@jarel/myskills 0.1.0-alpha.0 → 0.1.0-alpha.2

package/README.md

@@ -37,12 +37,27 @@ myskills validate --path <file-directory-or-zip>
 myskills scan --path <file-directory-or-zip>
 myskills search [query] [--api-url <url>]
 myskills info <skill-slug> [--api-url <url>]
-myskills login [--api-url <url>] [--email <email>]
+myskills login [--api-url <url>] [--method <password|api-key>] [--email <email>]
+myskills login --api-key [--api-url <url>]
 myskills logout [--api-url <url>] [--token <token>]
 myskills whoami [--api-url <url>] [--token <token>]
+myskills auth status [--api-url <url>] [--token <token>]
+myskills doctor [--api-url <url>] [--json]
+myskills config get api-url
+myskills config set api-url <url>
+myskills config reset api-url
+myskills config list
 myskills submit --path <file-directory-or-zip> [--api-url <url>] [--token <token>]
 myskills review submissions [--api-url <url>] [--token <token>]
 myskills review action <submission-id> --action <approve|publish> [--reason <text>]
+myskills teams list|skills [--api-url <url>] [--token <token>]
+myskills teams create <team-name> [--name <team-name>] [--api-url <url>] [--token <token>]
+myskills teams invite <team-id> --email <email> [--api-url <url>] [--token <token>]
+myskills teams accept <invitation-id> [--api-url <url>] [--token <token>]
+myskills sharing get <skill-slug> [--api-url <url>] [--token <token>]
+myskills sharing set <skill-slug> --visibility <scope> [--team <team-id>] [--user <email>]
+myskills admin sharing get [--api-url <url>] [--token <token>]
+myskills admin sharing set [--public <true|false>] [--authenticated <true|false>] [--teams <true|false>] [--team-visibility <true|false>] [--user-visibility <true|false>]
 myskills export <skill-slug> --version <version> --platform <platform> --output <dir>
 myskills install <skill-slug> [--version <version>] [--platform <platform>] [--dir <install-root>]
 myskills list [--dir <install-root>]
@@ -60,6 +75,7 @@ The first public alpha package is distributed through npm under the `alpha` tag:
 ```bash
 npm install -g @jarel/myskills@alpha
 myskills --version
+myskills login
 ```
 
 Update the CLI with:
@@ -68,9 +84,13 @@ Update the CLI with:
 npm install -g @jarel/myskills@alpha
 ```
 
-`validate`, `scan`, and `submit` accept a manifest file, package directory, or local `.zip` package. `login` prompts for the password, handles MFA challenges with a TOTP or recovery code prompt, and stores the returned session token by normalized API URL. Token resolution is `--token`, then `MYSKILLS_TOKEN`, then the stored login token. The default token store writes `tokens.json` under `MYSKILLS_CONFIG_DIR`, `MYSKILLS_TOKEN_FILE`, or the user config directory with user-only file permissions. `logout` revokes stored session tokens and clears the local entry; stored API tokens are removed locally and must be revoked with `token revoke`.
+`validate`, `scan`, and `submit` accept a manifest file, package directory, or local `.zip` package. `login` prompts for the API URL when one is not supplied; the default is the local API at `http://localhost:3001`, and custom hosted URLs can be entered manually. Successful login stores the selected API URL in local CLI config so later commands can omit `--api-url`. API URL resolution is `--api-url`, then `MYSKILLS_API_URL`, then saved config, then `http://localhost:3001`.
 
-`submit` validates and scans locally before sending package directories as normalized text entries or `.zip` packages as base64 archive uploads for server-side extraction. `export` downloads server-authorized bundle content, verifies byte size and SHA-256 against release metadata, and writes normalized package paths under the requested output directory. `install` uses the same verified bundle path, writes into `--dir`, `MYSKILLS_INSTALL_DIR`, or the user data directory, and records local state in `.myskills-app/installed.json`; `update` preserves a rollback snapshot before replacing files, and `rollback` restores the most recent snapshot. `token create` prints the plaintext API token only once and does not overwrite the stored login session. Platform keychain storage, browser login, platform-specific install adapters, and archive creation are still planned.
+`login` supports an email/password session flow and an API-key flow. The email/password flow handles MFA challenges with a TOTP or recovery code prompt and stores only the verified session token. The API-key flow validates the key with `/v1/me` before storing it. Token resolution is `--token`, then `MYSKILLS_TOKEN`, then the stored login token. The default token store uses the platform credential store through `@napi-rs/keyring` and falls back to `tokens.json` with user-only file permissions when keyring storage is unavailable or `MYSKILLS_TOKEN_STORE=file`/`MYSKILLS_TOKEN_FILE` is set. `auth status` validates the current token without printing it. `logout` revokes stored session tokens and clears the local entry; stored API tokens are removed locally and must be revoked with `token revoke`.
+
+`config get api-url`, `config set api-url <url>`, `config reset api-url`, and `config list` manage the saved API URL. `doctor` checks the CLI version, Node version, resolved API URL, `/health`, auth status, token-store backend, install-directory writability, and `/v1/capabilities`. If the CLI is pointed at the web app instead of the API, or a newer command is sent to an older server, command errors include concrete next steps and `--json` returns structured error codes.
+
+`submit` validates and scans locally before sending package directories as normalized text entries or `.zip` packages as base64 archive uploads for server-side extraction. `export` downloads server-authorized bundle content, verifies byte size and SHA-256 against release metadata, and writes normalized package paths under the requested output directory. `install` uses the same verified bundle path, writes into `--dir`, `MYSKILLS_INSTALL_DIR`, or the user data directory, and records local state in `.myskills-app/installed.json`; `update` preserves a rollback snapshot before replacing files, and `rollback` restores the most recent snapshot. `token create` prints the plaintext API token only once and does not overwrite the stored login session. Browser/device login, platform-specific install adapters, and archive creation are still planned.
 
 Common scopes:
 

package/dist/index.js

@@ -548,7 +548,7 @@ var require_yauzl = __commonJS({
     exports.Entry = Entry;
     exports.LocalFileHeader = LocalFileHeader;
     exports.RandomAccessReader = RandomAccessReader;
-    function open(path4, options2, callback) {
+    function open(path5, options2, callback) {
       if (typeof options2 === "function") {
         callback = options2;
         options2 = null;
@@ -560,7 +560,7 @@ var require_yauzl = __commonJS({
       if (options2.validateEntrySizes == null) options2.validateEntrySizes = true;
       if (options2.strictFileNames == null) options2.strictFileNames = false;
       if (callback == null) callback = defaultCallback;
-      fs.open(path4, "r", function(err, fd) {
+      fs.open(path5, "r", function(err, fd) {
         if (err) return callback(err);
         fromFd(fd, options2, function(err2, zipfile) {
           if (err2) fs.close(fd, defaultCallback);
@@ -2039,10 +2039,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path4) {
-  if (!path4)
+function getElementAtPath(obj, path5) {
+  if (!path5)
     return obj;
-  return path4.reduce((acc, key) => acc?.[key], obj);
+  return path5.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -2451,11 +2451,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path4, issues) {
+function prefixIssues(path5, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path4);
+    iss.path.unshift(path5);
     return iss;
   });
 }
@@ -2602,16 +2602,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path4 = []) => {
+  const processError = (error52, path5 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path4, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
       } else {
-        const fullpath = [...path4, ...issue2.path];
+        const fullpath = [...path5, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -2638,17 +2638,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path4 = []) => {
+  const processError = (error52, path5 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path4, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
       } else {
-        const fullpath = [...path4, ...issue2.path];
+        const fullpath = [...path5, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -2680,8 +2680,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path4 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path4) {
+  const path5 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path5) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -15373,13 +15373,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path4 = ref.slice(1).split("/").filter(Boolean);
-  if (path4.length === 0) {
+  const path5 = ref.slice(1).split("/").filter(Boolean);
+  if (path5.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path4[0] === defsKey) {
-    const key = path4[1];
+  if (path5[0] === defsKey) {
+    const key = path5[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -16321,8 +16321,9 @@ function decodePackageText(buffer, relativePath) {
 
 // src/cli.ts
 var DEFAULT_API_URL = "http://localhost:3001";
-var CLI_VERSION = "0.1.0-alpha.0";
+var CLI_VERSION = "0.1.0-alpha.2";
 var CLI_VISIBILITY_SCOPES = ["public", "authenticated", "organization", "team", "private", "explicit-users"];
+var LOGIN_AUTH_METHODS = ["password", "api-key"];
 async function runCli(argv, runtime) {
   const parsed = parseArgs(argv);
   try {
@@ -16352,6 +16353,12 @@ async function runCli(argv, runtime) {
         return await logoutCommand(parsed, runtime);
       case "whoami":
         return await whoamiCommand(parsed, runtime);
+      case "auth":
+        return await authCommand(parsed, runtime);
+      case "config":
+        return await configCommand(parsed, runtime);
+      case "doctor":
+        return await doctorCommand(parsed, runtime);
       case "submit":
         return await submitCommand(parsed, runtime);
       case "review":
@@ -16379,10 +16386,19 @@ async function runCli(argv, runtime) {
     }
   } catch (error51) {
     if (error51 instanceof CliError) {
-      runtime.io.stderr(error51.message);
+      if (parsed.options.json) {
+        runtime.io.stderr(JSON.stringify({ error: error51.toJSON() }, null, 2));
+      } else {
+        runtime.io.stderr(error51.message);
+      }
       return error51.exitCode;
     }
-    runtime.io.stderr(error51 instanceof Error ? error51.message : "Unexpected CLI failure.");
+    const message = error51 instanceof Error ? error51.message : "Unexpected CLI failure.";
+    if (parsed.options.json) {
+      runtime.io.stderr(JSON.stringify({ error: { code: "UNEXPECTED_CLI_FAILURE", message } }, null, 2));
+    } else {
+      runtime.io.stderr(message);
+    }
     return 1;
   }
 }
@@ -16450,23 +16466,46 @@ async function infoCommand(parsed, runtime) {
   return 0;
 }
 async function loginCommand(parsed, runtime) {
-  if (!runtime.tokenStore) {
+  const tokenStore = runtime.tokenStore;
+  if (!tokenStore) {
     throw new CliError("No token store is configured. Set MYSKILLS_TOKEN for one-off commands.", 1);
   }
+  const apiUrl = await loginApiUrl(parsed, runtime);
+  parsed.options["api-url"] = apiUrl;
+  const method = await loginAuthMethod(parsed, runtime);
+  if (method === "api-key") {
+    return await loginWithApiKey(parsed, runtime, apiUrl, tokenStore);
+  }
+  return await loginWithPassword(parsed, runtime, apiUrl, tokenStore);
+}
+async function loginWithPassword(parsed, runtime, apiUrl, tokenStore) {
   const email3 = optionalStringOption(parsed, "email") ?? await promptText(runtime, "Email: ");
   const password = await promptSecret(runtime, "Password: ");
   const loginResponse = await apiPost("/v1/auth/login", { email: email3.trim(), password }, parsed, runtime);
   const session = loginResponse.mfaRequired === true ? await completeMfaLogin(loginResponse, parsed, runtime) : authSessionFromResponse(loginResponse);
-  const apiUrl = apiBaseUrl(parsed, runtime);
-  await runtime.tokenStore.set(apiUrl, {
+  await tokenStore.set(apiUrl, {
     kind: "session",
     token: session.token,
     email: session.email,
     expiresAt: session.expiresAt
   });
+  await runtime.configStore?.setApiUrl(apiUrl);
   runtime.io.stdout(`${session.email ?? email3.trim()}	logged-in	expires=${session.expiresAt}`);
   return 0;
 }
+async function loginWithApiKey(parsed, runtime, apiUrl, tokenStore) {
+  const apiKey = await promptSecret(runtime, "API key: ");
+  const response = await apiGet("/v1/me", parsed, runtime, apiKey);
+  const user = response.user;
+  await tokenStore.set(apiUrl, {
+    kind: "api",
+    token: apiKey,
+    email: user.email
+  });
+  await runtime.configStore?.setApiUrl(apiUrl);
+  runtime.io.stdout(`${user.email ?? "api-key"}	api-key-stored`);
+  return 0;
+}
 async function completeMfaLogin(loginResponse, parsed, runtime) {
   const challengeToken = stringFromRecord(loginResponse, "challengeToken", "API login response is missing MFA challenge token.");
   const mfaValue = (await promptSecret(runtime, "MFA code or recovery code: ")).trim();
@@ -16514,6 +16553,143 @@ async function whoamiCommand(parsed, runtime) {
   }
   return 0;
 }
+async function authCommand(parsed, runtime) {
+  const subcommand = parsed.args[0];
+  if (subcommand === "status") {
+    return await authStatusCommand(parsed, runtime);
+  }
+  throw new CliError("Usage: myskills auth status", 2, "USAGE_ERROR");
+}
+async function authStatusCommand(parsed, runtime) {
+  const api = apiBaseUrlResolution(parsed, runtime);
+  const resolved = await resolveToken(parsed, runtime);
+  if (!resolved) {
+    const status2 = {
+      apiUrl: api.url,
+      apiUrlSource: api.source,
+      status: "not_logged_in",
+      tokenSource: "none",
+      tokenStore: await tokenStoreInfo(runtime)
+    };
+    if (parsed.options.json) {
+      runtime.io.stdout(JSON.stringify(status2, null, 2));
+    } else {
+      runtime.io.stdout(`API URL: ${status2.apiUrl} (${status2.apiUrlSource})`);
+      runtime.io.stdout("Status: not logged in");
+      runtime.io.stdout(`Token store: ${status2.tokenStore.backend}`);
+    }
+    return 0;
+  }
+  const response = await apiGet("/v1/me", parsed, runtime, resolved.value);
+  const user = response.user;
+  const status = {
+    apiUrl: api.url,
+    apiUrlSource: api.source,
+    status: "logged_in",
+    tokenSource: resolved.source,
+    tokenKind: resolved.stored.kind,
+    tokenStore: await tokenStoreInfo(runtime),
+    user: {
+      email: user.email,
+      roles: user.roles,
+      mfaVerified: user.mfaVerified
+    },
+    expiresAt: resolved.stored.expiresAt ?? null
+  };
+  if (parsed.options.json) {
+    runtime.io.stdout(JSON.stringify(status, null, 2));
+  } else {
+    runtime.io.stdout(`API URL: ${status.apiUrl} (${status.apiUrlSource})`);
+    runtime.io.stdout(`Status: logged in (${status.tokenKind}, ${status.tokenSource})`);
+    runtime.io.stdout(`User: ${user.email}`);
+    runtime.io.stdout(`Roles: ${user.roles.join(",") || "-"}`);
+    runtime.io.stdout(`MFA: ${user.mfaVerified ? "verified" : "not-verified"}`);
+    runtime.io.stdout(`Expires: ${status.expiresAt ?? "-"}`);
+    runtime.io.stdout(`Token store: ${status.tokenStore.backend}`);
+  }
+  return 0;
+}
+async function configCommand(parsed, runtime) {
+  const subcommand = parsed.args[0];
+  const key = parsed.args[1];
+  if (!runtime.configStore) {
+    throw new CliError("No config store is configured.", 1, "CONFIG_STORE_UNAVAILABLE");
+  }
+  if (subcommand === "get" && key === "api-url") {
+    const apiUrl = runtime.configStore.getApiUrl() ?? null;
+    if (parsed.options.json) {
+      runtime.io.stdout(JSON.stringify({ apiUrl }, null, 2));
+    } else {
+      runtime.io.stdout(apiUrl ?? "unset");
+    }
+    return 0;
+  }
+  if (subcommand === "set" && key === "api-url") {
+    const apiUrl = parsed.args[2];
+    if (!apiUrl) {
+      throw new CliError("Usage: myskills config set api-url <url>", 2, "USAGE_ERROR");
+    }
+    await runtime.configStore.setApiUrl(normalizeApiUrlOption(apiUrl));
+    if (parsed.options.json) {
+      runtime.io.stdout(JSON.stringify({ apiUrl: normalizeApiUrlOption(apiUrl) }, null, 2));
+    } else {
+      runtime.io.stdout(`api-url=${normalizeApiUrlOption(apiUrl)}`);
+    }
+    return 0;
+  }
+  if (subcommand === "reset" && key === "api-url") {
+    await runtime.configStore.resetApiUrl();
+    if (parsed.options.json) {
+      runtime.io.stdout(JSON.stringify({ apiUrl: null }, null, 2));
+    } else {
+      runtime.io.stdout("api-url unset");
+    }
+    return 0;
+  }
+  if (subcommand === "list") {
+    const resolved = apiBaseUrlResolution(parsed, runtime);
+    const saved = runtime.configStore.getApiUrl() ?? null;
+    if (parsed.options.json) {
+      runtime.io.stdout(JSON.stringify({ apiUrl: saved, resolvedApiUrl: resolved.url, resolvedApiUrlSource: resolved.source }, null, 2));
+    } else {
+      runtime.io.stdout(`api-url=${saved ?? "unset"}`);
+      runtime.io.stdout(`resolved-api-url=${resolved.url}	source=${resolved.source}`);
+    }
+    return 0;
+  }
+  throw new CliError("Usage: myskills config get api-url | config set api-url <url> | config reset api-url | config list", 2, "USAGE_ERROR");
+}
+async function doctorCommand(parsed, runtime) {
+  const api = apiBaseUrlResolution(parsed, runtime);
+  const checks = [];
+  checks.push(nodeVersionCheck());
+  checks.push({ name: "cli_version", ok: true, message: CLI_VERSION, details: { version: CLI_VERSION } });
+  checks.push({ name: "api_url", ok: true, message: `${api.url} (${api.source})`, details: api });
+  const health = await doctorHealthCheck(parsed, runtime);
+  checks.push(health);
+  const token = await resolveToken(parsed, runtime);
+  checks.push(await doctorAuthCheck(parsed, runtime, token));
+  checks.push(await doctorTokenStoreCheck(runtime));
+  checks.push(await doctorInstallDirCheck(parsed, runtime));
+  checks.push(await doctorCapabilitiesCheck(parsed, runtime));
+  const failed = checks.filter((check2) => !check2.ok);
+  const result = {
+    cliVersion: CLI_VERSION,
+    apiUrl: api.url,
+    apiUrlSource: api.source,
+    checks
+  };
+  if (parsed.options.json) {
+    runtime.io.stdout(JSON.stringify(result, null, 2));
+  } else {
+    runtime.io.stdout(`MySkills CLI ${CLI_VERSION}`);
+    runtime.io.stdout("");
+    for (const check2 of checks) {
+      runtime.io.stdout(`${check2.ok ? "ok" : "fail"}	${check2.name}	${check2.message}`);
+    }
+  }
+  return failed.length === 0 ? 0 : 1;
+}
 async function tokenCommand(parsed, runtime) {
   const token = await tokenOption(parsed, runtime);
   if (!token) {
@@ -17388,101 +17564,296 @@ function assertChildPath(root, target) {
   }
 }
 async function apiGet(pathname, parsed, runtime, token) {
-  const baseUrl = apiBaseUrl(parsed, runtime);
   const headers = {};
   if (token) {
     headers.authorization = `Bearer ${token}`;
   }
-  const response = await runtime.fetch(`${baseUrl}${pathname}`, { headers });
-  const text = await response.text();
-  const body = text ? JSON.parse(text) : {};
-  if (!response.ok) {
-    const error51 = body.error;
-    throw new CliError(error51?.message ?? `API request failed with ${response.status}.`, 1);
-  }
-  return body;
+  return await apiJsonRequest(pathname, parsed, runtime, { headers });
 }
 async function apiGetText(pathname, parsed, runtime, token) {
-  const baseUrl = apiBaseUrl(parsed, runtime);
   const headers = {};
   if (token) {
     headers.authorization = `Bearer ${token}`;
   }
-  const response = await runtime.fetch(`${baseUrl}${pathname}`, { headers });
-  const text = await response.text();
+  const response = await apiFetch(pathname, parsed, runtime, { headers });
   if (!response.ok) {
-    const error51 = parseApiError(text);
-    throw new CliError(error51 ?? `API request failed with ${response.status}.`, 1);
+    throw apiErrorFromResponse(pathname, apiBaseUrl(parsed, runtime), response.status, response.text);
   }
-  return text;
+  return response.text;
 }
 async function apiPost(pathname, payload, parsed, runtime, token) {
-  const baseUrl = apiBaseUrl(parsed, runtime);
   const headers = {
     "content-type": "application/json"
   };
   if (token) {
     headers.authorization = `Bearer ${token}`;
   }
-  const response = await runtime.fetch(`${baseUrl}${pathname}`, {
+  return await apiJsonRequest(pathname, parsed, runtime, {
     method: "POST",
     headers,
     body: JSON.stringify(payload)
   });
-  const text = await response.text();
-  const body = text ? JSON.parse(text) : {};
-  if (!response.ok) {
-    const error51 = body.error;
-    throw new CliError(error51?.message ?? `API request failed with ${response.status}.`, 1);
-  }
-  return body;
 }
 async function apiPut(pathname, payload, parsed, runtime, token) {
-  const baseUrl = apiBaseUrl(parsed, runtime);
   const headers = {
     "content-type": "application/json"
   };
   if (token) {
     headers.authorization = `Bearer ${token}`;
   }
-  const response = await runtime.fetch(`${baseUrl}${pathname}`, {
+  return await apiJsonRequest(pathname, parsed, runtime, {
     method: "PUT",
     headers,
     body: JSON.stringify(payload)
   });
-  const text = await response.text();
-  const body = text ? JSON.parse(text) : {};
-  if (!response.ok) {
-    const error51 = body.error;
-    throw new CliError(error51?.message ?? `API request failed with ${response.status}.`, 1);
-  }
-  return body;
 }
 async function apiDelete(pathname, parsed, runtime, token) {
-  const baseUrl = apiBaseUrl(parsed, runtime);
-  const response = await runtime.fetch(`${baseUrl}${pathname}`, {
+  return await apiJsonRequest(pathname, parsed, runtime, {
     method: "DELETE",
     headers: {
       authorization: `Bearer ${token}`
     }
   });
-  const text = await response.text();
-  const body = text ? JSON.parse(text) : {};
+}
+async function apiJsonRequest(pathname, parsed, runtime, init) {
+  const baseUrl = apiBaseUrl(parsed, runtime);
+  const response = await apiFetch(pathname, parsed, runtime, init);
+  const body = parseJsonResponse(pathname, baseUrl, response.text);
   if (!response.ok) {
-    const error51 = body.error;
-    throw new CliError(error51?.message ?? `API request failed with ${response.status}.`, 1);
+    throw apiErrorFromBody(pathname, baseUrl, response.status, body, response.text);
   }
   return body;
 }
-function parseApiError(text) {
+async function apiFetch(pathname, parsed, runtime, init) {
+  const baseUrl = apiBaseUrl(parsed, runtime);
+  let response;
+  try {
+    response = await runtime.fetch(`${baseUrl}${pathname}`, init);
+  } catch {
+    throw new CliError([
+      "Could not reach the MySkills API.",
+      "",
+      `API URL: ${baseUrl}`,
+      "Check that the API is running, or use:",
+      "  myskills <command> --api-url https://myskills.sh/api"
+    ].join("\n"), 1, "API_UNREACHABLE");
+  }
+  return {
+    ok: response.ok,
+    status: response.status,
+    text: await response.text()
+  };
+}
+function parseJsonResponse(pathname, baseUrl, text) {
+  if (!text) {
+    return {};
+  }
+  if (/^\s*</.test(text)) {
+    throw htmlApiError(baseUrl);
+  }
+  try {
+    const body = JSON.parse(text);
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      throw new Error("not object");
+    }
+    return body;
+  } catch {
+    throw new CliError(`API response for ${pathname} was not valid JSON.`, 1, "API_INVALID_JSON");
+  }
+}
+function apiErrorFromBody(pathname, baseUrl, status, body, text) {
+  if (status === 404 && isUnsupportedEndpointBody(body, text)) {
+    const command = unsupportedCommandForPath(pathname);
+    if (command) {
+      return new CliError([
+        `This MySkills server does not support the \`${command}\` command yet.`,
+        "",
+        `CLI version: ${CLI_VERSION}`,
+        `API URL: ${baseUrl}`,
+        "Run `myskills doctor` to inspect server capabilities."
+      ].join("\n"), 1, "API_UNSUPPORTED_ENDPOINT", status);
+    }
+  }
+  const error51 = body.error;
+  return new CliError(error51?.message ?? `API request failed with ${status}.`, 1, error51?.code ?? "API_REQUEST_FAILED", status);
+}
+function apiErrorFromResponse(pathname, baseUrl, status, text) {
+  if (/^\s*</.test(text)) {
+    return htmlApiError(baseUrl);
+  }
   try {
     const body = text ? JSON.parse(text) : {};
-    const error51 = body.error;
-    return error51?.message ?? null;
+    return apiErrorFromBody(pathname, baseUrl, status, body, text);
   } catch {
-    return null;
+    return new CliError(`API request failed with ${status}.`, 1, "API_REQUEST_FAILED", status);
+  }
+}
+function htmlApiError(baseUrl) {
+  return new CliError([
+    "The API URL returned HTML instead of JSON.",
+    "You may be pointing the CLI at the web app.",
+    "",
+    `Current API URL: ${baseUrl}`,
+    "Try: myskills <command> --api-url https://myskills.sh/api"
+  ].join("\n"), 1, "API_RETURNED_HTML");
+}
+function isUnsupportedEndpointBody(body, text) {
+  return typeof body.message === "string" && /Route .+ not found/.test(body.message) || typeof body.error === "string" && body.error === "Not Found" || /Route .+ not found/.test(text);
+}
+function unsupportedCommandForPath(pathname) {
+  if (pathname.startsWith("/v1/teams")) {
+    return "teams";
+  }
+  if (pathname.includes("/sharing") || pathname.startsWith("/v1/admin/sharing")) {
+    return "sharing";
+  }
+  return null;
+}
+function nodeVersionCheck() {
+  const version2 = process.versions.node;
+  const major = Number.parseInt(version2.split(".")[0] ?? "0", 10);
+  return {
+    name: "node",
+    ok: major >= 20,
+    message: `v${version2} (${major >= 20 ? "satisfies >=20" : "requires >=20"})`,
+    details: { version: version2, engine: ">=20" }
+  };
+}
+async function doctorHealthCheck(parsed, runtime) {
+  const baseUrl = apiBaseUrl(parsed, runtime);
+  try {
+    const response = await apiFetch("/health", parsed, runtime);
+    const body = parseJsonResponse("/health", baseUrl, response.text);
+    return {
+      name: "api_health",
+      ok: response.ok,
+      message: response.ok ? "ok" : `HTTP ${response.status}`,
+      details: { status: response.status, body }
+    };
+  } catch (error51) {
+    return {
+      name: "api_health",
+      ok: false,
+      message: error51 instanceof Error ? firstLine(error51.message) : "failed"
+    };
+  }
+}
+async function doctorAuthCheck(parsed, runtime, resolved) {
+  if (!resolved) {
+    return {
+      name: "auth",
+      ok: true,
+      message: "not logged in",
+      details: { status: "not_logged_in" }
+    };
+  }
+  try {
+    const response = await apiGet("/v1/me", parsed, runtime, resolved.value);
+    const user = response.user;
+    return {
+      name: "auth",
+      ok: true,
+      message: `${user.email ?? "unknown"} (${resolved.stored.kind}, ${resolved.source})`,
+      details: {
+        status: "logged_in",
+        tokenSource: resolved.source,
+        tokenKind: resolved.stored.kind,
+        expiresAt: resolved.stored.expiresAt ?? null,
+        user
+      }
+    };
+  } catch (error51) {
+    return {
+      name: "auth",
+      ok: false,
+      message: error51 instanceof Error ? firstLine(error51.message) : "failed"
+    };
+  }
+}
+async function doctorTokenStoreCheck(runtime) {
+  const info = await tokenStoreInfo(runtime);
+  if (info.backend === "file" && info.filePath) {
+    const permissions = await filePermissions(info.filePath);
+    if (permissions && permissions !== "600") {
+      return {
+        name: "token_store",
+        ok: false,
+        message: `file permissions ${permissions}; expected 600`,
+        details: { ...info, permissions }
+      };
+    }
+    return {
+      name: "token_store",
+      ok: true,
+      message: permissions ? `file ${info.filePath} (${permissions})` : `file ${info.filePath} (not created)`,
+      details: { ...info, permissions }
+    };
+  }
+  return {
+    name: "token_store",
+    ok: true,
+    message: info.backend,
+    details: info
+  };
+}
+async function doctorInstallDirCheck(parsed, runtime) {
+  const root = installRoot(parsed, runtime);
+  const testFile = path2.join(root, ".myskills-app", "doctor-write-test");
+  try {
+    await mkdir(path2.dirname(testFile), { recursive: true });
+    await writeFile(testFile, "ok\n", "utf8");
+    await rm(testFile, { force: true });
+    return {
+      name: "install_dir",
+      ok: true,
+      message: `writable ${root}`,
+      details: { path: root }
+    };
+  } catch (error51) {
+    return {
+      name: "install_dir",
+      ok: false,
+      message: error51 instanceof Error ? firstLine(error51.message) : "not writable",
+      details: { path: root }
+    };
+  }
+}
+async function doctorCapabilitiesCheck(parsed, runtime) {
+  try {
+    const response = await apiGet("/v1/capabilities", parsed, runtime);
+    const capabilities = response.capabilities && typeof response.capabilities === "object" && !Array.isArray(response.capabilities) ? response.capabilities : {};
+    const supported = Object.entries(capabilities).filter(([, value]) => value === true).map(([key]) => key);
+    const unsupported = Object.entries(capabilities).filter(([, value]) => value === false).map(([key]) => key);
+    return {
+      name: "capabilities",
+      ok: true,
+      message: `supported=${supported.join(",") || "-"} unsupported=${unsupported.join(",") || "-"}`,
+      details: response
+    };
+  } catch (error51) {
+    return {
+      name: "capabilities",
+      ok: true,
+      message: `unknown (${error51 instanceof Error ? firstLine(error51.message) : "not available"})`
+    };
   }
 }
+async function tokenStoreInfo(runtime) {
+  return await runtime.tokenStore?.describe?.() ?? { backend: "memory" };
+}
+async function filePermissions(filePath) {
+  try {
+    return ((await stat(filePath)).mode & 511).toString(8).padStart(3, "0");
+  } catch (error51) {
+    if (isNodeError(error51) && error51.code === "ENOENT") {
+      return null;
+    }
+    throw error51;
+  }
+}
+function firstLine(message) {
+  return message.split("\n")[0] ?? message;
+}
 function printScanResult(result, io) {
   if (result.findings.length === 0) {
     io.stdout(`clean files=${result.filesScanned} bytes=${result.bytesScanned}`);
@@ -17499,8 +17870,22 @@ function requiredPath(parsed) {
   }
   return value;
 }
+function apiBaseUrlResolution(parsed, runtime) {
+  const optionValue = optionalStringOption(parsed, "api-url");
+  if (optionValue) {
+    return { url: normalizeApiUrlOption(optionValue), source: "option" };
+  }
+  if (runtime.env.MYSKILLS_API_URL) {
+    return { url: normalizeApiUrlOption(runtime.env.MYSKILLS_API_URL), source: "env" };
+  }
+  const configuredApiUrl = runtime.configStore?.getApiUrl();
+  if (configuredApiUrl) {
+    return { url: normalizeApiUrlOption(configuredApiUrl), source: "config" };
+  }
+  return { url: DEFAULT_API_URL, source: "default" };
+}
 function apiBaseUrl(parsed, runtime) {
-  return String(parsed.options["api-url"] ?? runtime.env.MYSKILLS_API_URL ?? DEFAULT_API_URL).replace(/\/+$/, "");
+  return apiBaseUrlResolution(parsed, runtime).url;
 }
 async function tokenOption(parsed, runtime) {
   return (await resolveToken(parsed, runtime))?.value ?? null;
@@ -17558,6 +17943,60 @@ async function promptSecret(runtime, label) {
   }
   return value;
 }
+async function promptOptionalText(runtime, label) {
+  if (!runtime.prompt) {
+    throw new CliError("Interactive input is unavailable. Set MYSKILLS_TOKEN for one-off commands.", 1);
+  }
+  return (await runtime.prompt.text(label)).trim();
+}
+async function loginApiUrl(parsed, runtime) {
+  const resolved = apiBaseUrlResolution(parsed, runtime);
+  if (resolved.source === "option" || resolved.source === "env" || !runtime.prompt) {
+    return resolved.url;
+  }
+  const defaultUrl = resolved.source === "config" ? resolved.url : DEFAULT_API_URL;
+  const input = await promptOptionalText(runtime, `API URL [${defaultUrl}]: `);
+  return input ? normalizeApiUrlOption(input) : defaultUrl;
+}
+async function loginAuthMethod(parsed, runtime) {
+  if (parsed.options["api-key"] === true) {
+    return "api-key";
+  }
+  const methodOption = optionalStringOption(parsed, "auth-method") ?? optionalStringOption(parsed, "method");
+  if (methodOption) {
+    return parseLoginAuthMethod(methodOption);
+  }
+  if (optionalStringOption(parsed, "email") || !runtime.prompt) {
+    return "password";
+  }
+  const input = await promptOptionalText(runtime, "Authentication method [password] (password/api-key): ");
+  return input ? parseLoginAuthMethod(input) : "password";
+}
+function parseLoginAuthMethod(input) {
+  const normalized = input.trim().toLowerCase();
+  if (normalized === "password" || normalized === "email" || normalized === "user" || normalized === "username") {
+    return "password";
+  }
+  if (normalized === "api-key" || normalized === "apikey" || normalized === "api" || normalized === "key") {
+    return "api-key";
+  }
+  if (normalized === "browser" || normalized === "web") {
+    throw new CliError("Browser login is not available in this CLI/API version yet. Choose password or api-key.", 2);
+  }
+  throw new CliError(`Authentication method must be one of: ${LOGIN_AUTH_METHODS.join(", ")}.`, 2);
+}
+function normalizeApiUrlOption(input) {
+  const trimmed = input.trim().replace(/\/+$/, "");
+  try {
+    const url2 = new URL(trimmed);
+    if (url2.protocol !== "http:" && url2.protocol !== "https:") {
+      throw new Error("unsupported protocol");
+    }
+    return trimmed;
+  } catch {
+    throw new CliError("API URL must be a valid http:// or https:// URL.", 2);
+  }
+}
 function authSessionFromResponse(response) {
   const user = response.user;
   let email3;
@@ -17666,7 +18105,7 @@ function parseArgs(argv) {
       continue;
     }
     const key = value.slice(2);
-    if (key === "json") {
+    if (key === "json" || key === "api-key") {
       options2[key] = true;
       continue;
     }
@@ -17696,9 +18135,16 @@ function helpText() {
     "  scan --path <file-directory-or-zip>",
     "  search [query] [--api-url <url>]",
     "  info <skill-slug> [--api-url <url>]",
-    "  login [--api-url <url>] [--email <email>]",
+    "  login [--api-url <url>] [--method <password|api-key>] [--email <email>]",
+    "  login --api-key [--api-url <url>]",
     "  logout [--api-url <url>] [--token <token>]",
     "  whoami [--api-url <url>] [--token <token>]",
+    "  auth status [--api-url <url>] [--token <token>]",
+    "  doctor [--api-url <url>] [--json]",
+    "  config get api-url",
+    "  config set api-url <url>",
+    "  config reset api-url",
+    "  config list",
     "  submit --path <file-directory-or-zip> [--api-url <url>] [--token <token>]",
     "  review submissions [--api-url <url>] [--token <token>]",
     "  review action <submission-id> --action <approve|publish> [--reason <text>]",
@@ -17722,72 +18168,215 @@ function helpText() {
     "Options:",
     "  --version           Print CLI version.",
     "  --json              Print machine-readable JSON.",
-    "  --api-url <url>     API base URL. Defaults to MYSKILLS_API_URL or http://localhost:3001.",
+    "  --api-url <url>     API base URL. Defaults to MYSKILLS_API_URL, saved config, or http://localhost:3001.",
     "  --token <token>     Bearer token. Defaults to MYSKILLS_TOKEN, then stored login token."
   ].join("\n");
 }
 var CliError = class extends Error {
-  constructor(message, exitCode) {
+  constructor(message, exitCode, code = "CLI_ERROR", status) {
     super(message);
     this.exitCode = exitCode;
+    this.code = code;
+    this.status = status;
   }
   exitCode;
+  code;
+  status;
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      ...this.status !== void 0 ? { status: this.status } : {}
+    };
+  }
 };
 
-// src/token-store.ts
-import { chmod, mkdir as mkdir2, readFile as readFile3, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+// src/config-store.ts
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path3 from "node:path";
+function createFileConfigStore(env = process.env) {
+  const filePath = configFilePath(env);
+  let payload = readPayload(filePath);
+  return {
+    getApiUrl() {
+      return payload.apiUrl;
+    },
+    async setApiUrl(apiUrl) {
+      payload = {
+        ...payload,
+        apiUrl: apiUrl.replace(/\/+$/, "")
+      };
+      writePayload(filePath, payload);
+    },
+    async resetApiUrl() {
+      payload = { version: 1 };
+      rmSync(filePath, { force: true });
+    }
+  };
+}
+function configFilePath(env) {
+  if (env.MYSKILLS_CONFIG_FILE) {
+    return path3.resolve(env.MYSKILLS_CONFIG_FILE);
+  }
+  if (env.MYSKILLS_CONFIG_DIR) {
+    return path3.join(path3.resolve(env.MYSKILLS_CONFIG_DIR), "config.json");
+  }
+  const baseDir = env.XDG_CONFIG_HOME ? path3.join(env.XDG_CONFIG_HOME, "myskills-app") : path3.join(os.homedir(), ".config", "myskills-app");
+  return path3.join(baseDir, "config.json");
+}
+function readPayload(filePath) {
+  try {
+    return parsePayload(readFileSync(filePath, "utf8"));
+  } catch (error51) {
+    if (isNodeError2(error51) && error51.code === "ENOENT") {
+      return { version: 1 };
+    }
+    throw error51;
+  }
+}
+function writePayload(filePath, payload) {
+  mkdirSync(path3.dirname(filePath), { recursive: true, mode: 448 });
+  writeFileSync(filePath, `${JSON.stringify(payload, null, 2)}
+`, { mode: 384 });
+  chmodSync(filePath, 384);
+}
+function parsePayload(raw) {
+  const parsed = JSON.parse(raw);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("Config file must contain a JSON object.");
+  }
+  const record2 = parsed;
+  if (record2.version !== 1) {
+    throw new Error("Config file has an unsupported format.");
+  }
+  return {
+    version: 1,
+    apiUrl: typeof record2.apiUrl === "string" && record2.apiUrl ? record2.apiUrl.replace(/\/+$/, "") : void 0
+  };
+}
+function isNodeError2(error51) {
+  return error51 instanceof Error && "code" in error51;
+}
+
+// src/token-store.ts
+import { chmod, mkdir as mkdir2, readFile as readFile3, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import os2 from "node:os";
+import path4 from "node:path";
+var KEYRING_SERVICE = "ai.jarel.myskills.cli";
+function createTokenStore(env = process.env) {
+  const fileStore = createFileTokenStore(env);
+  if (env.MYSKILLS_TOKEN_STORE === "file" || env.MYSKILLS_TOKEN_FILE) {
+    return fileStore;
+  }
+  return createKeyringTokenStore(fileStore);
+}
 function createFileTokenStore(env = process.env) {
   const filePath = tokenFilePath(env);
   return {
     async get(apiUrl) {
-      return (await readPayload(filePath)).tokens[normalizeApiUrl(apiUrl)] ?? null;
+      return (await readPayload2(filePath)).tokens[normalizeApiUrl(apiUrl)] ?? null;
     },
     async set(apiUrl, token) {
-      const payload = await readPayload(filePath);
+      const payload = await readPayload2(filePath);
       payload.tokens[normalizeApiUrl(apiUrl)] = token;
-      await writePayload(filePath, payload);
+      await writePayload2(filePath, payload);
     },
     async delete(apiUrl) {
-      const payload = await readPayload(filePath);
+      const payload = await readPayload2(filePath);
       delete payload.tokens[normalizeApiUrl(apiUrl)];
       if (Object.keys(payload.tokens).length === 0) {
         await rm2(filePath, { force: true });
         return;
       }
-      await writePayload(filePath, payload);
+      await writePayload2(filePath, payload);
+    },
+    describe() {
+      return {
+        backend: "file",
+        filePath
+      };
+    }
+  };
+}
+function createKeyringTokenStore(fallback) {
+  const fallbackInfo = fallback.describe?.();
+  return {
+    async get(apiUrl) {
+      const keyringToken = await readKeyringToken(apiUrl);
+      return keyringToken ?? await fallback.get(apiUrl);
+    },
+    async set(apiUrl, token) {
+      if (await writeKeyringToken(apiUrl, token)) {
+        return;
+      }
+      await fallback.set(apiUrl, token);
+    },
+    async delete(apiUrl) {
+      await deleteKeyringToken(apiUrl);
+      await fallback.delete(apiUrl);
+    },
+    describe() {
+      return {
+        backend: "keyring",
+        fallbackFilePath: fallbackInfo?.filePath
+      };
     }
   };
 }
+async function readKeyringToken(apiUrl) {
+  try {
+    const { Entry } = await import("@napi-rs/keyring");
+    const raw = new Entry(KEYRING_SERVICE, keyringAccount(apiUrl)).getPassword();
+    return raw ? parseStoredToken(JSON.parse(raw)) : null;
+  } catch {
+    return null;
+  }
+}
+async function writeKeyringToken(apiUrl, token) {
+  try {
+    const { Entry } = await import("@napi-rs/keyring");
+    new Entry(KEYRING_SERVICE, keyringAccount(apiUrl)).setPassword(JSON.stringify(token));
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function deleteKeyringToken(apiUrl) {
+  try {
+    const { Entry } = await import("@napi-rs/keyring");
+    new Entry(KEYRING_SERVICE, keyringAccount(apiUrl)).deletePassword();
+  } catch {
+  }
+}
 function tokenFilePath(env) {
   if (env.MYSKILLS_TOKEN_FILE) {
-    return path3.resolve(env.MYSKILLS_TOKEN_FILE);
+    return path4.resolve(env.MYSKILLS_TOKEN_FILE);
   }
   if (env.MYSKILLS_CONFIG_DIR) {
-    return path3.join(path3.resolve(env.MYSKILLS_CONFIG_DIR), "tokens.json");
+    return path4.join(path4.resolve(env.MYSKILLS_CONFIG_DIR), "tokens.json");
   }
-  const baseDir = env.XDG_CONFIG_HOME ? path3.join(env.XDG_CONFIG_HOME, "myskills-app") : path3.join(os.homedir(), ".config", "myskills-app");
-  return path3.join(baseDir, "tokens.json");
+  const baseDir = env.XDG_CONFIG_HOME ? path4.join(env.XDG_CONFIG_HOME, "myskills-app") : path4.join(os2.homedir(), ".config", "myskills-app");
+  return path4.join(baseDir, "tokens.json");
 }
-async function readPayload(filePath) {
+async function readPayload2(filePath) {
   try {
     const raw = await readFile3(filePath, "utf8");
-    return parsePayload(raw);
+    return parsePayload2(raw);
   } catch (error51) {
-    if (isNodeError2(error51) && error51.code === "ENOENT") {
+    if (isNodeError3(error51) && error51.code === "ENOENT") {
       return { version: 1, tokens: {} };
     }
     throw error51;
   }
 }
-async function writePayload(filePath, payload) {
-  await mkdir2(path3.dirname(filePath), { recursive: true, mode: 448 });
+async function writePayload2(filePath, payload) {
+  await mkdir2(path4.dirname(filePath), { recursive: true, mode: 448 });
   await writeFile2(filePath, `${JSON.stringify(payload, null, 2)}
 `, { mode: 384 });
   await chmod(filePath, 384);
 }
-function parsePayload(raw) {
+function parsePayload2(raw) {
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error("Token store file must contain a JSON object.");
@@ -17823,7 +18412,10 @@ function parseStoredToken(input) {
 function normalizeApiUrl(apiUrl) {
   return apiUrl.replace(/\/+$/, "");
 }
-function isNodeError2(error51) {
+function keyringAccount(apiUrl) {
+  return `api-url:${Buffer.from(normalizeApiUrl(apiUrl)).toString("base64url")}`;
+}
+function isNodeError3(error51) {
   return error51 instanceof Error && "code" in error51;
 }
 
@@ -17943,8 +18535,9 @@ try {
   const exitCode = await runCli(process.argv.slice(2), {
     env: process.env,
     fetch: fetchImpl,
+    configStore: createFileConfigStore(process.env),
     prompt,
-    tokenStore: createFileTokenStore(process.env),
+    tokenStore: createTokenStore(process.env),
     io: {
       stdout: (line) => console.log(line),
       stderr: (line) => console.error(line)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jarel/myskills",
-  "version": "0.1.0-alpha.0",
+  "version": "0.1.0-alpha.2",
   "description": "Command-line client for publishing, discovering, installing, updating, and rolling back MySkills packages.",
   "license": "Apache-2.0",
   "private": false,
@@ -44,5 +44,8 @@
     "@myskills-app/skill-package": "0.1.0-alpha.0",
     "esbuild": "^0.28.1",
     "tsx": "^4.20.6"
+  },
+  "dependencies": {
+    "@napi-rs/keyring": "^1.3.0"
   }
 }