@newlandnpt/pep-cli 0.1.0

package/README.md

@@ -0,0 +1,111 @@
+# PEP CLI
+
+Command-line OAuth client for obtaining a PEP access token, reading PEP documentation, and
+syncing agent skills. Login uses the authorization-code flow with PKCE and a localhost callback.
+
+Tokens live in the OS keychain — **Windows Credential Manager** or the **macOS login keychain**
+(via the built-in `security` tool). Linux is not implemented yet: `systemCredentialStore()` throws,
+and `package.json` declares `os: ["win32", "darwin"]` so npm refuses to install elsewhere rather
+than letting the install succeed and the first `auth login` fail.
+
+The non-secret issuer, client ID, resources and documentation URL are stored in a plain config file
+(`%APPDATA%\\PEP` on Windows, `~/.config/pep` elsewhere). `auth logout` clears both.
+
+## Install
+
+```
+npm i -g @newlandnpt/pep-cli
+```
+
+The package name is scoped, the command names are not — see below. The scope is not a style
+choice: npm's typo-squatting policy **refuses** the unscoped name `pep-cli` ("too similar to
+existing packages cp-cli, del-cli, open-cli"), and that check applies to every short
+`<prefix>-cli` name. Scoped names skip the check, so `@newlandnpt/…` is what makes this
+publishable at all.
+
+## Command name
+
+The package installs **two** names for the same executable:
+
+```
+pep        # short form, used throughout this document
+pep-cli    # alias
+```
+
+`bin` names are global and independent of the package name — any other package (or any
+non-npm tool) may also claim `pep`, and on a global install the last one wins silently.
+The alias costs nothing (one more symlink to the same file) and gives scripts a name that
+cannot be clobbered by an unrelated `pep`. Prefer `pep-cli` in anything automated.
+
+## Register the public client
+
+Run this once from the `pep-webapp` repository for the customer tenant (replace the IDs):
+
+```bash
+node scripts/oauth-bootstrap.mjs --client --public \
+  --client-id 1b916aae96f69a535d7a1a30c8f2e1dc --name "PEP CLI" \
+  --party <party-id> --admission-user <user-id> \
+  --redirect-uri http://localhost:53682/callback \
+  --scopes "openid profile email"
+```
+
+If one PEP deployment serves multiple customer tenants, register a distinct client ID for each tenant
+and pass it with `--client-id`.
+
+## Use
+
+```powershell
+pep auth login
+pep auth status
+$token = pep auth token
+pep auth logout
+```
+
+The issuer is fixed at build time:
+
+| build         | issuer                                 |
+| ------------- | -------------------------------------- |
+| `development` | `https://pep-webapp-dev.onrender.com`  |
+| `view`        | `https://pep-webapp-view.onrender.com` |
+| `production`  | `https://pep.newlandnpt.us`            |
+
+`--issuer` remains available only as a temporary override — it is **not** remembered, so every
+`auth login` needs it again. That is why the built-in default decides where most users land.
+
+⚠ **The npm release is built from `view`** (see `prepublishOnly`). As of 2026-09-08
+`https://pep.newlandnpt.us/.well-known/openid-configuration` returns **404** — the production
+domain does not serve the authorization server yet, so a `production` build would fail at
+discovery on the user's very first `auth login`. Switch `prepublishOnly` back to `production`
+once that endpoint is live.
+
+`pep auth token` writes only the access token to stdout, so agents can use it without parsing status
+text. Refresh occurs automatically shortly before expiry and the rotated refresh token replaces the old
+credential atomically.
+
+## Build the customer executable
+
+```powershell
+pnpm build:exe:dev    # dist/pep-dev.exe
+pnpm build:exe:view   # dist/pep-view.exe
+pnpm build:exe        # dist/pep.exe (production)
+```
+
+The unsigned standalone executable is written to `dist/pep.exe` and does not require Node.js
+on the customer machine. Production distribution should sign that file with the organization's Windows
+code-signing certificate after injection.
+
+## Build the Windows installer
+
+Install [NSIS 3](https://nsis.sourceforge.io/Download), then run:
+
+```powershell
+pnpm build:installer:dev    # dist/pep-dev-setup.exe
+pnpm build:installer:view   # dist/pep-view-setup.exe
+pnpm build:installer       # dist/pep-setup.exe (production)
+```
+
+Both user-level installers install PEP CLI under `%LOCALAPPDATA%\Programs\PEP`, add that directory
+to the user `PATH`, and register an uninstaller. Installing one environment replaces the other, and
+new terminals can run `pep auth login` from any directory. Run `pep auth login` after switching
+environments so the stored authorization matches the installed environment. Sign both `pep.exe` and
+the final production installer before distribution.

package/dist/pep.cjs

@@ -0,0 +1,1119 @@
+#!/usr/bin/env node
+"use strict";
+
+// src/auth-service.ts
+var import_promises2 = require("node:fs/promises");
+var import_node_path2 = require("node:path");
+
+// src/config.ts
+var import_promises = require("node:fs/promises");
+var import_node_os = require("node:os");
+var import_node_path = require("node:path");
+var DEFAULT_CLIENT_ID = "pep-cli";
+var DEFAULT_REDIRECT_URI = "http://localhost:53682/callback";
+var DEFAULT_SCOPES = ["openid", "profile", "email", "docs:read", "skills:read"];
+var DEFAULT_RESOURCES = ["urn:newland:pep:docs"];
+var DEFAULT_DOCS_URL = "https://pep-developer-docs.onrender.com";
+function issuerForEnvironment(environment) {
+  if (environment === "production") return "https://pep.newlandnpt.us";
+  if (environment === "view") return "https://pep-webapp-view.onrender.com";
+  return "https://pep-webapp-dev.onrender.com";
+}
+var BUILD_ENVIRONMENT = false ? "development" : "production";
+var DEFAULT_ISSUER = issuerForEnvironment(BUILD_ENVIRONMENT);
+function configuredIssuer(explicitIssuer, savedIssuer) {
+  return explicitIssuer ?? savedIssuer ?? DEFAULT_ISSUER;
+}
+function configDirectory() {
+  if (process.platform === "win32") return (0, import_node_path.join)((0, import_node_os.homedir)(), "AppData", "Roaming", "PEP");
+  return (0, import_node_path.join)((0, import_node_os.homedir)(), ".config", "pep");
+}
+function configPath() {
+  return (0, import_node_path.join)(configDirectory(), "config.json");
+}
+function lockPath() {
+  return (0, import_node_path.join)(configDirectory(), "credentials.lock");
+}
+function skillsStatePath() {
+  return (0, import_node_path.join)(configDirectory(), "skills.json");
+}
+function defaultSkillsDirectory() {
+  return (0, import_node_path.join)((0, import_node_os.homedir)(), ".claude", "skills");
+}
+function isCliConfig(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return candidate.version === 1 && typeof candidate.issuer === "string" && typeof candidate.clientId === "string" && typeof candidate.redirectUri === "string" && // 可选：v0.1.0 写下的配置文件没有这个键，读它们不该报「配置损坏」。
+  (candidate.resources === void 0 || Array.isArray(candidate.resources) && candidate.resources.every((one) => typeof one === "string")) && (candidate.docsUrl === void 0 || typeof candidate.docsUrl === "string");
+}
+function fileConfigStore(path = configPath()) {
+  return {
+    async read() {
+      try {
+        const parsed = JSON.parse(await (0, import_promises.readFile)(path, "utf8"));
+        if (!isCliConfig(parsed)) throw new Error(`PEP CLI config is malformed: ${path}`);
+        return parsed;
+      } catch (error) {
+        if (error.code === "ENOENT") return null;
+        throw error;
+      }
+    },
+    async write(config) {
+      await (0, import_promises.mkdir)((0, import_node_path.dirname)(path), { recursive: true });
+      const temporary = `${path}.${process.pid}.tmp`;
+      await (0, import_promises.writeFile)(temporary, `${JSON.stringify(config, null, 2)}
+`, { mode: 384 });
+      await (0, import_promises.rename)(temporary, path);
+    },
+    async delete() {
+      await (0, import_promises.rm)(path, { force: true });
+    }
+  };
+}
+function isSkillsState(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return candidate.version === 1 && typeof candidate.directory === "string" && Array.isArray(candidate.skills) && candidate.skills.every((one) => typeof one === "string") && (candidate.commit === void 0 || typeof candidate.commit === "string");
+}
+function fileSkillsStateStore(path = skillsStatePath()) {
+  return {
+    async read() {
+      try {
+        const parsed = JSON.parse(await (0, import_promises.readFile)(path, "utf8"));
+        return isSkillsState(parsed) ? parsed : null;
+      } catch (error) {
+        if (error.code === "ENOENT") return null;
+        if (error instanceof SyntaxError) return null;
+        throw error;
+      }
+    },
+    async write(state) {
+      await (0, import_promises.mkdir)((0, import_node_path.dirname)(path), { recursive: true });
+      const temporary = `${path}.${process.pid}.tmp`;
+      await (0, import_promises.writeFile)(temporary, `${JSON.stringify(state, null, 2)}
+`, { mode: 384 });
+      await (0, import_promises.rename)(temporary, path);
+    }
+  };
+}
+function normalizeDocsUrl(raw) {
+  return normalizeIssuer(raw);
+}
+function normalizeIssuer(raw) {
+  const url = new URL(raw);
+  const isLoopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback)) {
+    throw new Error("Issuer must use HTTPS (HTTP is allowed only for a local PEP server).");
+  }
+  url.search = "";
+  url.hash = "";
+  url.pathname = url.pathname.replace(/\/$/, "");
+  return url.toString().replace(/\/$/, "");
+}
+
+// src/oauth-client.ts
+var import_node_crypto = require("node:crypto");
+var import_node_http = require("node:http");
+var import_node_child_process = require("node:child_process");
+var CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
+var HTTP_TIMEOUT_MS = 15 * 1e3;
+function endpoint(value, name) {
+  if (typeof value !== "string") throw new Error(`Discovery document is missing ${name}.`);
+  const url = new URL(value);
+  const isLoopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback)) {
+    throw new Error(`Discovery ${name} is not a secure HTTP endpoint.`);
+  }
+  return url.toString();
+}
+async function responseJson(response, operation) {
+  const body = await response.text();
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    throw new Error(`${operation} returned a non-JSON response (HTTP ${response.status}).`);
+  }
+  if (typeof parsed !== "object" || parsed === null)
+    throw new Error(`${operation} returned malformed JSON.`);
+  const record = parsed;
+  if (!response.ok) {
+    const description = typeof record.error_description === "string" ? record.error_description : void 0;
+    const code = typeof record.error === "string" ? record.error : `HTTP ${response.status}`;
+    throw new Error(`${operation} failed: ${description ?? code}`);
+  }
+  return record;
+}
+function createPkce() {
+  const verifier = (0, import_node_crypto.randomBytes)(32).toString("base64url");
+  const challenge = (0, import_node_crypto.createHash)("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+async function discover(issuer, fetcher = fetch) {
+  const response = await fetcher(`${issuer}/.well-known/openid-configuration`, {
+    headers: { Accept: "application/json" },
+    redirect: "error",
+    signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+  });
+  const body = await responseJson(response, "OAuth discovery");
+  if (body.issuer !== issuer)
+    throw new Error("Discovery issuer does not match the configured PEP issuer.");
+  return {
+    issuer,
+    authorizationEndpoint: endpoint(body.authorization_endpoint, "authorization_endpoint"),
+    tokenEndpoint: endpoint(body.token_endpoint, "token_endpoint"),
+    revocationEndpoint: endpoint(body.revocation_endpoint, "revocation_endpoint"),
+    userinfoEndpoint: endpoint(body.userinfo_endpoint, "userinfo_endpoint")
+  };
+}
+function authorizationUrl(args) {
+  const url = new URL(args.discovery.authorizationEndpoint);
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: args.config.clientId,
+    redirect_uri: args.config.redirectUri,
+    scope: args.scopes.join(" "),
+    state: args.state,
+    code_challenge: args.challenge,
+    code_challenge_method: "S256"
+  });
+  for (const resource of args.config.resources ?? []) params.append("resource", resource);
+  url.search = params.toString();
+  return url.toString();
+}
+function callbackHtml(isSuccess) {
+  const title = isSuccess ? "PEP login complete" : "PEP login failed";
+  const message = isSuccess ? "You can close this window and return to the terminal." : "Return to the terminal for details.";
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body><main><h1>${title}</h1><p>${message}</p></main></body></html>`;
+}
+async function waitForAuthorizationCallback(args) {
+  const redirect = new URL(args.redirectUri);
+  if (redirect.protocol !== "http:" || redirect.hostname !== "localhost" || !redirect.port) {
+    throw new Error("CLI redirect URI must be an http://localhost URL with an explicit port.");
+  }
+  let server;
+  return new Promise((resolve, reject) => {
+    const finish = (error, code) => {
+      clearTimeout(timeout);
+      server?.close();
+      if (error) reject(error);
+      else resolve(code);
+    };
+    const timeout = setTimeout(
+      () => finish(new Error("Login timed out while waiting for the browser callback.")),
+      args.timeoutMs ?? CALLBACK_TIMEOUT_MS
+    );
+    server = (0, import_node_http.createServer)((request, response) => {
+      const current = new URL(request.url ?? "/", args.redirectUri);
+      if (request.method !== "GET" || current.pathname !== redirect.pathname) {
+        response.writeHead(404).end();
+        return;
+      }
+      if (current.searchParams.get("state") !== args.state) {
+        response.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }).end(callbackHtml(false));
+        return;
+      }
+      const oauthError = current.searchParams.get("error");
+      if (oauthError) {
+        response.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }).end(callbackHtml(false));
+        finish(
+          new Error(
+            `Authorization failed: ${current.searchParams.get("error_description") ?? oauthError}`
+          )
+        );
+        return;
+      }
+      const code = current.searchParams.get("code");
+      if (!code) {
+        response.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }).end(callbackHtml(false));
+        return;
+      }
+      response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" }).end(callbackHtml(true));
+      finish(void 0, code);
+    });
+    server.once("error", (error) => finish(error));
+    server.listen(Number(redirect.port), "localhost", () => {
+      args.onListening().catch((error) => finish(error));
+    });
+  });
+}
+function openBrowser(url) {
+  const command = process.platform === "win32" ? "rundll32.exe" : process.platform === "darwin" ? "open" : "xdg-open";
+  const commandArgs = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+  return new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process.spawn)(command, commandArgs, {
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true
+    });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve();
+    });
+  });
+}
+function parseTokens(body, config) {
+  if (typeof body.access_token !== "string" || typeof body.refresh_token !== "string" || body.token_type !== "Bearer" || typeof body.expires_in !== "number" || !Number.isFinite(body.expires_in) || body.expires_in <= 0 || typeof body.scope !== "string") {
+    throw new Error("Token endpoint returned a malformed token response.");
+  }
+  return {
+    version: 1,
+    issuer: config.issuer,
+    clientId: config.clientId,
+    accessToken: body.access_token,
+    refreshToken: body.refresh_token,
+    tokenType: "Bearer",
+    expiresAt: Date.now() + body.expires_in * 1e3,
+    scopes: body.scope.split(/\s+/).filter(Boolean)
+  };
+}
+async function postForm(url, form, operation, fetcher) {
+  const body = new URLSearchParams();
+  for (const [key, value] of Object.entries(form)) {
+    if (typeof value === "string") body.set(key, value);
+    else for (const one of value) body.append(key, one);
+  }
+  const response = await fetcher(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+    body,
+    redirect: "error",
+    signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+  });
+  return responseJson(response, operation);
+}
+function createOAuthClient(fetcher = fetch) {
+  return {
+    discover: (issuer) => discover(issuer, fetcher),
+    async exchangeCode(discovery, config, code, verifier) {
+      const body = await postForm(
+        discovery.tokenEndpoint,
+        {
+          grant_type: "authorization_code",
+          client_id: config.clientId,
+          code,
+          redirect_uri: config.redirectUri,
+          code_verifier: verifier,
+          // 与 /authorize 报的那批一致。PEP 只允许**收窄**（§2.2），报同一批即原样批准；
+          // 不报则照授权时批准的全量落，两者在这里等价 —— 显式带上是为了让线上抓包能看出
+          // 这枚令牌的受众是谁，不必回头去翻授权请求。
+          resource: config.resources ?? []
+        },
+        "Authorization code exchange",
+        fetcher
+      );
+      return parseTokens(body, config);
+    },
+    async refresh(discovery, authorization) {
+      const config = {
+        version: 1,
+        issuer: authorization.issuer,
+        clientId: authorization.clientId,
+        redirectUri: ""
+      };
+      const body = await postForm(
+        discovery.tokenEndpoint,
+        {
+          grant_type: "refresh_token",
+          client_id: authorization.clientId,
+          refresh_token: authorization.refreshToken
+        },
+        "Token refresh",
+        fetcher
+      );
+      return parseTokens(body, config);
+    },
+    async userInfo(discovery, accessToken) {
+      const response = await fetcher(discovery.userinfoEndpoint, {
+        headers: { Authorization: `Bearer ${accessToken}`, Accept: "application/json" },
+        redirect: "error",
+        signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+      });
+      const body = await responseJson(response, "User info");
+      if (typeof body.sub !== "string") throw new Error("User info response is missing sub.");
+      return {
+        sub: body.sub,
+        ...typeof body.email === "string" ? { email: body.email } : {},
+        ...typeof body.name === "string" ? { name: body.name } : {}
+      };
+    },
+    async revoke(discovery, authorization) {
+      const response = await fetcher(discovery.revocationEndpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          client_id: authorization.clientId,
+          token: authorization.refreshToken,
+          token_type_hint: "refresh_token"
+        }),
+        redirect: "error",
+        signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+      });
+      if (!response.ok) await responseJson(response, "Token revocation");
+    }
+  };
+}
+
+// src/auth-service.ts
+var REFRESH_EARLY_MS = 60 * 1e3;
+var LOCK_STALE_MS = 30 * 1e3;
+var LOCK_WAIT_MS = 10 * 1e3;
+async function delay(milliseconds) {
+  await new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+async function withAuthorizationLock(path, action) {
+  await (0, import_promises2.mkdir)((0, import_node_path2.dirname)(path), { recursive: true });
+  const startedAt = Date.now();
+  while (true) {
+    try {
+      const handle = await (0, import_promises2.open)(path, "wx", 384);
+      try {
+        return await action();
+      } finally {
+        await handle.close();
+        await (0, import_promises2.unlink)(path).catch(() => void 0);
+      }
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      let age;
+      try {
+        age = Date.now() - (await (0, import_promises2.stat)(path)).mtimeMs;
+      } catch (statError) {
+        if (statError.code === "ENOENT") continue;
+        throw statError;
+      }
+      if (age > LOCK_STALE_MS) {
+        await (0, import_promises2.unlink)(path).catch(() => void 0);
+        continue;
+      }
+      if (Date.now() - startedAt > LOCK_WAIT_MS)
+        throw new Error("Another PEP authentication command is still running.");
+      await delay(100);
+    }
+  }
+}
+function createAuthService(dependencies) {
+  const now = dependencies.now ?? Date.now;
+  async function requireAuthorization() {
+    const authorization = await dependencies.credentialStore.read();
+    if (!authorization) throw new Error("Not logged in. Run `pep auth login` first.");
+    return authorization;
+  }
+  async function currentAuthorization() {
+    return withAuthorizationLock(dependencies.authorizationLockPath ?? lockPath(), async () => {
+      const authorization = await requireAuthorization();
+      if (authorization.expiresAt - now() > REFRESH_EARLY_MS) return authorization;
+      const discovery = await dependencies.oauth.discover(authorization.issuer);
+      const refreshed = await dependencies.oauth.refresh(discovery, authorization);
+      await dependencies.credentialStore.write(refreshed);
+      return refreshed;
+    });
+  }
+  return {
+    async login(config, onAuthorizationUrl) {
+      const normalized = { ...config, issuer: normalizeIssuer(config.issuer) };
+      const discovery = await dependencies.oauth.discover(normalized.issuer);
+      const state = createPkce().verifier;
+      const pkce = createPkce();
+      const url = authorizationUrl({
+        discovery,
+        config: normalized,
+        state,
+        challenge: pkce.challenge,
+        scopes: DEFAULT_SCOPES
+      });
+      const code = await (dependencies.receiveCode ?? waitForAuthorizationCallback)({
+        redirectUri: normalized.redirectUri,
+        state,
+        onListening: async () => {
+          onAuthorizationUrl?.(url);
+          try {
+            await (dependencies.launchBrowser ?? openBrowser)(url);
+          } catch {
+          }
+        }
+      });
+      const authorization = await dependencies.oauth.exchangeCode(
+        discovery,
+        normalized,
+        code,
+        pkce.verifier
+      );
+      const previous = await dependencies.credentialStore.read();
+      await dependencies.credentialStore.write(authorization);
+      await dependencies.configStore.write(normalized);
+      if (previous) {
+        try {
+          const previousDiscovery = await dependencies.oauth.discover(previous.issuer);
+          await dependencies.oauth.revoke(previousDiscovery, previous);
+        } catch {
+        }
+      }
+      return authorization;
+    },
+    currentAuthorization,
+    async status() {
+      const authorization = await currentAuthorization();
+      const discovery = await dependencies.oauth.discover(authorization.issuer);
+      const user = await dependencies.oauth.userInfo(discovery, authorization.accessToken);
+      return { authorization, user };
+    },
+    async logout() {
+      return withAuthorizationLock(dependencies.authorizationLockPath ?? lockPath(), async () => {
+        const authorization = await dependencies.credentialStore.read();
+        await dependencies.configStore.delete();
+        if (!authorization) return { wasLoggedIn: false };
+        let revocationError;
+        try {
+          const discovery = await dependencies.oauth.discover(authorization.issuer);
+          await dependencies.oauth.revoke(discovery, authorization);
+        } catch (error) {
+          revocationError = error;
+        } finally {
+          await dependencies.credentialStore.delete();
+        }
+        return { wasLoggedIn: true, ...revocationError ? { revocationError } : {} };
+      });
+    }
+  };
+}
+
+// src/credential-store.ts
+var import_node_child_process2 = require("node:child_process");
+var CREDENTIAL_TARGET = "PEP CLI OAuth Tokens";
+var WINDOWS_CREDENTIAL_NATIVE = String.raw`
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+
+public static class PepCredential {
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  public struct CREDENTIAL {
+    public UInt32 Flags;
+    public UInt32 Type;
+    public string TargetName;
+    public string Comment;
+    public Int64 LastWritten;
+    public UInt32 CredentialBlobSize;
+    public IntPtr CredentialBlob;
+    public UInt32 Persist;
+    public UInt32 AttributeCount;
+    public IntPtr Attributes;
+    public string TargetAlias;
+    public string UserName;
+  }
+
+  [DllImport("Advapi32.dll", EntryPoint = "CredWriteW", CharSet = CharSet.Unicode, SetLastError = true)]
+  private static extern bool CredWrite(ref CREDENTIAL credential, UInt32 flags);
+  [DllImport("Advapi32.dll", EntryPoint = "CredReadW", CharSet = CharSet.Unicode, SetLastError = true)]
+  private static extern bool CredRead(string target, UInt32 type, UInt32 flags, out IntPtr credential);
+  [DllImport("Advapi32.dll", EntryPoint = "CredDeleteW", CharSet = CharSet.Unicode, SetLastError = true)]
+  private static extern bool CredDelete(string target, UInt32 type, UInt32 flags);
+  [DllImport("Advapi32.dll", SetLastError = false)]
+  private static extern void CredFree(IntPtr credential);
+
+  public static void Write(string target, string userName, byte[] secret) {
+    IntPtr blob = Marshal.AllocCoTaskMem(secret.Length);
+    try {
+      Marshal.Copy(secret, 0, blob, secret.Length);
+      var credential = new CREDENTIAL {
+        Type = 1, TargetName = target, UserName = userName, CredentialBlob = blob,
+        CredentialBlobSize = (UInt32)secret.Length, Persist = 2
+      };
+      if (!CredWrite(ref credential, 0)) throw new Win32Exception(Marshal.GetLastWin32Error());
+    } finally {
+      for (int i = 0; i < secret.Length; i++) Marshal.WriteByte(blob, i, 0);
+      Marshal.FreeCoTaskMem(blob);
+    }
+  }
+
+  public static byte[] Read(string target) {
+    IntPtr pointer;
+    if (!CredRead(target, 1, 0, out pointer)) {
+      int error = Marshal.GetLastWin32Error();
+      if (error == 1168) return null;
+      throw new Win32Exception(error);
+    }
+    try {
+      var credential = Marshal.PtrToStructure<CREDENTIAL>(pointer);
+      var secret = new byte[credential.CredentialBlobSize];
+      Marshal.Copy(credential.CredentialBlob, secret, 0, secret.Length);
+      return secret;
+    } finally { CredFree(pointer); }
+  }
+
+  public static void Delete(string target) {
+    if (!CredDelete(target, 1, 0)) {
+      int error = Marshal.GetLastWin32Error();
+      if (error != 1168) throw new Win32Exception(error);
+    }
+  }
+}`;
+function encodedPowerShell(script) {
+  return Buffer.from(script, "utf16le").toString("base64");
+}
+async function runPowerShell(script, input) {
+  return new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process2.spawn)(
+      "powershell.exe",
+      [
+        "-NoLogo",
+        "-NoProfile",
+        "-NonInteractive",
+        "-EncodedCommand",
+        encodedPowerShell(script)
+      ],
+      { stdio: ["pipe", "pipe", "pipe"], windowsHide: true }
+    );
+    let stdout = "";
+    let stderr = "";
+    const timeout = setTimeout(() => child.kill(), 1e4);
+    child.stdout.setEncoding("utf8").on("data", (chunk) => stdout += chunk);
+    child.stderr.setEncoding("utf8").on("data", (chunk) => stderr += chunk);
+    child.once(
+      "error",
+      (error) => reject(new Error(`Windows Credential Manager failed: ${error.message}`))
+    );
+    child.once("close", (code) => {
+      clearTimeout(timeout);
+      if (code === 0) resolve(stdout.trim());
+      else
+        reject(
+          new Error(
+            `Windows Credential Manager failed: ${stderr.trim() || `exit ${code}`}`
+          )
+        );
+    });
+    child.stdin.end(input);
+  });
+}
+function parseStoredAuthorization(raw) {
+  const value = JSON.parse(raw);
+  if (typeof value !== "object" || value === null)
+    throw new Error("Stored PEP authorization is malformed.");
+  const candidate = value;
+  if (candidate.version !== 1 || typeof candidate.issuer !== "string" || typeof candidate.clientId !== "string" || typeof candidate.accessToken !== "string" || typeof candidate.refreshToken !== "string" || candidate.tokenType !== "Bearer" || typeof candidate.expiresAt !== "number" || !Array.isArray(candidate.scopes) || !candidate.scopes.every((scope) => typeof scope === "string")) {
+    throw new Error("Stored PEP authorization is malformed.");
+  }
+  return candidate;
+}
+function windowsCredentialStore(target = CREDENTIAL_TARGET) {
+  const preamble = `Add-Type -TypeDefinition @'
+${WINDOWS_CREDENTIAL_NATIVE}
+'@`;
+  return {
+    async read() {
+      const script = `${preamble}
+$bytes = [PepCredential]::Read('${target}')
+if ($null -ne $bytes) { [Convert]::ToBase64String($bytes) }`;
+      const encoded = await runPowerShell(script);
+      if (!encoded) return null;
+      return parseStoredAuthorization(
+        Buffer.from(encoded, "base64").toString("utf8")
+      );
+    },
+    async write(authorization) {
+      const script = `${preamble}
+$raw = [Console]::In.ReadToEnd()
+[PepCredential]::Write('${target}', 'oauth', [Text.Encoding]::UTF8.GetBytes($raw))`;
+      await runPowerShell(script, JSON.stringify(authorization));
+    },
+    async delete() {
+      await runPowerShell(`${preamble}
+[PepCredential]::Delete('${target}')`);
+    }
+  };
+}
+var SECURITY_NOT_FOUND = 44;
+async function runSecurity(args) {
+  return new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process2.spawn)("/usr/bin/security", [...args], {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    const timeout = setTimeout(() => child.kill(), 1e4);
+    child.stdout.setEncoding("utf8").on("data", (chunk) => stdout += chunk);
+    child.stderr.setEncoding("utf8").on("data", (chunk) => stderr += chunk);
+    child.once(
+      "error",
+      (error) => reject(new Error(`macOS Keychain failed: ${error.message}`))
+    );
+    child.once("close", (code) => {
+      clearTimeout(timeout);
+      resolve({ code: code ?? -1, stdout, stderr });
+    });
+  });
+}
+function macosCredentialStore(target = CREDENTIAL_TARGET) {
+  const selector = ["-s", target, "-a", "oauth"];
+  return {
+    async read() {
+      const { code, stdout, stderr } = await runSecurity([
+        "find-generic-password",
+        ...selector,
+        "-w"
+      ]);
+      if (code === SECURITY_NOT_FOUND) return null;
+      if (code !== 0)
+        throw new Error(
+          `macOS Keychain failed: ${stderr.trim() || `exit ${code}`}`
+        );
+      const raw = stdout.trim();
+      if (!raw) return null;
+      return parseStoredAuthorization(raw);
+    },
+    async write(authorization) {
+      const { code, stderr } = await runSecurity([
+        "add-generic-password",
+        ...selector,
+        "-U",
+        "-w",
+        JSON.stringify(authorization)
+      ]);
+      if (code !== 0)
+        throw new Error(
+          `macOS Keychain failed: ${stderr.trim() || `exit ${code}`}`
+        );
+    },
+    async delete() {
+      const { code, stderr } = await runSecurity([
+        "delete-generic-password",
+        ...selector
+      ]);
+      if (code !== 0 && code !== SECURITY_NOT_FOUND) {
+        throw new Error(
+          `macOS Keychain failed: ${stderr.trim() || `exit ${code}`}`
+        );
+      }
+    }
+  };
+}
+function systemCredentialStore() {
+  if (process.platform === "win32") return windowsCredentialStore();
+  if (process.platform === "darwin") return macosCredentialStore();
+  throw new Error(
+    `PEP CLI stores credentials in the OS keychain and currently supports Windows and macOS only (this is ${process.platform}).`
+  );
+}
+
+// src/docs-service.ts
+var ENTRY = /^-\s*\[([^\]]*)\]\(([^)]+)\)(?::\s*(.*))?$/;
+function parseDocsIndex(text) {
+  const entries = [];
+  for (const line of text.split("\n")) {
+    const match = ENTRY.exec(line.trim());
+    if (!match) continue;
+    const description = match[3]?.trim();
+    entries.push({
+      title: match[1],
+      path: match[2],
+      ...description ? { description } : {}
+    });
+  }
+  return entries;
+}
+function contentPathFor(path) {
+  const clean = `/${path.replace(/^\/+/, "").replace(/\/+$/, "")}`;
+  if (clean.includes("/llms.mdx/")) return clean.endsWith(".md") ? clean : `${clean}/content.md`;
+  const segments = clean.split("/").filter(Boolean);
+  const docsAt = segments.indexOf("docs");
+  if (docsAt === -1) {
+    throw new Error(`Not a documentation path (expected \u2026/docs/\u2026): ${path}`);
+  }
+  const before = segments.slice(0, docsAt);
+  const after = segments.slice(docsAt);
+  return `/${[...before, "llms.mdx", ...after, "content.md"].join("/")}`;
+}
+function describeFailure(status, what) {
+  if (status === 401) {
+    return `The documentation platform rejected the access token. Run \`pep auth login\` again.`;
+  }
+  if (status === 403) {
+    return "This client is not allowed to read documentation \u2014 it needs the `docs:read` scope.";
+  }
+  if (status === 404) {
+    return `No such document, or your account cannot read it: ${what}`;
+  }
+  if (status === 502) {
+    return "The documentation platform could not reach PEP to verify the token. Retry shortly.";
+  }
+  return `The documentation platform answered ${status} for ${what}.`;
+}
+async function get(dependencies, path, accept) {
+  const doFetch = dependencies.fetch ?? globalThis.fetch;
+  const response = await doFetch(`${dependencies.docsUrl.replace(/\/+$/, "")}${path}`, {
+    headers: { Authorization: `Bearer ${dependencies.accessToken}`, Accept: accept }
+  });
+  if (!response.ok) {
+    await response.body?.cancel();
+    throw new Error(describeFailure(response.status, path));
+  }
+  return response;
+}
+async function fetchDocsIndex(dependencies) {
+  const response = await get(dependencies, "/llms.txt", "text/plain");
+  return parseDocsIndex(await response.text());
+}
+async function fetchDocContent(dependencies, path) {
+  const response = await get(dependencies, contentPathFor(path), "text/markdown");
+  return response.text();
+}
+
+// src/skills-service.ts
+var import_promises3 = require("node:fs/promises");
+var import_node_path3 = require("node:path");
+var import_node_zlib = require("node:zlib");
+
+// src/tar.ts
+var BLOCK = 512;
+var NAME_OFFSET = 0;
+var NAME_LENGTH = 100;
+var SIZE_OFFSET = 124;
+var SIZE_LENGTH = 12;
+var TYPE_OFFSET = 156;
+var MAGIC_OFFSET = 257;
+var MAGIC_LENGTH = 6;
+var PREFIX_OFFSET = 345;
+var PREFIX_LENGTH = 155;
+var decoder = new TextDecoder();
+function readString(block, offset, length) {
+  const raw = block.subarray(offset, offset + length);
+  const end = raw.indexOf(0);
+  return decoder.decode(end === -1 ? raw : raw.subarray(0, end));
+}
+function readOctal(block, offset, length) {
+  const text = readString(block, offset, length).trim();
+  if (text === "") return 0;
+  const value = Number.parseInt(text, 8);
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new Error("Malformed archive: unreadable size field.");
+  }
+  return value;
+}
+function isZeroBlock(block) {
+  return block.every((byte) => byte === 0);
+}
+function paxPath(text) {
+  for (const match of text.matchAll(/\d+ ([^=\n]+)=([^\n]*)\n/g)) {
+    if (match[1] === "path") return match[2];
+  }
+  return void 0;
+}
+function readTar(bytes) {
+  const entries = [];
+  let overrideName;
+  let offset = 0;
+  while (offset + BLOCK <= bytes.length) {
+    const header = bytes.subarray(offset, offset + BLOCK);
+    if (isZeroBlock(header)) break;
+    if (!readString(header, MAGIC_OFFSET, MAGIC_LENGTH).startsWith("ustar")) {
+      throw new Error("Malformed archive: not a ustar tar stream.");
+    }
+    const size = readOctal(header, SIZE_OFFSET, SIZE_LENGTH);
+    const type = String.fromCharCode(header[TYPE_OFFSET]);
+    const dataStart = offset + BLOCK;
+    const data = bytes.subarray(dataStart, dataStart + size);
+    offset = dataStart + Math.ceil(size / BLOCK) * BLOCK;
+    if (type === "L") {
+      overrideName = decoder.decode(data).replace(/\0+$/, "");
+      continue;
+    }
+    if (type === "x") {
+      overrideName = paxPath(decoder.decode(data)) ?? overrideName;
+      continue;
+    }
+    if (type !== "0" && type !== "\0") {
+      overrideName = void 0;
+      continue;
+    }
+    const name = readString(header, NAME_OFFSET, NAME_LENGTH);
+    const prefix = readString(header, PREFIX_OFFSET, PREFIX_LENGTH);
+    entries.push({
+      path: overrideName ?? (prefix === "" ? name : `${prefix}/${name}`),
+      data
+    });
+    overrideName = void 0;
+  }
+  return entries;
+}
+
+// src/skills-service.ts
+var ARCHIVE_PATH = "/api/skills/archive";
+var SKILLS_SEGMENT = "skills";
+function planSkillFiles(entries) {
+  const files = [];
+  for (const entry of entries) {
+    const segments = entry.path.split("/").filter((one) => one !== "" && one !== ".");
+    if (segments.some((one) => one === "..")) {
+      throw new Error(
+        `Refusing an archive entry that escapes its directory: ${entry.path}`
+      );
+    }
+    const withoutRoot = segments.slice(1);
+    const relative = withoutRoot[0] === SKILLS_SEGMENT ? withoutRoot.slice(1) : withoutRoot;
+    if (relative.length < 2) continue;
+    files.push({
+      skill: relative[0],
+      path: relative.slice(1).join("/"),
+      data: entry.data
+    });
+  }
+  return files;
+}
+function describeFailure2(status) {
+  if (status === 401)
+    return "PEP rejected the access token. Run `pep auth login` again.";
+  if (status === 403) {
+    return "This access token carries no `skills:read` scope. Ask an operator to add it to this client's allowed_scopes in PEP, then run `pep auth login` again \u2014 existing tokens do not gain new scopes.";
+  }
+  if (status === 404) {
+    return "This PEP deployment does not serve skills \u2014 it has no /api/skills/archive endpoint. Ask an operator whether skills are enabled here.";
+  }
+  if (status === 503) {
+    return "PEP could not reach the skills repository. Retry shortly, or ask an operator whether this deployment serves skills.";
+  }
+  return `PEP answered ${status}.`;
+}
+async function syncSkills(dependencies) {
+  const doFetch = dependencies.fetch ?? globalThis.fetch;
+  const response = await doFetch(`${dependencies.issuer}${ARCHIVE_PATH}`, {
+    headers: { Authorization: `Bearer ${dependencies.accessToken}` }
+  });
+  if (!response.ok) {
+    await response.body?.cancel();
+    throw new Error(describeFailure2(response.status));
+  }
+  const commit = response.headers.get("x-skills-commit") ?? void 0;
+  const previous = await dependencies.stateStore.read();
+  if (commit !== void 0 && commit === previous?.commit && previous.directory === dependencies.directory) {
+    await response.body?.cancel();
+    return { status: "unchanged", commit };
+  }
+  const gzipped = new Uint8Array(await response.arrayBuffer());
+  const files = planSkillFiles(readTar((0, import_node_zlib.gunzipSync)(gzipped)));
+  const skills = [...new Set(files.map((file) => file.skill))].sort();
+  for (const skill of skills) {
+    await (0, import_promises3.rm)((0, import_node_path3.join)(dependencies.directory, skill), {
+      recursive: true,
+      force: true
+    });
+  }
+  for (const file of files) {
+    const target = (0, import_node_path3.join)(
+      dependencies.directory,
+      file.skill,
+      ...file.path.split("/")
+    );
+    await (0, import_promises3.mkdir)((0, import_node_path3.dirname)(target), { recursive: true });
+    await (0, import_promises3.writeFile)(target, file.data);
+  }
+  const removed = (previous?.skills ?? []).filter(
+    (skill) => !skills.includes(skill)
+  );
+  for (const skill of removed) {
+    await (0, import_promises3.rm)((0, import_node_path3.join)(previous?.directory ?? dependencies.directory, skill), {
+      recursive: true,
+      force: true
+    });
+  }
+  const state = {
+    version: 1,
+    skills,
+    directory: dependencies.directory,
+    ...commit ? { commit } : {}
+  };
+  await dependencies.stateStore.write(state);
+  return {
+    status: "written",
+    skills,
+    fileCount: files.length,
+    removed,
+    directory: dependencies.directory,
+    ...commit ? { commit } : {}
+  };
+}
+
+// src/cli.ts
+var VERSION = "0.1.0";
+function usage() {
+  return `PEP CLI ${VERSION}
+
+Usage:
+  pep auth login [--issuer <url>] [--client-id <id>] [--resource <uri> ...]
+  pep auth status
+  pep auth token
+  pep auth logout
+  pep skills sync [--dir <path>]
+  pep docs list [--docs-url <url>]
+  pep docs get <path> [--docs-url <url>]
+
+The issuer is built into this executable. Use --issuer only to override it temporarily.
+--resource names which resource server the token is for (RFC 8707); repeat it for more than
+one. It defaults to the docs platform \u2014 a token minted without it is rejected by every
+resource server, and their answer looks exactly like "this token does not exist".
+Use \`pep auth token\` when another agent needs a fresh bearer token.
+
+\`pep skills sync\` fetches the latest skills from PEP and writes them where Claude Code
+looks for them (${defaultSkillsDirectory()} unless --dir says otherwise). It only touches
+skills it wrote itself; anything you put there by hand is left alone.
+
+\`pep docs list\` prints the documents this account can read (path + description); feed a path
+straight to \`pep docs get\` to print that document as markdown on stdout. The documentation
+site is built in (${DEFAULT_DOCS_URL}); --docs-url overrides it and is then remembered.`;
+}
+function repeatedOption(args, name) {
+  const values = [];
+  for (; ; ) {
+    const index = args.indexOf(name);
+    if (index === -1) return values;
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) throw new Error(`${name} requires a value.`);
+    values.push(value);
+    args.splice(index, 2);
+  }
+}
+function option(args, name) {
+  const index = args.indexOf(name);
+  if (index === -1) return void 0;
+  const value = args[index + 1];
+  if (!value || value.startsWith("--")) throw new Error(`${name} requires a value.`);
+  args.splice(index, 2);
+  return value;
+}
+async function loginConfig(args) {
+  const store = fileConfigStore();
+  const saved = await store.read();
+  const issuer = configuredIssuer(option(args, "--issuer"), saved?.issuer);
+  const clientId = option(args, "--client-id") ?? saved?.clientId ?? DEFAULT_CLIENT_ID;
+  const explicit = repeatedOption(args, "--resource");
+  const resources = explicit.length > 0 ? explicit : saved?.resources ?? [...DEFAULT_RESOURCES];
+  if (args.length > 0) throw new Error(`Unknown option: ${args[0]}`);
+  return { version: 1, issuer, clientId, redirectUri: DEFAULT_REDIRECT_URI, resources };
+}
+async function main() {
+  const args = process.argv.slice(2);
+  if (args.length === 0 || args.includes("--help") || args.includes("-h")) {
+    console.log(usage());
+    return;
+  }
+  if (args[0] === "--version" || args[0] === "-v") {
+    console.log(VERSION);
+    return;
+  }
+  const group = args.shift();
+  if (group !== "auth" && group !== "skills" && group !== "docs")
+    throw new Error(`Unknown command.
+
+${usage()}`);
+  const command = args.shift();
+  const configStore = fileConfigStore(configPath());
+  const auth = createAuthService({
+    configStore,
+    credentialStore: systemCredentialStore(),
+    oauth: createOAuthClient()
+  });
+  if (group === "docs") {
+    if (command !== "list" && command !== "get") {
+      throw new Error(`Unknown docs command.
+
+${usage()}`);
+    }
+    const explicitDocsUrl = option(args, "--docs-url");
+    const path = command === "get" ? args.shift() : void 0;
+    if (args.length > 0) throw new Error(`Unknown option: ${args[0]}`);
+    if (command === "get" && !path) throw new Error("pep docs get needs a document path.");
+    const saved = await configStore.read();
+    const docsUrl = explicitDocsUrl ? normalizeDocsUrl(explicitDocsUrl) : saved?.docsUrl ?? DEFAULT_DOCS_URL;
+    if (explicitDocsUrl && saved && saved.docsUrl !== docsUrl) {
+      await configStore.write({ ...saved, docsUrl });
+    }
+    const authorization = await auth.currentAuthorization();
+    const dependencies = { docsUrl, accessToken: authorization.accessToken };
+    if (command === "list") {
+      const entries = await fetchDocsIndex(dependencies);
+      if (entries.length === 0) {
+        console.error("No documents are readable with this account.");
+        return;
+      }
+      for (const entry of entries) {
+        console.log(entry.description ? `${entry.path}	${entry.description}` : entry.path);
+      }
+      return;
+    }
+    process.stdout.write(await fetchDocContent(dependencies, path));
+    return;
+  }
+  if (group === "skills") {
+    if (command !== "sync") throw new Error(`Unknown skills command.
+
+${usage()}`);
+    const directory = option(args, "--dir") ?? defaultSkillsDirectory();
+    if (args.length > 0) throw new Error(`Unknown option: ${args[0]}`);
+    const authorization = await auth.currentAuthorization();
+    const result = await syncSkills({
+      issuer: authorization.issuer,
+      accessToken: authorization.accessToken,
+      directory,
+      stateStore: fileSkillsStateStore()
+    });
+    if (result.status === "unchanged") {
+      console.log(`Already at ${result.commit}. Nothing to do.`);
+      return;
+    }
+    console.log(
+      `Wrote ${result.fileCount} file(s) across ${result.skills.length} skill(s) to ${result.directory}`
+    );
+    if (result.commit) console.log(`Commit: ${result.commit}`);
+    if (result.removed.length > 0)
+      console.log(`Removed (gone upstream): ${result.removed.join(" ")}`);
+    return;
+  }
+  if (command === "login") {
+    const config = await loginConfig(args);
+    console.error("Opening your browser to sign in to PEP\u2026");
+    const authorization = await auth.login(
+      config,
+      (url) => console.error(`If the browser does not open, visit:
+${url}`)
+    );
+    console.log(`Logged in. Granted scopes: ${authorization.scopes.join(" ")}`);
+    return;
+  }
+  if (args.length > 0) throw new Error(`Unexpected argument: ${args[0]}`);
+  if (command === "status") {
+    const { authorization, user } = await auth.status();
+    console.log("Logged in");
+    console.log(`Issuer: ${authorization.issuer}`);
+    console.log(`Client: ${authorization.clientId}`);
+    console.log(`Account: ${user.email ?? user.name ?? user.sub}`);
+    console.log(`Scopes: ${authorization.scopes.join(" ")}`);
+    console.log(`Access token expires: ${new Date(authorization.expiresAt).toISOString()}`);
+    return;
+  }
+  if (command === "token") {
+    const authorization = await auth.currentAuthorization();
+    process.stdout.write(`${authorization.accessToken}
+`);
+    return;
+  }
+  if (command === "logout") {
+    const result = await auth.logout();
+    if (!result.wasLoggedIn) {
+      console.log("Already logged out.");
+      return;
+    }
+    if (result.revocationError)
+      console.error(`Warning: remote revocation failed: ${result.revocationError.message}`);
+    console.log("Logged out. Local credentials were removed.");
+    return;
+  }
+  throw new Error(`Unknown auth command.
+
+${usage()}`);
+}
+main().catch((error) => {
+  console.error(`pep: ${error.message}`);
+  process.exitCode = 1;
+});

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@newlandnpt/pep-cli",
+  "version": "0.1.0",
+  "description": "PEP CLI —— 凭 PEP 身份读取 Newland 开发者文档与 agent skills",
+  "license": "UNLICENSED",
+  "type": "module",
+  "os": [
+    "win32",
+    "darwin"
+  ],
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "packageManager": "pnpm@10.18.3",
+  "bin": {
+    "pep": "dist/pep.cjs",
+    "pep-cli": "dist/pep.cjs"
+  },
+  "files": [
+    "dist/pep.cjs",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "node scripts/build-js.mjs",
+    "build:exe": "node scripts/build-exe.mjs production",
+    "build:exe:dev": "node scripts/build-exe.mjs development",
+    "build:exe:prod": "node scripts/build-exe.mjs production",
+    "build:installer": "node scripts/build-installer.mjs production",
+    "build:installer:dev": "node scripts/build-installer.mjs development",
+    "build:installer:prod": "node scripts/build-installer.mjs production",
+    "prepack": "node scripts/build-js.mjs production",
+    "build:exe:view": "node scripts/build-exe.mjs view",
+    "build:installer:view": "node scripts/build-installer.mjs view"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "esbuild": "^0.28.2",
+    "postject": "^1.0.0-alpha.6",
+    "typescript": "^5.9.2",
+    "vitest": "^3.2.4"
+  }
+}