@efoo/ccprofile 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 efoo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,128 @@
+# ccprofile
+
+Per-directory Claude Code account routing via `CLAUDE_CODE_OAUTH_TOKEN`, direnv, and the macOS Keychain.
+
+`ccprofile` lets you run **multiple Claude Code accounts in parallel** — one per terminal, one per project — with zero manual switching. It never touches Claude Code's own Keychain entry, so there is no global "active account" to corrupt.
+
+## Why
+
+Claude Code stores its OAuth credentials in a single macOS Keychain entry, shared across every `CLAUDE_CONFIG_DIR` profile ([#20553](https://github.com/anthropics/claude-code/issues/20553)). Switcher-style tools work around this by swapping that entry in place — which breaks down the moment two sessions with different accounts run at the same time (in-session token refresh writes the old account back).
+
+`ccprofile` takes the declarative route instead:
+
+- Each account's **long-lived OAuth token** (`claude setup-token`, valid ~1 year) is stored in the Keychain under ccprofile's own namespace — one entry per profile, no sharing, no swapping.
+- `ccprofile link` writes a **self-contained `.envrc`** that exports `CLAUDE_CODE_OAUTH_TOKEN` straight from the Keychain. direnv activates it when you enter the directory. No node/npx in the hot path.
+- `CLAUDE_CODE_OAUTH_TOKEN` outranks the stored login in Claude Code's [documented auth precedence](https://code.claude.com/docs/en/authentication#authentication-precedence), so linked directories route to their account and everywhere else falls back to your normal `/login`.
+
+Auth state lives in each process's environment — parallel sessions cannot interfere with each other by construction.
+
+## Requirements
+
+- macOS (tokens are stored in the Keychain)
+- [Claude Code](https://code.claude.com) with a Pro / Max / Team / Enterprise subscription (`claude setup-token` requires one)
+- [direnv](https://direnv.net) — `brew install direnv` + the shell hook (fish: `direnv hook fish | source`)
+- Node.js >= 20 (only for running ccprofile itself)
+
+## Install
+
+```sh
+npm install -g @efoo/ccprofile   # provides the `ccprofile` command
+# or run ad hoc:
+npx @efoo/ccprofile --help
+```
+
+## Quick start
+
+```sh
+# 1. Register an account (launches `claude setup-token`, stores the token in the Keychain)
+ccprofile add work --email you@company.example
+
+# 2. Route a project to it — run inside the project directory…
+cd ~/src/my-project
+ccprofile link work
+
+#    …or point at a directory from anywhere:
+ccprofile link work ~/src/my-project
+
+# 3. Done — any claude launched in that directory (and below) runs as "work"
+claude        # /status shows "Auth token: CLAUDE_CODE_OAUTH_TOKEN"
+```
+
+Repeat with `ccprofile add personal` etc. Different terminals in different directories run different accounts concurrently.
+
+## Commands
+
+| Command | Description |
+| --- | --- |
+| `ccprofile add <name>` | Register a profile. Flags: `--email`, `--expires-at <iso>`, `--token <token>`, `--force` |
+| `ccprofile list [--json]` | Profiles with token presence and expiry countdown |
+| `ccprofile link <name> [dir]` | Write the managed `.envrc` block and `direnv allow` |
+| `ccprofile unlink [dir]` | Remove the managed block (deletes `.envrc` if nothing else remains) |
+| `ccprofile token <name>` | Print the stored token to stdout (for scripting — handle with care) |
+| `ccprofile remove <name>` | Delete the profile and its Keychain entry |
+| `ccprofile doctor [dir]` | Diagnose overriding env vars (`ANTHROPIC_API_KEY` etc.), `apiKeyHelper`, expiry, token liveness, broken links. `--offline` skips the server probe |
+| `ccprofile completion <shell>` | Print a completion script for fish, zsh, or bash |
+
+## Shell completion
+
+Subcommands, flags, and registered profile names are all tab-completable:
+
+```sh
+# fish
+ccprofile completion fish > ~/.config/fish/completions/ccprofile.fish
+
+# zsh (place _ccprofile somewhere in $fpath, then restart zsh)
+ccprofile completion zsh > "${fpath[1]}/_ccprofile"
+
+# bash
+echo 'eval "$(ccprofile completion bash)"' >> ~/.bashrc
+```
+
+`ccprofile link <TAB>` completes profile names by calling the hidden `ccprofile _profiles` helper, which only reads `~/.ccprofile/config.json` (never the Keychain).
+
+## How it works
+
+```
+~/.ccprofile/config.json     profile metadata: email, expiry, keychain ref (no secrets)
+macOS Keychain               service "ccprofile", one entry per profile (the secrets)
+<project>/.envrc             managed block, generated by `ccprofile link`:
+
+  # >>> ccprofile managed >>>
+  # profile: work
+  export CLAUDE_CODE_OAUTH_TOKEN="$(security find-generic-password -w -s 'ccprofile' -a 'work' 2>/dev/null)"
+  # <<< ccprofile managed <<<
+```
+
+Notes:
+
+- Tokens are written to the Keychain via `security -i` (stdin), so secrets never appear in `ps` output.
+- The `.envrc` block is **self-contained**: direnv re-evaluates it on every directory entry, and it must stay fast and dependency-free. ccprofile is only needed for CRUD operations.
+- Add `.envrc` to your project's `.gitignore` — it is machine-local.
+
+## Limitations — the price of parallel accounts
+
+ccprofile is built on `claude setup-token`, whose long-lived tokens are **deliberately scoped to inference only** ("for security reasons", per Claude Code's own `/doctor`). Several conveniences of a normal `/login` session are therefore unavailable in linked directories:
+
+- **No account identity introspection.** The token cannot answer "whose token is this?" — the OAuth profile endpoint rejects it (`user:profile` scope missing, see [#11985](https://github.com/anthropics/claude-code/issues/11985)). The `--email` you record is a self-declared label, not verified.
+  *Verify identity once, at registration time:* make sure the browser is logged into the intended claude.ai account before `claude setup-token`, then send a couple of prompts from a linked directory and confirm on claude.ai (web) that the intended account's usage moved.
+- **`/status` → Usage tab shows no plan utilization** in token-authenticated sessions (same scope restriction). Check usage on claude.ai instead.
+- **Remote Control is unavailable** in token-authenticated sessions; it requires a full-scope login token.
+- **Tokens last up to 1 year but can die earlier** (password change, logout-all). The recorded expiry is a hint, not a guarantee — `ccprofile doctor` probes the server and tells live tokens apart from revoked ones.
+- **`claude --bare` does not read `CLAUDE_CODE_OAUTH_TOKEN`.**
+- **Subscription accounting:** from June 15, 2026, `claude -p` / Agent SDK usage on subscription plans draws from a separate monthly Agent SDK credit.
+- **direnv only sees shell-launched processes.** Apps started outside a hooked shell (GUI launchers) bypass the routing.
+- **Higher-precedence auth wins silently.** `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, `apiKeyHelper`, and Bedrock/Vertex/Foundry env vars all outrank the token — `ccprofile doctor` flags them.
+- **macOS only** for now (the token store is the macOS Keychain).
+
+## Development
+
+```sh
+pnpm install
+pnpm build       # tsc → dist/
+pnpm test        # vitest
+node dist/index.js --help
+```
+
+## License
+
+MIT

package/dist/commands/add.js

@@ -0,0 +1,73 @@
+import { spawnSync } from "node:child_process";
+import { parseArgs } from "node:util";
+import { KEYCHAIN_SERVICE, computeExpiresAt, loadConfig, saveConfig, validateProfileName, } from "../lib/config.js";
+import { Keychain, assertDarwin } from "../lib/keychain.js";
+import { askHidden, confirm } from "../lib/prompt.js";
+import { bold, cyan, dim, ok, warn } from "../lib/format.js";
+const TOKEN_PREFIX = "sk-ant-";
+export async function addCommand(argv) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        allowPositionals: true,
+        options: {
+            email: { type: "string" },
+            "expires-at": { type: "string" },
+            token: { type: "string" },
+            force: { type: "boolean", default: false },
+            "no-setup": { type: "boolean", default: false },
+        },
+    });
+    const name = positionals[0];
+    if (!name) {
+        console.error("Usage: ccprofile add <name> [--email <email>] [--expires-at <ISO date>]");
+        return 1;
+    }
+    validateProfileName(name);
+    assertDarwin();
+    const config = loadConfig();
+    if (config.profiles[name] && !values.force) {
+        console.error(`Profile "${name}" already exists. Use --force to overwrite its token and metadata.`);
+        return 1;
+    }
+    let token = values.token;
+    if (!token) {
+        console.log(`A long-lived OAuth token is issued by ${bold("claude setup-token")} (requires a Claude subscription).`);
+        if (!values["no-setup"] && process.stdin.isTTY) {
+            if (await confirm("Run `claude setup-token` now?")) {
+                const result = spawnSync("claude", ["setup-token"], { stdio: "inherit" });
+                if (result.error) {
+                    console.error("Could not launch `claude`. Install Claude Code first, or run `claude setup-token` manually.");
+                    return 1;
+                }
+            }
+        }
+        token = await askHidden("Paste the token (input is hidden): ");
+    }
+    if (token === "") {
+        console.error("No token provided. Aborting.");
+        return 1;
+    }
+    if (!token.startsWith(TOKEN_PREFIX)) {
+        console.log(warn(`The token does not start with "${TOKEN_PREFIX}", which is unexpected.`));
+        if (process.stdin.isTTY && !(await confirm("Store it anyway?", false))) {
+            return 1;
+        }
+    }
+    const keychain = new Keychain();
+    await keychain.setToken(KEYCHAIN_SERVICE, name, token);
+    const now = new Date();
+    const expiresAt = values["expires-at"]
+        ? new Date(values["expires-at"]).toISOString()
+        : computeExpiresAt(now);
+    config.profiles[name] = {
+        ...(values.email ? { email: values.email } : {}),
+        createdAt: now.toISOString(),
+        expiresAt,
+        keychain: { service: KEYCHAIN_SERVICE, account: name },
+    };
+    saveConfig(config);
+    console.log(ok(`Profile ${bold(name)} saved (Keychain: ${KEYCHAIN_SERVICE}/${name}).`));
+    console.log(dim(`Token recorded as expiring at ${expiresAt} (setup-token issues 1-year tokens).`));
+    console.log(`\nNext: route a project directory to this account:\n  ${cyan(`ccprofile link ${name} <project-dir>`)}`);
+    return 0;
+}

package/dist/commands/completion.js

@@ -0,0 +1,149 @@
+import { parseArgs } from "node:util";
+export const SUBCOMMANDS = [
+    { name: "add", description: "Register a profile (runs claude setup-token)" },
+    { name: "list", description: "Show profiles, token presence, and expiry" },
+    { name: "link", description: "Route a directory to a profile" },
+    { name: "unlink", description: "Remove the managed .envrc block" },
+    { name: "token", description: "Print the stored token" },
+    { name: "remove", description: "Delete a profile and its Keychain entry" },
+    { name: "doctor", description: "Diagnose configuration problems" },
+    { name: "completion", description: "Print a shell completion script" },
+    { name: "help", description: "Show help" },
+];
+const names = SUBCOMMANDS.map((s) => s.name).join(" ");
+export function renderFishCompletion() {
+    const subcommandLines = SUBCOMMANDS.map((s) => `complete -c ccprofile -n __fish_use_subcommand -a ${s.name} -d "${s.description}"`).join("\n");
+    return `# ccprofile fish completion
+# Install: ccprofile completion fish > ~/.config/fish/completions/ccprofile.fish
+
+function __ccprofile_pos_eq
+    test (count (commandline -opc)) -eq $argv[1]
+end
+
+complete -c ccprofile -f
+
+${subcommandLines}
+
+# Profile name arguments
+complete -c ccprofile -n "__fish_seen_subcommand_from link" -n "__ccprofile_pos_eq 2" -a "(command ccprofile _profiles 2>/dev/null)"
+complete -c ccprofile -n "__fish_seen_subcommand_from remove token" -n "__ccprofile_pos_eq 2" -a "(command ccprofile _profiles 2>/dev/null)"
+
+# Directory arguments
+complete -c ccprofile -n "__fish_seen_subcommand_from link" -n "__ccprofile_pos_eq 3" -F
+complete -c ccprofile -n "__fish_seen_subcommand_from unlink doctor" -n "__ccprofile_pos_eq 2" -F
+
+# completion <shell>
+complete -c ccprofile -n "__fish_seen_subcommand_from completion" -n "__ccprofile_pos_eq 2" -a "fish zsh bash"
+
+# Flags
+complete -c ccprofile -n "__fish_seen_subcommand_from add" -l email -r -d "Account email (metadata)"
+complete -c ccprofile -n "__fish_seen_subcommand_from add" -l expires-at -r -d "Override recorded expiry (ISO date)"
+complete -c ccprofile -n "__fish_seen_subcommand_from add" -l token -r -d "Provide the token directly"
+complete -c ccprofile -n "__fish_seen_subcommand_from add" -l force -d "Overwrite an existing profile"
+complete -c ccprofile -n "__fish_seen_subcommand_from add" -l no-setup -d "Skip launching claude setup-token"
+complete -c ccprofile -n "__fish_seen_subcommand_from list" -l json -d "JSON output"
+complete -c ccprofile -n "__fish_seen_subcommand_from remove" -l force -d "Skip confirmation"
+complete -c ccprofile -n __fish_use_subcommand -l help -d "Show help"
+complete -c ccprofile -n __fish_use_subcommand -l version -d "Show version"
+`;
+}
+export function renderZshCompletion() {
+    const describeLines = SUBCOMMANDS.map((s) => `    '${s.name}:${s.description}'`).join("\n");
+    return `#compdef ccprofile
+# ccprofile zsh completion
+# Install: ccprofile completion zsh > "\${fpath[1]}/_ccprofile" (then restart zsh)
+
+_ccprofile() {
+  local -a subcmds
+  subcmds=(
+${describeLines}
+  )
+  if (( CURRENT == 2 )); then
+    _describe 'command' subcmds
+    return
+  fi
+  case "\${words[2]}" in
+    link)
+      if (( CURRENT == 3 )); then
+        compadd -- \$(ccprofile _profiles 2>/dev/null)
+      else
+        _files -/
+      fi
+      ;;
+    remove|token)
+      (( CURRENT == 3 )) && compadd -- \$(ccprofile _profiles 2>/dev/null)
+      ;;
+    unlink|doctor)
+      _files -/
+      ;;
+    completion)
+      compadd fish zsh bash
+      ;;
+    add)
+      compadd -- --email --expires-at --token --force --no-setup
+      ;;
+    list)
+      compadd -- --json
+      ;;
+  esac
+}
+
+_ccprofile "\$@"
+`;
+}
+export function renderBashCompletion() {
+    return `# ccprofile bash completion
+# Install: ccprofile completion bash > /usr/local/etc/bash_completion.d/ccprofile
+#          (or: eval "\$(ccprofile completion bash)" in ~/.bashrc)
+
+_ccprofile() {
+  local cur sub
+  cur="\${COMP_WORDS[COMP_CWORD]}"
+  sub="\${COMP_WORDS[1]}"
+  if [ "\$COMP_CWORD" -eq 1 ]; then
+    COMPREPLY=( \$(compgen -W "${names}" -- "\$cur") )
+    return
+  fi
+  case "\$sub" in
+    link)
+      if [ "\$COMP_CWORD" -eq 2 ]; then
+        COMPREPLY=( \$(compgen -W "\$(ccprofile _profiles 2>/dev/null)" -- "\$cur") )
+      else
+        COMPREPLY=( \$(compgen -d -- "\$cur") )
+      fi ;;
+    remove|token)
+      [ "\$COMP_CWORD" -eq 2 ] && COMPREPLY=( \$(compgen -W "\$(ccprofile _profiles 2>/dev/null)" -- "\$cur") ) ;;
+    unlink|doctor)
+      COMPREPLY=( \$(compgen -d -- "\$cur") ) ;;
+    completion)
+      COMPREPLY=( \$(compgen -W "fish zsh bash" -- "\$cur") ) ;;
+    add)
+      COMPREPLY=( \$(compgen -W "--email --expires-at --token --force --no-setup" -- "\$cur") ) ;;
+    list)
+      COMPREPLY=( \$(compgen -W "--json" -- "\$cur") ) ;;
+  esac
+}
+
+complete -F _ccprofile ccprofile
+`;
+}
+export async function completionCommand(argv) {
+    const { positionals } = parseArgs({ args: argv, allowPositionals: true, options: {} });
+    const shell = positionals[0];
+    switch (shell) {
+        case "fish":
+            process.stdout.write(renderFishCompletion());
+            return 0;
+        case "zsh":
+            process.stdout.write(renderZshCompletion());
+            return 0;
+        case "bash":
+            process.stdout.write(renderBashCompletion());
+            return 0;
+        default:
+            console.error("Usage: ccprofile completion <fish|zsh|bash>");
+            console.error("\nInstall (fish):");
+            console.error("  ccprofile completion fish > ~/.config/fish/completions/ccprofile.fish");
+            return 1;
+    }
+}

package/dist/commands/doctor.js

@@ -0,0 +1,141 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { parseArgs } from "node:util";
+import { daysRemaining, loadConfig } from "../lib/config.js";
+import { parseLinkedProfile } from "../lib/envrc.js";
+import { Keychain } from "../lib/keychain.js";
+import { probeToken } from "../lib/probe.js";
+import { bold, fail, ok, warn } from "../lib/format.js";
+/**
+ * Env vars that outrank CLAUDE_CODE_OAUTH_TOKEN in Claude Code's documented
+ * authentication precedence. If any is set, ccprofile routing is silently
+ * bypassed — that is the failure mode this command exists to catch.
+ */
+const OVERRIDING_ENV_VARS = [
+    "CLAUDE_CODE_USE_BEDROCK",
+    "CLAUDE_CODE_USE_VERTEX",
+    "CLAUDE_CODE_USE_FOUNDRY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "ANTHROPIC_API_KEY",
+];
+export async function doctorCommand(argv) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        allowPositionals: true,
+        options: { offline: { type: "boolean", default: false } },
+    });
+    const dir = resolve(positionals[0] ?? process.cwd());
+    let problems = 0;
+    let warnings = 0;
+    if (process.platform !== "darwin") {
+        console.log(fail("Not macOS: ccprofile's Keychain backend is unavailable on this platform."));
+        return 1;
+    }
+    console.log(ok("Platform: macOS (Keychain backend available)"));
+    const claude = spawnSync("claude", ["--version"], { stdio: "pipe" });
+    if (claude.error || claude.status !== 0) {
+        console.log(warn("`claude` CLI not found. `ccprofile add` cannot launch setup-token for you."));
+        warnings += 1;
+    }
+    else {
+        console.log(ok(`Claude Code: ${claude.stdout.toString().trim()}`));
+    }
+    const direnv = spawnSync("direnv", ["version"], { stdio: "pipe" });
+    if (direnv.error || direnv.status !== 0) {
+        console.log(fail("direnv not found. Linked directories will not activate tokens automatically."));
+        console.log("  Install: brew install direnv  /  fish hook: direnv hook fish | source");
+        problems += 1;
+    }
+    else {
+        console.log(ok(`direnv: ${direnv.stdout.toString().trim()}`));
+    }
+    for (const envVar of OVERRIDING_ENV_VARS) {
+        if (process.env[envVar] !== undefined) {
+            console.log(fail(`${envVar} is set: it overrides CLAUDE_CODE_OAUTH_TOKEN and bypasses ccprofile routing.`));
+            problems += 1;
+        }
+    }
+    const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude");
+    const settingsPath = join(claudeConfigDir, "settings.json");
+    if (existsSync(settingsPath)) {
+        try {
+            const settings = JSON.parse(readFileSync(settingsPath, "utf8"));
+            if (settings.apiKeyHelper !== undefined) {
+                console.log(fail(`apiKeyHelper is configured in ${settingsPath}: it overrides CLAUDE_CODE_OAUTH_TOKEN.`));
+                problems += 1;
+            }
+        }
+        catch {
+            console.log(warn(`Could not parse ${settingsPath}.`));
+            warnings += 1;
+        }
+    }
+    const config = loadConfig();
+    const keychain = new Keychain();
+    for (const [name, profile] of Object.entries(config.profiles)) {
+        const present = await keychain.hasEntry(profile.keychain.service, profile.keychain.account);
+        if (!present) {
+            console.log(fail(`Profile "${name}": Keychain entry missing. Re-run: ccprofile add ${name} --force`));
+            problems += 1;
+            continue;
+        }
+        const days = daysRemaining(profile.expiresAt);
+        if (days < 0) {
+            console.log(fail(`Profile "${name}": token recorded as expired ${-days}d ago. Re-issue with claude setup-token.`));
+            problems += 1;
+        }
+        else if (days <= config.settings.expiryWarningDays) {
+            console.log(warn(`Profile "${name}": token expires in ${days}d.`));
+            warnings += 1;
+        }
+        else {
+            console.log(ok(`Profile "${name}": token stored, expires in ${days}d.`));
+        }
+        if (values.offline)
+            continue;
+        const token = await keychain.getToken(profile.keychain.service, profile.keychain.account);
+        if (token === null)
+            continue;
+        const live = await probeToken(token);
+        if (live.status === "alive") {
+            if (live.email !== undefined && profile.email !== undefined && live.email !== profile.email) {
+                console.log(fail(`Profile "${name}": server says the token belongs to ${live.email}, but config records ${profile.email}.`));
+                problems += 1;
+            }
+            else {
+                console.log(ok(`Profile "${name}": token is live on the server${live.email ? ` (account: ${live.email})` : ""}.`));
+            }
+        }
+        else if (live.status === "invalid") {
+            console.log(fail(`Profile "${name}": token rejected by the server (revoked or expired early). Re-issue with: ccprofile add ${name} --force`));
+            problems += 1;
+        }
+        else {
+            console.log(warn(`Profile "${name}": liveness check inconclusive (${live.detail}). Use --offline to skip.`));
+            warnings += 1;
+        }
+    }
+    const envrcPath = join(dir, ".envrc");
+    if (existsSync(envrcPath)) {
+        const linked = parseLinkedProfile(readFileSync(envrcPath, "utf8"));
+        if (linked === null) {
+            console.log(ok(`${envrcPath} exists but has no ccprofile block (not managed here).`));
+        }
+        else if (config.profiles[linked]) {
+            console.log(ok(`${bold(dir)} is linked to profile "${linked}".`));
+        }
+        else {
+            console.log(fail(`${envrcPath} references unknown profile "${linked}". Run: ccprofile link <profile> ${dir}`));
+            problems += 1;
+        }
+    }
+    console.log();
+    if (problems > 0) {
+        console.log(fail(`${problems} problem(s), ${warnings} warning(s).`));
+        return 1;
+    }
+    console.log(ok(`No problems found (${warnings} warning(s)).`));
+    return 0;
+}

package/dist/commands/link.js

@@ -0,0 +1,45 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve, join } from "node:path";
+import { parseArgs } from "node:util";
+import { loadConfig } from "../lib/config.js";
+import { renderBlock, upsertBlock } from "../lib/envrc.js";
+import { bold, cyan, dim, ok, warn } from "../lib/format.js";
+export async function linkCommand(argv) {
+    const { positionals } = parseArgs({ args: argv, allowPositionals: true, options: {} });
+    const name = positionals[0];
+    if (!name) {
+        console.error("Usage: ccprofile link <profile> [dir]");
+        return 1;
+    }
+    const dir = resolve(positionals[1] ?? process.cwd());
+    const config = loadConfig();
+    const profile = config.profiles[name];
+    if (!profile) {
+        console.error(`Profile "${name}" does not exist. Create it with: ccprofile add ${name}`);
+        return 1;
+    }
+    if (!existsSync(dir)) {
+        console.error(`Directory does not exist: ${dir}`);
+        return 1;
+    }
+    const envrcPath = join(dir, ".envrc");
+    const current = existsSync(envrcPath) ? readFileSync(envrcPath, "utf8") : "";
+    const block = renderBlock(name, profile.keychain.service, profile.keychain.account);
+    writeFileSync(envrcPath, upsertBlock(current, block));
+    console.log(ok(`${bold(dir)} now routes Claude Code to profile ${bold(name)}${profile.email ? dim(` (${profile.email})`) : ""}.`));
+    const allow = spawnSync("direnv", ["allow", dir], { stdio: "pipe" });
+    if (allow.error) {
+        console.log(warn("direnv is not installed; the .envrc was written but will not load automatically."));
+        console.log(`  Install it with ${cyan("brew install direnv")} and add the shell hook (fish: ${cyan("direnv hook fish | source")}).`);
+    }
+    else if (allow.status !== 0) {
+        console.log(warn(`\`direnv allow\` failed: ${allow.stderr.toString().trim()}`));
+        return 1;
+    }
+    else {
+        console.log(ok("direnv allow completed. Entering the directory activates the token."));
+    }
+    console.log(dim(`Tip: add .envrc to the project's .gitignore (paths are machine-local).`));
+    return 0;
+}

package/dist/commands/list.js

@@ -0,0 +1,48 @@
+import { parseArgs } from "node:util";
+import { daysRemaining, loadConfig } from "../lib/config.js";
+import { Keychain, assertDarwin } from "../lib/keychain.js";
+import { bold, describeExpiry, dim, red, table } from "../lib/format.js";
+export async function listCommand(argv) {
+    const { values } = parseArgs({
+        args: argv,
+        options: { json: { type: "boolean", default: false } },
+    });
+    const config = loadConfig();
+    const names = Object.keys(config.profiles).sort();
+    if (values.json) {
+        const out = names.map((name) => {
+            const p = config.profiles[name];
+            return {
+                name,
+                email: p.email ?? null,
+                createdAt: p.createdAt,
+                expiresAt: p.expiresAt,
+                daysRemaining: daysRemaining(p.expiresAt),
+                keychain: p.keychain,
+            };
+        });
+        console.log(JSON.stringify(out, null, 2));
+        return 0;
+    }
+    if (names.length === 0) {
+        console.log(`No profiles yet. Create one with ${bold("ccprofile add <name>")}.`);
+        return 0;
+    }
+    assertDarwin();
+    const keychain = new Keychain();
+    const rows = [
+        [bold("NAME"), bold("EMAIL"), bold("TOKEN"), bold("EXPIRY")],
+    ];
+    for (const name of names) {
+        const p = config.profiles[name];
+        const present = await keychain.hasEntry(p.keychain.service, p.keychain.account);
+        rows.push([
+            name,
+            p.email ?? dim("-"),
+            present ? "stored" : red("missing"),
+            describeExpiry(daysRemaining(p.expiresAt), config.settings.expiryWarningDays),
+        ]);
+    }
+    console.log(table(rows));
+    return 0;
+}

package/dist/commands/remove.js

@@ -0,0 +1,39 @@
+import { parseArgs } from "node:util";
+import { loadConfig, saveConfig } from "../lib/config.js";
+import { Keychain, assertDarwin } from "../lib/keychain.js";
+import { bold, ok, warn } from "../lib/format.js";
+import { confirm } from "../lib/prompt.js";
+export async function removeCommand(argv) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        allowPositionals: true,
+        options: { force: { type: "boolean", default: false } },
+    });
+    const name = positionals[0];
+    if (!name) {
+        console.error("Usage: ccprofile remove <name> [--force]");
+        return 1;
+    }
+    const config = loadConfig();
+    const profile = config.profiles[name];
+    if (!profile) {
+        console.error(`Profile "${name}" does not exist.`);
+        return 1;
+    }
+    if (!values.force && process.stdin.isTTY) {
+        const yes = await confirm(`Delete profile ${bold(name)} and its Keychain token?`, false);
+        if (!yes)
+            return 1;
+    }
+    assertDarwin();
+    const keychain = new Keychain();
+    const deleted = await keychain.deleteToken(profile.keychain.service, profile.keychain.account);
+    if (!deleted) {
+        console.log(warn("Keychain entry was not found (already removed?). Continuing."));
+    }
+    delete config.profiles[name];
+    saveConfig(config);
+    console.log(ok(`Profile ${bold(name)} removed.`));
+    console.log("Note: any .envrc still referencing this profile will now export an empty token; run `ccprofile unlink <dir>` there.");
+    return 0;
+}

package/dist/commands/token.js

@@ -0,0 +1,26 @@
+import { parseArgs } from "node:util";
+import { loadConfig } from "../lib/config.js";
+import { Keychain, assertDarwin } from "../lib/keychain.js";
+export async function tokenCommand(argv) {
+    const { positionals } = parseArgs({ args: argv, allowPositionals: true, options: {} });
+    const name = positionals[0];
+    if (!name) {
+        console.error("Usage: ccprofile token <profile>");
+        return 1;
+    }
+    const config = loadConfig();
+    const profile = config.profiles[name];
+    if (!profile) {
+        console.error(`Profile "${name}" does not exist.`);
+        return 1;
+    }
+    assertDarwin();
+    const keychain = new Keychain();
+    const token = await keychain.getToken(profile.keychain.service, profile.keychain.account);
+    if (token === null) {
+        console.error(`No Keychain entry for profile "${name}". Re-run: ccprofile add ${name} --force`);
+        return 1;
+    }
+    process.stdout.write(`${token}\n`);
+    return 0;
+}

package/dist/commands/unlink.js

@@ -0,0 +1,29 @@
+import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { parseArgs } from "node:util";
+import { removeBlock } from "../lib/envrc.js";
+import { bold, ok } from "../lib/format.js";
+export async function unlinkCommand(argv) {
+    const { positionals } = parseArgs({ args: argv, allowPositionals: true, options: {} });
+    const dir = resolve(positionals[0] ?? process.cwd());
+    const envrcPath = join(dir, ".envrc");
+    if (!existsSync(envrcPath)) {
+        console.error(`No .envrc found in ${dir}.`);
+        return 1;
+    }
+    const current = readFileSync(envrcPath, "utf8");
+    const { content, removed } = removeBlock(current);
+    if (!removed) {
+        console.error(`No ccprofile-managed block found in ${envrcPath}.`);
+        return 1;
+    }
+    if (content.trim() === "") {
+        unlinkSync(envrcPath);
+        console.log(ok(`Removed ${bold(envrcPath)} (it contained only the ccprofile block).`));
+    }
+    else {
+        writeFileSync(envrcPath, content);
+        console.log(ok(`Removed the ccprofile block from ${bold(envrcPath)}.`));
+    }
+    return 0;
+}

package/dist/index.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module";
+import { bold, cyan } from "./lib/format.js";
+const require = createRequire(import.meta.url);
+const HELP = `${bold("ccprofile")} — per-directory Claude Code account routing
+
+Tokens live in the macOS Keychain; profile metadata lives in ~/.ccprofile/config.json.
+Linked directories get a self-contained .envrc that direnv loads on entry, so
+parallel sessions with different accounts never share mutable auth state.
+
+${bold("Usage")}
+  ccprofile <command> [options]
+
+${bold("Commands")}
+  add <name>              Register a profile (runs ${cyan("claude setup-token")}, stores the token)
+      --email <email>     Attach the account email as metadata
+      --expires-at <iso>  Override the recorded expiry (default: +365 days)
+      --token <token>     Provide the token directly (skips prompts)
+      --force             Overwrite an existing profile
+  list [--json]           Show profiles, token presence, and expiry
+  link <name> [dir]       Route a directory to a profile (writes .envrc, direnv allow)
+  unlink [dir]            Remove the managed block from a directory's .envrc
+  token <name>            Print the stored token (for scripting; handle with care)
+  remove <name> [--force] Delete a profile and its Keychain entry
+  doctor [dir]            Diagnose overriding env vars, expiry, token liveness,
+      --offline           and broken links; --offline skips the server probe
+  completion <shell>      Print a completion script (fish, zsh, bash)
+
+${bold("Typical flow")}
+  ccprofile add work --email you@company.example
+  ccprofile link work ~/src/my-project
+  cd ~/src/my-project && claude   # runs as "work" via CLAUDE_CODE_OAUTH_TOKEN
+`;
+async function main() {
+    const [command, ...rest] = process.argv.slice(2);
+    switch (command) {
+        case "add":
+            return (await import("./commands/add.js")).addCommand(rest);
+        case "list":
+        case "ls":
+            return (await import("./commands/list.js")).listCommand(rest);
+        case "remove":
+        case "rm":
+            return (await import("./commands/remove.js")).removeCommand(rest);
+        case "link":
+            return (await import("./commands/link.js")).linkCommand(rest);
+        case "unlink":
+            return (await import("./commands/unlink.js")).unlinkCommand(rest);
+        case "token":
+            return (await import("./commands/token.js")).tokenCommand(rest);
+        case "doctor":
+            return (await import("./commands/doctor.js")).doctorCommand(rest);
+        case "completion":
+            return (await import("./commands/completion.js")).completionCommand(rest);
+        // Hidden helper for shell completions: prints profile names, one per line.
+        case "_profiles": {
+            const { loadConfig } = await import("./lib/config.js");
+            for (const name of Object.keys(loadConfig().profiles).sort()) {
+                console.log(name);
+            }
+            return 0;
+        }
+        case "--version":
+        case "-v": {
+            const pkg = require("../package.json");
+            console.log(pkg.version);
+            return 0;
+        }
+        case undefined:
+        case "help":
+        case "--help":
+        case "-h":
+            console.log(HELP);
+            return command === undefined ? 1 : 0;
+        default:
+            console.error(`Unknown command: ${command}\n`);
+            console.log(HELP);
+            return 1;
+    }
+}
+main()
+    .then((code) => {
+    process.exitCode = code;
+})
+    .catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+});

package/dist/lib/config.js

@@ -0,0 +1,59 @@
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+export const KEYCHAIN_SERVICE = "ccprofile";
+export const DEFAULT_EXPIRY_DAYS = 365;
+export const DEFAULT_EXPIRY_WARNING_DAYS = 30;
+export function defaultConfig() {
+    return {
+        version: 1,
+        settings: { expiryWarningDays: DEFAULT_EXPIRY_WARNING_DAYS },
+        profiles: {},
+    };
+}
+export function configDir() {
+    return process.env.CCPROFILE_DIR ?? join(homedir(), ".ccprofile");
+}
+export function configPath() {
+    return join(configDir(), "config.json");
+}
+export function loadConfig() {
+    let raw;
+    try {
+        raw = readFileSync(configPath(), "utf8");
+    }
+    catch {
+        return defaultConfig();
+    }
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== 1) {
+        throw new Error(`Unsupported config version ${String(parsed.version)} in ${configPath()}`);
+    }
+    return {
+        ...defaultConfig(),
+        ...parsed,
+        settings: { ...defaultConfig().settings, ...parsed.settings },
+        profiles: parsed.profiles ?? {},
+    };
+}
+export function saveConfig(config) {
+    mkdirSync(configDir(), { recursive: true, mode: 0o700 });
+    writeFileSync(configPath(), `${JSON.stringify(config, null, 2)}\n`, {
+        mode: 0o600,
+    });
+}
+const PROFILE_NAME_RE = /^[a-z0-9][a-z0-9._-]*$/;
+export function validateProfileName(name) {
+    if (!PROFILE_NAME_RE.test(name)) {
+        throw new Error(`Invalid profile name "${name}". Use lowercase letters, digits, ".", "_" or "-" (must start with a letter or digit).`);
+    }
+}
+export function computeExpiresAt(from, days = DEFAULT_EXPIRY_DAYS) {
+    const d = new Date(from.getTime());
+    d.setUTCDate(d.getUTCDate() + days);
+    return d.toISOString();
+}
+export function daysRemaining(expiresAt, now = new Date()) {
+    const ms = new Date(expiresAt).getTime() - now.getTime();
+    return Math.floor(ms / 86_400_000);
+}

package/dist/lib/envrc.js

@@ -0,0 +1,42 @@
+const BEGIN = "# >>> ccprofile managed >>>";
+const END = "# <<< ccprofile managed <<<";
+const BLOCK_RE = new RegExp(`${escapeRe(BEGIN)}[\\s\\S]*?${escapeRe(END)}\\n?`);
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * The generated block is self-contained on purpose: direnv evaluates .envrc
+ * on every directory entry, so it must not depend on node/npx being invoked.
+ */
+export function renderBlock(profile, service, account) {
+    return [
+        BEGIN,
+        `# profile: ${profile}`,
+        `export CLAUDE_CODE_OAUTH_TOKEN="$(security find-generic-password -w -s '${service}' -a '${account}' 2>/dev/null)"`,
+        END,
+        "",
+    ].join("\n");
+}
+export function upsertBlock(content, block) {
+    if (BLOCK_RE.test(content)) {
+        return content.replace(BLOCK_RE, block);
+    }
+    if (content.trim() === "")
+        return block;
+    const sep = content.endsWith("\n") ? "\n" : "\n\n";
+    return `${content}${sep}${block}`;
+}
+export function removeBlock(content) {
+    if (!BLOCK_RE.test(content)) {
+        return { content, removed: false };
+    }
+    const next = content.replace(BLOCK_RE, "").replace(/\n{3,}/g, "\n\n");
+    return { content: next, removed: true };
+}
+export function parseLinkedProfile(content) {
+    const match = BLOCK_RE.exec(content);
+    if (!match)
+        return null;
+    const inner = /^# profile: (.+)$/m.exec(match[0]);
+    return inner?.[1]?.trim() ?? null;
+}

package/dist/lib/format.js

@@ -0,0 +1,40 @@
+const ESC = "\u001B";
+const useColor = process.stdout.isTTY && process.env.NO_COLOR === undefined;
+function paint(code, s) {
+    return useColor ? `${ESC}[${code}m${s}${ESC}[0m` : s;
+}
+export const bold = (s) => paint("1", s);
+export const dim = (s) => paint("2", s);
+export const red = (s) => paint("31", s);
+export const green = (s) => paint("32", s);
+export const yellow = (s) => paint("33", s);
+export const cyan = (s) => paint("36", s);
+export const ok = (s) => `${green("✓")} ${s}`;
+export const warn = (s) => `${yellow("⚠")} ${s}`;
+export const fail = (s) => `${red("✗")} ${s}`;
+function stripAnsi(s) {
+    return s.replaceAll(new RegExp(`${ESC}\\[[0-9;]*m`, "g"), "");
+}
+export function table(rows) {
+    if (rows.length === 0)
+        return "";
+    const widths = [];
+    for (const row of rows) {
+        row.forEach((cell, i) => {
+            widths[i] = Math.max(widths[i] ?? 0, stripAnsi(cell).length);
+        });
+    }
+    return rows
+        .map((row) => row
+        .map((cell, i) => cell + " ".repeat((widths[i] ?? 0) - stripAnsi(cell).length))
+        .join("  ")
+        .trimEnd())
+        .join("\n");
+}
+export function describeExpiry(days, warningDays) {
+    if (days < 0)
+        return red(`expired ${-days}d ago`);
+    if (days <= warningDays)
+        return yellow(`expires in ${days}d`);
+    return green(`expires in ${days}d`);
+}

package/dist/lib/keychain.js

@@ -0,0 +1,91 @@
+import { spawn } from "node:child_process";
+export const defaultRunner = (cmd, args, opts) => new Promise((resolve, reject) => {
+    const child = spawn(cmd, args, { stdio: ["pipe", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (d) => (stdout += d.toString()));
+    child.stderr.on("data", (d) => (stderr += d.toString()));
+    child.on("error", reject);
+    child.on("close", (code) => resolve({ code: code ?? -1, stdout, stderr }));
+    if (opts?.stdinData !== undefined) {
+        child.stdin.write(opts.stdinData);
+    }
+    child.stdin.end();
+});
+// The `security -i` batch parser and the generated .envrc both consume these
+// values unquoted, so the charset must stay shell- and parser-safe.
+const SAFE_VALUE_RE = /^[A-Za-z0-9._-]+$/;
+function assertSafe(label, value) {
+    if (!SAFE_VALUE_RE.test(value)) {
+        throw new Error(`${label} contains unsupported characters (allowed: letters, digits, ".", "_", "-").`);
+    }
+}
+export function assertDarwin() {
+    if (process.platform !== "darwin") {
+        throw new Error("ccprofile currently supports macOS only (tokens are stored in the macOS Keychain).");
+    }
+}
+export class Keychain {
+    run;
+    constructor(run = defaultRunner) {
+        this.run = run;
+    }
+    /**
+     * Stores the token via `security -i` (commands over stdin) so the secret
+     * never appears in the process argument list visible to `ps`.
+     * Write is verified with a read-back because `security -i` exit codes do
+     * not reliably reflect per-command failures.
+     */
+    async setToken(service, account, token) {
+        assertSafe("service", service);
+        assertSafe("account", account);
+        assertSafe("token", token);
+        await this.run("security", ["-i"], {
+            stdinData: `add-generic-password -U -s ${service} -a ${account} -w ${token}\n`,
+        });
+        const readBack = await this.getToken(service, account);
+        if (readBack !== token) {
+            throw new Error(`Failed to store the token in the Keychain (service=${service}, account=${account}).`);
+        }
+    }
+    async getToken(service, account) {
+        assertSafe("service", service);
+        assertSafe("account", account);
+        const result = await this.run("security", [
+            "find-generic-password",
+            "-w",
+            "-s",
+            service,
+            "-a",
+            account,
+        ]);
+        if (result.code !== 0)
+            return null;
+        return result.stdout.replace(/\n$/, "");
+    }
+    /** Presence check without reading the secret value. */
+    async hasEntry(service, account) {
+        assertSafe("service", service);
+        assertSafe("account", account);
+        const result = await this.run("security", [
+            "find-generic-password",
+            "-s",
+            service,
+            "-a",
+            account,
+        ]);
+        return result.code === 0;
+    }
+    async deleteToken(service, account) {
+        assertSafe("service", service);
+        assertSafe("account", account);
+        const result = await this.run("security", [
+            "delete-generic-password",
+            "-s",
+            service,
+            "-a",
+            account,
+        ]);
+        return result.code === 0;
+    }
+}

package/dist/lib/probe.js

@@ -0,0 +1,53 @@
+const PROFILE_ENDPOINT = "https://api.anthropic.com/api/oauth/profile";
+/**
+ * Distinguishes live tokens from revoked ones using the OAuth profile
+ * endpoint. setup-token tokens are inference-only by design, so a scope
+ * rejection (permission_error) proves the token authenticated successfully
+ * — that is the expected "alive" signal, not a failure. See
+ * anthropics/claude-code#11985.
+ */
+export async function probeToken(token, fetchFn = fetch) {
+    let res;
+    try {
+        res = await fetchFn(PROFILE_ENDPOINT, {
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "anthropic-beta": "oauth-2025-04-20",
+            },
+        });
+    }
+    catch (error) {
+        return {
+            status: "unknown",
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+    if (res.ok) {
+        // Tokens with the user:profile scope (not setup-token) get account info.
+        try {
+            const body = (await res.json());
+            const email = body.account?.email ?? body.account?.email_address;
+            return email ? { status: "alive", email } : { status: "alive" };
+        }
+        catch {
+            return { status: "alive" };
+        }
+    }
+    let errType = "";
+    let message = "";
+    try {
+        const body = (await res.json());
+        errType = body.error?.type ?? "";
+        message = body.error?.message ?? "";
+    }
+    catch {
+        // non-JSON error body
+    }
+    if (errType === "permission_error" && message.includes("scope")) {
+        return { status: "alive" };
+    }
+    if (res.status === 401 || errType === "authentication_error") {
+        return { status: "invalid", detail: message || `HTTP ${res.status}` };
+    }
+    return { status: "unknown", detail: message || `HTTP ${res.status}` };
+}

package/dist/lib/prompt.js

@@ -0,0 +1,71 @@
+import { createInterface } from "node:readline/promises";
+import { stdin, stdout } from "node:process";
+export async function ask(question) {
+    const rl = createInterface({ input: stdin, output: stdout });
+    try {
+        return (await rl.question(question)).trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+export async function confirm(question, defaultYes = true) {
+    const hint = defaultYes ? "[Y/n]" : "[y/N]";
+    const answer = (await ask(`${question} ${hint} `)).toLowerCase();
+    if (answer === "")
+        return defaultYes;
+    return answer === "y" || answer === "yes";
+}
+/** Reads a line without echoing it (for token paste). */
+export function askHidden(question) {
+    return new Promise((resolve, reject) => {
+        if (!stdin.isTTY) {
+            // Piped input: fall back to reading a single line.
+            let buf = "";
+            stdin.setEncoding("utf8");
+            stdin.on("data", (chunk) => {
+                buf += chunk;
+                const nl = buf.indexOf("\n");
+                if (nl !== -1) {
+                    stdin.pause();
+                    resolve(buf.slice(0, nl).trim());
+                }
+            });
+            stdin.on("end", () => resolve(buf.trim()));
+            stdin.on("error", reject);
+            return;
+        }
+        stdout.write(question);
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.setEncoding("utf8");
+        let value = "";
+        const onData = (chunk) => {
+            for (const ch of chunk) {
+                if (ch === "") {
+                    // Ctrl-C
+                    cleanup();
+                    stdout.write("\n");
+                    process.exit(130);
+                }
+                if (ch === "\r" || ch === "\n") {
+                    cleanup();
+                    stdout.write("\n");
+                    resolve(value.trim());
+                    return;
+                }
+                if (ch === "" || ch === "\b") {
+                    value = value.slice(0, -1);
+                    continue;
+                }
+                value += ch;
+            }
+        };
+        const cleanup = () => {
+            stdin.setRawMode(false);
+            stdin.pause();
+            stdin.off("data", onData);
+        };
+        stdin.on("data", onData);
+    });
+}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@efoo/ccprofile",
+  "version": "0.1.0",
+  "description": "Per-directory Claude Code account routing via CLAUDE_CODE_OAUTH_TOKEN, direnv, and macOS Keychain",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/efoo-team/ccprofile.git"
+  },
+  "homepage": "https://github.com/efoo-team/ccprofile#readme",
+  "bugs": {
+    "url": "https://github.com/efoo-team/ccprofile/issues"
+  },
+  "keywords": [
+    "claude",
+    "claude-code",
+    "account",
+    "profile",
+    "direnv",
+    "keychain",
+    "cli"
+  ],
+  "bin": {
+    "ccprofile": "./dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepublishOnly": "pnpm run build"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0"
+  }
+}