@revealui/cli 0.4.0 → 0.6.2

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { createLogger as createLogger12 } from "@revealui/setup/utils";
+import { createLogger as createLogger14 } from "@revealui/setup/utils";
 import { Command } from "commander";
 
 // src/commands/agent.ts
@@ -15,7 +15,9 @@ async function runAgentStatusCommand() {
   logger.info(`Project root: ${projectRoot}`);
   logger.info(`Available:    ${available ? "yes" : "no"}`);
   if (!available) {
-    logger.warn("No LLM provider detected. Start BitNet, Ollama, or set GROQ_API_KEY.");
+    logger.warn(
+      "No LLM provider detected. Start BitNet, Ollama, or install an Ubuntu inference snap."
+    );
   }
 }
 async function runAgentHeadlessCommand(prompt) {
@@ -200,9 +202,6 @@ async function detectProvider() {
     }
   } catch {
   }
-  if (process.env.GROQ_API_KEY) {
-    return { available: true, provider: "groq", model: "llama-3.3-70b-versatile", projectRoot };
-  }
   return { available: false, provider: "none", model: "none", projectRoot };
 }
 function buildMinimalInstructions() {
@@ -215,20 +214,337 @@ function buildMinimalInstructions() {
   ].join("\n");
 }
 
+// src/commands/auth.ts
+import fs from "fs/promises";
+import os from "os";
+import path from "path";
+import { createLogger as createLogger2 } from "@revealui/setup/utils";
+import { execa as execa2 } from "execa";
+
+// src/utils/command.ts
+import net from "net";
+import { execa } from "execa";
+async function commandExists(command) {
+  try {
+    await execa("bash", ["-lc", `command -v ${command}`], {
+      stdio: "pipe"
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function isTcpReachable(host, port, timeoutMs = 1500) {
+  return await new Promise((resolve2) => {
+    const socket = new net.Socket();
+    const finalize = (value) => {
+      socket.removeAllListeners();
+      socket.destroy();
+      resolve2(value);
+    };
+    socket.setTimeout(timeoutMs);
+    socket.once("connect", () => finalize(true));
+    socket.once("timeout", () => finalize(false));
+    socket.once("error", () => finalize(false));
+    socket.connect(port, host);
+  });
+}
+
+// src/commands/auth.ts
+var logger2 = createLogger2({ prefix: "Auth" });
+var REVVAULT_NPM_PATH = "revealui/env/npm";
+var NPM_TOKEN_INTERPOLATION = "${NPM_TOKEN}";
+var NPMRC_AUTH_LINE = `//registry.npmjs.org/:_authToken=${NPM_TOKEN_INTERPOLATION}`;
+function write(text5) {
+  process.stdout.write(text5);
+}
+function writeJson(data) {
+  process.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+}
+function getNpmrcPaths() {
+  const user = path.join(os.homedir(), ".npmrc");
+  let dir = process.cwd();
+  let project = null;
+  for (let i = 0; i < 10; i++) {
+    const candidate = path.join(dir, ".npmrc");
+    if (dir !== os.homedir()) {
+      project ??= candidate;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return { user, project };
+}
+async function fileContains(filePath, needle) {
+  try {
+    const content = await fs.readFile(filePath, "utf-8");
+    return content.includes(needle);
+  } catch {
+    return false;
+  }
+}
+async function getTokenFromEnv() {
+  return process.env.NPM_TOKEN || void 0;
+}
+async function getTokenFromNpmrc() {
+  const userRc = path.join(os.homedir(), ".npmrc");
+  try {
+    const content = await fs.readFile(userRc, "utf-8");
+    const match = content.match(/\/\/registry\.npmjs\.org\/:_authToken=(.+)/);
+    return match?.[1]?.trim() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function maskToken(token) {
+  if (token.length <= 8) return "***";
+  return `${token.slice(0, 4)}...${token.slice(-4)}`;
+}
+async function hasRevvault() {
+  return commandExists("revvault");
+}
+async function revvaultGet(secretPath) {
+  try {
+    const { stdout } = await execa2("revvault", ["get", secretPath], {
+      stdio: "pipe"
+    });
+    return stdout.trim() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function revvaultSet(secretPath, value) {
+  try {
+    await execa2("revvault", ["set", secretPath], {
+      input: value,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function runAuthStatusCommand(options) {
+  const envToken = await getTokenFromEnv();
+  const npmrcToken = await getTokenFromNpmrc();
+  const hasVault = await hasRevvault();
+  const vaultValue = hasVault ? await revvaultGet(REVVAULT_NPM_PATH) : void 0;
+  const paths = getNpmrcPaths();
+  const projectUsesEnvVar = paths.project ? await fileContains(paths.project, NPM_TOKEN_INTERPOLATION) : false;
+  const effectiveToken = envToken || npmrcToken;
+  let npmUser;
+  try {
+    const { stdout } = await execa2("npm", ["whoami"], { stdio: "pipe" });
+    npmUser = stdout.trim();
+  } catch {
+    npmUser = void 0;
+  }
+  if (options.json) {
+    writeJson({
+      authenticated: !!npmUser,
+      user: npmUser ?? null,
+      tokenSource: envToken ? "env" : npmrcToken ? "npmrc" : null,
+      tokenMasked: effectiveToken ? maskToken(effectiveToken) : null,
+      revvaultConfigured: !!vaultValue,
+      projectNpmrcUsesEnvVar: projectUsesEnvVar,
+      paths: {
+        userNpmrc: paths.user,
+        projectNpmrc: paths.project
+      }
+    });
+    return;
+  }
+  logger2.header("npm Authentication Status");
+  if (npmUser) {
+    logger2.success(`Authenticated as: ${npmUser}`);
+  } else {
+    logger2.error("Not authenticated \u2014 npm whoami failed");
+  }
+  write("\n");
+  logger2.info(
+    `Token source: ${envToken ? "$NPM_TOKEN (env)" : npmrcToken ? "~/.npmrc (file)" : "none"}`
+  );
+  if (effectiveToken) {
+    logger2.info(`Token: ${maskToken(effectiveToken)}`);
+  }
+  write("\n");
+  logger2.info(
+    `RevVault (${REVVAULT_NPM_PATH}): ${vaultValue ? "configured" : hasVault ? "not set" : "revvault not installed"}`
+  );
+  logger2.info(`Project .npmrc uses NPM_TOKEN: ${projectUsesEnvVar ? "yes" : "no"}`);
+  if (!projectUsesEnvVar && paths.project) {
+    logger2.warn(
+      "Project .npmrc does not reference NPM_TOKEN \u2014 direnv/RevVault tokens won't be used for publishing"
+    );
+  }
+  if (!vaultValue && hasVault && effectiveToken) {
+    logger2.warn("Token is not stored in RevVault. Run: revealui auth set-token to persist it.");
+  }
+}
+async function runAuthSetTokenCommand(options) {
+  logger2.header("Set npm Publish Token");
+  const token = options.token || process.env.NPM_TOKEN;
+  if (!token) {
+    logger2.error("No token provided. Pass --token <value> or set NPM_TOKEN in your environment.");
+    logger2.info("Create a Granular Access Token at: https://www.npmjs.com/settings/<user>/tokens");
+    logger2.info("  Type: Granular Access Token");
+    logger2.info("  Packages: All packages (read and write)");
+    logger2.info("  This bypasses 2FA \u2014 no OTP needed for publish");
+    process.exitCode = 1;
+    return;
+  }
+  if (!token.startsWith("npm_")) {
+    logger2.warn('Token does not start with "npm_" \u2014 this may not be a valid npm token');
+  }
+  if (!options.skipVault) {
+    const hasVault = await hasRevvault();
+    if (hasVault) {
+      const stored = await revvaultSet(REVVAULT_NPM_PATH, `NPM_TOKEN=${token}`);
+      if (stored) {
+        logger2.success(`Stored in RevVault (${REVVAULT_NPM_PATH})`);
+      } else {
+        logger2.error("Failed to store in RevVault");
+      }
+    } else {
+      logger2.warn("RevVault not installed \u2014 skipping vault storage");
+    }
+  }
+  if (!options.skipNpmrc) {
+    const paths = getNpmrcPaths();
+    if (paths.project) {
+      const hasInterpolation = await fileContains(paths.project, NPM_TOKEN_INTERPOLATION);
+      if (!hasInterpolation) {
+        try {
+          const content = await fs.readFile(paths.project, "utf-8");
+          const updatedContent = `${content.trimEnd()}
+${NPMRC_AUTH_LINE}
+`;
+          await fs.writeFile(paths.project, updatedContent, "utf-8");
+          logger2.success(`Added NPM_TOKEN interpolation to ${paths.project}`);
+        } catch (err) {
+          logger2.error(`Failed to update ${paths.project}: ${err}`);
+        }
+      } else {
+        logger2.info("Project .npmrc already uses NPM_TOKEN");
+      }
+    }
+  }
+  const userRc = path.join(os.homedir(), ".npmrc");
+  try {
+    const content = await fs.readFile(userRc, "utf-8");
+    const filtered = content.split("\n").filter((line) => !line.includes("//registry.npmjs.org/:_authToken=")).join("\n");
+    if (filtered !== content) {
+      await fs.writeFile(userRc, filtered, "utf-8");
+      logger2.success("Removed hardcoded token from ~/.npmrc (now managed via env var)");
+    }
+  } catch {
+  }
+  write("\n");
+  logger2.info("Verifying...");
+  process.env.NPM_TOKEN = token;
+  try {
+    const { stdout } = await execa2("npm", ["whoami"], { stdio: "pipe" });
+    logger2.success(`Authenticated as: ${stdout.trim()}`);
+  } catch {
+    logger2.error("npm whoami failed \u2014 token may be invalid or expired");
+    process.exitCode = 1;
+    return;
+  }
+  write("\n");
+  logger2.success("Token configured. Run `direnv reload` to load it in all terminals.");
+}
+async function runAuthVerifyCommand(options) {
+  const checks = [];
+  let npmUser;
+  try {
+    const { stdout } = await execa2("npm", ["whoami"], { stdio: "pipe" });
+    npmUser = stdout.trim();
+    checks.push({ name: "npm whoami", pass: true, detail: npmUser });
+  } catch {
+    checks.push({
+      name: "npm whoami",
+      pass: false,
+      detail: "Not authenticated"
+    });
+  }
+  const envToken = await getTokenFromEnv();
+  const npmrcToken = await getTokenFromNpmrc();
+  const source = envToken ? "$NPM_TOKEN (env)" : npmrcToken ? "~/.npmrc (hardcoded)" : "none";
+  checks.push({
+    name: "Token source",
+    pass: !!envToken,
+    detail: source + (npmrcToken && !envToken ? " \u2014 consider migrating to RevVault" : "")
+  });
+  const hasVault = await hasRevvault();
+  if (hasVault) {
+    const vaultValue = await revvaultGet(REVVAULT_NPM_PATH);
+    checks.push({
+      name: "RevVault",
+      pass: !!vaultValue,
+      detail: vaultValue ? `${REVVAULT_NPM_PATH} configured` : "Not stored in vault"
+    });
+  }
+  const paths = getNpmrcPaths();
+  if (paths.project) {
+    const usesEnvVar = await fileContains(paths.project, NPM_TOKEN_INTERPOLATION);
+    checks.push({
+      name: ".npmrc NPM_TOKEN",
+      pass: usesEnvVar,
+      detail: usesEnvVar ? "Project .npmrc uses env var" : "Missing \u2014 direnv token won't reach npm"
+    });
+  }
+  const envrcPath = path.join(process.cwd(), ".envrc");
+  const loadsNpm = await fileContains(envrcPath, REVVAULT_NPM_PATH);
+  checks.push({
+    name: ".envrc loads npm",
+    pass: loadsNpm,
+    detail: loadsNpm ? "revealui/env/npm in .envrc" : "Missing \u2014 direnv won't export NPM_TOKEN"
+  });
+  const hardcodedToken = await getTokenFromNpmrc();
+  checks.push({
+    name: "~/.npmrc clean",
+    pass: !hardcodedToken,
+    detail: hardcodedToken ? `Hardcoded token found (${maskToken(hardcodedToken)})` : "No hardcoded tokens"
+  });
+  if (options.json) {
+    const allPass2 = checks.every((c) => c.pass);
+    writeJson({ pass: allPass2, checks });
+    return;
+  }
+  logger2.header("npm Auth Verification");
+  for (const check of checks) {
+    if (check.pass) {
+      logger2.success(`${check.name}: ${check.detail}`);
+    } else {
+      logger2.error(`${check.name}: ${check.detail}`);
+    }
+  }
+  const allPass = checks.every((c) => c.pass);
+  write("\n");
+  if (allPass) {
+    logger2.success("All checks passed \u2014 ready to publish");
+  } else {
+    logger2.warn("Some checks failed. Run `revealui auth set-token` to fix.");
+    process.exitCode = 1;
+  }
+}
+
 // src/commands/create-flow.ts
 import { readFileSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
-import { createLogger as createLogger7 } from "@revealui/setup/utils";
+import { createLogger as createLogger8 } from "@revealui/setup/utils";
 import { importSPKI, jwtVerify } from "jose";
 
 // src/prompts/database.ts
-import inquirer from "inquirer";
+import { isCancel, select, text } from "@clack/prompts";
 
 // src/validators/credentials.ts
-import { createLogger as createLogger2 } from "@revealui/setup/utils";
-var logger2 = createLogger2({ prefix: "Validator" });
-async function validateStripeKey(key) {
+import { createLogger as createLogger3 } from "@revealui/setup/utils";
+var logger3 = createLogger3({ prefix: "Validator" });
+function validateStripeKey(key) {
   if (!(key.startsWith("sk_test_") || key.startsWith("sk_live_"))) {
     return {
       valid: false,
@@ -237,7 +553,7 @@ async function validateStripeKey(key) {
   }
   return { valid: true };
 }
-async function validateNeonUrl(url) {
+function validateNeonUrl(url) {
   try {
     const parsed = new URL(url);
     if (!parsed.protocol.startsWith("postgres")) {
@@ -254,7 +570,7 @@ async function validateNeonUrl(url) {
     };
   }
 }
-async function validateVercelToken(token) {
+function validateVercelToken(token) {
   if (!token || token.length < 20) {
     return {
       valid: false,
@@ -263,11 +579,11 @@ async function validateVercelToken(token) {
   }
   return { valid: true };
 }
-async function validateSupabaseUrl(url) {
+function validateSupabaseUrl(url) {
   try {
     const parsed = new URL(url);
     if (!parsed.hostname.includes("supabase")) {
-      logger2.warn("URL does not appear to be a Supabase URL");
+      logger3.warn("URL does not appear to be a Supabase URL");
     }
     return { valid: true };
   } catch {
@@ -277,150 +593,152 @@ async function validateSupabaseUrl(url) {
     };
   }
 }
+function validateNpmToken(token) {
+  if (!token.startsWith("npm_")) {
+    return {
+      valid: false,
+      message: "npm token must start with npm_"
+    };
+  }
+  if (token.length < 20) {
+    return {
+      valid: false,
+      message: "npm token appears invalid (too short)"
+    };
+  }
+  return { valid: true };
+}
 
 // src/prompts/database.ts
 async function promptDatabaseConfig() {
-  const { provider } = await inquirer.prompt([
-    {
-      type: "list",
-      name: "provider",
-      message: "Which database provider would you like to use?",
-      choices: [
-        {
-          name: "NeonDB - Serverless PostgreSQL (recommended)",
-          value: "neon"
-        },
-        {
-          name: "Supabase - PostgreSQL with built-in features",
-          value: "supabase"
-        },
-        {
-          name: "Local PostgreSQL - Use existing local database",
-          value: "local"
-        },
-        {
-          name: "Skip - Configure later",
-          value: "skip"
-        }
-      ],
-      default: "neon"
-    }
-  ]);
+  const provider = await select({
+    message: "Which database provider would you like to use?",
+    options: [
+      { value: "neon", label: "NeonDB - Serverless PostgreSQL (recommended)" },
+      { value: "supabase", label: "Supabase - PostgreSQL with built-in features" },
+      { value: "local", label: "Local PostgreSQL - Use existing local database" },
+      { value: "skip", label: "Skip - Configure later" }
+    ],
+    initialValue: "neon"
+  });
+  if (isCancel(provider)) {
+    process.exit(0);
+  }
   if (provider === "skip") {
     return { provider: "skip" };
   }
   if (provider === "local") {
-    const { postgresUrl: postgresUrl2 } = await inquirer.prompt([
-      {
-        type: "input",
-        name: "postgresUrl",
-        message: "Enter your PostgreSQL connection string:",
-        default: "postgresql://postgres:postgres@localhost:5432/revealui",
-        validate: async (input) => {
-          const result = await validateNeonUrl(input);
-          return result.valid ? true : result.message || "Invalid database URL";
-        }
+    const postgresUrl2 = await text({
+      message: "Enter your PostgreSQL connection string:",
+      defaultValue: "postgresql://postgres:postgres@localhost:5432/revealui",
+      validate: (input) => {
+        if (!input) return void 0;
+        const result = validateNeonUrl(input);
+        return result.valid ? void 0 : result.message || "Invalid database URL";
       }
-    ]);
+    });
+    if (isCancel(postgresUrl2)) {
+      process.exit(0);
+    }
     return { provider: "local", postgresUrl: postgresUrl2 };
   }
-  const { postgresUrl } = await inquirer.prompt([
-    {
-      type: "input",
-      name: "postgresUrl",
-      message: `Enter your ${provider === "neon" ? "Neon" : "Supabase"} database connection string:`,
-      validate: async (input) => {
-        if (!input || input.trim() === "") {
-          return "Database URL is required";
-        }
-        const result = await validateNeonUrl(input);
-        return result.valid ? true : result.message || "Invalid database URL";
+  const label = provider === "neon" ? "Neon" : "Supabase";
+  const postgresUrl = await text({
+    message: `Enter your ${label} database connection string:`,
+    validate: (input) => {
+      if (!input || input.trim() === "") {
+        return "Database URL is required";
       }
+      const result = validateNeonUrl(input);
+      return result.valid ? void 0 : result.message || "Invalid database URL";
     }
-  ]);
+  });
+  if (isCancel(postgresUrl)) {
+    process.exit(0);
+  }
   return { provider, postgresUrl };
 }
 
 // src/prompts/devenv.ts
-import inquirer2 from "inquirer";
+import { confirm, isCancel as isCancel2 } from "@clack/prompts";
 async function promptDevEnvConfig() {
-  const answers = await inquirer2.prompt([
-    {
-      type: "confirm",
-      name: "createDevContainer",
-      message: "Create Dev Container configuration for VS Code / GitHub Codespaces?",
-      default: true
-    },
-    {
-      type: "confirm",
-      name: "createDevbox",
-      message: "Create Devbox configuration for Nix-powered development?",
-      default: true
-    }
-  ]);
-  return answers;
+  const createDevContainer = await confirm({
+    message: "Create Dev Container configuration for VS Code / GitHub Codespaces?",
+    initialValue: true
+  });
+  if (isCancel2(createDevContainer)) {
+    process.exit(0);
+  }
+  const createDevbox = await confirm({
+    message: "Create Devbox configuration for Nix-powered development?",
+    initialValue: true
+  });
+  if (isCancel2(createDevbox)) {
+    process.exit(0);
+  }
+  return { createDevContainer, createDevbox };
 }
 
 // src/prompts/payments.ts
-import inquirer3 from "inquirer";
+import { confirm as confirm2, isCancel as isCancel3, text as text2 } from "@clack/prompts";
 async function promptPaymentConfig() {
-  const { enabled } = await inquirer3.prompt([
-    {
-      type: "confirm",
-      name: "enabled",
-      message: "Do you want to configure Stripe payments?",
-      default: true
-    }
-  ]);
+  const enabled = await confirm2({
+    message: "Do you want to configure Stripe payments?",
+    initialValue: true
+  });
+  if (isCancel3(enabled)) {
+    process.exit(0);
+  }
   if (!enabled) {
     return { enabled: false };
   }
-  const answers = await inquirer3.prompt([
-    {
-      type: "input",
-      name: "stripeSecretKey",
-      message: "Enter your Stripe secret key (sk_test_... or sk_live_...):",
-      validate: async (input) => {
-        if (!input || input.trim() === "") {
-          return "Stripe secret key is required";
-        }
-        const result = await validateStripeKey(input);
-        return result.valid ? true : result.message || "Invalid Stripe key";
+  const stripeSecretKey = await text2({
+    message: "Enter your Stripe secret key (sk_test_... or sk_live_...):",
+    validate: (input) => {
+      if (!input || input.trim() === "") {
+        return "Stripe secret key is required";
       }
-    },
-    {
-      type: "input",
-      name: "stripePublishableKey",
-      message: "Enter your Stripe publishable key (pk_test_... or pk_live_...):",
-      validate: (input) => {
-        if (!input || input.trim() === "") {
-          return "Stripe publishable key is required";
-        }
-        if (!(input.startsWith("pk_test_") || input.startsWith("pk_live_"))) {
-          return "Stripe publishable key must start with pk_test_ or pk_live_";
-        }
-        return true;
+      const result = validateStripeKey(input);
+      return result.valid ? void 0 : result.message || "Invalid Stripe key";
+    }
+  });
+  if (isCancel3(stripeSecretKey)) {
+    process.exit(0);
+  }
+  const stripePublishableKey = await text2({
+    message: "Enter your Stripe publishable key (pk_test_... or pk_live_...):",
+    validate: (input) => {
+      if (!input || input.trim() === "") {
+        return "Stripe publishable key is required";
       }
-    },
-    {
-      type: "input",
-      name: "stripeWebhookSecret",
-      message: "Enter your Stripe webhook secret (whsec_..., optional - press Enter to skip):",
-      default: ""
+      if (!(input.startsWith("pk_test_") || input.startsWith("pk_live_"))) {
+        return "Stripe publishable key must start with pk_test_ or pk_live_";
+      }
+      return void 0;
     }
-  ]);
+  });
+  if (isCancel3(stripePublishableKey)) {
+    process.exit(0);
+  }
+  const stripeWebhookSecret = await text2({
+    message: "Enter your Stripe webhook secret (whsec_..., optional - press Enter to skip):",
+    defaultValue: ""
+  });
+  if (isCancel3(stripeWebhookSecret)) {
+    process.exit(0);
+  }
   return {
     enabled: true,
-    stripeSecretKey: answers.stripeSecretKey,
-    stripePublishableKey: answers.stripePublishableKey,
-    stripeWebhookSecret: answers.stripeWebhookSecret || void 0
+    stripeSecretKey,
+    stripePublishableKey,
+    stripeWebhookSecret: stripeWebhookSecret || void 0
   };
 }
 
 // src/prompts/project.ts
-import fs from "fs";
-import path from "path";
-import inquirer4 from "inquirer";
+import fs2 from "fs";
+import path2 from "path";
+import { isCancel as isCancel4, select as select2, text as text3 } from "@clack/prompts";
 var VALID_TEMPLATES = ["basic-blog", "e-commerce", "portfolio"];
 async function promptProjectConfig(defaultName, templateArg, nonInteractive = false) {
   let projectName;
@@ -429,25 +747,31 @@ async function promptProjectConfig(defaultName, templateArg, nonInteractive = fa
   } else if (nonInteractive) {
     projectName = "my-revealui-project";
   } else {
-    const answers = await inquirer4.prompt([
-      {
-        type: "input",
-        name: "projectName",
-        message: "What is your project name?",
-        default: "my-revealui-project",
-        validate: (input) => {
-          if (!/^[a-z0-9-]+$/.test(input)) {
-            return "Project name must contain only lowercase letters, numbers, and hyphens";
-          }
-          const projectPath = path.resolve(process.cwd(), input);
-          if (fs.existsSync(projectPath)) {
-            return `Directory "${input}" already exists`;
-          }
-          return true;
+    const name = await text3({
+      message: "What is your project name?",
+      defaultValue: "my-revealui-project",
+      validate: (input) => {
+        if (!input) return void 0;
+        const isValid = input.split("").every((ch) => {
+          const code = ch.charCodeAt(0);
+          return code >= 97 && code <= 122 || // a-z
+          code >= 48 && code <= 57 || // 0-9
+          code === 45;
+        });
+        if (!isValid) {
+          return "Project name must contain only lowercase letters, numbers, and hyphens";
         }
+        const projectPath = path2.resolve(process.cwd(), input);
+        if (fs2.existsSync(projectPath)) {
+          return `Directory "${input}" already exists`;
+        }
+        return void 0;
       }
-    ]);
-    projectName = answers.projectName;
+    });
+    if (isCancel4(name)) {
+      process.exit(0);
+    }
+    projectName = name;
   }
   let template;
   if (templateArg && VALID_TEMPLATES.includes(templateArg)) {
@@ -455,118 +779,106 @@ async function promptProjectConfig(defaultName, templateArg, nonInteractive = fa
   } else if (nonInteractive) {
     template = "basic-blog";
   } else {
-    const answers = await inquirer4.prompt([
-      {
-        type: "list",
-        name: "template",
-        message: "Which template would you like to use?",
-        choices: [
-          { name: "Basic Blog - A simple blog with posts and pages", value: "basic-blog" },
-          { name: "E-commerce - Product catalog with checkout", value: "e-commerce" },
-          { name: "Portfolio - Personal portfolio site", value: "portfolio" }
-        ],
-        default: "basic-blog"
-      }
-    ]);
-    template = answers.template;
+    const selected = await select2({
+      message: "Which template would you like to use?",
+      options: [
+        { value: "basic-blog", label: "Basic Blog - A simple blog with posts and pages" },
+        { value: "e-commerce", label: "E-commerce - Product catalog with checkout" },
+        { value: "portfolio", label: "Portfolio - Personal portfolio site" }
+      ],
+      initialValue: "basic-blog"
+    });
+    if (isCancel4(selected)) {
+      process.exit(0);
+    }
+    template = selected;
   }
   return {
     projectName,
-    projectPath: path.resolve(process.cwd(), projectName),
+    projectPath: path2.resolve(process.cwd(), projectName),
     template
   };
 }
 
 // src/prompts/storage.ts
-import inquirer5 from "inquirer";
+import { isCancel as isCancel5, select as select3, text as text4 } from "@clack/prompts";
 async function promptStorageConfig() {
-  const { provider } = await inquirer5.prompt([
-    {
-      type: "list",
-      name: "provider",
-      message: "Which storage provider would you like to use?",
-      choices: [
-        {
-          name: "Vercel Blob - Simple object storage (recommended)",
-          value: "vercel-blob"
-        },
-        {
-          name: "Supabase Storage - Integrated with Supabase",
-          value: "supabase"
-        },
-        {
-          name: "Skip - Configure later",
-          value: "skip"
-        }
-      ],
-      default: "vercel-blob"
-    }
-  ]);
+  const provider = await select3({
+    message: "Which storage provider would you like to use?",
+    options: [
+      { value: "vercel-blob", label: "Vercel Blob - Simple object storage (recommended)" },
+      { value: "supabase", label: "Supabase Storage - Integrated with Supabase" },
+      { value: "skip", label: "Skip - Configure later" }
+    ],
+    initialValue: "vercel-blob"
+  });
+  if (isCancel5(provider)) {
+    process.exit(0);
+  }
   if (provider === "skip") {
     return { provider: "skip" };
   }
   if (provider === "vercel-blob") {
-    const { blobToken } = await inquirer5.prompt([
-      {
-        type: "input",
-        name: "blobToken",
-        message: "Enter your Vercel Blob read/write token:",
-        validate: async (input) => {
-          if (!input || input.trim() === "") {
-            return "Blob token is required";
-          }
-          const result = await validateVercelToken(input);
-          return result.valid ? true : result.message || "Invalid token";
+    const blobToken = await text4({
+      message: "Enter your Vercel Blob read/write token:",
+      validate: (input) => {
+        if (!input || input.trim() === "") {
+          return "Blob token is required";
         }
+        const result = validateVercelToken(input);
+        return result.valid ? void 0 : result.message || "Invalid token";
       }
-    ]);
+    });
+    if (isCancel5(blobToken)) {
+      process.exit(0);
+    }
     return { provider: "vercel-blob", blobToken };
   }
-  const answers = await inquirer5.prompt([
-    {
-      type: "input",
-      name: "supabaseUrl",
-      message: "Enter your Supabase project URL:",
-      validate: async (input) => {
-        if (!input || input.trim() === "") {
-          return "Supabase URL is required";
-        }
-        const result = await validateSupabaseUrl(input);
-        return result.valid ? true : result.message || "Invalid URL";
+  const supabaseUrl = await text4({
+    message: "Enter your Supabase project URL:",
+    validate: (input) => {
+      if (!input || input.trim() === "") {
+        return "Supabase URL is required";
       }
-    },
-    {
-      type: "input",
-      name: "supabasePublishableKey",
-      message: "Enter your Supabase publishable key (sb_publishable_...):",
-      validate: (input) => {
-        if (!input || input.trim() === "") {
-          return "Supabase publishable key is required";
-        }
-        return true;
+      const result = validateSupabaseUrl(input);
+      return result.valid ? void 0 : result.message || "Invalid URL";
+    }
+  });
+  if (isCancel5(supabaseUrl)) {
+    process.exit(0);
+  }
+  const supabasePublishableKey = await text4({
+    message: "Enter your Supabase publishable key (sb_publishable_...):",
+    validate: (input) => {
+      if (!input || input.trim() === "") {
+        return "Supabase publishable key is required";
       }
+      return void 0;
     }
-  ]);
+  });
+  if (isCancel5(supabasePublishableKey)) {
+    process.exit(0);
+  }
   return {
     provider: "supabase",
-    supabaseUrl: answers.supabaseUrl,
-    supabasePublishableKey: answers.supabasePublishableKey
+    supabaseUrl,
+    supabasePublishableKey
   };
 }
 
 // src/validators/node-version.ts
-import { createLogger as createLogger3 } from "@revealui/setup/utils";
-var logger3 = createLogger3({ prefix: "Setup" });
+import { createLogger as createLogger4 } from "@revealui/setup/utils";
+var logger4 = createLogger4({ prefix: "Setup" });
 var REQUIRED_NODE_VERSION = "24.13.0";
 function validateNodeVersion() {
   const currentVersion = process.version.slice(1);
   const [currentMajor, currentMinor] = currentVersion.split(".").map(Number);
   const [requiredMajor, requiredMinor] = REQUIRED_NODE_VERSION.split(".").map(Number);
   if (currentMajor < requiredMajor || currentMajor === requiredMajor && currentMinor < requiredMinor) {
-    logger3.error(
+    logger4.error(
       `Node.js ${REQUIRED_NODE_VERSION} or higher is required. You have ${currentVersion}.`
     );
-    logger3.info("Please upgrade Node.js: https://nodejs.org/");
+    logger4.info("Please upgrade Node.js: https://nodejs.org/");
     return false;
   }
   return true;
@@ -575,15 +887,15 @@ function validateNodeVersion() {
 // src/commands/create.ts
 import crypto from "crypto";
 import { existsSync } from "fs";
-import fs5 from "fs/promises";
-import path5 from "path";
+import fs6 from "fs/promises";
+import path6 from "path";
 import { fileURLToPath } from "url";
-import { createLogger as createLogger6 } from "@revealui/setup/utils";
+import { createLogger as createLogger7 } from "@revealui/setup/utils";
 import ora2 from "ora";
 
 // src/generators/devbox.ts
-import fs2 from "fs/promises";
-import path2 from "path";
+import fs3 from "fs/promises";
+import path3 from "path";
 async function generateDevbox(projectPath) {
   const devboxConfig = {
     packages: ["nodejs@24.13.0", "pnpm@10.28.2", "postgresql@16", "stripe-cli@latest"],
@@ -603,19 +915,19 @@ async function generateDevbox(projectPath) {
       NODE_ENV: "development"
     }
   };
-  await fs2.writeFile(
-    path2.join(projectPath, "devbox.json"),
+  await fs3.writeFile(
+    path3.join(projectPath, "devbox.json"),
     JSON.stringify(devboxConfig, null, 2),
     "utf-8"
   );
 }
 
 // src/generators/devcontainer.ts
-import fs3 from "fs/promises";
-import path3 from "path";
+import fs4 from "fs/promises";
+import path4 from "path";
 async function generateDevContainer(projectPath) {
-  const devcontainerDir = path3.join(projectPath, ".devcontainer");
-  await fs3.mkdir(devcontainerDir, { recursive: true });
+  const devcontainerDir = path4.join(projectPath, ".devcontainer");
+  await fs4.mkdir(devcontainerDir, { recursive: true });
   const devcontainerConfig = {
     name: "RevealUI Development",
     image: "mcr.microsoft.com/devcontainers/typescript-node:24",
@@ -662,8 +974,8 @@ async function generateDevContainer(projectPath) {
     },
     remoteUser: "node"
   };
-  await fs3.writeFile(
-    path3.join(devcontainerDir, "devcontainer.json"),
+  await fs4.writeFile(
+    path4.join(devcontainerDir, "devcontainer.json"),
     JSON.stringify(devcontainerConfig, null, 2),
     "utf-8"
   );
@@ -692,7 +1004,7 @@ services:
 volumes:
   postgres-data:
 `;
-  await fs3.writeFile(path3.join(devcontainerDir, "docker-compose.yml"), dockerCompose, "utf-8");
+  await fs4.writeFile(path4.join(devcontainerDir, "docker-compose.yml"), dockerCompose, "utf-8");
   const dockerfile = `FROM mcr.microsoft.com/devcontainers/typescript-node:24
 
 # Install additional tools
@@ -702,7 +1014,7 @@ RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \\
 # Enable pnpm
 RUN corepack enable
 `;
-  await fs3.writeFile(path3.join(devcontainerDir, "Dockerfile"), dockerfile, "utf-8");
+  await fs4.writeFile(path4.join(devcontainerDir, "Dockerfile"), dockerfile, "utf-8");
   const readme = `# Dev Container Setup
 
 This directory contains the Dev Container configuration for RevealUI.
@@ -744,12 +1056,12 @@ For GitHub Codespaces, set secrets in your repository settings.
 - 4000: CMS
 - 5432: PostgreSQL database
 `;
-  await fs3.writeFile(path3.join(devcontainerDir, "README.md"), readme, "utf-8");
+  await fs4.writeFile(path4.join(devcontainerDir, "README.md"), readme, "utf-8");
 }
 
 // src/generators/readme.ts
-import fs4 from "fs/promises";
-import path4 from "path";
+import fs5 from "fs/promises";
+import path5 from "path";
 async function generateReadme(projectPath, projectConfig) {
   const readme = `# ${projectConfig.projectName}
 
@@ -821,31 +1133,31 @@ This project was created using the **${projectConfig.template}** template.
 
 MIT
 `;
-  await fs4.writeFile(path4.join(projectPath, "README.md"), readme, "utf-8");
+  await fs5.writeFile(path5.join(projectPath, "README.md"), readme, "utf-8");
 }
 
 // src/installers/dependencies.ts
-import { createLogger as createLogger4 } from "@revealui/setup/utils";
-import { execa } from "execa";
+import { createLogger as createLogger5 } from "@revealui/setup/utils";
+import { execa as execa3 } from "execa";
 import ora from "ora";
-var logger4 = createLogger4({ prefix: "Install" });
+var logger5 = createLogger5({ prefix: "Install" });
 async function installDependencies(projectPath) {
   const spinner = ora("Installing dependencies with pnpm...").start();
   try {
-    await execa("pnpm", ["install"], {
+    await execa3("pnpm", ["install"], {
       cwd: projectPath,
       stdio: "pipe"
     });
     spinner.succeed("Dependencies installed successfully");
   } catch (error) {
     spinner.fail("Failed to install dependencies");
-    logger4.error('Please run "pnpm install" manually');
+    logger5.error('Please run "pnpm install" manually');
     throw error;
   }
 }
 async function isPnpmInstalled() {
   try {
-    await execa("pnpm", ["--version"]);
+    await execa3("pnpm", ["--version"]);
     return true;
   } catch {
     return false;
@@ -853,31 +1165,31 @@ async function isPnpmInstalled() {
 }
 
 // src/utils/git.ts
-import { createLogger as createLogger5 } from "@revealui/setup/utils";
-import { execa as execa2 } from "execa";
-var logger5 = createLogger5({ prefix: "Git" });
+import { createLogger as createLogger6 } from "@revealui/setup/utils";
+import { execa as execa4 } from "execa";
+var logger6 = createLogger6({ prefix: "Git" });
 async function initializeGitRepo(projectPath) {
   try {
-    await execa2("git", ["init"], { cwd: projectPath });
-    logger5.success("Initialized git repository");
+    await execa4("git", ["init"], { cwd: projectPath });
+    logger6.success("Initialized git repository");
   } catch (error) {
-    logger5.warn("Failed to initialize git repository");
+    logger6.warn("Failed to initialize git repository");
     throw error;
   }
 }
 async function createInitialCommit(projectPath) {
   try {
-    await execa2("git", ["add", "."], { cwd: projectPath });
-    await execa2("git", ["commit", "-m", "Initial commit from @revealui/cli"], { cwd: projectPath });
-    logger5.success("Created initial commit");
+    await execa4("git", ["add", "."], { cwd: projectPath });
+    await execa4("git", ["commit", "-m", "Initial commit from @revealui/cli"], { cwd: projectPath });
+    logger6.success("Created initial commit");
   } catch (error) {
-    logger5.warn("Failed to create initial commit");
+    logger6.warn("Failed to create initial commit");
     throw error;
   }
 }
 async function isGitInstalled() {
   try {
-    await execa2("git", ["--version"]);
+    await execa4("git", ["--version"]);
     return true;
   } catch {
     return false;
@@ -885,10 +1197,10 @@ async function isGitInstalled() {
 }
 
 // src/commands/create.ts
-var logger6 = createLogger6({ prefix: "Create" });
+var logger7 = createLogger7({ prefix: "Create" });
 var __filename2 = fileURLToPath(import.meta.url);
-var __dirname2 = path5.dirname(__filename2);
-var TEMPLATES_DIR = existsSync(path5.resolve(__dirname2, "../../templates")) ? path5.resolve(__dirname2, "../../templates") : path5.resolve(__dirname2, "../templates");
+var __dirname2 = path6.dirname(__filename2);
+var TEMPLATES_DIR = existsSync(path6.resolve(__dirname2, "../../templates")) ? path6.resolve(__dirname2, "../../templates") : path6.resolve(__dirname2, "../templates");
 function buildEnvLocal(cfg) {
   const lines = [
     "# Generated by @revealui/cli \u2014 fill in the remaining placeholders before running `pnpm dev`",
@@ -934,16 +1246,16 @@ function generateSecret() {
 }
 async function listAvailableTemplates() {
   try {
-    const entries = await fs5.readdir(TEMPLATES_DIR, { withFileTypes: true });
+    const entries = await fs6.readdir(TEMPLATES_DIR, { withFileTypes: true });
     return entries.filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
 }
 async function copyTemplate(templateName, targetPath) {
-  const templatePath = path5.join(TEMPLATES_DIR, templateName);
+  const templatePath = path6.join(TEMPLATES_DIR, templateName);
   try {
-    await fs5.access(templatePath);
+    await fs6.access(templatePath);
   } catch {
     const available = await listAvailableTemplates();
     const listing = available.length > 0 ? `Available templates: ${available.join(", ")}` : `No templates found in ${TEMPLATES_DIR}`;
@@ -952,16 +1264,16 @@ async function copyTemplate(templateName, targetPath) {
   await copyDir(templatePath, targetPath);
 }
 async function copyDir(src, dest) {
-  await fs5.mkdir(dest, { recursive: true });
-  const entries = await fs5.readdir(src, { withFileTypes: true });
+  await fs6.mkdir(dest, { recursive: true });
+  const entries = await fs6.readdir(src, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = path5.join(src, entry.name);
+    const srcPath = path6.join(src, entry.name);
     const destName = entry.name === "_gitignore" ? ".gitignore" : entry.name;
-    const destPath = path5.join(dest, destName);
+    const destPath = path6.join(dest, destName);
     if (entry.isDirectory()) {
       await copyDir(srcPath, destPath);
     } else {
-      await fs5.copyFile(srcPath, destPath);
+      await fs6.copyFile(srcPath, destPath);
     }
   }
 }
@@ -974,7 +1286,17 @@ function resolveTemplateName(template) {
   return map[template] ?? "starter";
 }
 async function pullContentRules(projectPath) {
-  const baseUrl = process.env.REVEALUI_RULES_URL ?? "https://raw.githubusercontent.com/RevealUIStudio/editor-configs/main/harnesses";
+  const rawBaseUrl = process.env.REVEALUI_RULES_URL ?? "https://raw.githubusercontent.com/RevealUIStudio/editor-configs/main/harnesses";
+  let baseUrl;
+  try {
+    const parsed = new URL(rawBaseUrl);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+      return;
+    }
+    baseUrl = rawBaseUrl;
+  } catch {
+    return;
+  }
   const spinner = ora2("Pulling AI coding rules...").start();
   try {
     const manifestRes = await fetch(`${baseUrl}/manifest.json`, {
@@ -988,18 +1310,27 @@ async function pullContentRules(projectPath) {
     const generatorId = "claude-code";
     const ossDefs = manifest.definitions.filter((d) => d.tier === "oss");
     let written = 0;
+    const allowedExtensions = /* @__PURE__ */ new Set([".md", ".json", ".txt", ".yaml", ".yml", ".ts", ".js"]);
+    const maxFileSize = 1048576;
     for (const def of ossDefs) {
       const paths = def.generatorPaths[generatorId] ?? [];
       for (const relPath of paths) {
         try {
+          if (relPath.includes("..") || relPath.startsWith("/")) continue;
+          const ext = path6.extname(relPath).toLowerCase();
+          if (!allowedExtensions.has(ext)) continue;
+          const absolutePath = path6.resolve(projectPath, relPath);
+          if (!absolutePath.startsWith(path6.resolve(projectPath))) continue;
           const fileRes = await fetch(`${baseUrl}/generators/${generatorId}/${relPath}`, {
             signal: AbortSignal.timeout(5e3)
           });
           if (!fileRes.ok) continue;
+          const contentLength = fileRes.headers.get("content-length");
+          if (contentLength && Number.parseInt(contentLength, 10) > maxFileSize) continue;
           const content = await fileRes.text();
-          const absolutePath = path5.join(projectPath, relPath);
-          await fs5.mkdir(path5.dirname(absolutePath), { recursive: true });
-          await fs5.writeFile(absolutePath, content, "utf-8");
+          if (content.length > maxFileSize) continue;
+          await fs6.mkdir(path6.dirname(absolutePath), { recursive: true });
+          await fs6.writeFile(absolutePath, content, "utf-8");
           written++;
         } catch {
         }
@@ -1025,58 +1356,58 @@ async function createProject(cfg) {
     spinner.fail("Failed to copy template files");
     throw err;
   }
-  const pkgJsonPath = path5.join(projectPath, "package.json");
+  const pkgJsonPath = path6.join(projectPath, "package.json");
   try {
-    const raw = await fs5.readFile(pkgJsonPath, "utf-8");
-    await fs5.writeFile(pkgJsonPath, raw.replaceAll("{{PROJECT_NAME}}", projectName), "utf-8");
+    const raw = await fs6.readFile(pkgJsonPath, "utf-8");
+    await fs6.writeFile(pkgJsonPath, raw.replaceAll("{{PROJECT_NAME}}", projectName), "utf-8");
   } catch {
   }
   const envSpinner = ora2("Writing .env.local...").start();
   try {
-    await fs5.writeFile(path5.join(projectPath, ".env.local"), buildEnvLocal(cfg), "utf-8");
+    await fs6.writeFile(path6.join(projectPath, ".env.local"), buildEnvLocal(cfg), "utf-8");
     envSpinner.succeed(".env.local written");
   } catch (err) {
     envSpinner.fail("Failed to write .env.local");
     throw err;
   }
   await generateReadme(projectPath, project);
-  logger6.success("README.md generated");
+  logger7.success("README.md generated");
   if (cfg.devenv.createDevContainer) {
     await generateDevContainer(projectPath);
-    logger6.success(".devcontainer/ generated");
+    logger7.success(".devcontainer/ generated");
   }
   if (cfg.devenv.createDevbox) {
     await generateDevbox(projectPath);
-    logger6.success("devbox.json generated");
+    logger7.success("devbox.json generated");
   }
   await pullContentRules(projectPath);
   if (!skipInstall) {
     const pnpmOk = await isPnpmInstalled();
     if (!pnpmOk) {
-      logger6.warn(
+      logger7.warn(
         "pnpm not found \u2014 skipping dependency installation. Run `pnpm install` manually."
       );
     } else {
       await installDependencies(projectPath);
     }
   } else {
-    logger6.info("Skipping dependency installation (--skip-install)");
+    logger7.info("Skipping dependency installation (--skip-install)");
   }
   if (!skipGit) {
     const gitOk = await isGitInstalled();
     if (!gitOk) {
-      logger6.warn("git not found \u2014 skipping repository initialisation.");
+      logger7.warn("git not found \u2014 skipping repository initialisation.");
     } else {
       await initializeGitRepo(projectPath);
       await createInitialCommit(projectPath);
     }
   } else {
-    logger6.info("Skipping git initialisation (--skip-git)");
+    logger7.info("Skipping git initialisation (--skip-git)");
   }
 }
 
 // src/commands/create-flow.ts
-var logger7 = createLogger7({ prefix: "@revealui/cli" });
+var logger8 = createLogger8({ prefix: "@revealui/cli" });
 var PRO_TEMPLATES = /* @__PURE__ */ new Set([]);
 async function checkProLicense() {
   let key = process.env.REVEALUI_LICENSE_KEY;
@@ -1114,108 +1445,113 @@ async function checkProLicense() {
   }
 }
 function printBanner() {
-  logger7.divider();
-  logger7.info("  RevealUI \u2014 B.O.S.S.");
-  logger7.info("  Build your business, not your boilerplate.");
-  logger7.divider();
-  logger7.info("");
+  logger8.divider();
+  logger8.info("  RevealUI \u2014 Agentic Business Runtime");
+  logger8.info("  Build your business, not your boilerplate.");
+  logger8.divider();
+  logger8.info("");
 }
 function printPostCreateSummary(projectName) {
-  logger7.divider();
-  logger7.success("Your RevealUI project is ready!");
-  logger7.info("");
-  logger7.info("  Quick start:");
-  logger7.info(`    cd ${projectName}`);
-  logger7.info("    pnpm install");
-  logger7.info("    pnpm dev");
-  logger7.info("");
-  logger7.info("  What was created:");
-  logger7.info(`    ./${projectName}/          \u2014 project root`);
-  logger7.info(`    ./${projectName}/.env.local \u2014 environment variables (edit before pnpm dev)`);
-  logger7.info(`    ./${projectName}/README.md  \u2014 getting started guide`);
-  logger7.info("");
-  logger7.info("  Helpful links:");
-  logger7.info("    Docs:    https://docs.revealui.com");
-  logger7.info("    GitHub:  https://github.com/RevealUIStudio/revealui");
-  logger7.info("    Support: support@revealui.com");
-  logger7.divider();
+  logger8.divider();
+  logger8.success("Your RevealUI project is ready!");
+  logger8.info("");
+  logger8.info("  Quick start:");
+  logger8.info(`    cd ${projectName}`);
+  logger8.info("    pnpm install");
+  logger8.info("    pnpm dev");
+  logger8.info("");
+  logger8.info("  What was created:");
+  logger8.info(`    ./${projectName}/          \u2014 project root`);
+  logger8.info(`    ./${projectName}/.env.local \u2014 environment variables (edit before pnpm dev)`);
+  logger8.info(`    ./${projectName}/README.md  \u2014 getting started guide`);
+  logger8.info("");
+  logger8.info("  RevealUI ecosystem:");
+  logger8.info("    Studio:   Native AI experience \u2014 agent hub, local inference, dev environment");
+  logger8.info("    Terminal: TUI client \u2014 run `revealui terminal install`");
+  logger8.info("    CMS:      Admin dashboard at your-domain.com/admin");
+  logger8.info("");
+  logger8.info("  Helpful links:");
+  logger8.info("    Docs:    https://docs.revealui.com");
+  logger8.info("    GitHub:  https://github.com/RevealUIStudio/revealui");
+  logger8.info("    Support: support@revealui.com");
+  logger8.divider();
 }
 function formatCreateError(err) {
   const message = err instanceof Error ? err.message : String(err);
   const code = err instanceof Error && "code" in err ? err.code : void 0;
-  logger7.error("Project creation failed.");
-  logger7.info("");
+  logger8.error("Project creation failed.");
+  logger8.info("");
   if (code === "EACCES") {
-    logger7.info("  Permission denied. Try:");
-    logger7.info("    - Running from a directory you own");
-    logger7.info("    - Checking folder permissions with `ls -la`");
+    logger8.info("  Permission denied. Try:");
+    logger8.info("    - Running from a directory you own");
+    logger8.info("    - Checking folder permissions with `ls -la`");
   } else if (code === "ENOENT") {
-    logger7.info("  A required file or directory was not found.");
-    logger7.info("    - Check that you are in the correct directory");
-    logger7.info("    - Try running `revealui doctor` to diagnose your environment");
+    logger8.info("  A required file or directory was not found.");
+    logger8.info("    - Check that you are in the correct directory");
+    logger8.info("    - Try running `revealui doctor` to diagnose your environment");
   } else if (code === "ENOSPC") {
-    logger7.info("  Disk full. Free up space and try again.");
+    logger8.info("  Disk full. Free up space and try again.");
   } else if (message.includes("fetch") || message.includes("ENOTFOUND") || message.includes("ETIMEDOUT")) {
-    logger7.info("  Network error. Check your internet connection and try again.");
+    logger8.info("  Network error. Check your internet connection and try again.");
   } else {
-    logger7.info(`  ${message}`);
+    logger8.info(`  ${message}`);
   }
-  logger7.info("");
-  logger7.info("  Troubleshooting:");
-  logger7.info("    revealui doctor       \u2014 diagnose your environment");
-  logger7.info("    https://docs.revealui.com/docs/TROUBLESHOOTING");
-  logger7.info("    support@revealui.com  \u2014 we are here to help");
-  logger7.divider();
+  logger8.info("");
+  logger8.info("  Troubleshooting:");
+  logger8.info("    revealui doctor       \u2014 diagnose your environment");
+  logger8.info("    https://docs.revealui.com/docs/TROUBLESHOOTING");
+  logger8.info("    support@revealui.com  \u2014 we are here to help");
+  logger8.divider();
 }
 async function runCreateFlow(projectName, options) {
   printBanner();
   try {
-    logger7.info("[1/8] Validating Node.js version...");
+    logger8.info("[1/8] Validating Node.js version...");
     if (!validateNodeVersion()) {
       process.exit(1);
     }
-    logger7.success(`Node.js version: ${process.version}`);
-    logger7.info("[2/8] Configure your project");
+    logger8.success(`Node.js version: ${process.version}`);
+    logger8.info("[2/8] Configure your project");
     const projectConfig = await promptProjectConfig(projectName, options.template, options.yes);
-    logger7.success(`Project: ${projectConfig.projectName}`);
-    logger7.success(`Template: ${projectConfig.template}`);
+    logger8.success(`Project: ${projectConfig.projectName}`);
+    logger8.success(`Template: ${projectConfig.template}`);
     if (PRO_TEMPLATES.has(projectConfig.template)) {
       if (!await checkProLicense()) {
-        logger7.error(`The "${projectConfig.template}" template requires a RevealUI Pro license.`);
-        logger7.info("Get Pro at https://revealui.com/pricing");
-        logger7.info("Set your license key: export REVEALUI_LICENSE_KEY=<your-key>");
+        logger8.error(`The "${projectConfig.template}" template requires a RevealUI Pro license.`);
+        logger8.info("Get Pro at https://revealui.com/pricing");
+        logger8.info("Set your license key: export REVEALUI_LICENSE_KEY=<your-key>");
         process.exit(2);
       }
-      logger7.success("Pro license verified");
+      logger8.success("Pro license verified");
     }
     const nonInteractive = options.yes === true;
-    logger7.info("[3/8] Configure database");
+    logger8.info("[3/8] Configure database");
     const databaseConfig = nonInteractive ? { provider: "skip" } : await promptDatabaseConfig();
     if (databaseConfig.provider !== "skip") {
-      logger7.success(`Database: ${databaseConfig.provider}`);
+      logger8.success(`Database: ${databaseConfig.provider}`);
     } else {
-      logger7.info("Database configuration skipped");
+      logger8.info("Database configuration skipped");
     }
-    logger7.info("[4/8] Configure storage");
+    logger8.info("[4/8] Configure storage");
     const storageConfig = nonInteractive ? { provider: "skip" } : await promptStorageConfig();
     if (storageConfig.provider !== "skip") {
-      logger7.success(`Storage: ${storageConfig.provider}`);
+      logger8.success(`Storage: ${storageConfig.provider}`);
     } else {
-      logger7.info("Storage configuration skipped");
+      logger8.info("Storage configuration skipped");
     }
-    logger7.info("[5/8] Configure payments");
+    logger8.info("[5/8] Configure payments");
     const paymentConfig = nonInteractive ? { enabled: false } : await promptPaymentConfig();
     if (paymentConfig.enabled) {
-      logger7.success("Stripe configured");
+      logger8.success("Stripe configured");
     } else {
-      logger7.info("Payments disabled");
+      logger8.info("Payments disabled");
     }
-    logger7.info("[6/8] Configure development environment");
+    logger8.info("[6/8] Configure development environment");
     const devEnvConfig = nonInteractive ? { createDevContainer: false, createDevbox: false } : await promptDevEnvConfig();
-    logger7.success(
+    logger8.success(
       `Dev Container: ${devEnvConfig.createDevContainer ? "Yes" : "No"}, Devbox: ${devEnvConfig.createDevbox ? "Yes" : "No"}`
     );
-    logger7.info("[7/8] Creating project...");
+    logger8.info("[7/8] Creating project...");
     await createProject({
       project: projectConfig,
       database: databaseConfig,
@@ -1225,8 +1561,8 @@ async function runCreateFlow(projectName, options) {
       skipGit: options.skipGit,
       skipInstall: options.skipInstall
     });
-    logger7.success("Project created successfully");
-    logger7.info("[8/8] Done!");
+    logger8.success("Project created successfully");
+    logger8.info("[8/8] Done!");
     printPostCreateSummary(projectConfig.projectName);
   } catch (err) {
     formatCreateError(err);
@@ -1235,45 +1571,16 @@ async function runCreateFlow(projectName, options) {
 }
 
 // src/commands/db.ts
-import fs8 from "fs/promises";
-import path8 from "path";
-import { createLogger as createLogger8 } from "@revealui/setup/utils";
-import { execa as execa4 } from "execa";
-
-// src/utils/command.ts
-import net from "net";
-import { execa as execa3 } from "execa";
-async function commandExists(command) {
-  try {
-    await execa3("bash", ["-lc", `command -v ${command}`], {
-      stdio: "pipe"
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function isTcpReachable(host, port, timeoutMs = 1500) {
-  return await new Promise((resolve) => {
-    const socket = new net.Socket();
-    const finalize = (value) => {
-      socket.removeAllListeners();
-      socket.destroy();
-      resolve(value);
-    };
-    socket.setTimeout(timeoutMs);
-    socket.once("connect", () => finalize(true));
-    socket.once("timeout", () => finalize(false));
-    socket.once("error", () => finalize(false));
-    socket.connect(port, host);
-  });
-}
+import fs9 from "fs/promises";
+import path9 from "path";
+import { createLogger as createLogger9 } from "@revealui/setup/utils";
+import { execa as execa5 } from "execa";
 
 // src/utils/db.ts
-import fs6 from "fs/promises";
-import path6 from "path";
+import fs7 from "fs/promises";
+import path7 from "path";
 function resolveLocalDbConfig(cwd = process.cwd(), env = process.env) {
-  const pgdata = env.PGDATA || path6.join(cwd, ".pgdata");
+  const pgdata = env.PGDATA || path7.join(cwd, ".pgdata");
   const pghost = env.PGHOST || pgdata;
   const pgdatabase = env.PGDATABASE || "postgres";
   const pguser = env.PGUSER || "postgres";
@@ -1320,27 +1627,27 @@ host    all             all             ::1/128                 trust
 `.trimStart();
 }
 async function writeLocalDbConfigs(pgdata) {
-  await fs6.appendFile(path6.join(pgdata, "postgresql.conf"), buildPostgresConfig(pgdata), "utf8");
-  await fs6.writeFile(path6.join(pgdata, "pg_hba.conf"), buildPgHbaConfig(), "utf8");
+  await fs7.appendFile(path7.join(pgdata, "postgresql.conf"), buildPostgresConfig(pgdata), "utf8");
+  await fs7.writeFile(path7.join(pgdata, "pg_hba.conf"), buildPgHbaConfig(), "utf8");
 }
 
 // src/utils/workspace.ts
-import fs7 from "fs";
-import path7 from "path";
+import fs8 from "fs";
+import path8 from "path";
 function findWorkspaceRoot(startDir = process.cwd()) {
-  let current = path7.resolve(startDir);
+  let current = path8.resolve(startDir);
   while (true) {
-    const packageJsonPath = path7.join(current, "package.json");
-    if (fs7.existsSync(packageJsonPath)) {
+    const packageJsonPath = path8.join(current, "package.json");
+    if (fs8.existsSync(packageJsonPath)) {
       try {
-        const pkg = JSON.parse(fs7.readFileSync(packageJsonPath, "utf8"));
+        const pkg = JSON.parse(fs8.readFileSync(packageJsonPath, "utf8"));
         if (pkg.name === "revealui" && pkg.private === true) {
           return current;
         }
       } catch {
       }
     }
-    const parent = path7.dirname(current);
+    const parent = path8.dirname(current);
     if (parent === current) {
       return null;
     }
@@ -1349,7 +1656,7 @@ function findWorkspaceRoot(startDir = process.cwd()) {
 }
 
 // src/commands/db.ts
-var logger8 = createLogger8({ prefix: "DB" });
+var logger9 = createLogger9({ prefix: "DB" });
 function isPgCtlNotRunningError(error) {
   return typeof error === "object" && error !== null && "exitCode" in error && error.exitCode === 3;
 }
@@ -1390,18 +1697,18 @@ async function runDbInitCommand(options = {}) {
   const pgdata = getPgDataOrThrow(env);
   await requireCommand("initdb");
   try {
-    await fs8.access(pgdata);
+    await fs9.access(pgdata);
     if (!options.force) {
       throw new Error(`PostgreSQL is already initialized at ${pgdata}. Use --force to reset it.`);
     }
-    await fs8.rm(pgdata, { recursive: true, force: true });
+    await fs9.rm(pgdata, { recursive: true, force: true });
   } catch (error) {
     if (error instanceof Error && !error.message.includes("already initialized")) {
     } else if (error instanceof Error) {
       throw error;
     }
   }
-  await execa4(
+  await execa5(
     "initdb",
     ["--locale=C.UTF-8", "--encoding=UTF8", "-D", pgdata, "--username=postgres"],
     {
@@ -1410,17 +1717,17 @@ async function runDbInitCommand(options = {}) {
     }
   );
   await writeLocalDbConfigs(pgdata);
-  logger8.success(`PostgreSQL initialized at ${pgdata}`);
+  logger9.success(`PostgreSQL initialized at ${pgdata}`);
 }
 async function runDbStartCommand() {
   const root = getWorkspaceRootOrThrow();
   const env = buildDbEnv(root);
   const pgdata = getPgDataOrThrow(env);
   await requireCommand("pg_ctl");
-  await fs8.access(pgdata);
-  await execa4(
+  await fs9.access(pgdata);
+  await execa5(
     "pg_ctl",
-    ["start", "-D", pgdata, "-l", path8.join(pgdata, "logfile"), "-o", `-k ${pgdata}`],
+    ["start", "-D", pgdata, "-l", path9.join(pgdata, "logfile"), "-o", `-k ${pgdata}`],
     {
       env,
       stdio: "inherit"
@@ -1432,7 +1739,7 @@ async function runDbStopCommand() {
   const env = buildDbEnv(root);
   const pgdata = getPgDataOrThrow(env);
   await requireCommand("pg_ctl");
-  await execa4("pg_ctl", ["stop", "-D", pgdata], {
+  await execa5("pg_ctl", ["stop", "-D", pgdata], {
     env,
     stdio: "inherit"
   });
@@ -1443,13 +1750,13 @@ async function runDbStatusCommand() {
   const pgdata = getPgDataOrThrow(env);
   await requireCommand("pg_ctl");
   try {
-    await execa4("pg_ctl", ["status", "-D", pgdata], {
+    await execa5("pg_ctl", ["status", "-D", pgdata], {
       env,
       stdio: "inherit"
     });
   } catch (error) {
     if (isPgCtlNotRunningError(error)) {
-      logger8.warn(`PostgreSQL is not running (PGDATA: ${pgdata})`);
+      logger9.warn(`PostgreSQL is not running (PGDATA: ${pgdata})`);
       return;
     }
     throw error;
@@ -1464,17 +1771,17 @@ async function runDbResetCommand(options = {}) {
   const pgdata = getPgDataOrThrow(env);
   if (await commandExists("pg_ctl")) {
     try {
-      await execa4("pg_ctl", ["stop", "-D", pgdata], { env, stdio: "pipe" });
+      await execa5("pg_ctl", ["stop", "-D", pgdata], { env, stdio: "pipe" });
     } catch {
     }
   }
-  await fs8.rm(pgdata, { recursive: true, force: true });
+  await fs9.rm(pgdata, { recursive: true, force: true });
   await runDbInitCommand({ force: false });
 }
 async function runDbMigrateCommand() {
   const root = getWorkspaceRootOrThrow();
   const env = buildDbEnv(root);
-  await execa4("pnpm", ["--filter", "@revealui/db", "db:migrate"], {
+  await execa5("pnpm", ["--filter", "@revealui/db", "db:migrate"], {
     cwd: root,
     env,
     stdio: "inherit"
@@ -1485,7 +1792,7 @@ async function runDbCleanupCommand(options = {}) {
   const env = { ...process.env };
   if (options.dryRun) env.DRY_RUN = "true";
   if (options.tables) env.TABLES = options.tables;
-  await execa4("pnpm", ["--filter", "@revealui/db", "db:cleanup"], {
+  await execa5("pnpm", ["--filter", "@revealui/db", "db:cleanup"], {
     cwd: root,
     env,
     stdio: "inherit"
@@ -1493,8 +1800,8 @@ async function runDbCleanupCommand(options = {}) {
 }
 
 // src/commands/dev.ts
-import { createLogger as createLogger11 } from "@revealui/setup/utils";
-import { execa as execa6 } from "execa";
+import { createLogger as createLogger12 } from "@revealui/setup/utils";
+import { execa as execa7 } from "execa";
 
 // src/runtime/doctor.ts
 function getMcpDetail(env) {
@@ -1513,6 +1820,140 @@ function getMcpDetail(env) {
     detail: `mcp credentials configured for ${configuredKeys.join(", ")}`
   };
 }
+var ENV_VAR_SPECS = [
+  // Core
+  {
+    key: "REVEALUI_SECRET",
+    label: "App secret",
+    required: false
+  },
+  {
+    key: "REVEALUI_ADMIN_EMAIL",
+    label: "Admin email",
+    required: false
+  },
+  // Database
+  {
+    key: "POSTGRES_URL",
+    label: "PostgreSQL URL",
+    required: true,
+    validate: validateNeonUrl
+  },
+  // Stripe
+  {
+    key: "STRIPE_SECRET_KEY",
+    label: "Stripe secret key",
+    required: false,
+    validate: validateStripeKey
+  },
+  {
+    key: "NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY",
+    label: "Stripe publishable key",
+    required: false,
+    validate: (v) => ({
+      valid: v.startsWith("pk_test_") || v.startsWith("pk_live_"),
+      message: "Must start with pk_test_ or pk_live_"
+    })
+  },
+  {
+    key: "STRIPE_WEBHOOK_SECRET",
+    label: "Stripe webhook secret",
+    required: false,
+    validate: (v) => ({
+      valid: v.startsWith("whsec_"),
+      message: "Must start with whsec_"
+    })
+  },
+  // Supabase
+  {
+    key: "NEXT_PUBLIC_SUPABASE_URL",
+    label: "Supabase URL",
+    required: false,
+    validate: validateSupabaseUrl
+  },
+  {
+    key: "SUPABASE_SERVICE_ROLE_KEY",
+    label: "Supabase service role key",
+    required: false,
+    validate: (v) => ({
+      valid: v.startsWith("eyJ"),
+      message: "Must be a JWT (starts with eyJ)"
+    })
+  },
+  // Services
+  {
+    key: "RESEND_API_KEY",
+    label: "Resend API key",
+    required: false,
+    validate: (v) => ({
+      valid: v.startsWith("re_"),
+      message: "Must start with re_"
+    })
+  },
+  // npm
+  {
+    key: "NPM_TOKEN",
+    label: "npm publish token",
+    required: false,
+    validate: validateNpmToken
+  },
+  // License
+  {
+    key: "REVEALUI_LICENSE_PRIVATE_KEY",
+    label: "License signing key",
+    required: false
+  },
+  // CRON
+  {
+    key: "REVEALUI_CRON_SECRET",
+    label: "Cron secret",
+    required: false
+  },
+  // AI (open-model inference)
+  {
+    key: "BITNET_BASE_URL",
+    label: "BitNet base URL",
+    required: false
+  },
+  {
+    key: "OLLAMA_BASE_URL",
+    label: "Ollama base URL",
+    required: false
+  }
+];
+function maskValue(value) {
+  if (value.length <= 8) return "***";
+  return `${value.slice(0, 4)}...${value.slice(-4)}`;
+}
+function gatherCredentialChecks(env) {
+  const checks = [];
+  for (const spec of ENV_VAR_SPECS) {
+    const value = env[spec.key];
+    if (!value) {
+      checks.push({
+        id: `env:${spec.key}`,
+        ok: !spec.required,
+        detail: spec.required ? `${spec.label} \u2014 missing (required)` : `${spec.label} \u2014 not set`
+      });
+      continue;
+    }
+    if (spec.validate) {
+      const result = spec.validate(value);
+      checks.push({
+        id: `env:${spec.key}`,
+        ok: result.valid,
+        detail: result.valid ? `${spec.label} \u2014 ${maskValue(value)}` : `${spec.label} \u2014 ${result.message} (got ${maskValue(value)})`
+      });
+    } else {
+      checks.push({
+        id: `env:${spec.key}`,
+        ok: true,
+        detail: `${spec.label} \u2014 set`
+      });
+    }
+  }
+  return checks;
+}
 async function gatherDoctorReport(cwd = process.cwd(), env = process.env) {
   const workspaceRoot = findWorkspaceRoot(cwd);
   const dbConfig = resolveLocalDbConfig(workspaceRoot ?? cwd, env);
@@ -1526,6 +1967,7 @@ async function gatherDoctorReport(cwd = process.cwd(), env = process.env) {
   const dockerOk = await commandExists("docker");
   const postgresReachable = dbTarget === "local" ? await isTcpReachable("127.0.0.1", 5432, 1e3) : false;
   const mcp = getMcpDetail(env);
+  const credentials = gatherCredentialChecks(env);
   return {
     workspaceRoot,
     dbTarget,
@@ -1584,7 +2026,8 @@ async function gatherDoctorReport(cwd = process.cwd(), env = process.env) {
         id: "mcp",
         ok: mcp.ok,
         detail: mcp.detail
-      }
+      },
+      ...credentials
     ]
   };
 }
@@ -1597,22 +2040,22 @@ function formatDoctorReport(report) {
 }
 
 // src/utils/dev-config.ts
-import fs9 from "fs";
-import path9 from "path";
+import fs10 from "fs";
+import path10 from "path";
 function getDevConfigPath(startDir = process.cwd()) {
   const workspaceRoot = findWorkspaceRoot(startDir);
   if (!workspaceRoot) {
     return null;
   }
-  return path9.join(workspaceRoot, ".revealui", "dev.json");
+  return path10.join(workspaceRoot, ".revealui", "dev.json");
 }
 function readDevConfig(startDir = process.cwd()) {
   const configPath = getDevConfigPath(startDir);
-  if (!(configPath && fs9.existsSync(configPath))) {
+  if (!(configPath && fs10.existsSync(configPath))) {
     return {};
   }
   try {
-    return JSON.parse(fs9.readFileSync(configPath, "utf8"));
+    return JSON.parse(fs10.readFileSync(configPath, "utf8"));
   } catch {
     return {};
   }
@@ -1622,15 +2065,15 @@ function writeDevConfig(config, startDir = process.cwd()) {
   if (!configPath) {
     throw new Error("RevealUI workspace root not found");
   }
-  fs9.mkdirSync(path9.dirname(configPath), { recursive: true });
-  fs9.writeFileSync(`${configPath}`, `${JSON.stringify(config, null, 2)}
+  fs10.mkdirSync(path10.dirname(configPath), { recursive: true });
+  fs10.writeFileSync(`${configPath}`, `${JSON.stringify(config, null, 2)}
 `, "utf8");
   return configPath;
 }
 
 // src/commands/doctor.ts
-import { createLogger as createLogger9 } from "@revealui/setup/utils";
-var logger9 = createLogger9({ prefix: "Doctor" });
+import { createLogger as createLogger10 } from "@revealui/setup/utils";
+var logger10 = createLogger10({ prefix: "Doctor" });
 function getDoctorFixPlan(report) {
   const attempted = [];
   const skipped = [];
@@ -1688,7 +2131,7 @@ async function runDoctorCommand(options = {}) {
 `);
   if (options.fix) {
     if (fixPlan.attempted.length === 0) {
-      logger9.warn("No safe automatic fixes available");
+      logger10.warn("No safe automatic fixes available");
     } else {
       await applyDoctorFixes(report);
       report = await gatherDoctorReport();
@@ -1697,7 +2140,7 @@ async function runDoctorCommand(options = {}) {
     }
   }
   if (report.checks.some((check) => !check.ok)) {
-    logger9.warn("Some checks failed");
+    logger10.warn("Some checks failed");
     if (options.strict || options.json || process.env.CI) {
       process.exitCode = 1;
     }
@@ -1705,15 +2148,15 @@ async function runDoctorCommand(options = {}) {
 }
 
 // src/commands/shell.ts
-import { createLogger as createLogger10 } from "@revealui/setup/utils";
-import { execa as execa5 } from "execa";
-var logger10 = createLogger10({ prefix: "Shell" });
+import { createLogger as createLogger11 } from "@revealui/setup/utils";
+import { execa as execa6 } from "execa";
+var logger11 = createLogger11({ prefix: "Shell" });
 async function runShellCommand(options = {}) {
   if (!(options.inside || process.env.IN_NIX_SHELL) && await commandExists("nix")) {
     const workspaceRoot = findWorkspaceRoot();
     if (workspaceRoot) {
       const reentryArgs = options.ensure ? ["dev", "up"] : ["dev", "status"];
-      await execa5(
+      await execa6(
         "nix",
         [
           "develop",
@@ -1752,12 +2195,12 @@ async function runShellCommand(options = {}) {
   }
   process.stdout.write(`${formatDoctorReport(freshReport)}
 `);
-  logger10.info("Use `revealui doctor --json` for machine-readable status.");
+  logger11.info("Use `revealui doctor --json` for machine-readable status.");
   return false;
 }
 
 // src/commands/dev.ts
-var logger11 = createLogger11({ prefix: "Dev" });
+var logger12 = createLogger12({ prefix: "Dev" });
 var DEV_PROFILES = {
   local: {},
   agent: {
@@ -1883,21 +2326,21 @@ async function runDevUpCommand(options = {}) {
   process.stdout.write(`${formatDevActions(plan)}
 `);
   if (plan.dryRun) {
-    logger11.info("Dry run only; no migrations or services were started.");
+    logger12.info("Dry run only; no migrations or services were started.");
     return;
   }
   if (options.fix) {
     await runDoctorCommand({ fix: true });
   }
   await runDbMigrateCommand();
-  logger11.success("Database migration complete");
+  logger12.success("Database migration complete");
   if (shouldIncludeMcp(resolved.include)) {
     const workspaceRoot = findWorkspaceRoot();
     if (!workspaceRoot) {
       throw new Error("RevealUI workspace root not found");
     }
-    logger11.info("Validating MCP setup");
-    await execa6("pnpm", ["setup:mcp"], {
+    logger12.info("Validating MCP setup");
+    await execa7("pnpm", ["setup:mcp"], {
       cwd: workspaceRoot,
       stdio: "inherit"
     });
@@ -1907,8 +2350,8 @@ async function runDevUpCommand(options = {}) {
     if (!workspaceRoot) {
       throw new Error("RevealUI workspace root not found");
     }
-    logger11.info(`Starting dev script: ${resolved.script}`);
-    await execa6("pnpm", [resolved.script], {
+    logger12.info(`Starting dev script: ${resolved.script}`);
+    await execa7("pnpm", [resolved.script], {
       cwd: workspaceRoot,
       stdio: "inherit"
     });
@@ -1965,7 +2408,7 @@ async function runDevProfileSetCommand(profile) {
     );
   }
   const configPath = writeDevConfig({ defaultProfile: profile });
-  logger11.success(`Default dev profile set to "${profile}" in ${configPath}`);
+  logger12.success(`Default dev profile set to "${profile}" in ${configPath}`);
 }
 async function runDevProfileShowCommand(options = {}) {
   const configuredProfile = getConfiguredProfile() ?? null;
@@ -1978,11 +2421,223 @@ async function runDevProfileShowCommand(options = {}) {
 `);
 }
 
+// src/commands/terminal.ts
+import { copyFile, mkdir, readdir, stat } from "fs/promises";
+import { homedir as homedir2, platform } from "os";
+import { dirname, join as join2, resolve } from "path";
+import { createLogger as createLogger13 } from "@revealui/setup/utils";
+var logger13 = createLogger13({ prefix: "Terminal" });
+async function dirExists(path11) {
+  try {
+    const s = await stat(path11);
+    return s.isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function fileExists(path11) {
+  try {
+    const s = await stat(path11);
+    return s.isFile();
+  } catch {
+    return false;
+  }
+}
+function getMacProfiles(home) {
+  return [
+    {
+      name: "iTerm2",
+      sourceFile: "iterm2-revealui.json",
+      destPath: join2(
+        home,
+        "Library",
+        "Application Support",
+        "iTerm2",
+        "DynamicProfiles",
+        "revealui.json"
+      ),
+      postInstall: 'Profile loaded automatically. Select "RevealUI" in iTerm2 > Settings > Profiles.',
+      detect: async () => dirExists(join2(home, "Library", "Application Support", "iTerm2"))
+    },
+    {
+      name: "Terminal.app",
+      sourceFile: "Terminal.app-RevealUI.terminal",
+      destPath: join2(home, "Desktop", "RevealUI.terminal"),
+      postInstall: "Double-click ~/Desktop/RevealUI.terminal to import, then set as default in Terminal > Settings > Profiles.",
+      detect: async () => fileExists("/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal")
+    },
+    {
+      name: "Alacritty",
+      sourceFile: "alacritty-revealui.toml",
+      destPath: join2(home, ".config", "alacritty", "revealui.toml"),
+      postInstall: 'Add `import = ["~/.config/alacritty/revealui.toml"]` to your alacritty.toml [general] section.',
+      detect: async () => dirExists(join2(home, ".config", "alacritty"))
+    },
+    {
+      name: "Kitty",
+      sourceFile: "kitty-revealui.conf",
+      destPath: join2(home, ".config", "kitty", "revealui.conf"),
+      postInstall: "Add `include revealui.conf` to your ~/.config/kitty/kitty.conf.",
+      detect: async () => dirExists(join2(home, ".config", "kitty"))
+    }
+  ];
+}
+function getLinuxProfiles(home) {
+  return [
+    {
+      name: "Alacritty",
+      sourceFile: "alacritty-revealui.toml",
+      destPath: join2(home, ".config", "alacritty", "revealui.toml"),
+      postInstall: 'Add `import = ["~/.config/alacritty/revealui.toml"]` to your alacritty.toml [general] section.',
+      detect: async () => dirExists(join2(home, ".config", "alacritty"))
+    },
+    {
+      name: "Kitty",
+      sourceFile: "kitty-revealui.conf",
+      destPath: join2(home, ".config", "kitty", "revealui.conf"),
+      postInstall: "Add `include revealui.conf` to your ~/.config/kitty/kitty.conf.",
+      detect: async () => dirExists(join2(home, ".config", "kitty"))
+    },
+    {
+      name: "GNOME Terminal",
+      sourceFile: "gnome-terminal-revealui.dconf",
+      destPath: join2(home, ".config", "revealui", "gnome-terminal-revealui.dconf"),
+      postInstall: "Import with: dconf load /org/gnome/terminal/legacy/profiles:/ < ~/.config/revealui/gnome-terminal-revealui.dconf",
+      detect: async () => {
+        const gnomeConfigDir = join2(home, ".config", "dconf");
+        return dirExists(gnomeConfigDir);
+      }
+    }
+  ];
+}
+async function findConfigDir() {
+  const monorepoPath = resolve(
+    dirname(new URL(import.meta.url).pathname),
+    "..",
+    "..",
+    "..",
+    "..",
+    "config",
+    "terminal"
+  );
+  if (await dirExists(monorepoPath)) return monorepoPath;
+  const npmPath = resolve(dirname(new URL(import.meta.url).pathname), "..", "config", "terminal");
+  if (await dirExists(npmPath)) return npmPath;
+  return null;
+}
+async function runTerminalInstallCommand(options) {
+  const os2 = platform();
+  const home = homedir2();
+  if (os2 !== "darwin" && os2 !== "linux") {
+    logger13.error(
+      `Unsupported platform: ${os2}. Terminal profiles are available for macOS and Linux.`
+    );
+    if (os2 === "win32") {
+      logger13.info("For Windows Terminal, copy config/terminal/ profiles manually.");
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const profiles = os2 === "darwin" ? getMacProfiles(home) : getLinuxProfiles(home);
+  if (options.list) {
+    if (options.json) {
+      const detected = await Promise.all(
+        profiles.map(async (p) => ({
+          name: p.name,
+          sourceFile: p.sourceFile,
+          destPath: p.destPath,
+          detected: await p.detect()
+        }))
+      );
+      process.stdout.write(`${JSON.stringify({ platform: os2, profiles: detected }, null, 2)}
+`);
+      return;
+    }
+    logger13.header("Available Terminal Profiles");
+    logger13.info(`Platform: ${os2 === "darwin" ? "macOS" : "Linux"}`);
+    for (const profile of profiles) {
+      const detected = await profile.detect();
+      const icon = detected ? "[detected]" : "[not found]";
+      logger13.info(`  ${profile.name} ${icon} \u2014 ${profile.sourceFile}`);
+    }
+    return;
+  }
+  const configDir = await findConfigDir();
+  if (!configDir) {
+    logger13.error("Could not find config/terminal/ directory.");
+    logger13.info(
+      "Run this command from the RevealUI monorepo root, or install via npx create-revealui."
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const sourceFiles = await readdir(configDir);
+  let targetProfiles = profiles;
+  if (options.terminal) {
+    const match = profiles.find((p) => p.name.toLowerCase() === options.terminal?.toLowerCase());
+    if (!match) {
+      logger13.error(`Unknown terminal: ${options.terminal}`);
+      logger13.info(`Available: ${profiles.map((p) => p.name).join(", ")}`);
+      process.exitCode = 1;
+      return;
+    }
+    targetProfiles = [match];
+  }
+  let installed = 0;
+  let skipped = 0;
+  logger13.header("RevealUI Terminal Profile Installer");
+  logger13.info(`Platform: ${os2 === "darwin" ? "macOS" : "Linux"}`);
+  for (const profile of targetProfiles) {
+    const detected = await profile.detect();
+    if (!(detected || options.terminal)) {
+      continue;
+    }
+    if (!detected && options.terminal) {
+      logger13.warn(`${profile.name} not detected, installing anyway (--terminal flag).`);
+    }
+    if (!sourceFiles.includes(profile.sourceFile)) {
+      logger13.warn(`Source file missing: ${profile.sourceFile} \u2014 skipping ${profile.name}`);
+      skipped++;
+      continue;
+    }
+    const sourcePath = join2(configDir, profile.sourceFile);
+    const destPath = profile.destPath;
+    if (await fileExists(destPath)) {
+      if (!options.force) {
+        logger13.warn(`${profile.name}: ${destPath} already exists. Use --force to overwrite.`);
+        skipped++;
+        continue;
+      }
+    }
+    await mkdir(dirname(destPath), { recursive: true });
+    await copyFile(sourcePath, destPath);
+    installed++;
+    logger13.success(`${profile.name}: installed to ${destPath}`);
+    logger13.info(`  ${profile.postInstall}`);
+  }
+  if (installed === 0 && skipped === 0) {
+    logger13.info("No supported terminal emulators detected.");
+    logger13.info(`Supported: ${profiles.map((p) => p.name).join(", ")}`);
+    logger13.info("Use --terminal <name> to install for a specific terminal.");
+  } else if (installed > 0) {
+    logger13.success(
+      `Installed ${installed} profile(s). ${skipped > 0 ? `Skipped ${skipped}.` : ""}`
+    );
+  }
+  if (options.json) {
+    process.stdout.write(`${JSON.stringify({ installed, skipped, platform: os2 }, null, 2)}
+`);
+  }
+}
+async function runTerminalListCommand(options) {
+  await runTerminalInstallCommand({ list: true, json: options.json });
+}
+
 // src/cli.ts
-var logger12 = createLogger12({ prefix: "CLI" });
+var logger14 = createLogger14({ prefix: "CLI" });
 function configureCreateCommand(command, legacyName) {
   command.description("Create a new RevealUI project").argument("[project-name]", "Name of the project").option("-t, --template <name>", "Template to use (basic-blog, e-commerce, portfolio)").option("--skip-git", "Skip git initialization", false).option("--skip-install", "Skip dependency installation", false).option("-y, --yes", "Skip all prompts and use defaults", false).action(async (projectName, options) => {
-    logger12.header(legacyName ? "Create RevealUI Project" : "RevealUI Create");
+    logger14.header(legacyName ? "Create RevealUI Project" : "RevealUI Create");
     await runCreateFlow(projectName, options);
   });
   return command;
@@ -2077,6 +2732,23 @@ function createCli() {
   devProfile.command("show").description("Show the configured default dev profile").option("--json", "Output machine-readable JSON", false).action(async (options) => {
     await runDevProfileShowCommand(options);
   });
+  const auth = program.command("auth").description("Manage npm registry authentication and publish tokens");
+  auth.command("status").description("Show current npm authentication state").option("--json", "Output machine-readable JSON", false).action(async (options) => {
+    await runAuthStatusCommand(options);
+  });
+  auth.command("set-token").description("Store an npm token via RevVault and configure .npmrc").option("--token <value>", "npm token (or set NPM_TOKEN env var)").option("--skip-vault", "Skip RevVault storage", false).option("--skip-npmrc", "Skip .npmrc modification", false).action(async (options) => {
+    await runAuthSetTokenCommand(options);
+  });
+  auth.command("verify").description("Verify the full npm auth chain (env \u2192 RevVault \u2192 .npmrc \u2192 registry)").option("--json", "Output machine-readable JSON", false).action(async (options) => {
+    await runAuthVerifyCommand(options);
+  });
+  const terminal = program.command("terminal").description("Install RevealUI terminal profiles for your terminal emulator");
+  terminal.command("install").description("Detect and install terminal profiles for supported emulators").option("--terminal <name>", "Install for a specific terminal (e.g. iTerm2, Alacritty, Kitty)").option("--force", "Overwrite existing profile files", false).option("--json", "Output machine-readable JSON", false).action(async (options) => {
+    await runTerminalInstallCommand(options);
+  });
+  terminal.command("list").description("List available terminal profiles and detected emulators").option("--json", "Output machine-readable JSON", false).action(async (options) => {
+    await runTerminalListCommand(options);
+  });
   program.command("shell").description("Deprecated alias for `revealui dev shell`").option("--ensure", "Initialize/start the local DB when possible", false).option("--json", "Output machine-readable JSON", false).option("--inside", "Internal flag used after re-entering nix develop", false).action(async (options) => {
     await runDevUpCommand({
       ensure: options.ensure,