@lpm-registry/cli 0.8.0 → 0.9.2

package/lib/api.js

@@ -9,7 +9,15 @@
  * @module cli/lib/api
  */
 
-import { getRegistryUrl, getRetries, getTimeout, getToken } from "./config.js"
+import {
+	getRefreshToken,
+	getRegistryUrl,
+	getRetries,
+	getTimeout,
+	getToken,
+	setRefreshToken,
+	setToken,
+} from "./config.js"
 import {
 	ERROR_MESSAGES,
 	RATE_LIMIT_STATUS_CODES,
@@ -63,6 +71,44 @@ function parseRetryAfter(retryAfter) {
 	return RETRY_BASE_DELAY_MS
 }
 
+/**
+ * Attempt silent token refresh using the stored refresh token (Feature 44 Part B).
+ * @returns {Promise<string|null>} New access token if successful, null otherwise
+ */
+async function tryRefresh() {
+	try {
+		const refreshToken = await getRefreshToken()
+		if (!refreshToken) return null
+
+		const registryUrl = getRegistryUrl()
+		const { createHash } = await import("node:crypto")
+		const { hostname, userInfo } = await import("node:os")
+		const fp = createHash("sha256")
+			.update(`${hostname()}:${userInfo().username}:lpm-cli`)
+			.digest("hex")
+
+		const resp = await fetch(`${registryUrl}/api/cli/refresh`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ refreshToken, deviceFingerprint: fp }),
+		})
+
+		if (!resp.ok) return null
+
+		const data = await resp.json()
+		if (data.token) {
+			await setToken(data.token)
+			if (data.refreshToken) {
+				await setRefreshToken(data.refreshToken)
+			}
+			return data.token
+		}
+	} catch {
+		// Refresh failed — fall through to auth error
+	}
+	return null
+}
+
 /**
  * @typedef {Object} RequestOptions
  * @property {Record<string, string>} [headers] - Request headers
@@ -113,9 +159,8 @@ export async function request(path, options = {}) {
 
 			clearTimeout(timeoutId)
 
-			// Handle authentication errors immediately (no retry)
-			// Exception: 2FA OTP responses (401 with OTP_REQUIRED/OTP_INVALID code)
-			// must be returned to the caller so the publish handler can prompt for OTP
+			// Handle authentication errors — try silent refresh before failing
+			// Exception: 2FA OTP responses must be returned to the caller
 			if (response.status === 401) {
 				const cloned = response.clone()
 				let data = {}
@@ -127,6 +172,16 @@ export async function request(path, options = {}) {
 				if (data.code === "OTP_REQUIRED" || data.code === "OTP_INVALID") {
 					return response
 				}
+
+				// Attempt silent refresh (Feature 44 Part B) — one retry on 401
+				if (attempt === 0) {
+					const refreshed = await tryRefresh()
+					if (refreshed) {
+						// Update the auth header and retry this request
+						headers.Authorization = `Bearer ${refreshed}`
+						continue
+					}
+				}
 				throw new Error(ERROR_MESSAGES.notAuthenticated)
 			}
 

package/lib/commands/login.js

@@ -1,7 +1,9 @@
+import { createHash } from "node:crypto"
 import http from "node:http"
+import { hostname, userInfo } from "node:os"
 import open from "open"
 import { request } from "../api.js"
-import { getRegistryUrl, setToken } from "../config.js"
+import { getRegistryUrl, setRefreshToken, setToken } from "../config.js"
 import { WARNING_MESSAGES } from "../constants.js"
 import { createSpinner, log, printHeader } from "../ui.js"
 
@@ -188,11 +190,52 @@ export async function login() {
 		res.setHeader("Access-Control-Allow-Origin", "*")
 
 		if (url.pathname === "/callback") {
-			const token = url.searchParams.get("token")
+			// Exchange code flow (Feature 42) — code is exchanged for token server-side
+			const exchangeCode = url.searchParams.get("code")
+			// Legacy fallback: direct token in URL (for older server versions)
+			const directToken = url.searchParams.get("token")
+
+			let token = directToken
+			let refreshToken = null
+			if (exchangeCode && !directToken) {
+				try {
+					const exchangeRes = await fetch(`${registryUrl}/api/cli/exchange`, {
+						method: "POST",
+						headers: { "Content-Type": "application/json" },
+						body: JSON.stringify({ code: exchangeCode }),
+					})
+					if (exchangeRes.ok) {
+						const data = await exchangeRes.json()
+						token = data.token
+						// Feature 44: store refresh token if server provides one
+						if (data.refreshToken) {
+							refreshToken = data.refreshToken
+						}
+					} else {
+						const err = await exchangeRes.json().catch(() => ({}))
+						throw new Error(err.error || "Exchange failed")
+					}
+				} catch (err) {
+					spinner.fail(`Token exchange failed: ${err.message}`)
+					res.writeHead(200, { "Content-Type": "text/html" })
+					res.end(
+						getErrorHtml(
+							"Exchange Failed",
+							"Failed to exchange the authorization code. Please try again.",
+						),
+					)
+					closeAndExit(res)
+					return
+				}
+			}
 
 			if (token) {
-				// Use async setToken
+				// Store access token
 				await setToken(token)
+				// Store refresh token for session auth (Feature 44 Part B)
+				if (refreshToken) {
+					await setRefreshToken(refreshToken)
+				}
 
 				try {
 					const response = await request("/-/whoami")
@@ -535,10 +578,15 @@ export async function login() {
 		}
 	})
 
+	// Compute device fingerprint for session auth (Feature 44 Part B)
+	const fp = createHash("sha256")
+		.update(`${hostname()}:${userInfo().username}:lpm-cli`)
+		.digest("hex")
+	const dn = encodeURIComponent(hostname())
+
 	server.listen(0, async () => {
 		const port = server.address().port
-		// Assuming registryUrl is the base URL of the Next.js app
-		const loginUrl = `${registryUrl}/cli/login?port=${port}`
+		const loginUrl = `${registryUrl}/cli/login?port=${port}&fp=${fp}&dn=${dn}`
 
 		console.log(`Opening browser to: ${loginUrl}`)
 		await open(loginUrl)

package/lib/config.js

@@ -118,6 +118,26 @@ export async function clearToken() {
 	config.delete("token")
 }
 
+/**
+ * Store a refresh token in secure storage (Feature 44 Part B).
+ * Uses the same secure-store as auth tokens with a "refresh:" prefix.
+ * @param {string} refreshToken
+ * @returns {Promise<void>}
+ */
+export async function setRefreshToken(refreshToken) {
+	const registryUrl = getRegistryUrl()
+	await secureSetToken(refreshToken, `refresh:${registryUrl}`)
+}
+
+/**
+ * Get the stored refresh token from secure storage.
+ * @returns {Promise<string|null>}
+ */
+export async function getRefreshToken() {
+	const registryUrl = getRegistryUrl()
+	return secureGetToken(`refresh:${registryUrl}`)
+}
+
 // ============================================================================
 // Registry URL Configuration
 // ============================================================================

package/package.json

@@ -1,11 +1,11 @@
 {
 	"name": "@lpm-registry/cli",
-	"version": "0.8.0",
+	"version": "0.9.2",
 	"description": "CLI for Licensed Package Manager",
 	"author": "LPM <hello@lpm.dev> (https://lpm.dev)",
 	"repository": {
 		"type": "git",
-		"url": "https://github.com/lpm-dev/cli"
+		"url": "https://github.com/lpm-dev/rust-client"
 	},
 	"homepage": "https://lpm.dev",
 	"license": "ISC",
@@ -61,11 +61,11 @@
 		"xcode": "^3.0.1"
 	},
 	"optionalDependencies": {
-		"@lpm-registry/cli-darwin-arm64": "0.8.0",
-		"@lpm-registry/cli-darwin-x64": "0.8.0",
-		"@lpm-registry/cli-linux-x64": "0.8.0",
-		"@lpm-registry/cli-linux-arm64": "0.8.0",
-		"@lpm-registry/cli-win32-x64": "0.8.0",
+		"@lpm-registry/cli-darwin-arm64": "0.9.2",
+		"@lpm-registry/cli-darwin-x64": "0.9.2",
+		"@lpm-registry/cli-linux-x64": "0.9.2",
+		"@lpm-registry/cli-linux-arm64": "0.9.2",
+		"@lpm-registry/cli-win32-x64": "0.9.2",
 		"keytar": "^7.9.0"
 	},
 	"type": "module",

package/bin/lpm-bin

@@ -1,347 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * LPM CLI Entry Point — Minimal fallback wrapper.
- *
- * In most cases, this file has been replaced by a hard link to the native
- * Rust binary during postinstall (zero Node.js overhead). This JS wrapper
- * only runs when:
- *
- * 1. Hard-link failed (cross-device mount, permissions)
- * 2. npm rebuild recreated the symlink
- * 3. Binary download failed during postinstall
- *
- * Resolution order:
- * 1. Try platform package binary (optionalDependencies)
- * 2. Try lpm-bin in bin/ directory (GitHub Releases download)
- * 3. Fall through to JS CLI implementation
- */
-
-import { execFileSync } from "node:child_process"
-import fs from "node:fs"
-import { createRequire } from "node:module"
-import os from "node:os"
-import path from "node:path"
-import { fileURLToPath } from "node:url"
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const require = createRequire(import.meta.url)
-
-// ─── Try native binary (Tier 1: platform package) ──────────────────
-
-const PLATFORMS = {
-	"darwin-arm64": { pkg: "@lpm-registry/cli-darwin-arm64", binary: "lpm" },
-	"darwin-x64": { pkg: "@lpm-registry/cli-darwin-x64", binary: "lpm" },
-	"linux-x64": { pkg: "@lpm-registry/cli-linux-x64", binary: "lpm" },
-	"linux-arm64": { pkg: "@lpm-registry/cli-linux-arm64", binary: "lpm" },
-	"win32-x64": { pkg: "@lpm-registry/cli-win32-x64", binary: "lpm.exe" },
-}
-
-// Allow override via environment variable (for debugging / custom builds)
-const envBinary = process.env.LPM_BINARY_PATH
-if (envBinary && fs.existsSync(envBinary)) {
-	runBinary(envBinary)
-}
-
-// Try platform package from optionalDependencies
-const platform = `${process.platform}-${os.arch()}`
-const platformInfo = PLATFORMS[platform]
-
-if (platformInfo) {
-	try {
-		const pkgJsonPath = require.resolve(`${platformInfo.pkg}/package.json`)
-		const binaryPath = path.join(path.dirname(pkgJsonPath), platformInfo.binary)
-		if (fs.existsSync(binaryPath)) {
-			runBinary(binaryPath)
-		}
-	} catch {
-		// Package not installed
-	}
-}
-
-// ─── Try native binary (Tier 2: downloaded by postinstall) ─────────
-
-const legacyBinaryName =
-	process.platform === "win32" ? "lpm-bin.exe" : "lpm-bin"
-const legacyBinaryPath = path.join(__dirname, legacyBinaryName)
-
-if (fs.existsSync(legacyBinaryPath)) {
-	runBinary(legacyBinaryPath)
-}
-
-// ─── JS CLI fallback (Tier 3) ──────────────────────────────────────
-
-import { Command } from "commander"
-import updateNotifier from "update-notifier"
-import { add } from "../lib/commands/add.js"
-import { audit } from "../lib/commands/audit.js"
-import { cache } from "../lib/commands/cache.js"
-import { checkName } from "../lib/commands/check-name.js"
-import { config } from "../lib/commands/config.js"
-import { doctor } from "../lib/commands/doctor.js"
-import { info } from "../lib/commands/info.js"
-import { init } from "../lib/commands/init.js"
-import { install } from "../lib/commands/install.js"
-import { login } from "../lib/commands/login.js"
-import { logout } from "../lib/commands/logout.js"
-import { marketplaceCompare } from "../lib/commands/marketplace-compare.js"
-import { marketplaceEarnings } from "../lib/commands/marketplace-earnings.js"
-import { mcpRemove, mcpSetup, mcpStatus } from "../lib/commands/mcp-setup.js"
-import { npmrc } from "../lib/commands/npmrc.js"
-import { openDashboard } from "../lib/commands/open.js"
-import { outdated } from "../lib/commands/outdated.js"
-import { poolStats } from "../lib/commands/pool-stats.js"
-import { publish } from "../lib/commands/publish.js"
-import { quality } from "../lib/commands/quality.js"
-import { remove } from "../lib/commands/remove.js"
-import { run } from "../lib/commands/run.js"
-import { search } from "../lib/commands/search.js"
-import { setup } from "../lib/commands/setup.js"
-import {
-	skillsClean,
-	skillsInstall,
-	skillsList,
-	skillsValidate,
-} from "../lib/commands/skills.js"
-import { rotateToken } from "../lib/commands/token-rotate.js"
-import { uninstall } from "../lib/commands/uninstall.js"
-import { whoami } from "../lib/commands/whoami.js"
-
-// Load package.json
-const pkg = JSON.parse(
-	fs.readFileSync(path.join(__dirname, "../package.json"), "utf-8"),
-)
-
-// Check for updates
-updateNotifier({ pkg }).notify()
-
-const program = new Command()
-
-program
-	.name("lpm")
-	.description("CLI for Licensed Package Manager")
-	.version(pkg.version)
-
-// Authentication
-program
-	.command("login")
-	.alias("l")
-	.description("Authenticate with the registry")
-	.action(login)
-program
-	.command("logout")
-	.alias("lo")
-	.description("Clear stored authentication token")
-	.option("--revoke", "Also revoke the token on the server")
-	.option("--clear-cache", "Clear local package cache")
-	.action(logout)
-program
-	.command("whoami")
-	.description("Check current authenticated user")
-	.option("--json", "Output in JSON format")
-	.action(whoami)
-
-// Package Management
-program
-	.command("init")
-	.description("Interactively create a package.json for LPM")
-	.action(init)
-program
-	.command("install [packages...]")
-	.alias("i")
-	.description("Install packages")
-	.option("--json", "Machine-readable JSON output")
-	.option("--no-skills", "Skip fetching Agent Skills")
-	.option("--pm <manager>", "Package manager to use")
-	.action(install)
-program
-	.command("uninstall <packages...>")
-	.aliases(["un", "unlink"])
-	.description("Uninstall packages")
-	.option("--pm <manager>", "Package manager to use")
-	.action(uninstall)
-program
-	.command("publish")
-	.alias("p")
-	.description("Publish a package to the registry")
-	.option("--check", "Quality check only")
-	.option("--min-score <score>", "Minimum quality score")
-	.option("--provenance", "Force OIDC provenance")
-	.option("--dry-run", "Preview without publishing")
-	.action(publish)
-program
-	.command("add <package>")
-	.description("Extract package source code")
-	.option("-p, --path <path>", "Target directory")
-	.option("-f, --force", "Overwrite existing files")
-	.option("-y, --yes", "Accept defaults")
-	.option("--alias <alias>", "Import alias prefix")
-	.option("--target <name>", "Swift SPM target")
-	.option("--json", "JSON output")
-	.option("--dry-run", "Preview only")
-	.action(add)
-program
-	.command("remove <package>")
-	.alias("rm")
-	.description("Remove a previously added package")
-	.action(remove)
-
-// Discovery
-program
-	.command("search <query>")
-	.description("Search packages")
-	.option("--limit <n>", "Max results", "20")
-	.option("--json", "JSON output")
-	.action((q, o) => search(q, { ...o, limit: parseInt(o.limit, 10) }))
-program
-	.command("info <package>")
-	.description("Package info")
-	.option("--json", "JSON output")
-	.option("-a, --all-versions", "Show all versions")
-	.action(info)
-program
-	.command("check-name <name>")
-	.description("Check name availability")
-	.option("--json", "JSON output")
-	.action(checkName)
-program
-	.command("quality <package>")
-	.description("Quality report")
-	.option("--json", "JSON output")
-	.action(quality)
-
-// Maintenance
-program
-	.command("audit [action]")
-	.description("Security audit")
-	.option("--json", "JSON output")
-	.option("--level <level>", "Minimum severity")
-	.action(audit)
-program
-	.command("outdated")
-	.description("Check outdated deps")
-	.option("--json", "JSON output")
-	.option("--all", "Show all deps")
-	.action(outdated)
-program.command("doctor").description("Health check").action(doctor)
-
-// Configuration
-program
-	.command("setup")
-	.description("Configure .npmrc")
-	.option("-r, --registry <url>", "Custom registry URL")
-	.option("--oidc", "Exchange OIDC token")
-	.option("--scoped", "Scoped registry only")
-	.action(setup)
-program
-	.command("npmrc")
-	.description("Generate read-only .npmrc token")
-	.option("-d, --days <number>", "Token expiry days")
-	.option("--scoped", "Scoped registry only")
-	.action(npmrc)
-program
-	.command("config [action] [key] [value]")
-	.description("Manage CLI config")
-	.action(config)
-program
-	.command("set <key> <value>")
-	.description('Shortcut for "lpm config set"')
-	.action((k, v) => config("set", k, v))
-program
-	.command("cache <action>")
-	.description("Manage local cache")
-	.action(cache)
-
-// Utility
-program
-	.command("open")
-	.description("Open dashboard in browser")
-	.action(openDashboard)
-program
-	.command("run <script>")
-	.description("Run npm scripts")
-	.allowUnknownOption()
-	.action(run)
-
-// Subcommands
-const token = program.command("token").description("Token management")
-token.command("rotate").description("Rotate token").action(rotateToken)
-
-const pool = program.command("pool").description("Pool revenue")
-pool
-	.command("stats")
-	.description("Pool earnings")
-	.option("--json", "JSON output")
-	.action(poolStats)
-
-const mcp = program.command("mcp").description("MCP server")
-mcp
-	.command("setup")
-	.description("Configure MCP server")
-	.option("--project", "Project-level config")
-	.action(mcpSetup)
-mcp
-	.command("remove")
-	.description("Remove MCP server")
-	.option("--project", "Project-level only")
-	.action(mcpRemove)
-mcp
-	.command("status")
-	.description("MCP server status")
-	.option("--verbose", "Show diagnostics")
-	.action(mcpStatus)
-
-const skills = program.command("skills").description("Agent Skills")
-skills
-	.command("validate")
-	.description("Validate skills files")
-	.option("--json", "JSON output")
-	.action(skillsValidate)
-skills
-	.command("install [package]")
-	.description("Install skills")
-	.option("--json", "JSON output")
-	.action(skillsInstall)
-skills
-	.command("list")
-	.description("List available skills")
-	.option("--json", "JSON output")
-	.action(skillsList)
-skills
-	.command("clean")
-	.description("Remove installed skills")
-	.option("--json", "JSON output")
-	.action(skillsClean)
-
-const marketplace = program.command("marketplace").description("Marketplace")
-marketplace
-	.command("compare <input>")
-	.description("Find comparable packages")
-	.option("--json", "JSON output")
-	.option("--category <category>", "Filter by category")
-	.option("--limit <n>", "Max results")
-	.action(marketplaceCompare)
-marketplace
-	.command("earnings")
-	.description("Revenue summary")
-	.option("--json", "JSON output")
-	.action(marketplaceEarnings)
-
-program.parse()
-
-// ─── Helper ────────────────────────────────────────────────────────
-
-function runBinary(binaryPath) {
-	try {
-		execFileSync(binaryPath, process.argv.slice(2), {
-			stdio: "inherit",
-			env: process.env,
-		})
-		process.exit(0)
-	} catch (err) {
-		if (err.status != null) {
-			process.exit(err.status)
-		}
-		// Binary failed to execute — fall through to JS CLI
-	}
-}

package/bin/lpm.js.bak

@@ -1,347 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * LPM CLI Entry Point — Minimal fallback wrapper.
- *
- * In most cases, this file has been replaced by a hard link to the native
- * Rust binary during postinstall (zero Node.js overhead). This JS wrapper
- * only runs when:
- *
- * 1. Hard-link failed (cross-device mount, permissions)
- * 2. npm rebuild recreated the symlink
- * 3. Binary download failed during postinstall
- *
- * Resolution order:
- * 1. Try platform package binary (optionalDependencies)
- * 2. Try lpm-bin in bin/ directory (GitHub Releases download)
- * 3. Fall through to JS CLI implementation
- */
-
-import { execFileSync } from "node:child_process"
-import fs from "node:fs"
-import { createRequire } from "node:module"
-import os from "node:os"
-import path from "node:path"
-import { fileURLToPath } from "node:url"
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const require = createRequire(import.meta.url)
-
-// ─── Try native binary (Tier 1: platform package) ──────────────────
-
-const PLATFORMS = {
-	"darwin-arm64": { pkg: "@lpm-registry/cli-darwin-arm64", binary: "lpm" },
-	"darwin-x64": { pkg: "@lpm-registry/cli-darwin-x64", binary: "lpm" },
-	"linux-x64": { pkg: "@lpm-registry/cli-linux-x64", binary: "lpm" },
-	"linux-arm64": { pkg: "@lpm-registry/cli-linux-arm64", binary: "lpm" },
-	"win32-x64": { pkg: "@lpm-registry/cli-win32-x64", binary: "lpm.exe" },
-}
-
-// Allow override via environment variable (for debugging / custom builds)
-const envBinary = process.env.LPM_BINARY_PATH
-if (envBinary && fs.existsSync(envBinary)) {
-	runBinary(envBinary)
-}
-
-// Try platform package from optionalDependencies
-const platform = `${process.platform}-${os.arch()}`
-const platformInfo = PLATFORMS[platform]
-
-if (platformInfo) {
-	try {
-		const pkgJsonPath = require.resolve(`${platformInfo.pkg}/package.json`)
-		const binaryPath = path.join(path.dirname(pkgJsonPath), platformInfo.binary)
-		if (fs.existsSync(binaryPath)) {
-			runBinary(binaryPath)
-		}
-	} catch {
-		// Package not installed
-	}
-}
-
-// ─── Try native binary (Tier 2: downloaded by postinstall) ─────────
-
-const legacyBinaryName =
-	process.platform === "win32" ? "lpm-bin.exe" : "lpm-bin"
-const legacyBinaryPath = path.join(__dirname, legacyBinaryName)
-
-if (fs.existsSync(legacyBinaryPath)) {
-	runBinary(legacyBinaryPath)
-}
-
-// ─── JS CLI fallback (Tier 3) ──────────────────────────────────────
-
-import { Command } from "commander"
-import updateNotifier from "update-notifier"
-import { add } from "../lib/commands/add.js"
-import { audit } from "../lib/commands/audit.js"
-import { cache } from "../lib/commands/cache.js"
-import { checkName } from "../lib/commands/check-name.js"
-import { config } from "../lib/commands/config.js"
-import { doctor } from "../lib/commands/doctor.js"
-import { info } from "../lib/commands/info.js"
-import { init } from "../lib/commands/init.js"
-import { install } from "../lib/commands/install.js"
-import { login } from "../lib/commands/login.js"
-import { logout } from "../lib/commands/logout.js"
-import { marketplaceCompare } from "../lib/commands/marketplace-compare.js"
-import { marketplaceEarnings } from "../lib/commands/marketplace-earnings.js"
-import { mcpRemove, mcpSetup, mcpStatus } from "../lib/commands/mcp-setup.js"
-import { npmrc } from "../lib/commands/npmrc.js"
-import { openDashboard } from "../lib/commands/open.js"
-import { outdated } from "../lib/commands/outdated.js"
-import { poolStats } from "../lib/commands/pool-stats.js"
-import { publish } from "../lib/commands/publish.js"
-import { quality } from "../lib/commands/quality.js"
-import { remove } from "../lib/commands/remove.js"
-import { run } from "../lib/commands/run.js"
-import { search } from "../lib/commands/search.js"
-import { setup } from "../lib/commands/setup.js"
-import {
-	skillsClean,
-	skillsInstall,
-	skillsList,
-	skillsValidate,
-} from "../lib/commands/skills.js"
-import { rotateToken } from "../lib/commands/token-rotate.js"
-import { uninstall } from "../lib/commands/uninstall.js"
-import { whoami } from "../lib/commands/whoami.js"
-
-// Load package.json
-const pkg = JSON.parse(
-	fs.readFileSync(path.join(__dirname, "../package.json"), "utf-8"),
-)
-
-// Check for updates
-updateNotifier({ pkg }).notify()
-
-const program = new Command()
-
-program
-	.name("lpm")
-	.description("CLI for Licensed Package Manager")
-	.version(pkg.version)
-
-// Authentication
-program
-	.command("login")
-	.alias("l")
-	.description("Authenticate with the registry")
-	.action(login)
-program
-	.command("logout")
-	.alias("lo")
-	.description("Clear stored authentication token")
-	.option("--revoke", "Also revoke the token on the server")
-	.option("--clear-cache", "Clear local package cache")
-	.action(logout)
-program
-	.command("whoami")
-	.description("Check current authenticated user")
-	.option("--json", "Output in JSON format")
-	.action(whoami)
-
-// Package Management
-program
-	.command("init")
-	.description("Interactively create a package.json for LPM")
-	.action(init)
-program
-	.command("install [packages...]")
-	.alias("i")
-	.description("Install packages")
-	.option("--json", "Machine-readable JSON output")
-	.option("--no-skills", "Skip fetching Agent Skills")
-	.option("--pm <manager>", "Package manager to use")
-	.action(install)
-program
-	.command("uninstall <packages...>")
-	.aliases(["un", "unlink"])
-	.description("Uninstall packages")
-	.option("--pm <manager>", "Package manager to use")
-	.action(uninstall)
-program
-	.command("publish")
-	.alias("p")
-	.description("Publish a package to the registry")
-	.option("--check", "Quality check only")
-	.option("--min-score <score>", "Minimum quality score")
-	.option("--provenance", "Force OIDC provenance")
-	.option("--dry-run", "Preview without publishing")
-	.action(publish)
-program
-	.command("add <package>")
-	.description("Extract package source code")
-	.option("-p, --path <path>", "Target directory")
-	.option("-f, --force", "Overwrite existing files")
-	.option("-y, --yes", "Accept defaults")
-	.option("--alias <alias>", "Import alias prefix")
-	.option("--target <name>", "Swift SPM target")
-	.option("--json", "JSON output")
-	.option("--dry-run", "Preview only")
-	.action(add)
-program
-	.command("remove <package>")
-	.alias("rm")
-	.description("Remove a previously added package")
-	.action(remove)
-
-// Discovery
-program
-	.command("search <query>")
-	.description("Search packages")
-	.option("--limit <n>", "Max results", "20")
-	.option("--json", "JSON output")
-	.action((q, o) => search(q, { ...o, limit: parseInt(o.limit, 10) }))
-program
-	.command("info <package>")
-	.description("Package info")
-	.option("--json", "JSON output")
-	.option("-a, --all-versions", "Show all versions")
-	.action(info)
-program
-	.command("check-name <name>")
-	.description("Check name availability")
-	.option("--json", "JSON output")
-	.action(checkName)
-program
-	.command("quality <package>")
-	.description("Quality report")
-	.option("--json", "JSON output")
-	.action(quality)
-
-// Maintenance
-program
-	.command("audit [action]")
-	.description("Security audit")
-	.option("--json", "JSON output")
-	.option("--level <level>", "Minimum severity")
-	.action(audit)
-program
-	.command("outdated")
-	.description("Check outdated deps")
-	.option("--json", "JSON output")
-	.option("--all", "Show all deps")
-	.action(outdated)
-program.command("doctor").description("Health check").action(doctor)
-
-// Configuration
-program
-	.command("setup")
-	.description("Configure .npmrc")
-	.option("-r, --registry <url>", "Custom registry URL")
-	.option("--oidc", "Exchange OIDC token")
-	.option("--scoped", "Scoped registry only")
-	.action(setup)
-program
-	.command("npmrc")
-	.description("Generate read-only .npmrc token")
-	.option("-d, --days <number>", "Token expiry days")
-	.option("--scoped", "Scoped registry only")
-	.action(npmrc)
-program
-	.command("config [action] [key] [value]")
-	.description("Manage CLI config")
-	.action(config)
-program
-	.command("set <key> <value>")
-	.description('Shortcut for "lpm config set"')
-	.action((k, v) => config("set", k, v))
-program
-	.command("cache <action>")
-	.description("Manage local cache")
-	.action(cache)
-
-// Utility
-program
-	.command("open")
-	.description("Open dashboard in browser")
-	.action(openDashboard)
-program
-	.command("run <script>")
-	.description("Run npm scripts")
-	.allowUnknownOption()
-	.action(run)
-
-// Subcommands
-const token = program.command("token").description("Token management")
-token.command("rotate").description("Rotate token").action(rotateToken)
-
-const pool = program.command("pool").description("Pool revenue")
-pool
-	.command("stats")
-	.description("Pool earnings")
-	.option("--json", "JSON output")
-	.action(poolStats)
-
-const mcp = program.command("mcp").description("MCP server")
-mcp
-	.command("setup")
-	.description("Configure MCP server")
-	.option("--project", "Project-level config")
-	.action(mcpSetup)
-mcp
-	.command("remove")
-	.description("Remove MCP server")
-	.option("--project", "Project-level only")
-	.action(mcpRemove)
-mcp
-	.command("status")
-	.description("MCP server status")
-	.option("--verbose", "Show diagnostics")
-	.action(mcpStatus)
-
-const skills = program.command("skills").description("Agent Skills")
-skills
-	.command("validate")
-	.description("Validate skills files")
-	.option("--json", "JSON output")
-	.action(skillsValidate)
-skills
-	.command("install [package]")
-	.description("Install skills")
-	.option("--json", "JSON output")
-	.action(skillsInstall)
-skills
-	.command("list")
-	.description("List available skills")
-	.option("--json", "JSON output")
-	.action(skillsList)
-skills
-	.command("clean")
-	.description("Remove installed skills")
-	.option("--json", "JSON output")
-	.action(skillsClean)
-
-const marketplace = program.command("marketplace").description("Marketplace")
-marketplace
-	.command("compare <input>")
-	.description("Find comparable packages")
-	.option("--json", "JSON output")
-	.option("--category <category>", "Filter by category")
-	.option("--limit <n>", "Max results")
-	.action(marketplaceCompare)
-marketplace
-	.command("earnings")
-	.description("Revenue summary")
-	.option("--json", "JSON output")
-	.action(marketplaceEarnings)
-
-program.parse()
-
-// ─── Helper ────────────────────────────────────────────────────────
-
-function runBinary(binaryPath) {
-	try {
-		execFileSync(binaryPath, process.argv.slice(2), {
-			stdio: "inherit",
-			env: process.env,
-		})
-		process.exit(0)
-	} catch (err) {
-		if (err.status != null) {
-			process.exit(err.status)
-		}
-		// Binary failed to execute — fall through to JS CLI
-	}
-}