@vess-id/vess 0.2.0-alpha.1

package/dist/audit/audit-sync.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditSync = void 0;
+const audit_dto_mapper_1 = require("./audit-dto-mapper");
+/**
+ * Async batch sync of audit events to Gateway (spec §9.2).
+ *
+ * Transforms agentd's AuditEntry format into the API's CreateAuditEventDto
+ * format before sending.
+ */
+/** Default batch size for audit sync */
+const AUDIT_SYNC_DEFAULT_BATCH_SIZE = 100;
+class AuditSync {
+    auditLogger;
+    gatewayUrl;
+    sessionToken;
+    constructor(auditLogger, gatewayUrl, sessionToken) {
+        this.auditLogger = auditLogger;
+        this.gatewayUrl = gatewayUrl;
+        this.sessionToken = sessionToken;
+    }
+    async syncPendingEvents(batchSize = AUDIT_SYNC_DEFAULT_BATCH_SIZE) {
+        const pending = this.auditLogger.getPendingEvents(batchSize);
+        if (pending.length === 0) {
+            return { synced: 0, failed: 0 };
+        }
+        // Filter out gateway-executed events — they are already recorded server-side
+        const gatewayEvents = pending.filter(e => e.executionType === 'gateway');
+        const localEvents = pending.filter(e => e.executionType !== 'gateway');
+        // Mark gateway events as synced immediately to prevent re-processing
+        if (gatewayEvents.length > 0) {
+            this.auditLogger.markSynced(gatewayEvents.map(e => e.id));
+            console.info(`[AuditSync] Skipped ${gatewayEvents.length} gateway-executed event(s) (already recorded server-side)`);
+        }
+        if (localEvents.length === 0) {
+            return { synced: 0, failed: 0 };
+        }
+        const events = localEvents.map(e => (0, audit_dto_mapper_1.auditEntryToApiDto)(e));
+        try {
+            const response = await fetch(`${this.gatewayUrl}/api/v1/audit/batch`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-Device-Session-Token': this.sessionToken,
+                },
+                body: JSON.stringify({ events }),
+                signal: AbortSignal.timeout(10000),
+            });
+            if (!response.ok) {
+                const body = await response.text().catch(() => '');
+                console.warn(`[AuditSync] Audit sync failed: ${response.status} - ${body}`);
+                return { synced: 0, failed: localEvents.length };
+            }
+            const ids = localEvents.map(e => e.id);
+            this.auditLogger.markSynced(ids);
+            return { synced: localEvents.length, failed: 0 };
+        }
+        catch (err) {
+            console.warn(`[AuditSync] Audit sync network error: ${err instanceof Error ? err.message : String(err)}`);
+            return { synced: 0, failed: localEvents.length };
+        }
+    }
+}
+exports.AuditSync = AuditSync;
+//# sourceMappingURL=audit-sync.js.map

package/dist/audit/audit-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-sync.js","sourceRoot":"","sources":["../../src/audit/audit-sync.ts"],"names":[],"mappings":";;;AACA,yDAAuD;AAEvD;;;;;GAKG;AACH,wCAAwC;AACxC,MAAM,6BAA6B,GAAG,GAAG,CAAA;AAEzC,MAAa,SAAS;IAED;IACA;IACA;IAHnB,YACmB,WAAwB,EACxB,UAAkB,EAClB,YAAoB;QAFpB,gBAAW,GAAX,WAAW,CAAa;QACxB,eAAU,GAAV,UAAU,CAAQ;QAClB,iBAAY,GAAZ,YAAY,CAAQ;IACpC,CAAC;IAEJ,KAAK,CAAC,iBAAiB,CAAC,YAAoB,6BAA6B;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAA;QAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;QACjC,CAAC;QAED,6EAA6E;QAC7E,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAA;QACxE,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAA;QAEtE,qEAAqE;QACrE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAG,CAAC,CAAC,CAAA;YAC1D,OAAO,CAAC,IAAI,CAAC,uBAAuB,aAAa,CAAC,MAAM,2DAA2D,CAAC,CAAA;QACtH,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;QACjC,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAA,qCAAkB,EAAC,CAAC,CAAC,CAAC,CAAA;QAE1D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,qBAAqB,EAAE;gBACpE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,wBAAwB,EAAE,IAAI,CAAC,YAAY;iBAC5C;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;gBAChC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACnC,CAAC,CAAA;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;gBAClD,OAAO,CAAC,IAAI,CAAC,kCAAkC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;gBAC3E,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAA;YAClD,CAAC;YAED,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAG,CAAC,CAAA;YACvC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAChC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,yCAAyC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACzG,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAA;QAClD,CAAC;IACH,CAAC;CACF;AAtDD,8BAsDC"}

package/dist/auth/user-authenticator.d.ts

@@ -0,0 +1,51 @@
+import { execFileSync as _execFileSync } from 'child_process';
+/** @internal Test-only: override execFileSync for mocking */
+export declare function _setExecFileSync(fn: typeof _execFileSync): void;
+/** Platform-agnostic user-authentication contract. */
+export interface UserAuthenticator {
+    /** Check if authentication is available on this platform */
+    isAvailable(): Promise<boolean>;
+    /** Request user authentication. Throws if denied or unavailable. */
+    authenticate(reason: string): Promise<void>;
+}
+export declare class AuthenticationDeniedError extends Error {
+    constructor(message?: string);
+}
+export declare class AuthenticationUnavailableError extends Error {
+    constructor(message?: string);
+}
+/**
+ * macOS authenticator with Touch ID → system password fallback.
+ *
+ * 1. If Touch ID hardware is available, uses node-mac-auth (biometric prompt)
+ * 2. If not (Mac mini, old MacBook, lid closed), falls back to osascript
+ *    confirmation dialog (no admin privileges required)
+ *
+ * Security note (Phase 1): Both Touch ID and password dialog serve as UX
+ * gates — they prevent accidental secret exposure by requiring physical
+ * user presence. The authentication and Keychain read are separate
+ * operations. Phase 2 will merge these into a single native call using
+ * Security.framework's kSecAccessControlUserPresence for OS-level protection.
+ */
+export declare class MacOSAuthenticator implements UserAuthenticator {
+    isAvailable(): Promise<boolean>;
+    authenticate(reason: string): Promise<void>;
+    private tryTouchId;
+    private promptSystemPassword;
+}
+/**
+ * Fallback authenticator for platforms without supported authentication.
+ * Always reports unavailable and throws on authenticate().
+ */
+export declare class NoopAuthenticator implements UserAuthenticator {
+    isAvailable(): Promise<boolean>;
+    authenticate(_reason: string): Promise<void>;
+}
+/**
+ * Create a platform-appropriate authenticator.
+ * - macOS: Touch ID with system password fallback
+ * - Others: NoopAuthenticator (restore not available)
+ * @param platform - Override for testing (defaults to process.platform)
+ */
+export declare function createAuthenticator(platform?: string): UserAuthenticator;
+//# sourceMappingURL=user-authenticator.d.ts.map

package/dist/auth/user-authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-authenticator.d.ts","sourceRoot":"","sources":["../../src/auth/user-authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,eAAe,CAAA;AAK7D,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,OAAO,aAAa,GAAG,IAAI,CAE/D;AAMD,sDAAsD;AACtD,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/B,oEAAoE;IACpE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5C;AAMD,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,SAAkC;CAItD;AAED,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,OAAO,SAA0D;CAI9E;AAMD;;;;;;;;;;;;GAYG;AACH,qBAAa,kBAAmB,YAAW,iBAAiB;IACpD,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAQnC,UAAU;IAWxB,OAAO,CAAC,oBAAoB;CAqB7B;AAMD;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,iBAAiB;IACnD,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGnD;AAMD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,GAAE,MAAyB,GAAG,iBAAiB,CAK1F"}

package/dist/auth/user-authenticator.js

@@ -0,0 +1,155 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NoopAuthenticator = exports.MacOSAuthenticator = exports.AuthenticationUnavailableError = exports.AuthenticationDeniedError = void 0;
+exports._setExecFileSync = _setExecFileSync;
+exports.createAuthenticator = createAuthenticator;
+const child_process_1 = require("child_process");
+// Indirection for testability — tests can swap this via _setExecFileSync
+let execFileSyncFn = child_process_1.execFileSync;
+/** @internal Test-only: override execFileSync for mocking */
+function _setExecFileSync(fn) {
+    execFileSyncFn = fn;
+}
+// ---------------------------------------------------------------------------
+// Error types
+// ---------------------------------------------------------------------------
+class AuthenticationDeniedError extends Error {
+    constructor(message = 'Authentication denied by user') {
+        super(message);
+        this.name = 'AuthenticationDeniedError';
+    }
+}
+exports.AuthenticationDeniedError = AuthenticationDeniedError;
+class AuthenticationUnavailableError extends Error {
+    constructor(message = 'User authentication is not available on this platform') {
+        super(message);
+        this.name = 'AuthenticationUnavailableError';
+    }
+}
+exports.AuthenticationUnavailableError = AuthenticationUnavailableError;
+// ---------------------------------------------------------------------------
+// MacOSAuthenticator
+// ---------------------------------------------------------------------------
+/**
+ * macOS authenticator with Touch ID → system password fallback.
+ *
+ * 1. If Touch ID hardware is available, uses node-mac-auth (biometric prompt)
+ * 2. If not (Mac mini, old MacBook, lid closed), falls back to osascript
+ *    confirmation dialog (no admin privileges required)
+ *
+ * Security note (Phase 1): Both Touch ID and password dialog serve as UX
+ * gates — they prevent accidental secret exposure by requiring physical
+ * user presence. The authentication and Keychain read are separate
+ * operations. Phase 2 will merge these into a single native call using
+ * Security.framework's kSecAccessControlUserPresence for OS-level protection.
+ */
+class MacOSAuthenticator {
+    async isAvailable() {
+        return true; // macOS always has at least password-based auth
+    }
+    async authenticate(reason) {
+        // Try Touch ID first
+        if (await this.tryTouchId(reason))
+            return;
+        // Fall back to confirmation dialog via osascript
+        this.promptSystemPassword(reason);
+    }
+    async tryTouchId(reason) {
+        try {
+            const mod = await Promise.resolve().then(() => __importStar(require('node-mac-auth')));
+            if (!mod.canPromptTouchID())
+                return false;
+            await mod.promptTouchID({ reason });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    promptSystemPassword(reason) {
+        // osascript presents a native macOS confirmation dialog that cannot be
+        // bypassed by a non-interactive process. The dialog blocks until the user
+        // clicks OK or Cancel. No admin privileges are required — this is purely
+        // a UX gate to confirm user presence.
+        // Using execFileSync with arguments array to prevent shell injection.
+        const script = `display dialog ${JSON.stringify(reason)} ` +
+            `buttons {"Cancel", "OK"} default button "OK" ` +
+            `with title "VESS Authentication" ` +
+            `with icon caution`;
+        try {
+            execFileSyncFn('osascript', ['-e', script], {
+                stdio: ['ignore', 'pipe', 'pipe'],
+                timeout: 120_000, // 2 minute timeout for user response
+            });
+        }
+        catch {
+            throw new AuthenticationDeniedError('System password authentication denied or cancelled');
+        }
+    }
+}
+exports.MacOSAuthenticator = MacOSAuthenticator;
+// ---------------------------------------------------------------------------
+// NoopAuthenticator
+// ---------------------------------------------------------------------------
+/**
+ * Fallback authenticator for platforms without supported authentication.
+ * Always reports unavailable and throws on authenticate().
+ */
+class NoopAuthenticator {
+    async isAvailable() {
+        return false;
+    }
+    async authenticate(_reason) {
+        throw new AuthenticationUnavailableError();
+    }
+}
+exports.NoopAuthenticator = NoopAuthenticator;
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Create a platform-appropriate authenticator.
+ * - macOS: Touch ID with system password fallback
+ * - Others: NoopAuthenticator (restore not available)
+ * @param platform - Override for testing (defaults to process.platform)
+ */
+function createAuthenticator(platform = process.platform) {
+    if (platform === 'darwin') {
+        return new MacOSAuthenticator();
+    }
+    return new NoopAuthenticator();
+}
+//# sourceMappingURL=user-authenticator.js.map

package/dist/auth/user-authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-authenticator.js","sourceRoot":"","sources":["../../src/auth/user-authenticator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMA,4CAEC;AA4HD,kDAKC;AAzID,iDAA6D;AAE7D,yEAAyE;AACzE,IAAI,cAAc,GAAyB,4BAAa,CAAA;AAExD,6DAA6D;AAC7D,SAAgB,gBAAgB,CAAC,EAAwB;IACvD,cAAc,GAAG,EAAE,CAAA;AACrB,CAAC;AAcD,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAa,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAO,GAAG,+BAA+B;QACnD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AALD,8DAKC;AAED,MAAa,8BAA+B,SAAQ,KAAK;IACvD,YAAY,OAAO,GAAG,uDAAuD;QAC3E,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAA;IAC9C,CAAC;CACF;AALD,wEAKC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAa,kBAAkB;IAC7B,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAA,CAAC,gDAAgD;IAC9D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,qBAAqB;QACrB,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAM;QAEzC,iDAAiD;QACjD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAc;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,wDAAa,eAAe,GAAC,CAAA;YACzC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE;gBAAE,OAAO,KAAK,CAAA;YACzC,MAAM,GAAG,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;YACnC,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,MAAc;QACzC,uEAAuE;QACvE,0EAA0E;QAC1E,yEAAyE;QACzE,sCAAsC;QACtC,sEAAsE;QACtE,MAAM,MAAM,GACV,kBAAkB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG;YAC3C,+CAA+C;YAC/C,mCAAmC;YACnC,mBAAmB,CAAA;QAErB,IAAI,CAAC;YACH,cAAc,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;gBAC1C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,OAAO,EAAE,OAAO,EAAE,qCAAqC;aACxD,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,yBAAyB,CAAC,oDAAoD,CAAC,CAAA;QAC3F,CAAC;IACH,CAAC;CACF;AA7CD,gDA6CC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;GAGG;AACH,MAAa,iBAAiB;IAC5B,KAAK,CAAC,WAAW;QACf,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,MAAM,IAAI,8BAA8B,EAAE,CAAA;IAC5C,CAAC;CACF;AARD,8CAQC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,WAAmB,OAAO,CAAC,QAAQ;IACrE,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,IAAI,kBAAkB,EAAE,CAAA;IACjC,CAAC;IACD,OAAO,IAAI,iBAAiB,EAAE,CAAA;AAChC,CAAC"}

package/dist/cli/cli-db.d.ts

@@ -0,0 +1,12 @@
+import { EnvProfileStore } from '../env/env-profile-store';
+import type Database from 'better-sqlite3';
+export interface ProfileStoreContext {
+    db: Database.Database;
+    profileStore: EnvProfileStore;
+}
+/**
+ * Open the profile store database with standard initialization.
+ * Returns null if VESS is not initialized (ensureInitialized fails).
+ */
+export declare function openProfileStore(command: string): ProfileStoreContext | null;
+//# sourceMappingURL=cli-db.d.ts.map

package/dist/cli/cli-db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-db.d.ts","sourceRoot":"","sources":["../../src/cli/cli-db.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAE1D,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAE1C,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAA;IACrB,YAAY,EAAE,eAAe,CAAA;CAC9B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAM5E"}

package/dist/cli/cli-db.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openProfileStore = openProfileStore;
+const paths_1 = require("../config/paths");
+const sqlite_1 = require("../wallet/sqlite");
+const env_profile_store_1 = require("../env/env-profile-store");
+const init_guard_1 = require("./init-guard");
+/**
+ * Open the profile store database with standard initialization.
+ * Returns null if VESS is not initialized (ensureInitialized fails).
+ */
+function openProfileStore(command) {
+    const paths = new paths_1.VessPaths();
+    if (!(0, init_guard_1.ensureInitialized)(paths, command))
+        return null;
+    const db = (0, sqlite_1.openDatabase)(paths.walletDb);
+    (0, sqlite_1.initSchema)(db);
+    return { db, profileStore: new env_profile_store_1.EnvProfileStore(db) };
+}
+//# sourceMappingURL=cli-db.js.map

package/dist/cli/cli-db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-db.js","sourceRoot":"","sources":["../../src/cli/cli-db.ts"],"names":[],"mappings":";;AAeA,4CAMC;AArBD,2CAA2C;AAC3C,6CAA2D;AAC3D,gEAA0D;AAC1D,6CAAgD;AAQhD;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,OAAe;IAC9C,MAAM,KAAK,GAAG,IAAI,iBAAS,EAAE,CAAA;IAC7B,IAAI,CAAC,IAAA,8BAAiB,EAAC,KAAK,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACnD,MAAM,EAAE,GAAG,IAAA,qBAAY,EAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACvC,IAAA,mBAAU,EAAC,EAAE,CAAC,CAAA;IACd,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,mCAAe,CAAC,EAAE,CAAC,EAAE,CAAA;AACtD,CAAC"}

package/dist/cli/cli-utils.d.ts

@@ -0,0 +1,14 @@
+import * as readline from 'node:readline/promises';
+/** Log to stderr (used by all CLI commands) */
+export declare function log(msg: string): void;
+/** Open a URL in the default browser (fire-and-forget). Only http(s) URLs are allowed. */
+export declare function openBrowser(url: string): void;
+/**
+ * If running in a TTY, listen for a single Enter keypress and open the
+ * given URL in the default browser.  Returns a cleanup function that
+ * removes the listener, or `undefined` when not in a TTY.
+ */
+export declare function promptEnterToOpenBrowser(url: string): (() => void) | undefined;
+/** Prompt yes/no with default yes. Returns false on 'n', EOF, or error. */
+export declare function promptYesNo(rl: readline.Interface, question: string): Promise<boolean>;
+//# sourceMappingURL=cli-utils.d.ts.map

package/dist/cli/cli-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-utils.d.ts","sourceRoot":"","sources":["../../src/cli/cli-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAA;AAGlD,+CAA+C;AAC/C,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAErC;AAED,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAQ7C;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAoB9E;AAED,2EAA2E;AAC3E,wBAAsB,WAAW,CAC/B,EAAE,EAAE,QAAQ,CAAC,SAAS,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAOlB"}

package/dist/cli/cli-utils.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.log = log;
+exports.openBrowser = openBrowser;
+exports.promptEnterToOpenBrowser = promptEnterToOpenBrowser;
+exports.promptYesNo = promptYesNo;
+const node_child_process_1 = require("node:child_process");
+/** Log to stderr (used by all CLI commands) */
+function log(msg) {
+    process.stderr.write(`${msg}\n`);
+}
+/** Open a URL in the default browser (fire-and-forget). Only http(s) URLs are allowed. */
+function openBrowser(url) {
+    if (!/^https?:\/\//i.test(url))
+        return;
+    if (process.platform === 'win32') {
+        (0, node_child_process_1.execFile)('cmd', ['/c', 'start', '', url], () => { });
+    }
+    else {
+        const cmd = process.platform === 'darwin' ? 'open' : 'xdg-open';
+        (0, node_child_process_1.execFile)(cmd, [url], () => { });
+    }
+}
+/**
+ * If running in a TTY, listen for a single Enter keypress and open the
+ * given URL in the default browser.  Returns a cleanup function that
+ * removes the listener, or `undefined` when not in a TTY.
+ */
+function promptEnterToOpenBrowser(url) {
+    if (!process.stdin.isTTY)
+        return undefined;
+    log('Press Enter to open in browser (or copy the URL above)');
+    const wasPaused = process.stdin.isPaused();
+    process.stdin.resume();
+    const onData = () => {
+        openBrowser(url);
+        cleanup();
+    };
+    const cleanup = () => {
+        process.stdin.removeListener('data', onData);
+        if (wasPaused)
+            process.stdin.pause();
+    };
+    process.stdin.once('data', onData);
+    return cleanup;
+}
+/** Prompt yes/no with default yes. Returns false on 'n', EOF, or error. */
+async function promptYesNo(rl, question) {
+    try {
+        const answer = await rl.question(`${question} (Y/n): `);
+        return answer.trim().toLowerCase() !== 'n';
+    }
+    catch {
+        return false; // EOF or error — treat as decline
+    }
+}
+//# sourceMappingURL=cli-utils.js.map

package/dist/cli/cli-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-utils.js","sourceRoot":"","sources":["../../src/cli/cli-utils.ts"],"names":[],"mappings":";;AAIA,kBAEC;AAGD,kCAQC;AAOD,4DAoBC;AAGD,kCAUC;AAxDD,2DAA6C;AAE7C,+CAA+C;AAC/C,SAAgB,GAAG,CAAC,GAAW;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAA;AAClC,CAAC;AAED,0FAA0F;AAC1F,SAAgB,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAM;IACtC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAA,6BAAQ,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACrD,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;QAC/D,IAAA,6BAAQ,EAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,wBAAwB,CAAC,GAAW;IAClD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAE1C,GAAG,CAAC,wDAAwD,CAAC,CAAA;IAE7D,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAA;IAC1C,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;IAEtB,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,WAAW,CAAC,GAAG,CAAC,CAAA;QAChB,OAAO,EAAE,CAAA;IACX,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC5C,IAAI,SAAS;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IACtC,CAAC,CAAA;IAED,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,2EAA2E;AACpE,KAAK,UAAU,WAAW,CAC/B,EAAsB,EACtB,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,UAAU,CAAC,CAAA;QACvD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA,CAAC,kCAAkC;IACjD,CAAC;AACH,CAAC"}

package/dist/cli/daemon-utils.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Write PID to file. Creates parent directories if needed.
+ */
+export declare function writePidFile(filePath: string, pid: number): void;
+/**
+ * Read PID from file. Returns null if file doesn't exist or contains invalid data.
+ */
+export declare function readPidFile(filePath: string): number | null;
+/**
+ * Write port number to file. Creates parent directories if needed.
+ */
+export declare function writePortFile(filePath: string, port: number): void;
+/**
+ * Read port from file. Returns null if file doesn't exist or contains invalid data.
+ */
+export declare function readPortFile(filePath: string): number | null;
+/**
+ * Remove PID file. No-op if file doesn't exist.
+ */
+export declare function removePidFile(filePath: string): void;
+/**
+ * Remove port file. No-op if file doesn't exist.
+ */
+export declare function removePortFile(filePath: string): void;
+/**
+ * Check if a process with the given PID is running.
+ * Uses kill(pid, 0) which checks existence without sending a signal.
+ */
+export declare function isDaemonRunning(pid: number): boolean;
+//# sourceMappingURL=daemon-utils.d.ts.map

package/dist/cli/daemon-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-utils.d.ts","sourceRoot":"","sources":["../../src/cli/daemon-utils.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAMhE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ3D;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAMlE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ5D;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAMpD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAMrD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAQpD"}

package/dist/cli/daemon-utils.js

@@ -0,0 +1,131 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writePidFile = writePidFile;
+exports.readPidFile = readPidFile;
+exports.writePortFile = writePortFile;
+exports.readPortFile = readPortFile;
+exports.removePidFile = removePidFile;
+exports.removePortFile = removePortFile;
+exports.isDaemonRunning = isDaemonRunning;
+/**
+ * Daemon utility functions for PID/port file management.
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+/**
+ * Write PID to file. Creates parent directories if needed.
+ */
+function writePidFile(filePath, pid) {
+    const dir = path.dirname(filePath);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    fs.writeFileSync(filePath, String(pid), { encoding: 'utf-8', mode: 0o600 });
+}
+/**
+ * Read PID from file. Returns null if file doesn't exist or contains invalid data.
+ */
+function readPidFile(filePath) {
+    try {
+        const content = fs.readFileSync(filePath, 'utf-8').trim();
+        const pid = parseInt(content, 10);
+        return Number.isFinite(pid) && pid > 0 ? pid : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write port number to file. Creates parent directories if needed.
+ */
+function writePortFile(filePath, port) {
+    const dir = path.dirname(filePath);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    fs.writeFileSync(filePath, String(port), { encoding: 'utf-8', mode: 0o600 });
+}
+/**
+ * Read port from file. Returns null if file doesn't exist or contains invalid data.
+ */
+function readPortFile(filePath) {
+    try {
+        const content = fs.readFileSync(filePath, 'utf-8').trim();
+        const port = parseInt(content, 10);
+        return Number.isFinite(port) && port > 0 ? port : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Remove PID file. No-op if file doesn't exist.
+ */
+function removePidFile(filePath) {
+    try {
+        fs.unlinkSync(filePath);
+    }
+    catch {
+        // Ignore errors (file may not exist)
+    }
+}
+/**
+ * Remove port file. No-op if file doesn't exist.
+ */
+function removePortFile(filePath) {
+    try {
+        fs.unlinkSync(filePath);
+    }
+    catch {
+        // Ignore errors (file may not exist)
+    }
+}
+/**
+ * Check if a process with the given PID is running.
+ * Uses kill(pid, 0) which checks existence without sending a signal.
+ */
+function isDaemonRunning(pid) {
+    if (pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=daemon-utils.js.map

package/dist/cli/daemon-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-utils.js","sourceRoot":"","sources":["../../src/cli/daemon-utils.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA,oCAMC;AAKD,kCAQC;AAKD,sCAMC;AAKD,oCAQC;AAKD,sCAMC;AAKD,wCAMC;AAMD,0CAQC;AAxFD;;GAEG;AACH,4CAA6B;AAC7B,gDAAiC;AAEjC;;GAEG;AACH,SAAgB,YAAY,CAAC,QAAgB,EAAE,GAAW;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AAC7E,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW,CAAC,QAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QACzD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,QAAgB,EAAE,IAAY;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AAC9E,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAAC,QAAgB;IAC3C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QAClC,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,QAAgB;IAC5C,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,QAAgB;IAC7C,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,GAAW;IACzC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/cli/daemon.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Start the daemon in foreground mode.
+ */
+export declare function runDaemonStart(opts: {
+    port?: number;
+    host?: string;
+    foreground?: boolean;
+}): Promise<void>;
+/**
+ * Stop the running daemon.
+ */
+export declare function runDaemonStop(): void;
+//# sourceMappingURL=daemon.d.ts.map

package/dist/cli/daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../src/cli/daemon.ts"],"names":[],"mappings":"AA0CA;;GAEG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8HhB;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,IAAI,CA8BpC"}