@duffcloudservices/cli 0.3.1 → 0.3.3

package/dist/index.js

@@ -5,7 +5,7 @@ import { Command } from "commander";
 import chalk8 from "chalk";
 
 // package.json
-var version = "0.3.1";
+var version = "0.3.3";
 
 // src/commands/auth.ts
 import chalk2 from "chalk";
@@ -17,64 +17,375 @@ import chalk from "chalk";
 
 // src/auth/credentials.ts
 import Conf from "conf";
-var config = new Conf({
-  projectName: "dcs-cli",
-  schema: {
-    auth: {
-      type: "object",
-      properties: {
-        accessToken: { type: "string" },
-        refreshToken: { type: "string" },
-        expiresAt: { type: "number" },
-        email: { type: "string" },
-        userId: { type: "string" }
+
+// src/auth/keychain/run.ts
+import { spawnSync } from "child_process";
+function run(cmd, args, opts = {}) {
+  const options = {
+    encoding: "utf8",
+    env: opts.env ? { ...process.env, ...opts.env } : process.env,
+    windowsHide: true
+  };
+  if (opts.input !== void 0) options.input = opts.input;
+  const res = spawnSync(cmd, args, options);
+  if (res.error) {
+    return { ok: false, code: null, stdout: "", stderr: String(res.error), spawnError: true };
+  }
+  return {
+    ok: res.status === 0,
+    code: res.status,
+    stdout: typeof res.stdout === "string" ? res.stdout : "",
+    stderr: typeof res.stderr === "string" ? res.stderr : "",
+    spawnError: false
+  };
+}
+function commandExists(cmd, probeArgs) {
+  const res = run(cmd, probeArgs);
+  return !res.spawnError;
+}
+
+// src/auth/keychain/types.ts
+var SERVICE = "dcs-cli";
+
+// src/auth/keychain/macos.ts
+var macosKeychain = {
+  name: "macos-keychain",
+  isAvailable() {
+    return process.platform === "darwin" && commandExists("security", ["help"]);
+  },
+  get(account) {
+    const res = run("security", [
+      "find-generic-password",
+      "-s",
+      SERVICE,
+      "-a",
+      account,
+      "-w"
+    ]);
+    if (!res.ok) return null;
+    return res.stdout.replace(/\n$/, "");
+  },
+  set(account, secret) {
+    const res = run("security", [
+      "add-generic-password",
+      "-s",
+      SERVICE,
+      "-a",
+      account,
+      "-w",
+      secret,
+      "-U"
+    ]);
+    if (!res.ok) {
+      throw new Error(`macOS Keychain write failed: ${res.stderr.trim() || res.code}`);
+    }
+  },
+  delete(account) {
+    run("security", ["delete-generic-password", "-s", SERVICE, "-a", account]);
+  }
+};
+
+// src/auth/keychain/libsecret.ts
+var libsecretKeychain = {
+  name: "libsecret",
+  isAvailable() {
+    return process.platform === "linux" && commandExists("secret-tool", ["--version"]);
+  },
+  get(account) {
+    const res = run("secret-tool", ["lookup", "service", SERVICE, "account", account]);
+    if (!res.ok) return null;
+    return res.stdout.replace(/\n$/, "");
+  },
+  set(account, secret) {
+    const res = run(
+      "secret-tool",
+      ["store", "--label", `${SERVICE}:${account}`, "service", SERVICE, "account", account],
+      { input: secret }
+    );
+    if (!res.ok) {
+      throw new Error(`libsecret write failed: ${res.stderr.trim() || res.code}`);
+    }
+  },
+  delete(account) {
+    run("secret-tool", ["clear", "service", SERVICE, "account", account]);
+  }
+};
+
+// src/auth/keychain/windows.ts
+import fs3 from "fs";
+
+// src/auth/keychain/paths.ts
+import os from "os";
+import path from "path";
+import fs from "fs";
+var APP_DIR = "dcs-cli-nodejs";
+function configDir() {
+  const override2 = process.env.DCS_CLI_CONFIG_DIR;
+  if (override2) return override2;
+  if (process.platform === "win32") {
+    const base2 = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
+    return path.join(base2, APP_DIR);
+  }
+  if (process.platform === "darwin") {
+    return path.join(os.homedir(), "Library", "Application Support", APP_DIR);
+  }
+  const base = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config");
+  return path.join(base, APP_DIR);
+}
+function secretFile(account, ext) {
+  const safe = account.replace(/[^a-zA-Z0-9._-]/g, "_");
+  return path.join(configDir(), `${safe}.${ext}`);
+}
+function ensureConfigDir() {
+  const dir = configDir();
+  fs.mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+// src/auth/keychain/encrypted-file.ts
+import fs2 from "fs";
+import os2 from "os";
+import crypto from "crypto";
+var EXT = "enc";
+var MAGIC = "DCSK1";
+var STATIC_SALT = Buffer.from("dcs-cli-keychain-v1-salt", "utf8");
+function deriveKey() {
+  let username = "unknown";
+  try {
+    username = os2.userInfo().username;
+  } catch {
+  }
+  const material = `${username}\0${os2.hostname()}\0dcs-cli`;
+  return crypto.scryptSync(material, STATIC_SALT, 32);
+}
+var encryptedFile = {
+  name: "encrypted-file",
+  isAvailable() {
+    return true;
+  },
+  get(account) {
+    let raw;
+    try {
+      raw = fs2.readFileSync(secretFile(account, EXT), "utf8").trim();
+    } catch {
+      return null;
+    }
+    const parts = raw.split(":");
+    if (parts.length !== 4 || parts[0] !== MAGIC) return null;
+    try {
+      const iv = Buffer.from(parts[1], "base64");
+      const tag = Buffer.from(parts[2], "base64");
+      const ciphertext = Buffer.from(parts[3], "base64");
+      const decipher = crypto.createDecipheriv("aes-256-gcm", deriveKey(), iv);
+      decipher.setAuthTag(tag);
+      const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+      return plaintext.toString("utf8");
+    } catch {
+      return null;
+    }
+  },
+  set(account, secret) {
+    ensureConfigDir();
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv("aes-256-gcm", deriveKey(), iv);
+    const ciphertext = Buffer.concat([cipher.update(secret, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    const envelope = [
+      MAGIC,
+      iv.toString("base64"),
+      tag.toString("base64"),
+      ciphertext.toString("base64")
+    ].join(":");
+    fs2.writeFileSync(secretFile(account, EXT), envelope, { encoding: "utf8", mode: 384 });
+  },
+  delete(account) {
+    try {
+      fs2.unlinkSync(secretFile(account, EXT));
+    } catch {
+    }
+  }
+};
+
+// src/auth/keychain/windows.ts
+var EXT2 = "dpapi";
+var PROTECT = "$ErrorActionPreference='Stop'; Add-Type -AssemblyName System.Security; $b=[Text.Encoding]::UTF8.GetBytes($env:DCS_KEYCHAIN_SECRET); $p=[Security.Cryptography.ProtectedData]::Protect($b,$null,'CurrentUser'); [Convert]::ToBase64String($p)";
+var UNPROTECT = "$ErrorActionPreference='Stop'; Add-Type -AssemblyName System.Security; $p=[Convert]::FromBase64String($env:DCS_KEYCHAIN_ENC); $b=[Security.Cryptography.ProtectedData]::Unprotect($p,$null,'CurrentUser'); [Text.Encoding]::UTF8.GetString($b)";
+function powershell(script, env) {
+  return run("powershell", ["-NoProfile", "-NonInteractive", "-Command", script], { env });
+}
+function deleteDpapiSidecar(account) {
+  try {
+    fs3.unlinkSync(secretFile(account, EXT2));
+  } catch {
+  }
+}
+var dpapiUnavailable = false;
+var windowsDpapi = {
+  name: "windows-dpapi",
+  isAvailable() {
+    return process.platform === "win32" && !dpapiUnavailable;
+  },
+  get(account) {
+    if (dpapiUnavailable) return encryptedFile.get(account);
+    let enc;
+    try {
+      enc = fs3.readFileSync(secretFile(account, EXT2), "utf8").trim();
+    } catch {
+      return encryptedFile.get(account);
+    }
+    if (!enc) return null;
+    const res = powershell(UNPROTECT, { DCS_KEYCHAIN_ENC: enc });
+    if (!res.ok) {
+      if (res.spawnError) {
+        dpapiUnavailable = true;
+        return encryptedFile.get(account);
       }
+      return null;
+    }
+    return res.stdout.replace(/\r?\n$/, "");
+  },
+  set(account, secret) {
+    if (dpapiUnavailable) {
+      encryptedFile.set(account, secret);
+      deleteDpapiSidecar(account);
+      return;
     }
+    ensureConfigDir();
+    const res = powershell(PROTECT, { DCS_KEYCHAIN_SECRET: secret });
+    if (!res.ok || !res.stdout.trim()) {
+      dpapiUnavailable = true;
+      encryptedFile.set(account, secret);
+      deleteDpapiSidecar(account);
+      return;
+    }
+    fs3.writeFileSync(secretFile(account, EXT2), res.stdout.trim(), { encoding: "utf8", mode: 384 });
+    encryptedFile.delete(account);
+  },
+  delete(account) {
+    deleteDpapiSidecar(account);
+    encryptedFile.delete(account);
   }
-});
-function storeCredentials(credentials) {
-  config.set("auth", credentials);
+};
+
+// src/auth/keychain/index.ts
+var CANDIDATES = [macosKeychain, libsecretKeychain, windowsDpapi];
+var resolved;
+var override = null;
+function resolve() {
+  for (const backend of CANDIDATES) {
+    try {
+      if (backend.isAvailable()) return backend;
+    } catch {
+    }
+  }
+  return encryptedFile;
+}
+function getKeychain() {
+  if (override) return override;
+  if (!resolved) resolved = resolve();
+  return resolved;
+}
+
+// src/auth/credentials.ts
+var ACCOUNT = "auth";
+function defaultLegacyStore() {
+  const config = new Conf({ projectName: "dcs-cli" });
+  return {
+    read: () => config.get("auth"),
+    clear: () => {
+      if (config.has("auth")) config.delete("auth");
+    }
+  };
 }
-function getCredentials() {
-  return config.get("auth");
+var legacyStore;
+function getLegacyStore() {
+  if (!legacyStore) legacyStore = defaultLegacyStore();
+  return legacyStore;
+}
+var cache;
+function load() {
+  if (cache !== void 0) return cache;
+  const raw = getKeychain().get(ACCOUNT);
+  if (raw) {
+    try {
+      cache = JSON.parse(raw);
+      return cache;
+    } catch {
+      getKeychain().delete(ACCOUNT);
+      cache = null;
+      return cache;
+    }
+  }
+  const legacy = getLegacyStore().read();
+  if (legacy) {
+    getKeychain().set(ACCOUNT, JSON.stringify(legacy));
+    getLegacyStore().clear();
+    cache = legacy;
+    return cache;
+  }
+  cache = null;
+  return cache;
+}
+function persist(creds) {
+  getKeychain().set(ACCOUNT, JSON.stringify(creds));
+  cache = creds;
+  getLegacyStore().clear();
+}
+function storeCredentials(credentials) {
+  persist(credentials);
 }
 function clearCredentials() {
-  config.delete("auth");
+  getKeychain().delete(ACCOUNT);
+  getLegacyStore().clear();
+  cache = null;
 }
 function isAuthenticated() {
-  const creds = getCredentials();
+  const creds = load();
   if (!creds) return false;
   const bufferMs = 5 * 60 * 1e3;
   return creds.expiresAt > Date.now() + bufferMs;
 }
+function hasStoredSession() {
+  return load() !== null;
+}
 function getCurrentUserEmail() {
-  return getCredentials()?.email;
+  return load()?.email;
 }
 function getAccessToken() {
-  const creds = getCredentials();
-  if (!creds) return void 0;
-  return creds.accessToken;
+  return load()?.accessToken;
 }
 function getRefreshToken() {
-  return getCredentials()?.refreshToken;
+  return load()?.refreshToken;
 }
 function updateAccessToken(accessToken, expiresIn) {
-  const creds = getCredentials();
+  const creds = load();
   if (!creds) return;
-  config.set("auth", {
+  persist({
     ...creds,
     accessToken,
     expiresAt: Date.now() + expiresIn * 1e3
   });
 }
-function getConfigPath() {
-  return config.path;
+function getStorageBackendName() {
+  return getKeychain().name;
 }
 
 // src/auth/device-flow.ts
 var DEFAULT_API_URL = "https://portal.duffcloudservices.com";
+var RefreshTokenRevokedError = class extends Error {
+  constructor(message = "Refresh token was rejected (expired or revoked).") {
+    super(message);
+    this.name = "RefreshTokenRevokedError";
+  }
+};
+var ReauthRequiredError = class extends Error {
+  constructor(message = "Your CLI session expired or was revoked. Run `dcs login` to sign in again.") {
+    super(message);
+    this.name = "ReauthRequiredError";
+  }
+};
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 async function startDeviceAuth(options = {}) {
   const apiUrl = options.apiUrl || DEFAULT_API_URL;
@@ -201,8 +512,11 @@ async function refreshAccessToken(refreshToken, options = {}) {
     },
     body: JSON.stringify({ refresh_token: refreshToken })
   });
+  if (response.status === 401) {
+    throw new RefreshTokenRevokedError();
+  }
   if (!response.ok) {
-    throw new Error("Failed to refresh access token. Please login again.");
+    throw new Error(`Failed to refresh access token (HTTP ${response.status}).`);
   }
   const data = await response.json();
   return {
@@ -234,7 +548,7 @@ async function whoamiCommand() {
     return;
   }
   console.log("Logged in as:", chalk2.green(email));
-  console.log(chalk2.dim("Config file:"), chalk2.dim(getConfigPath()));
+  console.log(chalk2.dim("Token storage:"), chalk2.dim(getStorageBackendName()));
 }
 
 // src/commands/sites.ts
@@ -248,36 +562,59 @@ var PortalClient = class {
   constructor(options = {}) {
     this.apiUrl = options.apiUrl || process.env.DCS_API_URL || DEFAULT_API_URL2;
   }
+  /**
+   * Refresh the session using the stored refresh token. Exactly one attempt —
+   * never a retry loop. On a revoked/expired refresh token the dead local
+   * session is dropped and a clean re-auth is demanded; transient failures
+   * (network/5xx/429) keep the session and surface a retryable error.
+   */
+  async refreshSession() {
+    const refreshToken = getRefreshToken();
+    try {
+      const { accessToken: newToken, expiresIn } = await refreshAccessToken(refreshToken, {
+        apiUrl: this.apiUrl
+      });
+      updateAccessToken(newToken, expiresIn);
+      return newToken;
+    } catch (error) {
+      if (error instanceof RefreshTokenRevokedError) {
+        clearCredentials();
+        throw new ReauthRequiredError();
+      }
+      throw new Error(
+        `Could not reach the DCS Portal to refresh your session: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
   /**
    * Make an authenticated API request.
    */
-  async request(path5, options = {}) {
+  async request(path6, options = {}) {
     let accessToken = getAccessToken();
+    let refreshedThisRequest = false;
     if (!isAuthenticated() && getRefreshToken()) {
-      const refreshToken = getRefreshToken();
-      try {
-        const { accessToken: newToken, expiresIn } = await refreshAccessToken(refreshToken, {
-          apiUrl: this.apiUrl
-        });
-        updateAccessToken(newToken, expiresIn);
-        accessToken = newToken;
-      } catch {
-        throw new Error("Session expired. Please login again with `dcs login`.");
-      }
+      accessToken = await this.refreshSession();
+      refreshedThisRequest = true;
     }
     if (!accessToken) {
-      throw new Error("Not authenticated. Please login with `dcs login`.");
+      throw new ReauthRequiredError("Not authenticated. Run `dcs login` to sign in.");
     }
-    const response = await fetch(`${this.apiUrl}${path5}`, {
+    const send = (token) => fetch(`${this.apiUrl}${path6}`, {
       ...options,
       headers: {
         ...options.headers,
-        Authorization: `Bearer ${accessToken}`,
+        Authorization: `Bearer ${token}`,
         "Content-Type": "application/json"
       }
     });
+    let response = await send(accessToken);
+    if (response.status === 401 && !refreshedThisRequest && getRefreshToken()) {
+      const newToken = await this.refreshSession();
+      response = await send(newToken);
+    }
     if (response.status === 401) {
-      throw new Error("Session expired. Please login again with `dcs login`.");
+      clearCredentials();
+      throw new ReauthRequiredError();
     }
     if (!response.ok) {
       const error = await response.text();
@@ -340,7 +677,7 @@ function getPortalClient(options) {
 
 // src/commands/sites.ts
 async function listSitesCommand() {
-  if (!isAuthenticated()) {
+  if (!hasStoredSession()) {
     console.log(chalk3.yellow("Not logged in."));
     console.log("Run", chalk3.cyan("dcs login"), "to authenticate.");
     process.exit(1);
@@ -387,7 +724,7 @@ async function listSitesCommand() {
   }
 }
 async function showSiteCommand(slug) {
-  if (!isAuthenticated()) {
+  if (!hasStoredSession()) {
     console.log(chalk3.yellow("Not logged in."));
     console.log("Run", chalk3.cyan("dcs login"), "to authenticate.");
     process.exit(1);
@@ -435,8 +772,8 @@ function displaySiteDetails(site) {
 }
 
 // src/commands/init.ts
-import fs from "fs/promises";
-import path from "path";
+import fs4 from "fs/promises";
+import path2 from "path";
 import chalk4 from "chalk";
 import ora2 from "ora";
 
@@ -638,7 +975,7 @@ jobs:
 // src/commands/init.ts
 async function initCommand(options) {
   const { siteSlug, siteName, framework = "vue", target = ".", dryRun = false, force = false } = options;
-  if (!isAuthenticated()) {
+  if (!hasStoredSession()) {
     console.log(chalk4.yellow("Not logged in."));
     console.log("Run", chalk4.cyan("dcs login"), "to authenticate.");
     process.exit(1);
@@ -669,7 +1006,7 @@ async function initCommand(options) {
     }
     process.exit(1);
   }
-  const targetDir = path.resolve(target);
+  const targetDir = path2.resolve(target);
   console.log(chalk4.dim(`Target directory: ${targetDir}`));
   const generatedFiles = [];
   const timestamp = (/* @__PURE__ */ new Date()).toISOString();
@@ -721,21 +1058,21 @@ async function initCommand(options) {
   console.log();
 }
 async function writeFile(targetDir, relativePath, content, options) {
-  const fullPath = path.join(targetDir, relativePath);
+  const fullPath = path2.join(targetDir, relativePath);
   if (options.dryRun) {
     console.log(chalk4.dim(`Would create: ${relativePath}`));
     return relativePath;
   }
   try {
-    await fs.access(fullPath);
+    await fs4.access(fullPath);
     if (!options.force) {
       console.log(chalk4.yellow(`Skipped (exists): ${relativePath}`));
       return relativePath;
     }
   } catch {
   }
-  await fs.mkdir(path.dirname(fullPath), { recursive: true });
-  await fs.writeFile(fullPath, content, "utf8");
+  await fs4.mkdir(path2.dirname(fullPath), { recursive: true });
+  await fs4.writeFile(fullPath, content, "utf8");
   return relativePath;
 }
 function generateSiteYaml(data) {
@@ -1346,19 +1683,19 @@ After completing this plan:
 }
 
 // src/commands/validate.ts
-import fs2 from "fs/promises";
-import path2 from "path";
+import fs5 from "fs/promises";
+import path3 from "path";
 import chalk5 from "chalk";
 import yaml from "js-yaml";
 async function validateCommand(options) {
   const { target = ".", fix = false, verbose = false } = options;
-  const targetDir = path2.resolve(target);
-  const dcsDir = path2.join(targetDir, ".dcs");
+  const targetDir = path3.resolve(target);
+  const dcsDir = path3.join(targetDir, ".dcs");
   console.log(chalk5.bold("Validating DCS configuration..."));
   console.log(chalk5.dim(`Directory: ${targetDir}`));
   console.log();
   try {
-    await fs2.access(dcsDir);
+    await fs5.access(dcsDir);
   } catch {
     console.log(chalk5.red("No .dcs directory found."));
     console.log("Run", chalk5.cyan("dcs init"), "to create DCS configuration.");
@@ -1404,7 +1741,7 @@ async function validateCommand(options) {
   }
 }
 async function validateSiteYaml(dcsDir, verbose) {
-  const filePath = path2.join(dcsDir, "site.yaml");
+  const filePath = path3.join(dcsDir, "site.yaml");
   const result = {
     file: ".dcs/site.yaml",
     valid: true,
@@ -1412,28 +1749,28 @@ async function validateSiteYaml(dcsDir, verbose) {
     warnings: []
   };
   try {
-    const content = await fs2.readFile(filePath, "utf8");
-    const config2 = yaml.load(content);
-    if (!config2.site_name) {
+    const content = await fs5.readFile(filePath, "utf8");
+    const config = yaml.load(content);
+    if (!config.site_name) {
       result.errors.push("Missing required field: site_name");
       result.valid = false;
     }
-    if (!config2.site_slug) {
+    if (!config.site_slug) {
       result.errors.push("Missing required field: site_slug");
       result.valid = false;
-    } else if (!/^[a-z0-9-]+$/.test(config2.site_slug)) {
+    } else if (!/^[a-z0-9-]+$/.test(config.site_slug)) {
       result.errors.push("site_slug must be lowercase alphanumeric with hyphens only");
       result.valid = false;
     }
-    if (!config2.swa_resource_id) {
+    if (!config.swa_resource_id) {
       result.warnings.push("swa_resource_id is not set (required for deployment)");
     }
-    if (!config2.production_url) {
+    if (!config.production_url) {
       result.warnings.push("production_url is not set");
     }
     if (verbose) {
-      console.log(chalk5.dim(`  site_name: ${config2.site_name}`));
-      console.log(chalk5.dim(`  site_slug: ${config2.site_slug}`));
+      console.log(chalk5.dim(`  site_name: ${config.site_name}`));
+      console.log(chalk5.dim(`  site_slug: ${config.site_slug}`));
     }
   } catch (error) {
     if (error.code === "ENOENT") {
@@ -1446,7 +1783,7 @@ async function validateSiteYaml(dcsDir, verbose) {
   return result;
 }
 async function validatePagesYaml(dcsDir, verbose) {
-  const filePath = path2.join(dcsDir, "pages.yaml");
+  const filePath = path3.join(dcsDir, "pages.yaml");
   const result = {
     file: ".dcs/pages.yaml",
     valid: true,
@@ -1454,17 +1791,17 @@ async function validatePagesYaml(dcsDir, verbose) {
     warnings: []
   };
   try {
-    const content = await fs2.readFile(filePath, "utf8");
-    const config2 = yaml.load(content);
-    if (config2.version === void 0) {
+    const content = await fs5.readFile(filePath, "utf8");
+    const config = yaml.load(content);
+    if (config.version === void 0) {
       result.errors.push("Missing required field: version");
       result.valid = false;
     }
-    if (!config2.siteSlug) {
+    if (!config.siteSlug) {
       result.errors.push("Missing required field: siteSlug");
       result.valid = false;
     }
-    const pages = config2.pages;
+    const pages = config.pages;
     if (!pages || !Array.isArray(pages)) {
       result.errors.push("Missing or invalid pages array");
       result.valid = false;
@@ -1502,7 +1839,7 @@ async function validatePagesYaml(dcsDir, verbose) {
   return result;
 }
 async function validateContentYaml(dcsDir, verbose) {
-  const filePath = path2.join(dcsDir, "content.yaml");
+  const filePath = path3.join(dcsDir, "content.yaml");
   const result = {
     file: ".dcs/content.yaml",
     valid: true,
@@ -1510,23 +1847,23 @@ async function validateContentYaml(dcsDir, verbose) {
     warnings: []
   };
   try {
-    const content = await fs2.readFile(filePath, "utf8");
-    const config2 = yaml.load(content);
-    if (config2.version === void 0) {
+    const content = await fs5.readFile(filePath, "utf8");
+    const config = yaml.load(content);
+    if (config.version === void 0) {
       result.errors.push("Missing required field: version");
       result.valid = false;
     }
-    if (config2.global !== void 0 && typeof config2.global !== "object") {
+    if (config.global !== void 0 && typeof config.global !== "object") {
       result.errors.push("global must be an object");
       result.valid = false;
     }
-    if (config2.pages !== void 0 && typeof config2.pages !== "object") {
+    if (config.pages !== void 0 && typeof config.pages !== "object") {
       result.errors.push("pages must be an object");
       result.valid = false;
     }
     if (verbose) {
-      const globalKeys = config2.global ? Object.keys(config2.global).length : 0;
-      const pageCount = config2.pages ? Object.keys(config2.pages).length : 0;
+      const globalKeys = config.global ? Object.keys(config.global).length : 0;
+      const pageCount = config.pages ? Object.keys(config.pages).length : 0;
       console.log(chalk5.dim(`  ${globalKeys} global keys, ${pageCount} page sections`));
     }
   } catch (error) {
@@ -1540,7 +1877,7 @@ async function validateContentYaml(dcsDir, verbose) {
   return result;
 }
 async function validateSeoYaml(dcsDir, verbose) {
-  const filePath = path2.join(dcsDir, "seo.yaml");
+  const filePath = path3.join(dcsDir, "seo.yaml");
   const result = {
     file: ".dcs/seo.yaml",
     valid: true,
@@ -1548,13 +1885,13 @@ async function validateSeoYaml(dcsDir, verbose) {
     warnings: []
   };
   try {
-    const content = await fs2.readFile(filePath, "utf8");
-    const config2 = yaml.load(content);
-    if (config2.version === void 0) {
+    const content = await fs5.readFile(filePath, "utf8");
+    const config = yaml.load(content);
+    if (config.version === void 0) {
       result.errors.push("Missing required field: version");
       result.valid = false;
     }
-    const global = config2.global;
+    const global = config.global;
     if (!global) {
       result.errors.push("Missing required section: global");
       result.valid = false;
@@ -1569,7 +1906,7 @@ async function validateSeoYaml(dcsDir, verbose) {
         result.warnings.push("global.defaultDescription is not set");
       }
     }
-    const pages = config2.pages;
+    const pages = config.pages;
     if (pages && typeof pages === "object") {
       const pageKeys = Object.keys(pages);
       if (!pageKeys.includes("home")) {
@@ -1591,20 +1928,20 @@ async function validateSeoYaml(dcsDir, verbose) {
 }
 
 // src/commands/plans.ts
-import fs3 from "fs/promises";
-import path3 from "path";
+import fs6 from "fs/promises";
+import path4 from "path";
 import chalk6 from "chalk";
 import yaml2 from "js-yaml";
 async function plansCommand(options) {
   const { target = ".", force = false } = options;
-  const targetDir = path3.resolve(target);
-  const dcsDir = path3.join(targetDir, ".dcs");
-  const plansDir = path3.join(targetDir, ".plans");
+  const targetDir = path4.resolve(target);
+  const dcsDir = path4.join(targetDir, ".dcs");
+  const plansDir = path4.join(targetDir, ".plans");
   console.log(chalk6.bold("Generating DCS integration plans..."));
   console.log(chalk6.dim(`Directory: ${targetDir}`));
   console.log();
   try {
-    await fs3.access(dcsDir);
+    await fs6.access(dcsDir);
   } catch {
     console.log(chalk6.red("No .dcs directory found."));
     console.log("Run", chalk6.cyan("dcs init"), "first to create DCS configuration.");
@@ -1613,7 +1950,7 @@ async function plansCommand(options) {
   let siteName = "Customer Site";
   let framework = "vue";
   try {
-    const siteYaml = await fs3.readFile(path3.join(dcsDir, "site.yaml"), "utf8");
+    const siteYaml = await fs6.readFile(path4.join(dcsDir, "site.yaml"), "utf8");
     const siteConfig = yaml2.load(siteYaml);
     siteName = siteConfig.site_name || siteName;
     const metadata = siteConfig.metadata;
@@ -1629,19 +1966,19 @@ async function plansCommand(options) {
     { name: "04-capture-snapshots.md", content: generateSnapshotsPlan(siteName) },
     { name: "05-verify-deployment.md", content: generateVerifyPlan(siteName) }
   ];
-  await fs3.mkdir(plansDir, { recursive: true });
+  await fs6.mkdir(plansDir, { recursive: true });
   const generatedFiles = [];
   for (const plan of plans) {
-    const filePath = path3.join(plansDir, plan.name);
+    const filePath = path4.join(plansDir, plan.name);
     try {
-      await fs3.access(filePath);
+      await fs6.access(filePath);
       if (!force) {
         console.log(chalk6.yellow(`Skipped (exists): .plans/${plan.name}`));
         continue;
       }
     } catch {
     }
-    await fs3.writeFile(filePath, plan.content, "utf8");
+    await fs6.writeFile(filePath, plan.content, "utf8");
     generatedFiles.push(plan.name);
     console.log(`${chalk6.green("\u2713")} .plans/${plan.name}`);
   }
@@ -2100,8 +2437,8 @@ Once verified:
 }
 
 // src/commands/capture-snapshots.ts
-import fs4 from "fs";
-import path4 from "path";
+import fs7 from "fs";
+import path5 from "path";
 import yaml3 from "js-yaml";
 import chalk7 from "chalk";
 import ora3 from "ora";
@@ -2133,15 +2470,15 @@ async function waitForAboveFoldAssets(page) {
       if (img.complete && img.naturalWidth > 0) {
         return Promise.resolve();
       }
-      return new Promise((resolve) => {
-        const done = () => resolve();
+      return new Promise((resolve2) => {
+        const done = () => resolve2();
         img.addEventListener("load", done, { once: true });
         img.addEventListener("error", done, { once: true });
       });
     }));
     await Promise.race([
       Promise.all([waitForFonts, waitForImages]),
-      new Promise((resolve) => window.setTimeout(resolve, timeoutMs))
+      new Promise((resolve2) => window.setTimeout(resolve2, timeoutMs))
     ]);
   }, ASSET_WAIT_TIMEOUT_MS).catch((error) => {
     console.warn(`    Warning: could not verify above-fold assets: ${error instanceof Error ? error.message : String(error)}`);
@@ -2164,7 +2501,7 @@ async function resetScrollForFullPageCapture(page) {
     window.dispatchEvent(new Event("scroll"));
   });
   await page.waitForFunction(() => Math.abs(window.scrollY) < 1, void 0, { timeout: 1e3 }).catch(() => void 0);
-  await page.evaluate(() => new Promise((resolve) => requestAnimationFrame(() => requestAnimationFrame(resolve)))).catch(() => void 0);
+  await page.evaluate(() => new Promise((resolve2) => requestAnimationFrame(() => requestAnimationFrame(resolve2)))).catch(() => void 0);
   await page.waitForTimeout(350);
   await waitForAboveFoldAssets(page);
 }
@@ -2207,7 +2544,7 @@ async function withFullPageCaptureLayout(page, capture) {
     window.scrollTo(0, 0);
     window.dispatchEvent(new Event("scroll"));
   });
-  await page.evaluate(() => new Promise((resolve) => requestAnimationFrame(() => requestAnimationFrame(resolve)))).catch(() => void 0);
+  await page.evaluate(() => new Promise((resolve2) => requestAnimationFrame(() => requestAnimationFrame(resolve2)))).catch(() => void 0);
   try {
     return await capture();
   } finally {
@@ -2246,27 +2583,27 @@ var SECTION_SELECTORS = {
   cta: '[class*="cta"], [data-section-type="cta"], .call-to-action'
 };
 function loadPagesConfig(targetDir) {
-  const configPath = path4.join(targetDir, ".dcs", "pages.yaml");
-  if (!fs4.existsSync(configPath)) {
+  const configPath = path5.join(targetDir, ".dcs", "pages.yaml");
+  if (!fs7.existsSync(configPath)) {
     throw new Error(`Configuration file not found: ${configPath}`);
   }
-  const content = fs4.readFileSync(configPath, "utf-8");
+  const content = fs7.readFileSync(configPath, "utf-8");
   return yaml3.load(content);
 }
 function loadContentConfig(targetDir) {
-  const contentPath = path4.join(targetDir, ".dcs", "content.yaml");
-  if (!fs4.existsSync(contentPath)) {
+  const contentPath = path5.join(targetDir, ".dcs", "content.yaml");
+  if (!fs7.existsSync(contentPath)) {
     return null;
   }
-  const content = fs4.readFileSync(contentPath, "utf-8");
+  const content = fs7.readFileSync(contentPath, "utf-8");
   return yaml3.load(content);
 }
 function loadTargetedSnapshotsConfig(targetDir) {
-  const targetedPath = path4.join(targetDir, ".dcs", "targeted-snapshots.yaml");
-  if (!fs4.existsSync(targetedPath)) {
+  const targetedPath = path5.join(targetDir, ".dcs", "targeted-snapshots.yaml");
+  if (!fs7.existsSync(targetedPath)) {
     return null;
   }
-  const content = fs4.readFileSync(targetedPath, "utf-8");
+  const content = fs7.readFileSync(targetedPath, "utf-8");
   return yaml3.load(content);
 }
 function getValidTextKeysForPage(contentConfig, pageSlug) {
@@ -2286,27 +2623,27 @@ function getValidTextKeysForPage(contentConfig, pageSlug) {
   }
   return keys;
 }
-async function resolveAllPages(config2) {
-  const resolved = [];
-  for (const page of config2.pages) {
+async function resolveAllPages(config) {
+  const resolved2 = [];
+  for (const page of config.pages) {
     if (page.type === "dynamic" && page.instances) {
       for (const instance of page.instances) {
         const instancePath = page.pathTemplate ? page.pathTemplate.replace(/:[\w]+/, instance) : `${page.path}/${instance}`;
-        resolved.push({
+        resolved2.push({
           slug: `${page.slug}-${instance}`,
           path: instancePath,
           config: { ...page, slug: `${page.slug}-${instance}` }
         });
       }
     } else {
-      resolved.push({
+      resolved2.push({
         slug: page.slug,
         path: page.path,
         config: page
       });
     }
   }
-  return resolved;
+  return resolved2;
 }
 async function getDomPath(element) {
   return element.evaluate((el) => {
@@ -2434,12 +2771,12 @@ async function capturePageSnapshot(browser, pageInfo, snapshotConfig, siteSlug,
   }
   await page.waitForTimeout(snapshotConfig.waitAfterLoad);
   await waitForAboveFoldAssets(page);
-  const pageOutputDir = path4.join(outputDir, siteSlug, pageInfo.slug);
-  fs4.mkdirSync(path4.join(pageOutputDir, "sections"), { recursive: true });
+  const pageOutputDir = path5.join(outputDir, siteSlug, pageInfo.slug);
+  fs7.mkdirSync(path5.join(pageOutputDir, "sections"), { recursive: true });
   const title = await page.title();
   let pageHeight = await lazyLoadPage(page, snapshotConfig.viewport.height);
   await resetScrollForFullPageCapture(page);
-  const fullPagePath = path4.join(pageOutputDir, "full-page.png");
+  const fullPagePath = path5.join(pageOutputDir, "full-page.png");
   await withFullPageCaptureLayout(
     page,
     () => page.screenshot({
@@ -2447,7 +2784,7 @@ async function capturePageSnapshot(browser, pageInfo, snapshotConfig, siteSlug,
       fullPage: snapshotConfig.captureFullPage
     })
   );
-  const thumbnailPath = path4.join(pageOutputDir, "thumbnail.png");
+  const thumbnailPath = path5.join(pageOutputDir, "thumbnail.png");
   await captureHeaderThumbnail(page, thumbnailPath, snapshotConfig.viewport);
   await page.evaluate(() => window.scrollTo(0, 0));
   await page.waitForTimeout(100);
@@ -2501,7 +2838,7 @@ async function capturePageSnapshot(browser, pageInfo, snapshotConfig, siteSlug,
     const bounds = await getAccurateBounds(element, resolvedType);
     if (!bounds || bounds.height < 10) continue;
     const sectionId = basicMetadata.sectionId || `section-${i}`;
-    const sectionPath = path4.join(pageOutputDir, "sections", `${sectionId}.png`);
+    const sectionPath = path5.join(pageOutputDir, "sections", `${sectionId}.png`);
     try {
       await element.screenshot({ path: sectionPath });
     } catch {
@@ -2572,7 +2909,7 @@ async function capturePageSnapshot(browser, pageInfo, snapshotConfig, siteSlug,
       const bounds = await getAccurateBounds(element, sectionType);
       if (!bounds || bounds.height < 10) continue;
       const sectionId = `${sectionType}-${i}`;
-      const sectionPath = path4.join(pageOutputDir, "sections", `${sectionId}.png`);
+      const sectionPath = path5.join(pageOutputDir, "sections", `${sectionId}.png`);
       try {
         await element.screenshot({ path: sectionPath });
       } catch {
@@ -2625,7 +2962,7 @@ async function capturePageSnapshot(browser, pageInfo, snapshotConfig, siteSlug,
       });
       if (!bounds || bounds.height < 10) continue;
       const sectionId = `content-fallback-${i}`;
-      const sectionPath = path4.join(pageOutputDir, "sections", `${sectionId}.png`);
+      const sectionPath = path5.join(pageOutputDir, "sections", `${sectionId}.png`);
       try {
         await element.screenshot({ path: sectionPath });
       } catch {
@@ -2672,22 +3009,22 @@ async function capturePageSnapshot(browser, pageInfo, snapshotConfig, siteSlug,
 }
 async function captureSnapshotsCommand(options) {
   const { target, baseUrl, dryRun, verbose, pages: targetedPages } = options;
-  const targetDir = path4.resolve(target);
+  const targetDir = path5.resolve(target);
   console.log(chalk7.blue("\u{1F4F8} Page Snapshot Capture"));
   console.log(chalk7.gray("========================"));
   console.log(chalk7.gray(`Target:   ${targetDir}`));
   console.log(chalk7.gray(`Base URL: ${baseUrl}`));
   process.env.SITE_BASE_URL = baseUrl;
-  let config2;
+  let config;
   try {
-    config2 = loadPagesConfig(targetDir);
+    config = loadPagesConfig(targetDir);
   } catch (error) {
     console.error(chalk7.red("Error:"), error.message);
     console.log(chalk7.yellow("\nMake sure .dcs/pages.yaml exists in the target directory."));
     process.exit(1);
   }
-  console.log(chalk7.gray(`Site:     ${config2.siteSlug}`));
-  const outputDir = path4.join(targetDir, config2.snapshot.outputDir || ".dcs/snapshots");
+  console.log(chalk7.gray(`Site:     ${config.siteSlug}`));
+  const outputDir = path5.join(targetDir, config.snapshot.outputDir || ".dcs/snapshots");
   const contentConfig = loadContentConfig(targetDir);
   if (contentConfig) {
     const pageCount = Object.keys(contentConfig.pages || {}).length;
@@ -2704,19 +3041,19 @@ async function captureSnapshotsCommand(options) {
     console.log(chalk7.gray(`   Reason: ${targetedConfig.reason}`));
     console.log(chalk7.gray("   No snapshots will be captured."));
     if (!dryRun) {
-      fs4.mkdirSync(outputDir, { recursive: true });
+      fs7.mkdirSync(outputDir, { recursive: true });
       const skipMarker = {
         skipped: true,
         reason: targetedConfig.reason,
         triggeredBy: targetedConfig.triggeredBy,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       };
-      fs4.writeFileSync(path4.join(outputDir, "skipped.json"), JSON.stringify(skipMarker, null, 2));
+      fs7.writeFileSync(path5.join(outputDir, "skipped.json"), JSON.stringify(skipMarker, null, 2));
     }
     console.log(chalk7.green("\n\u2705 Snapshot capture skipped (as requested)"));
     return;
   }
-  let pagesToCapture = await resolveAllPages(config2);
+  let pagesToCapture = await resolveAllPages(config);
   console.log(chalk7.gray(`Found ${pagesToCapture.length} total pages in configuration`));
   if (targetedPages && targetedPages.length > 0) {
     const targetedSlugs = new Set(targetedPages);
@@ -2746,10 +3083,10 @@ async function captureSnapshotsCommand(options) {
     return;
   }
   const { chromium } = await import("playwright");
-  if (fs4.existsSync(outputDir)) {
-    fs4.rmSync(outputDir, { recursive: true });
+  if (fs7.existsSync(outputDir)) {
+    fs7.rmSync(outputDir, { recursive: true });
   }
-  fs4.mkdirSync(outputDir, { recursive: true });
+  fs7.mkdirSync(outputDir, { recursive: true });
   const spinner = ora3("Launching browser...").start();
   const browser = await chromium.launch();
   spinner.succeed("Browser launched");
@@ -2762,15 +3099,15 @@ async function captureSnapshotsCommand(options) {
       const snapshot = await capturePageSnapshot(
         browser,
         pageInfo,
-        config2.snapshot,
-        config2.siteSlug,
+        config.snapshot,
+        config.siteSlug,
         validTextKeys,
         outputDir,
         verbose || false
       );
       snapshots.push(snapshot);
-      const snapshotPath = path4.join(outputDir, config2.siteSlug, pageInfo.slug, "snapshot.json");
-      fs4.writeFileSync(snapshotPath, JSON.stringify(snapshot, null, 2));
+      const snapshotPath = path5.join(outputDir, config.siteSlug, pageInfo.slug, "snapshot.json");
+      fs7.writeFileSync(snapshotPath, JSON.stringify(snapshot, null, 2));
       pageSpinner.succeed(`${pageInfo.slug}: ${snapshot.sections.length} sections captured`);
     } catch (error) {
       const message = `${pageInfo.slug}: ${error.message}`;
@@ -2780,11 +3117,11 @@ async function captureSnapshotsCommand(options) {
   }
   await browser.close();
   const manifest = {
-    siteSlug: config2.siteSlug,
+    siteSlug: config.siteSlug,
     capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
     capturedVersion: process.env.GITHUB_SHA,
     deploymentRef: process.env.GITHUB_REF || "local",
-    pagesConfigVersion: config2.version,
+    pagesConfigVersion: config.version,
     pages: snapshots.map((s) => ({
       pageSlug: s.pageSlug,
       pagePath: s.path,
@@ -2796,11 +3133,11 @@ async function captureSnapshotsCommand(options) {
       hasSnapshot: true
     }))
   };
-  const manifestPath = path4.join(outputDir, config2.siteSlug, "manifest.json");
+  const manifestPath = path5.join(outputDir, config.siteSlug, "manifest.json");
   if (isTargetedCapture) {
     console.log(chalk7.gray("   Targeted capture: leaving the existing remote manifest intact"));
   } else {
-    fs4.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2));
+    fs7.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2));
   }
   console.log("");
   console.log(chalk7.green("\u2705 Snapshot capture complete!"));