR, "session-password.txt");
+    TOTP_STATE_PATH = join2(STATE_DIR, "2fa-state.json");
+    AuthState = class extends EventEmitter {
+      sessionPassword = null;
+      totpState = null;
+      watchers = [];
+      async init() {
+        mkdirSync(STATE_DIR, { recursive: true });
+        this.loadSessionPassword();
+        this.loadTotpState();
+        this.watchFiles();
+      }
+      loadSessionPassword() {
+        if (existsSync2(SESSION_PASSWORD_PATH)) {
+          try {
+            this.sessionPassword = readFileSync2(SESSION_PASSWORD_PATH, "utf-8").trim();
+            logger_default.info(`[auth-state] Session password loaded from disk`);
+          } catch (err) {
+            logger_default.error(`[auth-state] Failed to load session password: ${err instanceof Error ? err.message : err}`);
+            this.generateNewSessionPassword();
+          }
+        } else {
+          this.generateNewSessionPassword();
+        }
+      }
+      generateNewSessionPassword() {
+        const type = (process.env.SESSION_PASSWORD_TYPE || "xkcd").toLowerCase();
+        const length = parseInt(process.env.SESSION_PASSWORD_LENGTH || "4", 10);
+        if (type === "random") {
+          this.sessionPassword = generateRandomPassword(length);
+        } else {
+          this.sessionPassword = generateXkcdPassword(length);
+        }
+        this.persistSessionPassword();
+        logger_default.info(`[auth-state] Generated new session password`);
+      }
+      persistSessionPassword() {
+        if (!this.sessionPassword) return;
+        try {
+          writeFileSync2(SESSION_PASSWORD_PATH, this.sessionPassword, { mode: 384 });
+        } catch (err) {
+          logger_default.error(`[auth-state] Failed to save session password: ${err instanceof Error ? err.message : err}`);
+        }
+      }
+      loadTotpState() {
+        if (existsSync2(TOTP_STATE_PATH)) {
+          try {
+            const data = readFileSync2(TOTP_STATE_PATH, "utf-8");
+            this.totpState = JSON.parse(data);
+            logger_default.info(`[auth-state] TOTP state loaded from ${TOTP_STATE_PATH}: verified=${this.totpState?.verified}`);
+          } catch (err) {
+            logger_default.error(`[auth-state] Failed to load TOTP state from ${TOTP_STATE_PATH}: ${err instanceof Error ? err.message : err}`);
+            this.totpState = null;
+          }
+        } else {
+          logger_default.info(`[auth-state] TOTP state file not found at ${TOTP_STATE_PATH}`);
+        }
+      }
+      watchFiles() {
+        watchFile(SESSION_PASSWORD_PATH, () => {
+          const oldPassword = this.sessionPassword;
+          this.loadSessionPassword();
+          if (oldPassword !== this.sessionPassword) {
+            logger_default.info(`[auth-state] Session password changed externally`);
+            this.emit("passwordRotated");
+          }
+        });
+        watchFile(TOTP_STATE_PATH, () => {
+          const oldState = this.totpState;
+          this.loadTotpState();
+          if (JSON.stringify(oldState) !== JSON.stringify(this.totpState)) {
+            logger_default.info(`[auth-state] TOTP state changed externally`);
+            this.emit("2faChanged");
+          }
+        });
+      }
+      getSessionPassword() {
+        if (!this.sessionPassword) {
+          this.generateNewSessionPassword();
+        }
+        return this.sessionPassword;
+      }
+      rotateSessionPassword() {
+        this.generateNewSessionPassword();
+        this.emit("passwordRotated");
+        return this.sessionPassword;
+      }
+      get2FAState() {
+        this.loadTotpState();
+        logger_default.info(`[auth-state] get2FAState() returning: ${this.totpState ? `verified=${this.totpState.verified}` : "null"}`);
+        return this.totpState;
+      }
+      save2FAState(state) {
+        this.totpState = state;
+        try {
+          mkdirSync(STATE_DIR, { recursive: true });
+          writeFileSync2(TOTP_STATE_PATH, JSON.stringify(state, null, 2), { mode: 384 });
+          this.emit("2faChanged");
+          logger_default.info(`[auth-state] TOTP state saved`);
+        } catch (err) {
+          logger_default.error(`[auth-state] Failed to save TOTP state: ${err instanceof Error ? err.message : err}`);
+        }
+      }
+      clear2FAState() {
+        this.totpState = null;
+        try {
+          if (existsSync2(TOTP_STATE_PATH)) {
+            unlinkSync(TOTP_STATE_PATH);
+          }
+          this.emit("2faChanged");
+          logger_default.info(`[auth-state] TOTP state cleared`);
+        } catch (err) {
+          logger_default.error(`[auth-state] Failed to clear TOTP state: ${err instanceof Error ? err.message : err}`);
+        }
+      }
+      on2FAStateChange(callback) {
+        this.on("2faChanged", callback);
+      }
+      onPasswordRotated(callback) {
+        this.on("passwordRotated", callback);
+      }
+      cleanup() {
+        this.watchers.forEach((w) => clearTimeout(w));
+        this.removeAllListeners();
+      }
+    };
+    authState = new AuthState();
+  }
+});
+
+// src/server/passkey-state.ts
+var passkey_state_exports = {};
+__export(passkey_state_exports, {
+  clearPasskeys: () => clearPasskeys,
+  deletePasskey: () => deletePasskey,
+  getPasskeyById: () => getPasskeyById,
+  getPasskeys: () => getPasskeys,
+  savePasskey: () => savePasskey
+});
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2, existsSync as existsSync3, unlinkSync as unlinkSync2 } from "node:fs";
+import { join as join3 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+function loadPasskeys() {
+  if (existsSync3(PASSKEYS_PATH)) {
+    try {
+      const data = readFileSync3(PASSKEYS_PATH, "utf-8");
+      const passkeys = JSON.parse(data);
+      logger_default.info(`[passkey-state] Loaded ${passkeys.length} passkeys from disk`);
+      return passkeys;
+    } catch (err) {
+      logger_default.error(`[passkey-state] Failed to load passkeys: ${err instanceof Error ? err.message : err}`);
+      return [];
+    }
+  }
+  return [];
+}
+function savePasskeys(passkeys) {
+  try {
+    mkdirSync2(STATE_DIR2, { recursive: true });
+    writeFileSync3(PASSKEYS_PATH, JSON.stringify(passkeys, null, 2), { mode: 384 });
+    logger_default.info(`[passkey-state] Saved ${passkeys.length} passkeys to disk`);
+  } catch (err) {
+    logger_default.error(`[passkey-state] Failed to save passkeys: ${err instanceof Error ? err.message : err}`);
+  }
+}
+function getPasskeys() {
+  return loadPasskeys();
+}
+function savePasskey(cred) {
+  const passkeys = loadPasskeys();
+  const existingIndex = passkeys.findIndex((p) => p.id === cred.id);
+  if (existingIndex >= 0) {
+    passkeys[existingIndex] = cred;
+  } else {
+    passkeys.push(cred);
+  }
+  savePasskeys(passkeys);
+}
+function deletePasskey(id) {
+  const passkeys = loadPasskeys();
+  const filtered = passkeys.filter((p) => p.id !== id);
+  savePasskeys(filtered);
+  logger_default.info(`[passkey-state] Deleted passkey ${id.slice(0, 8)}...`);
+}
+function getPasskeyById(id) {
+  const passkeys = loadPasskeys();
+  return passkeys.find((p) => p.id === id) ?? null;
+}
+function clearPasskeys() {
+  try {
+    if (existsSync3(PASSKEYS_PATH)) {
+      unlinkSync2(PASSKEYS_PATH);
+    }
+    logger_default.info(`[passkey-state] All passkeys cleared`);
+  } catch (err) {
+    logger_default.error(`[passkey-state] Failed to clear passkeys: ${err instanceof Error ? err.message : err}`);
+  }
+}
+var STATE_DIR2, PASSKEYS_PATH;
+var init_passkey_state = __esm({
+  "src/server/passkey-state.ts"() {
+    init_logger();
+    STATE_DIR2 = join3(homedir3(), ".puttry");
+    PASSKEYS_PATH = join3(STATE_DIR2, "passkeys.json");
+  }
+});
+
+// src/server/cli.ts
+import { spawn } from "node:child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync4, unlinkSync as unlinkSync3 } from "node:fs";
+import { join as join4 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { setTimeout as setTimeoutPromise } from "node:timers/promises";
+var PID_DIR = join4(homedir4(), ".puttry");
+var PID_PATH = join4(PID_DIR, "server.pid");
+function loadEnvFiles() {
+  const envPaths = [
+    join4(import.meta.dirname, "../../.env.local"),
+    join4(homedir4(), ".puttry", ".env")
+  ];
+  for (const envPath of envPaths) {
+    if (existsSync4(envPath)) {
+      try {
+        const envContent = readFileSync4(envPath, "utf-8");
+        const lines = envContent.split("\n");
+        for (const line of lines) {
+          const trimmed = line.trim();
+          if (trimmed && !trimmed.startsWith("#")) {
+            const [key, ...valueParts] = trimmed.split("=");
+            const value = valueParts.join("=");
+            if (key && !process.env[key]) {
+              process.env[key] = value;
+            }
+          }
+        }
+      } catch {
+      }
+    }
+  }
+}
+function printHelp() {
+  console.log(`
+Usage: puttry <command>
+
+Commands:
+  start               Start the server in the background
+  stop                Stop the running server
+  restart             Restart the server
+  status              Show server status
+
+  password            Show the current session password
+  password show       Show the current session password
+  password rotate     Rotate to a new session password
+
+  totp reset          Clear TOTP configuration
+  passkey list        List registered passkeys
+  passkey reset       Clear all registered passkeys
+
+  configure           Interactive configuration wizard
+  config list         List all configuration values
+  config set KEY VAL  Update a configuration value
+
+  help                Show this help message
+`);
+}
+async function startServer() {
+  const serverPath = join4(import.meta.dirname, "server.js");
+  if (!existsSync4(serverPath)) {
+    console.error(`Error: Server not found at ${serverPath}`);
+    console.error("Run 'npm run build:server' to compile the server.");
+    process.exit(1);
+  }
+  if (existsSync4(PID_PATH)) {
+    const pidContent = readFileSync4(PID_PATH, "utf-8").trim();
+    const pid = parseInt(pidContent);
+    try {
+      process.kill(pid, 0);
+      console.log(`Server is already running (PID: ${pid})`);
+      return;
+    } catch {
+      try {
+        unlinkSync3(PID_PATH);
+      } catch {
+      }
+    }
+  }
+  const child = spawn(process.execPath, [serverPath], {
+    detached: true,
+    stdio: "ignore",
+    env: { ...process.env }
+  });
+  child.unref();
+  await setTimeoutPromise(1e3);
+  const passwordPath = join4(PID_DIR, "session-password.txt");
+  let attempts = 0;
+  while (attempts < 10) {
+    if (existsSync4(passwordPath)) {
+      try {
+        const password = readFileSync4(passwordPath, "utf-8").trim();
+        const port = process.env.PORT || "5174";
+        const host = process.env.HOST || "localhost";
+        console.log("");
+        console.log("\u2713 Server started successfully");
+        console.log("");
+        console.log("\u2500\u2500\u2500 Session Password \u2500\u2500\u2500");
+        console.log(password);
+        console.log("");
+        console.log("\u2500\u2500\u2500 Direct Link \u2500\u2500\u2500");
+        console.log(`http://${host}:${port}/`);
+        console.log("");
+        const envLocal = join4(import.meta.dirname, "../../.env.local");
+        const envUser = join4(homedir4(), ".puttry", ".env");
+        const isFirstRun = !existsSync4(envLocal) && !existsSync4(envUser);
+        if (isFirstRun) {
+          console.log("\u2139  Running with default settings. Use 'puttry config list' to view or 'puttry config set KEY VALUE' to change.");
+          console.log("");
+        }
+        return;
+      } catch {
+      }
+    }
+    await setTimeoutPromise(100);
+    attempts++;
+  }
+  console.log("\u2713 Server started (password file not yet available)");
+}
+async function stopServer() {
+  if (!existsSync4(PID_PATH)) {
+    console.log("Server is not running");
+    return;
+  }
+  try {
+    const pidContent = readFileSync4(PID_PATH, "utf-8").trim();
+    const pid = parseInt(pidContent);
+    try {
+      process.kill(pid, 0);
+    } catch {
+      console.log("Server is not running (stale PID file)");
+      unlinkSync3(PID_PATH);
+      return;
+    }
+    process.kill(pid, "SIGTERM");
+    try {
+      unlinkSync3(PID_PATH);
+    } catch {
+    }
+    console.log(`Stopped server (PID: ${pid})`);
+  } catch (err) {
+    console.error(`Failed to stop server: ${err instanceof Error ? err.message : err}`);
+    process.exit(1);
+  }
+}
+async function restartServer() {
+  if (existsSync4(PID_PATH)) {
+    await stopServer();
+    await setTimeoutPromise(500);
+  }
+  await startServer();
+}
+async function statusServer() {
+  if (!existsSync4(PID_PATH)) {
+    console.log("Server is stopped");
+    return;
+  }
+  try {
+    const pidContent = readFileSync4(PID_PATH, "utf-8").trim();
+    const pid = parseInt(pidContent);
+    try {
+      process.kill(pid, 0);
+      const port = process.env.PORT || "5174";
+      console.log(`Server is running (PID: ${pid}, http://localhost:${port})`);
+      return;
+    } catch {
+      console.log("Server is stopped (stale PID file)");
+      unlinkSync3(PID_PATH);
+    }
+  } catch (err) {
+    console.error(`Failed to check status: ${err instanceof Error ? err.message : err}`);
+    process.exit(1);
+  }
+}
+async function showPassword() {
+  loadEnvFiles();
+  const { initializeConfig: initializeConfig2 } = await Promise.resolve().then(() => (init_settings_api(), settings_api_exports));
+  const { initAuthState: initAuthState2, getSessionPassword: getSessionPassword2 } = await Promise.resolve().then(() => (init_auth_state(), auth_state_exports));
+  initializeConfig2();
+  await initAuthState2();
+  const password = getSessionPassword2();
+  const port = process.env.PORT || "5174";
+  const host = process.env.HOST || "localhost";
+  console.log("");
+  console.log("\u2500\u2500\u2500 Session Password \u2500\u2500\u2500");
+  console.log(password);
+  console.log("");
+  console.log("\u2500\u2500\u2500 Direct Link \u2500\u2500\u2500");
+  console.log(`http://${host}:${port}/`);
+  console.log("");
+}
+async function rotatePassword() {
+  loadEnvFiles();
+  const { initializeConfig: initializeConfig2 } = await Promise.resolve().then(() => (init_settings_api(), settings_api_exports));
+  const { initAuthState: initAuthState2, rotateSessionPassword: rotateSessionPassword2 } = await Promise.resolve().then(() => (init_auth_state(), auth_state_exports));
+  initializeConfig2();
+  await initAuthState2();
+  const newPassword = rotateSessionPassword2();
+  console.log("");
+  console.log("\u2713 Password rotated successfully!");
+  console.log("");
+  console.log("\u2500\u2500\u2500 New Session Password \u2500\u2500\u2500");
+  console.log(newPassword);
+  console.log("");
+  console.log("If the server is running, it will automatically invalidate all existing sessions.");
+  console.log("Users will need to log in again with the new password.");
+  console.log("");
+}
+async function listConfig() {
+  loadEnvFiles();
+  const { initializeConfig: initializeConfig2, config: config2 } = await Promise.resolve().then(() => (init_settings_api(), settings_api_exports));
+  initializeConfig2();
+  console.log("");
+  console.log("\u2500\u2500\u2500 Configuration \u2500\u2500\u2500");
+  for (const [key, value] of Object.entries(config2)) {
+    console.log(`${key}=${value}`);
+  }
+  console.log("");
+}
+async function setConfig(key, value) {
+  loadEnvFiles();
+  const { initializeConfig: initializeConfig2, updateSetting: updateSetting2 } = await Promise.resolve().then(() => (init_settings_api(), settings_api_exports));
+  initializeConfig2();
+  const result = updateSetting2(key, value);
+  if (!result.success) {
+    console.error(`Error: ${result.error}`);
+    process.exit(1);
+  }
+  console.log(`\u2713 Updated ${key}=${value}`);
+  if (result.note) {
+    console.log(`  Note: ${result.note}`);
+  }
+}
+async function runConfigureWizard() {
+  loadEnvFiles();
+  const { getEnvFilePath: getEnvFilePath2, parseEnvFile: parseEnvFile2, writeEnvFile: writeEnvFile2 } = await Promise.resolve().then(() => (init_settings_api(), settings_api_exports));
+  const readline = await import("node:readline");
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const ask = (question) => new Promise((resolve) => rl.question(question, resolve));
+  const envPath = getEnvFilePath2();
+  const current = parseEnvFile2(envPath);
+  const changes = {};
+  function currentDisplay(key, defaultVal) {
+    return current[key] !== void 0 ? `${current[key]}` : `${defaultVal} (default)`;
+  }
+  async function promptSetting(key, description, defaultVal, type, enumValues) {
+    const display = currentDisplay(key, defaultVal);
+    console.log(`
+${key}`);
+    console.log(`  ${description}`);
+    console.log(`  Current value: ${display}`);
+    let input = await ask("> ");
+    if (input.trim() === "") {
+      return;
+    }
+    let normalized = input.trim();
+    if (type === "boolean") {
+      const lower = normalized.toLowerCase();
+      if (["true", "yes", "y", "1"].includes(lower)) {
+        normalized = "true";
+      } else if (["false", "no", "n", "0"].includes(lower)) {
+        normalized = "false";
+      } else {
+        console.log(`  Invalid boolean value. Use true/false, yes/no, y/n, or 1/0.`);
+        return;
+      }
+    }
+    if (type === "enum" && enumValues && !enumValues.includes(normalized)) {
+      console.log(`  Invalid value. Must be one of: ${enumValues.join(", ")}`);
+      return;
+    }
+    if (type === "number" && isNaN(Number(normalized))) {
+      console.log(`  Invalid number.`);
+      return;
+    }
+    if (current[key] !== normalized) {
+      changes[key] = normalized;
+    }
+  }
+  console.log("\nWelcome to PuTTrY configuration. Press Enter to keep the current value.\n");
+  console.log("\u2500\u2500\u2500 Network \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  await promptSetting("PORT", "HTTP port the server listens on", "5174", "number");
+  await promptSetting("HOST", "Network interface to bind to (0.0.0.0 = all interfaces, 127.0.0.1 = localhost only)", "0.0.0.0", "string");
+  console.log("\n\u2500\u2500\u2500 Authentication \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  await promptSetting(
+    "AUTH_DISABLED",
+    "Disable password authentication. Anyone with the URL can access the terminal. Not recommended for remote access. (true/false)",
+    "false",
+    "boolean"
+  );
+  const authDisabled = changes["AUTH_DISABLED"] === "true" || changes["AUTH_DISABLED"] === void 0 && (current["AUTH_DISABLED"] === "true" || current["AUTH_DISABLED"] === "1");
+  await promptSetting(
+    "SESSION_PASSWORD_TYPE",
+    `Password style: 'xkcd' = memorable word phrase (e.g. "correct horse battery staple"), 'random' = hex string`,
+    "xkcd",
+    "enum",
+    ["xkcd", "random"]
+  );
+  await promptSetting("SESSION_PASSWORD_LENGTH", "Number of words (xkcd) or characters (random) in the session password", "4", "number");
+  await promptSetting("LOG_SESSION_PASSWORD", "Print the session password to the console on server start (true/false)", "true", "boolean");
+  await promptSetting(
+    "TOTP_ENABLED",
+    "Require a TOTP code (authenticator app / 2FA) in addition to the session password (true/false)",
+    "false",
+    "boolean"
+  );
+  await promptSetting(
+    "PASSKEY_RP_ORIGIN",
+    "WebAuthn passkey origin, e.g. https://example.com \u2014 required for passkey login from a custom domain",
+    "",
+    "string"
+  );
+  if (!authDisabled) {
+    console.log("\n\u2500\u2500\u2500 Rate Limiting \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+    await promptSetting("RATE_LIMIT_GLOBAL_MAX", "Max HTTP requests per 15 minutes per IP", "500", "number");
+    await promptSetting("RATE_LIMIT_SESSION_PASSWORD_MAX", "Max login attempts per hour per IP", "10", "number");
+  }
+  console.log("\n\u2500\u2500\u2500 Terminal \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  await promptSetting("SCROLLBACK_LINES", "Terminal scrollback buffer \u2014 lines kept in memory per session", "10000", "number");
+  if (Object.keys(changes).length === 0) {
+    rl.close();
+    console.log("\nNo changes made. Configuration unchanged.");
+    return;
+  }
+  console.log("\n\u2500\u2500\u2500 Summary \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  console.log("Changes to apply:");
+  for (const [k, v] of Object.entries(changes)) {
+    console.log(`  ${k}=${v}`);
+  }
+  const confirm = await ask("\nApply changes? (y/N): ");
+  rl.close();
+  if (confirm.trim().toLowerCase() !== "y") {
+    console.log("Cancelled.");
+    return;
+  }
+  const merged = { ...current, ...changes };
+  writeEnvFile2(envPath, merged);
+  console.log("\n\u2713 Configuration saved.");
+}
+async function resetTotp() {
+  loadEnvFiles();
+  const { clear2FAState: clear2FAState2 } = await Promise.resolve().then(() => (init_auth_state(), auth_state_exports));
+  clear2FAState2();
+  console.log("\u2713 TOTP configuration cleared.");
+  console.log("  Users will need to re-scan the QR code on their next login to set up 2FA again.");
+}
+async function listPasskeys() {
+  const { getPasskeys: getPasskeys2 } = await Promise.resolve().then(() => (init_passkey_state(), passkey_state_exports));
+  const passkeys = getPasskeys2();
+  if (passkeys.length === 0) {
+    console.log("No passkeys registered.");
+    return;
+  }
+  console.log("");
+  console.log("\u2500\u2500\u2500 Registered Passkeys \u2500\u2500\u2500");
+  for (const pk of passkeys) {
+    const registeredDate = new Date(pk.registeredAt).toLocaleDateString();
+    console.log(`  \u2022 ${pk.name} (${registeredDate})`);
+    console.log(`    ID: ${pk.id.slice(0, 16)}...`);
+  }
+  console.log("");
+}
+async function resetPasskeys() {
+  const { getPasskeys: getPasskeys2, clearPasskeys: clearPasskeys2 } = await Promise.resolve().then(() => (init_passkey_state(), passkey_state_exports));
+  const passkeys = getPasskeys2();
+  if (passkeys.length === 0) {
+    console.log("No passkeys registered.");
+    return;
+  }
+  clearPasskeys2();
+  console.log(`\u2713 Cleared ${passkeys.length} passkey(s).`);
+  console.log("  Users will need to register a new passkey on their next login.");
+}
+async function main() {
+  const args = process.argv.slice(2);
+  if (args.length === 0) {
+    printHelp();
+    return;
+  }
+  const command = args[0];
+  try {
+    switch (command) {
+      case "help":
+        printHelp();
+        break;
+      case "start":
+        await startServer();
+        break;
+      case "stop":
+        await stopServer();
+        break;
+      case "restart":
+        await restartServer();
+        break;
+      case "status":
+        await statusServer();
+        break;
+      case "password":
+        if (args[1] === "show" || args.length === 1) {
+          await showPassword();
+        } else if (args[1] === "rotate") {
+          await rotatePassword();
+        } else {
+          console.error(`Unknown password command: ${args[1]}`);
+          printHelp();
+          process.exit(1);
+        }
+        break;
+      case "configure":
+        await runConfigureWizard();
+        break;
+      case "config":
+        if (args[1] === "list") {
+          await listConfig();
+        } else if (args[1] === "set") {
+          if (args.length < 4) {
+            console.error("Usage: puttry config set KEY VALUE");
+            process.exit(1);
+          }
+          await setConfig(args[2], args[3]);
+        } else {
+          console.error(`Unknown config command: ${args[1]}`);
+          printHelp();
+          process.exit(1);
+        }
+        break;
+      case "totp":
+        if (args[1] === "reset") {
+          await resetTotp();
+        } else {
+          console.error(`Unknown totp command: ${args[1]}`);
+          printHelp();
+          process.exit(1);
+        }
+        break;
+      case "passkey":
+        if (args[1] === "list") {
+          await listPasskeys();
+        } else if (args[1] === "reset") {
+          await resetPasskeys();
+        } else {
+          console.error(`Unknown passkey command: ${args[1]}`);
+          printHelp();
+          process.exit(1);
+        }
+        break;
+      default:
+        console.error(`Unknown command: ${command}`);
+        printHelp();
+        process.exit(1);
+    }
+  } catch (err) {
+    console.error(`Error: ${err instanceof Error ? err.message : err}`);
+    process.exit(1);
+  }
+}
+main().catch((err) => {
+  console.error(`Fatal error: ${err instanceof Error ? err.message : err}`);
+  process.exit(1);
+});