@heossi/qnsi 0.3.2

package/dist/cli/utils/backend-validator.js

@@ -0,0 +1,72 @@
+import { EXIT_CODES } from "../config.js";
+import { printError } from "./output.js";
+const CLOUD_PORTAL_URL = process.env["QNSP_CLOUD_PORTAL_URL"] ?? "https://cloud.qnsp.cuilabs.io";
+export function handleBackendError(response, body) {
+    const error = body;
+    switch (response.status) {
+        case 429: // Rate Limited
+            printError(`🚫 Rate limit exceeded for your tier (${error.tier || "unknown"}).\n` +
+                `Limit: ${error.limit || "N/A"} requests per minute\n` +
+                `Remaining: ${error.remaining || 0}\n` +
+                `Retry after: ${error.retryAfter || 60}s\n\n` +
+                `💡 Upgrade your tier for higher limits: ${CLOUD_PORTAL_URL}/billing/upgrade`);
+            process.exit(EXIT_CODES.RATE_LIMITED);
+            return;
+        case 402: // Payment Required
+            printError(`💳 Payment required: ${error.message}\n\n` +
+                `This feature requires a paid tier or add-on.\n` +
+                `Current tier: ${error.tier || "unknown"}\n` +
+                `Required: ${error.requiredTier || error.requiredAddOn || "unknown"}\n\n` +
+                `💡 Upgrade at: ${CLOUD_PORTAL_URL}/billing`);
+            process.exit(EXIT_CODES.AUTHORIZATION_ERROR);
+            return;
+        case 403: // Forbidden - Feature not enabled
+            if (error.requiredAddOn) {
+                printError(`🔒 Feature not enabled: ${error.message}\n\n` +
+                    `This requires the "${error.requiredAddOn}" add-on.\n` +
+                    `Current tier: ${error.tier || "unknown"}\n\n` +
+                    `💡 Enable add-ons at: ${CLOUD_PORTAL_URL}/billing/addons\n` +
+                    `⚠️  Note: Some add-ons require sales approval for security/compliance.`);
+            }
+            else {
+                printError(`🔒 Access denied: ${error.message}\n\n` +
+                    `You don't have permission for this operation.\n` +
+                    `Current tier: ${error.tier || "unknown"}\n` +
+                    `Required tier: ${error.requiredTier || "higher"}\n\n` +
+                    `💡 Upgrade at: ${CLOUD_PORTAL_URL}/billing/upgrade`);
+            }
+            process.exit(EXIT_CODES.AUTHORIZATION_ERROR);
+            return;
+        case 507: // Insufficient Storage / Quota Exceeded
+            printError(`📊 Quota exceeded: ${error.message}\n\n` +
+                `You've reached your tier limit.\n` +
+                `Current tier: ${error.tier || "unknown"}\n\n` +
+                `💡 Options:\n` +
+                `  1. Upgrade your tier: ${CLOUD_PORTAL_URL}/billing/upgrade\n` +
+                `  2. Delete unused resources\n` +
+                `  3. Purchase additional capacity: ${CLOUD_PORTAL_URL}/billing/addons`);
+            process.exit(EXIT_CODES.GENERAL_ERROR);
+            return;
+        default:
+            printError(`❌ Backend error (${response.status}): ${error.message || "Unknown error"}`);
+            process.exit(EXIT_CODES.GENERAL_ERROR);
+            return;
+    }
+}
+export function parseRateLimitHeaders(headers) {
+    const limitRaw = headers.get("x-ratelimit-limit");
+    const remainingRaw = headers.get("x-ratelimit-remaining");
+    const resetRaw = headers.get("x-ratelimit-reset");
+    return {
+        limit: limitRaw ? Number.parseInt(limitRaw, 10) : null,
+        remaining: remainingRaw ? Number.parseInt(remainingRaw, 10) : null,
+        reset: resetRaw ? Number.parseInt(resetRaw, 10) : null,
+    };
+}
+export function warnIfLowQuota(remaining, limit) {
+    if (remaining !== null && limit !== null && remaining < limit * 0.1) {
+        console.warn(`⚠️  Warning: Low quota remaining (${remaining}/${limit}).\n` +
+            `Consider upgrading your tier or purchasing add-ons to avoid service interruption.`);
+    }
+}
+//# sourceMappingURL=backend-validator.js.map

package/dist/cli/utils/backend-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-validator.js","sourceRoot":"","sources":["../../../src/cli/utils/backend-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,+BAA+B,CAAC;AAcjG,MAAM,UAAU,kBAAkB,CAAC,QAAkB,EAAE,IAAa;IACnE,MAAM,KAAK,GAAG,IAA4B,CAAC;IAE3C,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzB,KAAK,GAAG,EAAE,eAAe;YACxB,UAAU,CACT,yCAAyC,KAAK,CAAC,IAAI,IAAI,SAAS,MAAM;gBACrE,UAAU,KAAK,CAAC,KAAK,IAAI,KAAK,wBAAwB;gBACtD,cAAc,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI;gBACtC,gBAAgB,KAAK,CAAC,UAAU,IAAI,EAAE,OAAO;gBAC7C,2CAA2C,gBAAgB,kBAAkB,CAC9E,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YACtC,OAAO;QAER,KAAK,GAAG,EAAE,mBAAmB;YAC5B,UAAU,CACT,wBAAwB,KAAK,CAAC,OAAO,MAAM;gBAC1C,gDAAgD;gBAChD,iBAAiB,KAAK,CAAC,IAAI,IAAI,SAAS,IAAI;gBAC5C,aAAa,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,aAAa,IAAI,SAAS,MAAM;gBACzE,kBAAkB,gBAAgB,UAAU,CAC7C,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;YAC7C,OAAO;QAER,KAAK,GAAG,EAAE,kCAAkC;YAC3C,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACzB,UAAU,CACT,2BAA2B,KAAK,CAAC,OAAO,MAAM;oBAC7C,sBAAsB,KAAK,CAAC,aAAa,aAAa;oBACtD,iBAAiB,KAAK,CAAC,IAAI,IAAI,SAAS,MAAM;oBAC9C,yBAAyB,gBAAgB,mBAAmB;oBAC5D,wEAAwE,CACzE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,UAAU,CACT,qBAAqB,KAAK,CAAC,OAAO,MAAM;oBACvC,iDAAiD;oBACjD,iBAAiB,KAAK,CAAC,IAAI,IAAI,SAAS,IAAI;oBAC5C,kBAAkB,KAAK,CAAC,YAAY,IAAI,QAAQ,MAAM;oBACtD,kBAAkB,gBAAgB,kBAAkB,CACrD,CAAC;YACH,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;YAC7C,OAAO;QAER,KAAK,GAAG,EAAE,wCAAwC;YACjD,UAAU,CACT,sBAAsB,KAAK,CAAC,OAAO,MAAM;gBACxC,mCAAmC;gBACnC,iBAAiB,KAAK,CAAC,IAAI,IAAI,SAAS,MAAM;gBAC9C,eAAe;gBACf,2BAA2B,gBAAgB,oBAAoB;gBAC/D,gCAAgC;gBAChC,sCAAsC,gBAAgB,iBAAiB,CACxE,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACvC,OAAO;QAER;YACC,UAAU,CAAC,oBAAoB,QAAQ,CAAC,MAAM,MAAM,KAAK,CAAC,OAAO,IAAI,eAAe,EAAE,CAAC,CAAC;YACxF,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACvC,OAAO;IACT,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IAKrD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAElD,OAAO;QACN,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QACtD,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QAClE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;KACtD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAwB,EAAE,KAAoB;IAC5E,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,GAAG,KAAK,GAAG,GAAG,EAAE,CAAC;QACrE,OAAO,CAAC,IAAI,CACX,qCAAqC,SAAS,IAAI,KAAK,MAAM;YAC5D,mFAAmF,CACpF,CAAC;IACH,CAAC;AACF,CAAC"}

package/dist/cli/utils/command-config.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from "commander";
+import type { CliConfig } from "../config.js";
+export declare function getEffectiveConfig(baseConfig: CliConfig, command: Command): CliConfig;
+//# sourceMappingURL=command-config.d.ts.map

package/dist/cli/utils/command-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-config.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/command-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAG9C,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,SAAS,CAqCrF"}

package/dist/cli/utils/command-config.js

@@ -0,0 +1,29 @@
+import { loadConfig } from "../config.js";
+export function getEffectiveConfig(baseConfig, command) {
+    const globals = command.optsWithGlobals();
+    return loadConfig({
+        ...baseConfig,
+        edgeGatewayUrl: globals["edgeGatewayUrl"] ?? baseConfig.edgeGatewayUrl,
+        cloudPortalUrl: globals["cloudPortalUrl"] ?? baseConfig.cloudPortalUrl,
+        authServiceUrl: globals["authServiceUrl"] ?? baseConfig.authServiceUrl,
+        serviceId: globals["serviceId"] ?? baseConfig.serviceId,
+        serviceSecret: globals["serviceSecret"] ?? baseConfig.serviceSecret,
+        tenantId: globals["tenantId"] ?? baseConfig.tenantId,
+        kmsServiceUrl: globals["kmsServiceUrl"] ?? baseConfig.kmsServiceUrl,
+        vaultServiceUrl: globals["vaultServiceUrl"] ?? baseConfig.vaultServiceUrl,
+        auditServiceUrl: globals["auditServiceUrl"] ?? baseConfig.auditServiceUrl,
+        tenantServiceUrl: globals["tenantServiceUrl"] ?? baseConfig.tenantServiceUrl,
+        billingServiceUrl: globals["billingServiceUrl"] ?? baseConfig.billingServiceUrl,
+        accessControlServiceUrl: globals["accessControlServiceUrl"] ??
+            baseConfig.accessControlServiceUrl,
+        securityMonitoringServiceUrl: globals["securityMonitoringServiceUrl"] ??
+            baseConfig.securityMonitoringServiceUrl,
+        storageServiceUrl: globals["storageServiceUrl"] ?? baseConfig.storageServiceUrl,
+        searchServiceUrl: globals["searchServiceUrl"] ?? baseConfig.searchServiceUrl,
+        observabilityServiceUrl: globals["observabilityServiceUrl"] ??
+            baseConfig.observabilityServiceUrl,
+        outputFormat: globals["output"] ?? baseConfig.outputFormat,
+        verbose: globals["verbose"] ?? baseConfig.verbose,
+    });
+}
+//# sourceMappingURL=command-config.js.map

package/dist/cli/utils/command-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-config.js","sourceRoot":"","sources":["../../../src/cli/utils/command-config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,UAAU,kBAAkB,CAAC,UAAqB,EAAE,OAAgB;IACzE,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,EAA6B,CAAC;IAErE,OAAO,UAAU,CAAC;QACjB,GAAG,UAAU;QACb,cAAc,EAAG,OAAO,CAAC,gBAAgB,CAAwB,IAAI,UAAU,CAAC,cAAc;QAC9F,cAAc,EAAG,OAAO,CAAC,gBAAgB,CAAwB,IAAI,UAAU,CAAC,cAAc;QAC9F,cAAc,EAAG,OAAO,CAAC,gBAAgB,CAAwB,IAAI,UAAU,CAAC,cAAc;QAC9F,SAAS,EAAG,OAAO,CAAC,WAAW,CAAwB,IAAI,UAAU,CAAC,SAAS;QAC/E,aAAa,EAAG,OAAO,CAAC,eAAe,CAAwB,IAAI,UAAU,CAAC,aAAa;QAC3F,QAAQ,EAAG,OAAO,CAAC,UAAU,CAAwB,IAAI,UAAU,CAAC,QAAQ;QAC5E,aAAa,EAAG,OAAO,CAAC,eAAe,CAAwB,IAAI,UAAU,CAAC,aAAa;QAC3F,eAAe,EACb,OAAO,CAAC,iBAAiB,CAAwB,IAAI,UAAU,CAAC,eAAe;QACjF,eAAe,EACb,OAAO,CAAC,iBAAiB,CAAwB,IAAI,UAAU,CAAC,eAAe;QACjF,gBAAgB,EACd,OAAO,CAAC,kBAAkB,CAAwB,IAAI,UAAU,CAAC,gBAAgB;QACnF,iBAAiB,EACf,OAAO,CAAC,mBAAmB,CAAwB,IAAI,UAAU,CAAC,iBAAiB;QACrF,uBAAuB,EACrB,OAAO,CAAC,yBAAyB,CAAwB;YAC1D,UAAU,CAAC,uBAAuB;QACnC,4BAA4B,EAC1B,OAAO,CAAC,8BAA8B,CAAwB;YAC/D,UAAU,CAAC,4BAA4B;QACxC,iBAAiB,EACf,OAAO,CAAC,mBAAmB,CAAwB,IAAI,UAAU,CAAC,iBAAiB;QACrF,gBAAgB,EACd,OAAO,CAAC,kBAAkB,CAAwB,IAAI,UAAU,CAAC,gBAAgB;QACnF,uBAAuB,EACrB,OAAO,CAAC,yBAAyB,CAAwB;YAC1D,UAAU,CAAC,uBAAuB;QACnC,YAAY,EACV,OAAO,CAAC,QAAQ,CAA2C,IAAI,UAAU,CAAC,YAAY;QACxF,OAAO,EAAG,OAAO,CAAC,SAAS,CAAyB,IAAI,UAAU,CAAC,OAAO;KAC1E,CAAC,CAAC;AACJ,CAAC"}

package/dist/cli/utils/fetcher.d.ts

@@ -0,0 +1,3 @@
+import type { CliConfig } from "../config.js";
+export declare function fetchWithBackendHandling(_config: CliConfig, input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]): Promise<Response>;
+//# sourceMappingURL=fetcher.d.ts.map

package/dist/cli/utils/fetcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetcher.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/fetcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAM9C,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,SAAS,EAClB,KAAK,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAClC,IAAI,CAAC,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAChC,OAAO,CAAC,QAAQ,CAAC,CA4BnB"}

package/dist/cli/utils/fetcher.js

@@ -0,0 +1,30 @@
+import { handleBackendError, parseRateLimitHeaders, warnIfLowQuota } from "./backend-validator.js";
+const ENFORCEMENT_STATUSES = new Set([429, 402, 403, 507]);
+export async function fetchWithBackendHandling(_config, input, init) {
+    const response = await fetch(input, init);
+    if (!response.ok && ENFORCEMENT_STATUSES.has(response.status)) {
+        const errorText = typeof response.clone === "function"
+            ? await response.clone().text()
+            : await response.text();
+        let errorBody;
+        try {
+            errorBody = JSON.parse(errorText);
+        }
+        catch {
+            errorBody = { error: "unknown", message: errorText };
+        }
+        handleBackendError(response, errorBody);
+    }
+    try {
+        const headers = response.headers;
+        if (headers && typeof headers.get === "function") {
+            const rateLimits = parseRateLimitHeaders(headers);
+            warnIfLowQuota(rateLimits.remaining, rateLimits.limit);
+        }
+    }
+    catch {
+        // ignore non-standard/mocked responses
+    }
+    return response;
+}
+//# sourceMappingURL=fetcher.js.map

package/dist/cli/utils/fetcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetcher.js","sourceRoot":"","sources":["../../../src/cli/utils/fetcher.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAEnG,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE3D,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAAkB,EAClB,KAAkC,EAClC,IAAkC;IAElC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAE1C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,MAAM,SAAS,GACd,OAAQ,QAAqB,CAAC,KAAK,KAAK,UAAU;YACjD,CAAC,CAAC,MAAO,QAAqB,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE;YAC7C,CAAC,CAAC,MAAO,QAAqB,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,SAAkB,CAAC;QACvB,IAAI,CAAC;YACJ,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACR,SAAS,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC;QACD,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,OAAO,GAAI,QAAkC,CAAC,OAAO,CAAC;QAC5D,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAClD,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAClD,cAAc,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,uCAAuC;IACxC,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/cli/utils/https-validator.d.ts

@@ -0,0 +1,9 @@
+export declare function validateHttpsUrl(url: string, context: string, nodeEnv?: string): void;
+export declare function isLocalhostUrl(url: string): boolean;
+export declare function validateAllServiceUrls(config: {
+    authServiceUrl: string;
+    kmsServiceUrl: string;
+    vaultServiceUrl: string;
+    auditServiceUrl: string;
+}): void;
+//# sourceMappingURL=https-validator.d.ts.map

package/dist/cli/utils/https-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"https-validator.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/https-validator.ts"],"names":[],"mappings":"AAGA,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,SAAe,GAAG,IAAI,CAiB3F;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAYnD;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACxB,GAAG,IAAI,CAOP"}

package/dist/cli/utils/https-validator.js

@@ -0,0 +1,35 @@
+import { EXIT_CODES } from "../config.js";
+import { printError } from "./output.js";
+export function validateHttpsUrl(url, context, nodeEnv = "production") {
+    if (nodeEnv === "production" && !url.startsWith("https://")) {
+        printError(`${context} requires an https:// URL when NODE_ENV=production. Got: ${url}\n` +
+            "Use --auth-service-url with https:// or set NODE_ENV=development for testing.");
+        process.exit(EXIT_CODES.INVALID_ARGUMENTS);
+        return;
+    }
+    if (url.startsWith("http://") && !isLocalhostUrl(url) && nodeEnv !== "development") {
+        printError(`Warning: ${context} is using unencrypted HTTP. This is insecure.\n` +
+            `URL: ${url}\n` +
+            "Consider using HTTPS or set NODE_ENV=development to suppress this warning.");
+    }
+}
+export function isLocalhostUrl(url) {
+    try {
+        const parsed = new URL(url);
+        return (parsed.hostname === "localhost" ||
+            parsed.hostname === "127.0.0.1" ||
+            parsed.hostname === "::1" ||
+            parsed.hostname.endsWith(".local"));
+    }
+    catch {
+        return false;
+    }
+}
+export function validateAllServiceUrls(config) {
+    const nodeEnv = process.env["NODE_ENV"] ?? "production";
+    validateHttpsUrl(config.authServiceUrl, "Auth service URL", nodeEnv);
+    validateHttpsUrl(config.kmsServiceUrl, "KMS service URL", nodeEnv);
+    validateHttpsUrl(config.vaultServiceUrl, "Vault service URL", nodeEnv);
+    validateHttpsUrl(config.auditServiceUrl, "Audit service URL", nodeEnv);
+}
+//# sourceMappingURL=https-validator.js.map

package/dist/cli/utils/https-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"https-validator.js","sourceRoot":"","sources":["../../../src/cli/utils/https-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,OAAe,EAAE,OAAO,GAAG,YAAY;IACpF,IAAI,OAAO,KAAK,YAAY,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,UAAU,CACT,GAAG,OAAO,4DAA4D,GAAG,IAAI;YAC5E,+EAA+E,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAC3C,OAAO;IACR,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QACpF,UAAU,CACT,YAAY,OAAO,iDAAiD;YACnE,QAAQ,GAAG,IAAI;YACf,4EAA4E,CAC7E,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,CACN,MAAM,CAAC,QAAQ,KAAK,WAAW;YAC/B,MAAM,CAAC,QAAQ,KAAK,WAAW;YAC/B,MAAM,CAAC,QAAQ,KAAK,KAAK;YACzB,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAKtC;IACA,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,YAAY,CAAC;IAExD,gBAAgB,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACrE,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACnE,gBAAgB,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACvE,gBAAgB,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC"}

package/dist/cli/utils/output.d.ts

@@ -0,0 +1,6 @@
+export declare function printJson(data: unknown): void;
+export declare function printTable(data: Record<string, unknown>[] | Record<string, unknown>): void;
+export declare function printError(message: string): void;
+export declare function printSuccess(message: string): void;
+export declare function printVerbose(message: string, verbose: boolean): void;
+//# sourceMappingURL=output.d.ts.map

package/dist/cli/utils/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/output.ts"],"names":[],"mappings":"AAEA,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAE7C;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAU1F;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEhD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAElD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAKpE"}

package/dist/cli/utils/output.js

@@ -0,0 +1,29 @@
+import { sanitizeOutput } from "./sanitize.js";
+export function printJson(data) {
+    console.log(JSON.stringify(data, null, 2));
+}
+export function printTable(data) {
+    if (Array.isArray(data)) {
+        if (data.length === 0) {
+            console.log("No results");
+            return;
+        }
+        console.table(data);
+    }
+    else {
+        console.table([data]);
+    }
+}
+export function printError(message) {
+    console.error(`Error: ${message}`);
+}
+export function printSuccess(message) {
+    console.log(`✓ ${message}`);
+}
+export function printVerbose(message, verbose) {
+    if (verbose) {
+        const sanitized = sanitizeOutput(message);
+        console.log(`[DEBUG] ${sanitized}`);
+    }
+}
+//# sourceMappingURL=output.js.map

package/dist/cli/utils/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../../src/cli/utils/output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,UAAU,SAAS,CAAC,IAAa;IACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAyD;IACnF,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC1B,OAAO;QACR,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAe;IACzC,OAAO,CAAC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAe;IAC3C,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,OAAgB;IAC7D,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,WAAW,SAAS,EAAE,CAAC,CAAC;IACrC,CAAC;AACF,CAAC"}

package/dist/cli/utils/pqc-validator.d.ts

@@ -0,0 +1,17 @@
+export declare const APPROVED_PQC_ALGORITHMS: {
+    readonly signature: readonly ["dilithium-2", "dilithium-3", "dilithium-5", "falcon-512", "falcon-1024", "sphincs-sha2-128f"];
+    readonly kem: readonly ["kyber-512", "kyber-768", "kyber-1024"];
+};
+export type ApprovedSignatureAlgorithm = (typeof APPROVED_PQC_ALGORITHMS.signature)[number];
+export type ApprovedKemAlgorithm = (typeof APPROVED_PQC_ALGORITHMS.kem)[number];
+export declare function validatePqcAlgorithm(algorithm: string, type: "signature" | "kem"): algorithm is ApprovedSignatureAlgorithm | ApprovedKemAlgorithm;
+export declare function getRecommendedPqcAlgorithm(securityLevel: 1 | 3 | 5, type: "signature" | "kem"): string;
+export interface PqcSecurityProfile {
+    readonly signatureAlgorithm: ApprovedSignatureAlgorithm;
+    readonly kemAlgorithm: ApprovedKemAlgorithm;
+    readonly securityLevel: 1 | 3 | 5;
+    readonly hybridMode: boolean;
+}
+export declare function getDefaultSecurityProfile(): PqcSecurityProfile;
+export declare function validateSecurityProfile(profile: Partial<PqcSecurityProfile>): string[];
+//# sourceMappingURL=pqc-validator.d.ts.map

package/dist/cli/utils/pqc-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pqc-validator.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/pqc-validator.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB;;;CAU1B,CAAC;AAEX,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,uBAAuB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAC5F,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF,wBAAgB,oBAAoB,CACnC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,WAAW,GAAG,KAAK,GACvB,SAAS,IAAI,0BAA0B,GAAG,oBAAoB,CAGhE;AAED,wBAAgB,0BAA0B,CACzC,aAAa,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EACxB,IAAI,EAAE,WAAW,GAAG,KAAK,GACvB,MAAM,CAoBR;AAED,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,kBAAkB,EAAE,0BAA0B,CAAC;IACxD,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC7B;AAED,wBAAgB,yBAAyB,IAAI,kBAAkB,CAO9D;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,EAAE,CAyBtF"}

package/dist/cli/utils/pqc-validator.js

@@ -0,0 +1,62 @@
+export const APPROVED_PQC_ALGORITHMS = {
+    signature: [
+        "dilithium-2",
+        "dilithium-3",
+        "dilithium-5",
+        "falcon-512",
+        "falcon-1024",
+        "sphincs-sha2-128f",
+    ],
+    kem: ["kyber-512", "kyber-768", "kyber-1024"],
+};
+export function validatePqcAlgorithm(algorithm, type) {
+    const approved = APPROVED_PQC_ALGORITHMS[type];
+    return approved.includes(algorithm);
+}
+export function getRecommendedPqcAlgorithm(securityLevel, type) {
+    if (type === "signature") {
+        switch (securityLevel) {
+            case 1:
+                return "dilithium-2";
+            case 3:
+                return "dilithium-3";
+            case 5:
+                return "dilithium-5";
+        }
+    }
+    else {
+        switch (securityLevel) {
+            case 1:
+                return "kyber-512";
+            case 3:
+                return "kyber-768";
+            case 5:
+                return "kyber-1024";
+        }
+    }
+}
+export function getDefaultSecurityProfile() {
+    return {
+        signatureAlgorithm: "dilithium-2",
+        kemAlgorithm: "kyber-768",
+        securityLevel: 3,
+        hybridMode: true,
+    };
+}
+export function validateSecurityProfile(profile) {
+    const errors = [];
+    if (profile.signatureAlgorithm &&
+        !validatePqcAlgorithm(profile.signatureAlgorithm, "signature")) {
+        errors.push(`Invalid signature algorithm: ${profile.signatureAlgorithm}. ` +
+            `Approved: ${APPROVED_PQC_ALGORITHMS.signature.join(", ")}`);
+    }
+    if (profile.kemAlgorithm && !validatePqcAlgorithm(profile.kemAlgorithm, "kem")) {
+        errors.push(`Invalid KEM algorithm: ${profile.kemAlgorithm}. ` +
+            `Approved: ${APPROVED_PQC_ALGORITHMS.kem.join(", ")}`);
+    }
+    if (profile.securityLevel && ![1, 3, 5].includes(profile.securityLevel)) {
+        errors.push(`Invalid security level: ${profile.securityLevel}. Must be 1, 3, or 5.`);
+    }
+    return errors;
+}
+//# sourceMappingURL=pqc-validator.js.map

package/dist/cli/utils/pqc-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pqc-validator.js","sourceRoot":"","sources":["../../../src/cli/utils/pqc-validator.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACtC,SAAS,EAAE;QACV,aAAa;QACb,aAAa;QACb,aAAa;QACb,YAAY;QACZ,aAAa;QACb,mBAAmB;KACnB;IACD,GAAG,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC;CACpC,CAAC;AAKX,MAAM,UAAU,oBAAoB,CACnC,SAAiB,EACjB,IAAyB;IAEzB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO,QAAQ,CAAC,QAAQ,CAAC,SAAkB,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,0BAA0B,CACzC,aAAwB,EACxB,IAAyB;IAEzB,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC1B,QAAQ,aAAa,EAAE,CAAC;YACvB,KAAK,CAAC;gBACL,OAAO,aAAa,CAAC;YACtB,KAAK,CAAC;gBACL,OAAO,aAAa,CAAC;YACtB,KAAK,CAAC;gBACL,OAAO,aAAa,CAAC;QACvB,CAAC;IACF,CAAC;SAAM,CAAC;QACP,QAAQ,aAAa,EAAE,CAAC;YACvB,KAAK,CAAC;gBACL,OAAO,WAAW,CAAC;YACpB,KAAK,CAAC;gBACL,OAAO,WAAW,CAAC;YACpB,KAAK,CAAC;gBACL,OAAO,YAAY,CAAC;QACtB,CAAC;IACF,CAAC;AACF,CAAC;AASD,MAAM,UAAU,yBAAyB;IACxC,OAAO;QACN,kBAAkB,EAAE,aAAa;QACjC,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,CAAC;QAChB,UAAU,EAAE,IAAI;KAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAoC;IAC3E,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IACC,OAAO,CAAC,kBAAkB;QAC1B,CAAC,oBAAoB,CAAC,OAAO,CAAC,kBAAkB,EAAE,WAAW,CAAC,EAC7D,CAAC;QACF,MAAM,CAAC,IAAI,CACV,gCAAgC,OAAO,CAAC,kBAAkB,IAAI;YAC7D,aAAa,uBAAuB,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5D,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;QAChF,MAAM,CAAC,IAAI,CACV,0BAA0B,OAAO,CAAC,YAAY,IAAI;YACjD,aAAa,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,2BAA2B,OAAO,CAAC,aAAa,uBAAuB,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/cli/utils/prompt.d.ts

@@ -0,0 +1,4 @@
+export declare function promptForSecret(promptText?: string): Promise<string>;
+export declare function promptForInput(promptText: string): Promise<string>;
+export declare function promptForConfirmation(promptText: string): Promise<boolean>;
+//# sourceMappingURL=prompt.d.ts.map

package/dist/cli/utils/prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/prompt.ts"],"names":[],"mappings":"AAEA,wBAAsB,eAAe,CAAC,UAAU,SAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAYtF;AAED,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYxE;AAED,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGhF"}

package/dist/cli/utils/prompt.js

@@ -0,0 +1,30 @@
+import { createInterface } from "node:readline";
+export async function promptForSecret(promptText = "Service secret: ") {
+    return new Promise((resolve) => {
+        const rl = createInterface({
+            input: process.stdin,
+            output: process.stdout,
+        });
+        rl.question(promptText, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}
+export async function promptForInput(promptText) {
+    return new Promise((resolve) => {
+        const rl = createInterface({
+            input: process.stdin,
+            output: process.stdout,
+        });
+        rl.question(promptText, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}
+export async function promptForConfirmation(promptText) {
+    const answer = await promptForInput(`${promptText} (y/N): `);
+    return answer.toLowerCase() === "y" || answer.toLowerCase() === "yes";
+}
+//# sourceMappingURL=prompt.js.map

package/dist/cli/utils/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../../../src/cli/utils/prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAU,GAAG,kBAAkB;IACpE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,EAAE,GAAG,eAAe,CAAC;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE;YAClC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,EAAE,GAAG,eAAe,CAAC;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE;YAClC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAAkB;IAC7D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,UAAU,UAAU,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;AACvE,CAAC"}

package/dist/cli/utils/rate-limiter.d.ts

@@ -0,0 +1,15 @@
+export declare class RateLimiter {
+    private requests;
+    private readonly maxRequests;
+    private readonly windowMs;
+    private hasWarned;
+    constructor(maxRequests?: number, windowMs?: number);
+    checkLimit(): Promise<void>;
+    reset(): void;
+    getRemaining(): number;
+}
+export declare class RateLimitError extends Error {
+    readonly retryAfterMs: number;
+    constructor(message: string, retryAfterMs: number);
+}
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/cli/utils/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/rate-limiter.ts"],"names":[],"mappings":"AAAA,qBAAa,WAAW;IACvB,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,SAAS,CAAS;gBAEd,WAAW,SAAM,EAAE,QAAQ,SAAQ;IAKzC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BjC,KAAK,IAAI,IAAI;IAIb,YAAY,IAAI,MAAM;CAKtB;AAED,qBAAa,cAAe,SAAQ,KAAK;aAGvB,YAAY,EAAE,MAAM;gBADpC,OAAO,EAAE,MAAM,EACC,YAAY,EAAE,MAAM;CAKrC"}

package/dist/cli/utils/rate-limiter.js

@@ -0,0 +1,46 @@
+export class RateLimiter {
+    requests = [];
+    maxRequests;
+    windowMs;
+    hasWarned = false;
+    constructor(maxRequests = 100, windowMs = 60000) {
+        this.maxRequests = maxRequests;
+        this.windowMs = windowMs;
+    }
+    async checkLimit() {
+        const now = Date.now();
+        this.requests = this.requests.filter((timestamp) => now - timestamp < this.windowMs);
+        if (this.requests.length >= this.maxRequests * 0.8 && !this.hasWarned) {
+            console.warn(`⚠️  Warning: Approaching CLI rate limit (${this.requests.length}/${this.maxRequests} requests).\n` +
+                `This is a defensive limit to prevent accidental self-DoS.\n` +
+                `Your tier-based limits are enforced by backend services.`);
+            this.hasWarned = true;
+        }
+        if (this.requests.length >= this.maxRequests) {
+            const oldestRequest = this.requests[0];
+            const waitMs = this.windowMs - (now - (oldestRequest ?? now));
+            throw new RateLimitError(`🛡️  Defensive rate limit exceeded: ${this.maxRequests} requests per ${this.windowMs / 1000}s.\n` +
+                `This protects against runaway scripts and bugs.\n` +
+                `Your tier-based limits are enforced by backend services.\n` +
+                `Retry after ${Math.ceil(waitMs / 1000)}s`, waitMs);
+        }
+        this.requests.push(now);
+    }
+    reset() {
+        this.requests = [];
+    }
+    getRemaining() {
+        const now = Date.now();
+        this.requests = this.requests.filter((timestamp) => now - timestamp < this.windowMs);
+        return Math.max(0, this.maxRequests - this.requests.length);
+    }
+}
+export class RateLimitError extends Error {
+    retryAfterMs;
+    constructor(message, retryAfterMs) {
+        super(message);
+        this.retryAfterMs = retryAfterMs;
+        this.name = "RateLimitError";
+    }
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/cli/utils/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/cli/utils/rate-limiter.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,WAAW;IACf,QAAQ,GAAa,EAAE,CAAC;IACf,WAAW,CAAS;IACpB,QAAQ,CAAS;IAC1B,SAAS,GAAG,KAAK,CAAC;IAE1B,YAAY,WAAW,GAAG,GAAG,EAAE,QAAQ,GAAG,KAAK;QAC9C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,UAAU;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAErF,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACvE,OAAO,CAAC,IAAI,CACX,4CAA4C,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,eAAe;gBAClG,6DAA6D;gBAC7D,0DAA0D,CAC3D,CAAC;YACF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC,CAAC;YAC9D,MAAM,IAAI,cAAc,CACvB,uCAAuC,IAAI,CAAC,WAAW,iBAAiB,IAAI,CAAC,QAAQ,GAAG,IAAI,MAAM;gBACjG,mDAAmD;gBACnD,4DAA4D;gBAC5D,eAAe,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAC3C,MAAM,CACN,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK;QACJ,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,YAAY;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;CACD;AAED,MAAM,OAAO,cAAe,SAAQ,KAAK;IAGvB;IAFjB,YACC,OAAe,EACC,YAAoB;QAEpC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,iBAAY,GAAZ,YAAY,CAAQ;QAGpC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC9B,CAAC;CACD"}

package/dist/cli/utils/sanitize.d.ts

@@ -0,0 +1,3 @@
+export declare function sanitizeOutput(message: string): string;
+export declare function sanitizeHeaders(headers: Record<string, string>): Record<string, string>;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/cli/utils/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/sanitize.ts"],"names":[],"mappings":"AAWA,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAetD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBvF"}

package/dist/cli/utils/sanitize.js

@@ -0,0 +1,44 @@
+const SENSITIVE_PATTERNS = [
+    /Bearer\s+[A-Za-z0-9._-]+/gi,
+    /"accessToken"\s*:\s*"[^"]+"/gi,
+    /"token"\s*:\s*"[^"]+"/gi,
+    /"secret"\s*:\s*"[^"]+"/gi,
+    /"password"\s*:\s*"[^"]+"/gi,
+    /"apiKey"\s*:\s*"[^"]+"/gi,
+    /Authorization:\s*Bearer\s+[A-Za-z0-9._-]+/gi,
+    /x-api-key:\s*[A-Za-z0-9._-]+/gi,
+];
+export function sanitizeOutput(message) {
+    let sanitized = message;
+    for (const pattern of SENSITIVE_PATTERNS) {
+        sanitized = sanitized.replace(pattern, (match) => {
+            if (match.includes(":")) {
+                const [key] = match.split(":");
+                return `${key}: [REDACTED]`;
+            }
+            if (match.includes("Bearer")) {
+                return "Bearer [REDACTED]";
+            }
+            return match.replace(/"[^"]+"/g, '"[REDACTED]"');
+        });
+    }
+    return sanitized;
+}
+export function sanitizeHeaders(headers) {
+    const sanitized = {};
+    for (const [key, value] of Object.entries(headers)) {
+        const lowerKey = key.toLowerCase();
+        if (lowerKey.includes("authorization") ||
+            lowerKey.includes("token") ||
+            lowerKey.includes("secret") ||
+            lowerKey.includes("api-key") ||
+            lowerKey.includes("password")) {
+            sanitized[key] = "[REDACTED]";
+        }
+        else {
+            sanitized[key] = value;
+        }
+    }
+    return sanitized;
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/cli/utils/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../src/cli/utils/sanitize.ts"],"names":[],"mappings":"AAAA,MAAM,kBAAkB,GAAG;IAC1B,4BAA4B;IAC5B,+BAA+B;IAC/B,yBAAyB;IACzB,0BAA0B;IAC1B,4BAA4B;IAC5B,0BAA0B;IAC1B,6CAA6C;IAC7C,gCAAgC;CAChC,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,OAAe;IAC7C,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QAC1C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,OAAO,GAAG,GAAG,cAAc,CAAC;YAC7B,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9B,OAAO,mBAAmB,CAAC;YAC5B,CAAC;YACD,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC9D,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,IACC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;YAClC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC1B,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3B,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC5B,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAC5B,CAAC;YACF,SAAS,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAC/B,CAAC;aAAM,CAAC;YACP,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC"}

package/dist/cli/utils/security-headers.d.ts

@@ -0,0 +1,18 @@
+export interface SecurityHeaders {
+    readonly "Strict-Transport-Security"?: string;
+    readonly "X-Content-Type-Options"?: string;
+    readonly "X-Frame-Options"?: string;
+    readonly "X-XSS-Protection"?: string;
+    readonly "Content-Security-Policy"?: string;
+    readonly "Referrer-Policy"?: string;
+    readonly "Permissions-Policy"?: string;
+}
+export declare function getRecommendedSecurityHeaders(): SecurityHeaders;
+export declare function validateSecurityHeaders(headers: Record<string, string>): {
+    missing: string[];
+    weak: Array<{
+        header: string;
+        issue: string;
+    }>;
+};
+//# sourceMappingURL=security-headers.d.ts.map

package/dist/cli/utils/security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/security-headers.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,wBAAgB,6BAA6B,IAAI,eAAe,CAW/D;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;IACzE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/C,CAoBA"}

package/dist/cli/utils/security-headers.js

@@ -0,0 +1,32 @@
+export function getRecommendedSecurityHeaders() {
+    return {
+        "Strict-Transport-Security": "max-age=31536000; includeSubDomains; preload",
+        "X-Content-Type-Options": "nosniff",
+        "X-Frame-Options": "DENY",
+        "X-XSS-Protection": "1; mode=block",
+        "Content-Security-Policy": "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';",
+        "Referrer-Policy": "strict-origin-when-cross-origin",
+        "Permissions-Policy": "geolocation=(), microphone=(), camera=()",
+    };
+}
+export function validateSecurityHeaders(headers) {
+    const recommended = getRecommendedSecurityHeaders();
+    const missing = [];
+    const weak = [];
+    for (const header of Object.keys(recommended)) {
+        if (!headers[header]) {
+            missing.push(header);
+        }
+        else {
+            const value = headers[header];
+            if (header === "Strict-Transport-Security" && !value?.includes("max-age")) {
+                weak.push({ header, issue: "Missing max-age directive" });
+            }
+            if (header === "Content-Security-Policy" && value === "default-src *") {
+                weak.push({ header, issue: "Too permissive - allows all sources" });
+            }
+        }
+    }
+    return { missing, weak };
+}
+//# sourceMappingURL=security-headers.js.map

package/dist/cli/utils/security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../../../src/cli/utils/security-headers.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,6BAA6B;IAC5C,OAAO;QACN,2BAA2B,EAAE,8CAA8C;QAC3E,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,MAAM;QACzB,kBAAkB,EAAE,eAAe;QACnC,yBAAyB,EACxB,4EAA4E;QAC7E,iBAAiB,EAAE,iCAAiC;QACpD,oBAAoB,EAAE,0CAA0C;KAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAA+B;IAItE,MAAM,WAAW,GAAG,6BAA6B,EAAE,CAAC;IACpD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAA6C,EAAE,CAAC;IAE1D,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACP,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,MAAM,KAAK,2BAA2B,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3E,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,IAAI,MAAM,KAAK,yBAAyB,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;gBACvE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACrE,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC"}

package/dist/cli/utils/token-cache.d.ts

@@ -0,0 +1,4 @@
+export declare function getCachedToken(serviceId: string): string | null;
+export declare function setCachedToken(serviceId: string, token: string, ttlMs?: number): void;
+export declare function clearTokenCache(): void;
+//# sourceMappingURL=token-cache.d.ts.map

package/dist/cli/utils/token-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-cache.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/token-cache.ts"],"names":[],"mappings":"AASA,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS/D;AAED,wBAAgB,cAAc,CAC7B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,KAAK,SAAuB,GAC1B,IAAI,CAKN;AAED,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}