@vess-id/vess 0.0.0-dev-20260902121045

package/dist/auth/user-authenticator.js

@@ -0,0 +1,155 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NoopAuthenticator = exports.MacOSAuthenticator = exports.AuthenticationUnavailableError = exports.AuthenticationDeniedError = void 0;
+exports._setExecFileSync = _setExecFileSync;
+exports.createAuthenticator = createAuthenticator;
+const child_process_1 = require("child_process");
+// Indirection for testability — tests can swap this via _setExecFileSync
+let execFileSyncFn = child_process_1.execFileSync;
+/** @internal Test-only: override execFileSync for mocking */
+function _setExecFileSync(fn) {
+    execFileSyncFn = fn;
+}
+// ---------------------------------------------------------------------------
+// Error types
+// ---------------------------------------------------------------------------
+class AuthenticationDeniedError extends Error {
+    constructor(message = 'Authentication denied by user') {
+        super(message);
+        this.name = 'AuthenticationDeniedError';
+    }
+}
+exports.AuthenticationDeniedError = AuthenticationDeniedError;
+class AuthenticationUnavailableError extends Error {
+    constructor(message = 'User authentication is not available on this platform') {
+        super(message);
+        this.name = 'AuthenticationUnavailableError';
+    }
+}
+exports.AuthenticationUnavailableError = AuthenticationUnavailableError;
+// ---------------------------------------------------------------------------
+// MacOSAuthenticator
+// ---------------------------------------------------------------------------
+/**
+ * macOS authenticator with Touch ID → system password fallback.
+ *
+ * 1. If Touch ID hardware is available, uses node-mac-auth (biometric prompt)
+ * 2. If not (Mac mini, old MacBook, lid closed), falls back to osascript
+ *    confirmation dialog (no admin privileges required)
+ *
+ * Security note (Phase 1): Both Touch ID and password dialog serve as UX
+ * gates — they prevent accidental secret exposure by requiring physical
+ * user presence. The authentication and Keychain read are separate
+ * operations. Phase 2 will merge these into a single native call using
+ * Security.framework's kSecAccessControlUserPresence for OS-level protection.
+ */
+class MacOSAuthenticator {
+    async isAvailable() {
+        return true; // macOS always has at least password-based auth
+    }
+    async authenticate(reason) {
+        // Try Touch ID first
+        if (await this.tryTouchId(reason))
+            return;
+        // Fall back to confirmation dialog via osascript
+        this.promptSystemPassword(reason);
+    }
+    async tryTouchId(reason) {
+        try {
+            const mod = await Promise.resolve().then(() => __importStar(require('node-mac-auth')));
+            if (!mod.canPromptTouchID())
+                return false;
+            await mod.promptTouchID({ reason });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    promptSystemPassword(reason) {
+        // osascript presents a native macOS confirmation dialog that cannot be
+        // bypassed by a non-interactive process. The dialog blocks until the user
+        // clicks OK or Cancel. No admin privileges are required — this is purely
+        // a UX gate to confirm user presence.
+        // Using execFileSync with arguments array to prevent shell injection.
+        const script = `display dialog ${JSON.stringify(reason)} ` +
+            `buttons {"Cancel", "OK"} default button "OK" ` +
+            `with title "VESS Authentication" ` +
+            `with icon caution`;
+        try {
+            execFileSyncFn('osascript', ['-e', script], {
+                stdio: ['ignore', 'pipe', 'pipe'],
+                timeout: 120_000, // 2 minute timeout for user response
+            });
+        }
+        catch {
+            throw new AuthenticationDeniedError('System password authentication denied or cancelled');
+        }
+    }
+}
+exports.MacOSAuthenticator = MacOSAuthenticator;
+// ---------------------------------------------------------------------------
+// NoopAuthenticator
+// ---------------------------------------------------------------------------
+/**
+ * Fallback authenticator for platforms without supported authentication.
+ * Always reports unavailable and throws on authenticate().
+ */
+class NoopAuthenticator {
+    async isAvailable() {
+        return false;
+    }
+    async authenticate(_reason) {
+        throw new AuthenticationUnavailableError();
+    }
+}
+exports.NoopAuthenticator = NoopAuthenticator;
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Create a platform-appropriate authenticator.
+ * - macOS: Touch ID with system password fallback
+ * - Others: NoopAuthenticator (restore not available)
+ * @param platform - Override for testing (defaults to process.platform)
+ */
+function createAuthenticator(platform = process.platform) {
+    if (platform === 'darwin') {
+        return new MacOSAuthenticator();
+    }
+    return new NoopAuthenticator();
+}
+//# sourceMappingURL=user-authenticator.js.map

package/dist/auth/user-authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-authenticator.js","sourceRoot":"","sources":["../../src/auth/user-authenticator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMA,4CAEC;AA4HD,kDAKC;AAzID,iDAA6D;AAE7D,yEAAyE;AACzE,IAAI,cAAc,GAAyB,4BAAa,CAAA;AAExD,6DAA6D;AAC7D,SAAgB,gBAAgB,CAAC,EAAwB;IACvD,cAAc,GAAG,EAAE,CAAA;AACrB,CAAC;AAcD,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAa,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAO,GAAG,+BAA+B;QACnD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AALD,8DAKC;AAED,MAAa,8BAA+B,SAAQ,KAAK;IACvD,YAAY,OAAO,GAAG,uDAAuD;QAC3E,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAA;IAC9C,CAAC;CACF;AALD,wEAKC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAa,kBAAkB;IAC7B,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAA,CAAC,gDAAgD;IAC9D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,qBAAqB;QACrB,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAM;QAEzC,iDAAiD;QACjD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAc;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,wDAAa,eAAe,GAAC,CAAA;YACzC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE;gBAAE,OAAO,KAAK,CAAA;YACzC,MAAM,GAAG,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;YACnC,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,MAAc;QACzC,uEAAuE;QACvE,0EAA0E;QAC1E,yEAAyE;QACzE,sCAAsC;QACtC,sEAAsE;QACtE,MAAM,MAAM,GACV,kBAAkB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG;YAC3C,+CAA+C;YAC/C,mCAAmC;YACnC,mBAAmB,CAAA;QAErB,IAAI,CAAC;YACH,cAAc,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;gBAC1C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,OAAO,EAAE,OAAO,EAAE,qCAAqC;aACxD,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,yBAAyB,CAAC,oDAAoD,CAAC,CAAA;QAC3F,CAAC;IACH,CAAC;CACF;AA7CD,gDA6CC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;GAGG;AACH,MAAa,iBAAiB;IAC5B,KAAK,CAAC,WAAW;QACf,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,MAAM,IAAI,8BAA8B,EAAE,CAAA;IAC5C,CAAC;CACF;AARD,8CAQC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,WAAmB,OAAO,CAAC,QAAQ;IACrE,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,IAAI,kBAAkB,EAAE,CAAA;IACjC,CAAC;IACD,OAAO,IAAI,iBAAiB,EAAE,CAAA;AAChC,CAAC"}

package/dist/bootstrap/sdk-precheck.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Runtime guard: verifies that the installed @vess-id/ai-identity exports every
+ * symbol agentd depends on at runtime. If any are missing (e.g. the published
+ * agentd was pinned to a stale SDK that lacked these exports), abort startup
+ * with an actionable error message instead of failing later with a cryptic
+ * `(0, ai_identity_1.foo) is not a function`.
+ */
+export declare function runSdkPrecheck(): void;
+//# sourceMappingURL=sdk-precheck.d.ts.map

package/dist/bootstrap/sdk-precheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-precheck.d.ts","sourceRoot":"","sources":["../../src/bootstrap/sdk-precheck.ts"],"names":[],"mappings":"AAIA;;;;;;GAMG;AACH,wBAAgB,cAAc,IAAI,IAAI,CA8CrC"}

package/dist/bootstrap/sdk-precheck.js

@@ -0,0 +1,103 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSdkPrecheck = runSdkPrecheck;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const sdk = __importStar(require("@vess-id/ai-identity"));
+/**
+ * Runtime guard: verifies that the installed @vess-id/ai-identity exports every
+ * symbol agentd depends on at runtime. If any are missing (e.g. the published
+ * agentd was pinned to a stale SDK that lacked these exports), abort startup
+ * with an actionable error message instead of failing later with a cryptic
+ * `(0, ai_identity_1.foo) is not a function`.
+ */
+function runSdkPrecheck() {
+    const symbolsPath = path.join(__dirname, '..', '..', 'required-sdk-symbols.json');
+    let required;
+    try {
+        required = JSON.parse(fs.readFileSync(symbolsPath, 'utf8'));
+    }
+    catch (err) {
+        // Reachable only when the published tarball is missing the JSON or it
+        // is malformed — both indicate a packaging defect, not a user error.
+        process.stderr.write([
+            'vess: failed to load required-sdk-symbols.json (packaging defect).',
+            `  path: ${symbolsPath}`,
+            `  reason: ${err.message}`,
+            '',
+            'Please re-install @vess-id/vess. If the error persists,',
+            'file an issue at https://github.com/cvoxelprotocol/aidentity/issues.',
+            '',
+        ].join('\n'));
+        process.exit(1);
+        return;
+    }
+    const mod = sdk;
+    const missing = required.filter((name) => !(name in mod) || typeof mod[name] === 'undefined');
+    if (missing.length === 0)
+        return;
+    const sdkVersion = readVersion('@vess-id/ai-identity/package.json');
+    const cliVersion = readVersion(path.join(__dirname, '..', '..', 'package.json'));
+    const lines = [
+        'vess: incompatible @vess-id/ai-identity installation.',
+        '',
+        `The installed @vess-id/ai-identity@${sdkVersion} is missing required exports:`,
+        ...missing.map((n) => `  - ${n}`),
+        '',
+        'This means @vess-id/vess was published with a stale SDK pin. Please update:',
+        '  npm install -g @vess-id/vess@latest',
+        '',
+        'If this persists, file an issue at https://github.com/cvoxelprotocol/aidentity/issues',
+        'referencing your installed versions:',
+        `  - vess CLI:             ${cliVersion}`,
+        `  - @vess-id/ai-identity: ${sdkVersion}`,
+        '',
+    ];
+    process.stderr.write(lines.join('\n'));
+    process.exit(1);
+}
+function readVersion(specifierOrPath) {
+    try {
+        // require() handles both package specifiers (resolved via node_modules)
+        // and absolute filesystem paths (e.g. agentd's own package.json).
+        const pkg = require(specifierOrPath);
+        return pkg.version ?? 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+//# sourceMappingURL=sdk-precheck.js.map

package/dist/bootstrap/sdk-precheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-precheck.js","sourceRoot":"","sources":["../../src/bootstrap/sdk-precheck.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,wCA8CC;AAzDD,4CAA6B;AAC7B,gDAAiC;AACjC,0DAA2C;AAE3C;;;;;;GAMG;AACH,SAAgB,cAAc;IAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,2BAA2B,CAAC,CAAA;IACjF,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,qEAAqE;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;YACE,oEAAoE;YACpE,WAAW,WAAW,EAAE;YACxB,aAAc,GAAa,CAAC,OAAO,EAAE;YACrC,EAAE;YACF,yDAAyD;YACzD,sEAAsE;YACtE,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAA;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACf,OAAM;IACR,CAAC;IACD,MAAM,GAAG,GAAG,GAAyC,CAAA;IACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC,CAAA;IAC7F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEhC,MAAM,UAAU,GAAG,WAAW,CAAC,mCAAmC,CAAC,CAAA;IACnE,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAA;IAEhF,MAAM,KAAK,GAAG;QACZ,uDAAuD;QACvD,EAAE;QACF,sCAAsC,UAAU,+BAA+B;QAC/E,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,EAAE;QACF,6EAA6E;QAC7E,uCAAuC;QACvC,EAAE;QACF,uFAAuF;QACvF,sCAAsC;QACtC,6BAA6B,UAAU,EAAE;QACzC,6BAA6B,UAAU,EAAE;QACzC,EAAE;KACH,CAAA;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,eAAuB;IAC1C,IAAI,CAAC;QACH,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,CAAyB,CAAA;QAC5D,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC"}

package/dist/cli/claude-config-path.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Resolve the path to Claude Code's `.claude.json` configuration file.
+ *
+ * Claude Code reads its config from `$CLAUDE_CONFIG_DIR/.claude.json` when the
+ * `CLAUDE_CONFIG_DIR` environment variable is set (used for multi-profile setups
+ * such as switching between personal and work accounts). When the variable is
+ * unset or empty, Claude Code falls back to `~/.claude.json`.
+ *
+ * Hardcoding `os.homedir()` here previously caused `vess mcp register` (and the
+ * companion uninstall/doctor commands) to silently target the wrong file when
+ * the user had `CLAUDE_CONFIG_DIR` exported. The MCP entry was written but
+ * Claude Code never read it back. (AIDENTITY-33)
+ *
+ * @returns Absolute path to the `.claude.json` file Claude Code is configured to use.
+ */
+export declare function getClaudeConfigPath(): string;
+//# sourceMappingURL=claude-config-path.d.ts.map

package/dist/cli/claude-config-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-config-path.d.ts","sourceRoot":"","sources":["../../src/cli/claude-config-path.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAI5C"}

package/dist/cli/claude-config-path.js

@@ -0,0 +1,59 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getClaudeConfigPath = getClaudeConfigPath;
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * Resolve the path to Claude Code's `.claude.json` configuration file.
+ *
+ * Claude Code reads its config from `$CLAUDE_CONFIG_DIR/.claude.json` when the
+ * `CLAUDE_CONFIG_DIR` environment variable is set (used for multi-profile setups
+ * such as switching between personal and work accounts). When the variable is
+ * unset or empty, Claude Code falls back to `~/.claude.json`.
+ *
+ * Hardcoding `os.homedir()` here previously caused `vess mcp register` (and the
+ * companion uninstall/doctor commands) to silently target the wrong file when
+ * the user had `CLAUDE_CONFIG_DIR` exported. The MCP entry was written but
+ * Claude Code never read it back. (AIDENTITY-33)
+ *
+ * @returns Absolute path to the `.claude.json` file Claude Code is configured to use.
+ */
+function getClaudeConfigPath() {
+    const configDir = process.env.CLAUDE_CONFIG_DIR?.trim();
+    const baseDir = configDir && configDir.length > 0 ? configDir : os.homedir();
+    return path.join(baseDir, '.claude.json');
+}
+//# sourceMappingURL=claude-config-path.js.map

package/dist/cli/claude-config-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-config-path.js","sourceRoot":"","sources":["../../src/cli/claude-config-path.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,kDAIC;AAtBD,uCAAwB;AACxB,2CAA4B;AAE5B;;;;;;;;;;;;;;GAcG;AACH,SAAgB,mBAAmB;IACjC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAA;IACvD,MAAM,OAAO,GAAG,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAA;IAC5E,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;AAC3C,CAAC"}

package/dist/cli/cli-db.d.ts

@@ -0,0 +1,12 @@
+import { EnvProfileStore } from '../env/env-profile-store';
+import type Database from 'better-sqlite3';
+export interface ProfileStoreContext {
+    db: Database.Database;
+    profileStore: EnvProfileStore;
+}
+/**
+ * Open the profile store database with standard initialization.
+ * Returns null if VESS is not initialized (ensureInitialized fails).
+ */
+export declare function openProfileStore(command: string): ProfileStoreContext | null;
+//# sourceMappingURL=cli-db.d.ts.map

package/dist/cli/cli-db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-db.d.ts","sourceRoot":"","sources":["../../src/cli/cli-db.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAE1D,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAE1C,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAA;IACrB,YAAY,EAAE,eAAe,CAAA;CAC9B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAM5E"}

package/dist/cli/cli-db.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openProfileStore = openProfileStore;
+const paths_1 = require("../config/paths");
+const sqlite_1 = require("../wallet/sqlite");
+const env_profile_store_1 = require("../env/env-profile-store");
+const init_guard_1 = require("./init-guard");
+/**
+ * Open the profile store database with standard initialization.
+ * Returns null if VESS is not initialized (ensureInitialized fails).
+ */
+function openProfileStore(command) {
+    const paths = new paths_1.VessPaths();
+    if (!(0, init_guard_1.ensureInitialized)(paths, command))
+        return null;
+    const db = (0, sqlite_1.openDatabase)(paths.walletDb);
+    (0, sqlite_1.initSchema)(db);
+    return { db, profileStore: new env_profile_store_1.EnvProfileStore(db) };
+}
+//# sourceMappingURL=cli-db.js.map

package/dist/cli/cli-db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-db.js","sourceRoot":"","sources":["../../src/cli/cli-db.ts"],"names":[],"mappings":";;AAeA,4CAMC;AArBD,2CAA2C;AAC3C,6CAA2D;AAC3D,gEAA0D;AAC1D,6CAAgD;AAQhD;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,OAAe;IAC9C,MAAM,KAAK,GAAG,IAAI,iBAAS,EAAE,CAAA;IAC7B,IAAI,CAAC,IAAA,8BAAiB,EAAC,KAAK,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACnD,MAAM,EAAE,GAAG,IAAA,qBAAY,EAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACvC,IAAA,mBAAU,EAAC,EAAE,CAAC,CAAA;IACd,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,mCAAe,CAAC,EAAE,CAAC,EAAE,CAAA;AACtD,CAAC"}

package/dist/cli/cli-utils.d.ts

@@ -0,0 +1,14 @@
+import * as readline from 'node:readline/promises';
+/** Log to stderr (used by all CLI commands) */
+export declare function log(msg: string): void;
+/** Open a URL in the default browser (fire-and-forget). Only http(s) URLs are allowed. */
+export declare function openBrowser(url: string): void;
+/**
+ * If running in a TTY, listen for a single Enter keypress and open the
+ * given URL in the default browser.  Returns a cleanup function that
+ * removes the listener, or `undefined` when not in a TTY.
+ */
+export declare function promptEnterToOpenBrowser(url: string): (() => void) | undefined;
+/** Prompt yes/no with default yes. Returns false on 'n', EOF, or error. */
+export declare function promptYesNo(rl: readline.Interface, question: string): Promise<boolean>;
+//# sourceMappingURL=cli-utils.d.ts.map

package/dist/cli/cli-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-utils.d.ts","sourceRoot":"","sources":["../../src/cli/cli-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAA;AAGlD,+CAA+C;AAC/C,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAErC;AAED,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAQ7C;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAoB9E;AAED,2EAA2E;AAC3E,wBAAsB,WAAW,CAC/B,EAAE,EAAE,QAAQ,CAAC,SAAS,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAOlB"}

package/dist/cli/cli-utils.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.log = log;
+exports.openBrowser = openBrowser;
+exports.promptEnterToOpenBrowser = promptEnterToOpenBrowser;
+exports.promptYesNo = promptYesNo;
+const node_child_process_1 = require("node:child_process");
+/** Log to stderr (used by all CLI commands) */
+function log(msg) {
+    process.stderr.write(`${msg}\n`);
+}
+/** Open a URL in the default browser (fire-and-forget). Only http(s) URLs are allowed. */
+function openBrowser(url) {
+    if (!/^https?:\/\//i.test(url))
+        return;
+    if (process.platform === 'win32') {
+        (0, node_child_process_1.execFile)('cmd', ['/c', 'start', '', url], () => { });
+    }
+    else {
+        const cmd = process.platform === 'darwin' ? 'open' : 'xdg-open';
+        (0, node_child_process_1.execFile)(cmd, [url], () => { });
+    }
+}
+/**
+ * If running in a TTY, listen for a single Enter keypress and open the
+ * given URL in the default browser.  Returns a cleanup function that
+ * removes the listener, or `undefined` when not in a TTY.
+ */
+function promptEnterToOpenBrowser(url) {
+    if (!process.stdin.isTTY)
+        return undefined;
+    log('Press Enter to open in browser (or copy the URL above)');
+    const wasPaused = process.stdin.isPaused();
+    process.stdin.resume();
+    const onData = () => {
+        openBrowser(url);
+        cleanup();
+    };
+    const cleanup = () => {
+        process.stdin.removeListener('data', onData);
+        if (wasPaused)
+            process.stdin.pause();
+    };
+    process.stdin.once('data', onData);
+    return cleanup;
+}
+/** Prompt yes/no with default yes. Returns false on 'n', EOF, or error. */
+async function promptYesNo(rl, question) {
+    try {
+        const answer = await rl.question(`${question} (Y/n): `);
+        return answer.trim().toLowerCase() !== 'n';
+    }
+    catch {
+        return false; // EOF or error — treat as decline
+    }
+}
+//# sourceMappingURL=cli-utils.js.map

package/dist/cli/cli-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-utils.js","sourceRoot":"","sources":["../../src/cli/cli-utils.ts"],"names":[],"mappings":";;AAIA,kBAEC;AAGD,kCAQC;AAOD,4DAoBC;AAGD,kCAUC;AAxDD,2DAA6C;AAE7C,+CAA+C;AAC/C,SAAgB,GAAG,CAAC,GAAW;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAA;AAClC,CAAC;AAED,0FAA0F;AAC1F,SAAgB,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAM;IACtC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAA,6BAAQ,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACrD,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;QAC/D,IAAA,6BAAQ,EAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,wBAAwB,CAAC,GAAW;IAClD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAE1C,GAAG,CAAC,wDAAwD,CAAC,CAAA;IAE7D,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAA;IAC1C,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;IAEtB,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,WAAW,CAAC,GAAG,CAAC,CAAA;QAChB,OAAO,EAAE,CAAA;IACX,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC5C,IAAI,SAAS;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IACtC,CAAC,CAAA;IAED,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,2EAA2E;AACpE,KAAK,UAAU,WAAW,CAC/B,EAAsB,EACtB,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,UAAU,CAAC,CAAA;QACvD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA,CAAC,kCAAkC;IACjD,CAAC;AACH,CAAC"}

package/dist/cli/daemon-utils.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Write PID to file. Creates parent directories if needed.
+ */
+export declare function writePidFile(filePath: string, pid: number): void;
+/**
+ * Read PID from file. Returns null if file doesn't exist or contains invalid data.
+ */
+export declare function readPidFile(filePath: string): number | null;
+/**
+ * Write port number to file. Creates parent directories if needed.
+ */
+export declare function writePortFile(filePath: string, port: number): void;
+/**
+ * Read port from file. Returns null if file doesn't exist or contains invalid data.
+ */
+export declare function readPortFile(filePath: string): number | null;
+/**
+ * Remove PID file. No-op if file doesn't exist.
+ */
+export declare function removePidFile(filePath: string): void;
+/**
+ * Remove port file. No-op if file doesn't exist.
+ */
+export declare function removePortFile(filePath: string): void;
+/**
+ * Check if a process with the given PID is running.
+ * Uses kill(pid, 0) which checks existence without sending a signal.
+ */
+export declare function isDaemonRunning(pid: number): boolean;
+//# sourceMappingURL=daemon-utils.d.ts.map

package/dist/cli/daemon-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-utils.d.ts","sourceRoot":"","sources":["../../src/cli/daemon-utils.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAMhE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ3D;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAMlE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ5D;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAMpD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAMrD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAQpD"}

package/dist/cli/daemon-utils.js

@@ -0,0 +1,131 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writePidFile = writePidFile;
+exports.readPidFile = readPidFile;
+exports.writePortFile = writePortFile;
+exports.readPortFile = readPortFile;
+exports.removePidFile = removePidFile;
+exports.removePortFile = removePortFile;
+exports.isDaemonRunning = isDaemonRunning;
+/**
+ * Daemon utility functions for PID/port file management.
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+/**
+ * Write PID to file. Creates parent directories if needed.
+ */
+function writePidFile(filePath, pid) {
+    const dir = path.dirname(filePath);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    fs.writeFileSync(filePath, String(pid), { encoding: 'utf-8', mode: 0o600 });
+}
+/**
+ * Read PID from file. Returns null if file doesn't exist or contains invalid data.
+ */
+function readPidFile(filePath) {
+    try {
+        const content = fs.readFileSync(filePath, 'utf-8').trim();
+        const pid = parseInt(content, 10);
+        return Number.isFinite(pid) && pid > 0 ? pid : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write port number to file. Creates parent directories if needed.
+ */
+function writePortFile(filePath, port) {
+    const dir = path.dirname(filePath);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    fs.writeFileSync(filePath, String(port), { encoding: 'utf-8', mode: 0o600 });
+}
+/**
+ * Read port from file. Returns null if file doesn't exist or contains invalid data.
+ */
+function readPortFile(filePath) {
+    try {
+        const content = fs.readFileSync(filePath, 'utf-8').trim();
+        const port = parseInt(content, 10);
+        return Number.isFinite(port) && port > 0 ? port : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Remove PID file. No-op if file doesn't exist.
+ */
+function removePidFile(filePath) {
+    try {
+        fs.unlinkSync(filePath);
+    }
+    catch {
+        // Ignore errors (file may not exist)
+    }
+}
+/**
+ * Remove port file. No-op if file doesn't exist.
+ */
+function removePortFile(filePath) {
+    try {
+        fs.unlinkSync(filePath);
+    }
+    catch {
+        // Ignore errors (file may not exist)
+    }
+}
+/**
+ * Check if a process with the given PID is running.
+ * Uses kill(pid, 0) which checks existence without sending a signal.
+ */
+function isDaemonRunning(pid) {
+    if (pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=daemon-utils.js.map