@vreko/cli 3.0.1

package/dist/secure-credentials-JXWAQLS2.js

@@ -0,0 +1,306 @@
+#!/usr/bin/env node
+import { __name } from './chunk-EWOJGXRX.js';
+import { randomBytes, scryptSync, createCipheriv, createDecipheriv } from 'crypto';
+import { existsSync, readFileSync, mkdirSync, writeFileSync, chmodSync } from 'fs';
+import { unlink, readFile, mkdir, writeFile } from 'fs/promises';
+import { homedir, hostname, platform, userInfo } from 'os';
+import { join, dirname } from 'path';
+
+process.env.VREKO_CLI='true';process.env.NODE_NO_WARNINGS='1';
+var SERVICE_NAME = "vreko-cli";
+var ACCOUNT_NAME = "default";
+var ENCRYPTION_ALGORITHM = "aes-256-gcm";
+var KEY_LENGTH = 32;
+var IV_LENGTH = 12;
+var AUTH_TAG_LENGTH = 16;
+var SALT_LENGTH = 32;
+var GLOBAL_DIR = join(homedir(), ".vreko");
+var CREDENTIALS_FILE = join(GLOBAL_DIR, "credentials.json");
+var ENCRYPTED_CREDENTIALS_FILE = join(GLOBAL_DIR, "credentials.enc");
+var PER_INSTALL_SECRET_FILE = join(GLOBAL_DIR, ".cred-key");
+var PER_INSTALL_SECRET_LENGTH = 32;
+async function createKeytarProvider() {
+  try {
+    const keytar = await import('keytar');
+    return {
+      name: "keytar",
+      async isAvailable() {
+        try {
+          await keytar.getPassword("__vreko_test__", "__test__");
+          return true;
+        } catch {
+          return false;
+        }
+      },
+      async getPassword(service, account) {
+        return keytar.getPassword(service, account);
+      },
+      async setPassword(service, account, password) {
+        await keytar.setPassword(service, account, password);
+      },
+      async deletePassword(service, account) {
+        return keytar.deletePassword(service, account);
+      }
+    };
+  } catch {
+    return null;
+  }
+}
+__name(createKeytarProvider, "createKeytarProvider");
+function getOrCreatePerInstallSecret() {
+  try {
+    if (existsSync(PER_INSTALL_SECRET_FILE)) {
+      const existing = readFileSync(PER_INSTALL_SECRET_FILE);
+      if (existing.length >= PER_INSTALL_SECRET_LENGTH) {
+        return existing;
+      }
+    }
+  } catch {
+  }
+  const secret = randomBytes(PER_INSTALL_SECRET_LENGTH);
+  mkdirSync(dirname(PER_INSTALL_SECRET_FILE), {
+    recursive: true
+  });
+  writeFileSync(PER_INSTALL_SECRET_FILE, secret, {
+    mode: 384
+  });
+  try {
+    chmodSync(PER_INSTALL_SECRET_FILE, 384);
+  } catch {
+  }
+  return secret;
+}
+__name(getOrCreatePerInstallSecret, "getOrCreatePerInstallSecret");
+function machineDataString() {
+  return [
+    hostname(),
+    platform(),
+    userInfo().username,
+    homedir(),
+    // Add some entropy from process info
+    process.arch,
+    process.platform
+  ].join("|");
+}
+__name(machineDataString, "machineDataString");
+function deriveKeyFromSecret(salt, perInstallSecret) {
+  const keyMaterial = Buffer.concat([
+    Buffer.from(machineDataString(), "utf8"),
+    Buffer.from("|", "utf8"),
+    perInstallSecret
+  ]);
+  return scryptSync(keyMaterial, salt, KEY_LENGTH);
+}
+__name(deriveKeyFromSecret, "deriveKeyFromSecret");
+function deriveMachineKey(salt) {
+  return deriveKeyFromSecret(salt, getOrCreatePerInstallSecret());
+}
+__name(deriveMachineKey, "deriveMachineKey");
+function encryptCredentials(credentials, salt) {
+  const key = deriveMachineKey(salt);
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv(ENCRYPTION_ALGORITHM, key, iv);
+  const plaintext = JSON.stringify(credentials);
+  const encrypted = Buffer.concat([
+    cipher.update(plaintext, "utf8"),
+    cipher.final()
+  ]);
+  const authTag = cipher.getAuthTag();
+  return Buffer.concat([
+    salt,
+    iv,
+    authTag,
+    encrypted
+  ]);
+}
+__name(encryptCredentials, "encryptCredentials");
+function decryptCredentials(data) {
+  const salt = data.subarray(0, SALT_LENGTH);
+  const iv = data.subarray(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);
+  const authTag = data.subarray(SALT_LENGTH + IV_LENGTH, SALT_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH);
+  const encrypted = data.subarray(SALT_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH);
+  const key = deriveMachineKey(salt);
+  const decipher = createDecipheriv(ENCRYPTION_ALGORITHM, key, iv);
+  decipher.setAuthTag(authTag);
+  const decrypted = Buffer.concat([
+    decipher.update(encrypted),
+    decipher.final()
+  ]);
+  return JSON.parse(decrypted.toString("utf8"));
+}
+__name(decryptCredentials, "decryptCredentials");
+function createEncryptedFileProvider() {
+  return {
+    name: "encrypted-file",
+    async isAvailable() {
+      return true;
+    },
+    async getPassword(_service, _account) {
+      try {
+        const data = await readFile(ENCRYPTED_CREDENTIALS_FILE);
+        const credentials = decryptCredentials(data);
+        return JSON.stringify(credentials);
+      } catch {
+        return null;
+      }
+    },
+    async setPassword(_service, _account, password) {
+      const credentials = JSON.parse(password);
+      const salt = randomBytes(SALT_LENGTH);
+      const encrypted = encryptCredentials(credentials, salt);
+      await mkdir(dirname(ENCRYPTED_CREDENTIALS_FILE), {
+        recursive: true
+      });
+      await writeFile(ENCRYPTED_CREDENTIALS_FILE, encrypted);
+    },
+    async deletePassword(_service, _account) {
+      try {
+        await unlink(ENCRYPTED_CREDENTIALS_FILE);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+__name(createEncryptedFileProvider, "createEncryptedFileProvider");
+var SecureCredentialsManager = class SecureCredentialsManager2 {
+  static {
+    __name(this, "SecureCredentialsManager");
+  }
+  provider = null;
+  initialized = false;
+  /**
+  * Initialize the credentials manager
+  * Selects the best available provider
+  */
+  async initialize() {
+    if (this.initialized) {
+      return;
+    }
+    const keytarProvider = await createKeytarProvider();
+    if (keytarProvider && await keytarProvider.isAvailable()) {
+      this.provider = keytarProvider;
+      this.initialized = true;
+      return;
+    }
+    this.provider = createEncryptedFileProvider();
+    this.initialized = true;
+  }
+  /**
+  * Get the name of the active provider
+  */
+  getProviderName() {
+    return this.provider?.name ?? "none";
+  }
+  /**
+  * Get stored credentials
+  */
+  async getCredentials() {
+    await this.initialize();
+    if (!this.provider) {
+      return null;
+    }
+    const stored = await this.provider.getPassword(SERVICE_NAME, ACCOUNT_NAME);
+    if (!stored) {
+      const legacy = await this.getLegacyCredentials();
+      if (legacy) {
+        await this.setCredentials(legacy);
+        try {
+          await unlink(CREDENTIALS_FILE);
+        } catch {
+        }
+        return legacy;
+      }
+      return null;
+    }
+    try {
+      return JSON.parse(stored);
+    } catch {
+      return null;
+    }
+  }
+  /**
+  * Get legacy plain-text credentials for migration
+  */
+  async getLegacyCredentials() {
+    try {
+      const content = await readFile(CREDENTIALS_FILE, "utf8");
+      return JSON.parse(content);
+    } catch {
+      return null;
+    }
+  }
+  /**
+  * Save credentials securely
+  */
+  async setCredentials(credentials) {
+    await this.initialize();
+    if (!this.provider) {
+      throw new Error("No credentials provider available");
+    }
+    await this.provider.setPassword(SERVICE_NAME, ACCOUNT_NAME, JSON.stringify(credentials));
+  }
+  /**
+  * Clear stored credentials
+  */
+  async clearCredentials() {
+    await this.initialize();
+    if (!this.provider) {
+      return;
+    }
+    await this.provider.deletePassword(SERVICE_NAME, ACCOUNT_NAME);
+    try {
+      await unlink(CREDENTIALS_FILE);
+    } catch {
+    }
+    try {
+      await unlink(ENCRYPTED_CREDENTIALS_FILE);
+    } catch {
+    }
+  }
+  /**
+  * Check if user is logged in
+  */
+  async isLoggedIn() {
+    const credentials = await this.getCredentials();
+    if (!credentials?.accessToken) {
+      return false;
+    }
+    if (credentials.expiresAt) {
+      const expiresAt = new Date(credentials.expiresAt);
+      if (expiresAt < /* @__PURE__ */ new Date()) {
+        return false;
+      }
+    }
+    return true;
+  }
+};
+var secureCredentialsManager = null;
+function getSecureCredentials() {
+  if (!secureCredentialsManager) {
+    secureCredentialsManager = new SecureCredentialsManager();
+  }
+  return secureCredentialsManager;
+}
+__name(getSecureCredentials, "getSecureCredentials");
+async function getCredentialsSecure() {
+  return getSecureCredentials().getCredentials();
+}
+__name(getCredentialsSecure, "getCredentialsSecure");
+async function saveCredentialsSecure(credentials) {
+  return getSecureCredentials().setCredentials(credentials);
+}
+__name(saveCredentialsSecure, "saveCredentialsSecure");
+async function clearCredentialsSecure() {
+  return getSecureCredentials().clearCredentials();
+}
+__name(clearCredentialsSecure, "clearCredentialsSecure");
+async function isLoggedInSecure() {
+  return getSecureCredentials().isLoggedIn();
+}
+__name(isLoggedInSecure, "isLoggedInSecure");
+
+export { SecureCredentialsManager, clearCredentialsSecure, deriveKeyFromSecret, getCredentialsSecure, getSecureCredentials, isLoggedInSecure, saveCredentialsSecure };
+//# sourceMappingURL=secure-credentials-JXWAQLS2.js.map
+//# sourceMappingURL=secure-credentials-JXWAQLS2.js.map

package/dist/secure-credentials-JXWAQLS2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/secure-credentials.ts"],"names":["SERVICE_NAME","ACCOUNT_NAME","ENCRYPTION_ALGORITHM","KEY_LENGTH","IV_LENGTH","AUTH_TAG_LENGTH","SALT_LENGTH","GLOBAL_DIR","join","homedir","CREDENTIALS_FILE","ENCRYPTED_CREDENTIALS_FILE","PER_INSTALL_SECRET_FILE","PER_INSTALL_SECRET_LENGTH","createKeytarProvider","keytar","name","isAvailable","getPassword","service","account","setPassword","password","deletePassword","getOrCreatePerInstallSecret","existsSync","existing","readFileSync","length","secret","randomBytes","mkdirSync","dirname","recursive","writeFileSync","mode","chmodSync","machineDataString","hostname","platform","userInfo","username","process","arch","deriveKeyFromSecret","salt","perInstallSecret","keyMaterial","Buffer","concat","from","scryptSync","deriveMachineKey","encryptCredentials","credentials","key","iv","cipher","createCipheriv","plaintext","JSON","stringify","encrypted","update","final","authTag","getAuthTag","decryptCredentials","data","subarray","decipher","createDecipheriv","setAuthTag","decrypted","parse","toString","createEncryptedFileProvider","_service","_account","readFile","mkdir","writeFile","unlink","SecureCredentialsManager","provider","initialized","initialize","keytarProvider","getProviderName","getCredentials","stored","legacy","getLegacyCredentials","setCredentials","content","Error","clearCredentials","isLoggedIn","accessToken","expiresAt","Date","secureCredentialsManager","getSecureCredentials","getCredentialsSecure","saveCredentialsSecure","clearCredentialsSecure","isLoggedInSecure"],"mappings":";;;;;;;;;AAwBA,IAAMA,YAAAA,GAAe,WAAA;AACrB,IAAMC,YAAAA,GAAe,SAAA;AACrB,IAAMC,oBAAAA,GAAuB,aAAA;AAC7B,IAAMC,UAAAA,GAAa,EAAA;AACnB,IAAMC,SAAAA,GAAY,EAAA;AAClB,IAAMC,eAAAA,GAAkB,EAAA;AACxB,IAAMC,WAAAA,GAAc,EAAA;AAGpB,IAAMC,UAAAA,GAAaC,IAAAA,CAAKC,OAAAA,EAAAA,EAAW,QAAA,CAAA;AACnC,IAAMC,gBAAAA,GAAmBF,IAAAA,CAAKD,UAAAA,EAAY,kBAAA,CAAA;AAC1C,IAAMI,0BAAAA,GAA6BH,IAAAA,CAAKD,UAAAA,EAAY,iBAAA,CAAA;AAOpD,IAAMK,uBAAAA,GAA0BJ,IAAAA,CAAKD,UAAAA,EAAY,WAAA,CAAA;AACjD,IAAMM,yBAAAA,GAA4B,EAAA;AA0BlC,eAAeC,oBAAAA,GAAAA;AACd,EAAA,IAAI;AAEH,IAAA,MAAMC,MAAAA,GAAS,MAAM,OAAO,QAAA,CAAA;AAE5B,IAAA,OAAO;MACNC,IAAAA,EAAM,QAAA;AACN,MAAA,MAAMC,WAAAA,GAAAA;AACL,QAAA,IAAI;AAEH,UAAA,MAAMF,MAAAA,CAAOG,WAAAA,CAAY,gBAAA,EAAkB,UAAA,CAAA;AAC3C,UAAA,OAAO,IAAA;QACR,CAAA,CAAA,MAAQ;AACP,UAAA,OAAO,KAAA;AACR,QAAA;AACD,MAAA,CAAA;MACA,MAAMA,WAAAA,CAAYC,SAAiBC,OAAAA,EAAe;AACjD,QAAA,OAAOL,MAAAA,CAAOG,WAAAA,CAAYC,OAAAA,EAASC,OAAAA,CAAAA;AACpC,MAAA,CAAA;MACA,MAAMC,WAAAA,CAAYF,OAAAA,EAAiBC,OAAAA,EAAiBE,QAAAA,EAAgB;AACnE,QAAA,MAAMP,MAAAA,CAAOM,WAAAA,CAAYF,OAAAA,EAASC,OAAAA,EAASE,QAAAA,CAAAA;AAC5C,MAAA,CAAA;MACA,MAAMC,cAAAA,CAAeJ,SAAiBC,OAAAA,EAAe;AACpD,QAAA,OAAOL,MAAAA,CAAOQ,cAAAA,CAAeJ,OAAAA,EAASC,OAAAA,CAAAA;AACvC,MAAA;AACD,KAAA;EACD,CAAA,CAAA,MAAQ;AAEP,IAAA,OAAO,IAAA;AACR,EAAA;AACD;AA9BeN,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AA6Cf,SAASU,2BAAAA,GAAAA;AACR,EAAA,IAAI;AACH,IAAA,IAAIC,UAAAA,CAAWb,uBAAAA,CAAAA,EAA0B;AACxC,MAAA,MAAMc,QAAAA,GAAWC,aAAaf,uBAAAA,CAAAA;AAC9B,MAAA,IAAIc,QAAAA,CAASE,UAAUf,yBAAAA,EAA2B;AACjD,QAAA,OAAOa,QAAAA;AACR,MAAA;AACD,IAAA;EACD,CAAA,CAAA,MAAQ;AAER,EAAA;AAEA,EAAA,MAAMG,MAAAA,GAASC,YAAYjB,yBAAAA,CAAAA;AAC3BkB,EAAAA,SAAAA,CAAUC,OAAAA,CAAQpB,uBAAAA,CAAAA,EAA0B;IAAEqB,SAAAA,EAAW;GAAK,CAAA;AAG9DC,EAAAA,aAAAA,CAActB,yBAAyBiB,MAAAA,EAAQ;IAAEM,IAAAA,EAAM;GAAM,CAAA;AAC7D,EAAA,IAAI;AACHC,IAAAA,SAAAA,CAAUxB,yBAAyB,GAAA,CAAA;EACpC,CAAA,CAAA,MAAQ;AAER,EAAA;AACA,EAAA,OAAOiB,MAAAA;AACR;AAvBSL,MAAAA,CAAAA,2BAAAA,EAAAA,6BAAAA,CAAAA;AAgCT,SAASa,iBAAAA,GAAAA;AACR,EAAA,OAAO;IACNC,QAAAA,EAAAA;IACAC,QAAAA,EAAAA;AACAC,IAAAA,QAAAA,EAAAA,CAAWC,QAAAA;IACXhC,OAAAA,EAAAA;;IAEAiC,OAAAA,CAAQC,IAAAA;IACRD,OAAAA,CAAQH;AACP/B,GAAAA,CAAAA,IAAAA,CAAK,GAAA,CAAA;AACR;AAVS6B,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAiBF,SAASO,mBAAAA,CAAoBC,MAAcC,gBAAAA,EAAwB;AACzE,EAAA,MAAMC,WAAAA,GAAcC,OAAOC,MAAAA,CAAO;IACjCD,MAAAA,CAAOE,IAAAA,CAAKb,iBAAAA,EAAAA,EAAqB,MAAA,CAAA;IACjCW,MAAAA,CAAOE,IAAAA,CAAK,KAAK,MAAA,CAAA;AACjBJ,IAAAA;AACA,GAAA,CAAA;AACD,EAAA,OAAOK,UAAAA,CAAWJ,WAAAA,EAAaF,IAAAA,EAAM1C,UAAAA,CAAAA;AACtC;AAPgByC,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAShB,SAASQ,iBAAiBP,IAAAA,EAAY;AAGrC,EAAA,OAAOD,mBAAAA,CAAoBC,IAAAA,EAAMrB,2BAAAA,EAAAA,CAAAA;AAClC;AAJS4B,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAST,SAASC,kBAAAA,CAAmBC,aAAgCT,IAAAA,EAAY;AACvE,EAAA,MAAMU,GAAAA,GAAMH,iBAAiBP,IAAAA,CAAAA;AAC7B,EAAA,MAAMW,EAAAA,GAAK1B,YAAY1B,SAAAA,CAAAA;AACvB,EAAA,MAAMqD,MAAAA,GAASC,cAAAA,CAAexD,oBAAAA,EAAsBqD,GAAAA,EAAKC,EAAAA,CAAAA;AAEzD,EAAA,MAAMG,SAAAA,GAAYC,IAAAA,CAAKC,SAAAA,CAAUP,WAAAA,CAAAA;AACjC,EAAA,MAAMQ,SAAAA,GAAYd,OAAOC,MAAAA,CAAO;IAACQ,MAAAA,CAAOM,MAAAA,CAAOJ,WAAW,MAAA,CAAA;AAASF,IAAAA,MAAAA,CAAOO,KAAAA;AAAQ,GAAA,CAAA;AAClF,EAAA,MAAMC,OAAAA,GAAUR,OAAOS,UAAAA,EAAU;AAGjC,EAAA,OAAOlB,OAAOC,MAAAA,CAAO;AAACJ,IAAAA,IAAAA;AAAMW,IAAAA,EAAAA;AAAIS,IAAAA,OAAAA;AAASH,IAAAA;AAAU,GAAA,CAAA;AACpD;AAXST,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAgBT,SAASc,mBAAmBC,IAAAA,EAAY;AAEvC,EAAA,MAAMvB,IAAAA,GAAOuB,IAAAA,CAAKC,QAAAA,CAAS,CAAA,EAAG/D,WAAAA,CAAAA;AAC9B,EAAA,MAAMkD,EAAAA,GAAKY,IAAAA,CAAKC,QAAAA,CAAS/D,WAAAA,EAAaA,cAAcF,SAAAA,CAAAA;AACpD,EAAA,MAAM6D,UAAUG,IAAAA,CAAKC,QAAAA,CAAS/D,cAAcF,SAAAA,EAAWE,WAAAA,GAAcF,YAAYC,eAAAA,CAAAA;AACjF,EAAA,MAAMyD,SAAAA,GAAYM,IAAAA,CAAKC,QAAAA,CAAS/D,WAAAA,GAAcF,YAAYC,eAAAA,CAAAA;AAE1D,EAAA,MAAMkD,GAAAA,GAAMH,iBAAiBP,IAAAA,CAAAA;AAC7B,EAAA,MAAMyB,QAAAA,GAAWC,gBAAAA,CAAiBrE,oBAAAA,EAAsBqD,GAAAA,EAAKC,EAAAA,CAAAA;AAC7Dc,EAAAA,QAAAA,CAASE,WAAWP,OAAAA,CAAAA;AAEpB,EAAA,MAAMQ,SAAAA,GAAYzB,OAAOC,MAAAA,CAAO;AAACqB,IAAAA,QAAAA,CAASP,OAAOD,SAAAA,CAAAA;AAAYQ,IAAAA,QAAAA,CAASN,KAAAA;AAAQ,GAAA,CAAA;AAC9E,EAAA,OAAOJ,IAAAA,CAAKc,KAAAA,CAAMD,SAAAA,CAAUE,QAAAA,CAAS,MAAA,CAAA,CAAA;AACtC;AAbSR,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAmBT,SAASS,2BAAAA,GAAAA;AACR,EAAA,OAAO;IACN5D,IAAAA,EAAM,gBAAA;AACN,IAAA,MAAMC,WAAAA,GAAAA;AACL,MAAA,OAAO,IAAA;AACR,IAAA,CAAA;IACA,MAAMC,WAAAA,CAAY2D,UAAkBC,QAAAA,EAAgB;AACnD,MAAA,IAAI;AACH,QAAA,MAAMV,IAAAA,GAAO,MAAMW,QAAAA,CAASpE,0BAAAA,CAAAA;AAC5B,QAAA,MAAM2C,WAAAA,GAAca,mBAAmBC,IAAAA,CAAAA;AACvC,QAAA,OAAOR,IAAAA,CAAKC,UAAUP,WAAAA,CAAAA;MACvB,CAAA,CAAA,MAAQ;AACP,QAAA,OAAO,IAAA;AACR,MAAA;AACD,IAAA,CAAA;IACA,MAAMjC,WAAAA,CAAYwD,QAAAA,EAAkBC,QAAAA,EAAkBxD,QAAAA,EAAgB;AACrE,MAAA,MAAMgC,WAAAA,GAAcM,IAAAA,CAAKc,KAAAA,CAAMpD,QAAAA,CAAAA;AAC/B,MAAA,MAAMuB,IAAAA,GAAOf,YAAYxB,WAAAA,CAAAA;AACzB,MAAA,MAAMwD,SAAAA,GAAYT,kBAAAA,CAAmBC,WAAAA,EAAaT,IAAAA,CAAAA;AAElD,MAAA,MAAMmC,KAAAA,CAAMhD,OAAAA,CAAQrB,0BAAAA,CAAAA,EAA6B;QAAEsB,SAAAA,EAAW;OAAK,CAAA;AACnE,MAAA,MAAMgD,SAAAA,CAAUtE,4BAA4BmD,SAAAA,CAAAA;AAC7C,IAAA,CAAA;IACA,MAAMvC,cAAAA,CAAesD,UAAkBC,QAAAA,EAAgB;AACtD,MAAA,IAAI;AACH,QAAA,MAAMI,OAAOvE,0BAAAA,CAAAA;AACb,QAAA,OAAO,IAAA;MACR,CAAA,CAAA,MAAQ;AACP,QAAA,OAAO,KAAA;AACR,MAAA;AACD,IAAA;AACD,GAAA;AACD;AAhCSiE,MAAAA,CAAAA,2BAAAA,EAAAA,6BAAAA,CAAAA;AA2FT,IAAMO,wBAAAA,GAAN,MAAMA,yBAAAA,CAAAA;EAnTN;;;EAoTSC,QAAAA,GAAoC,IAAA;EACpCC,WAAAA,GAAc,KAAA;;;;;AAMtB,EAAA,MAAMC,UAAAA,GAA4B;AACjC,IAAA,IAAI,KAAKD,WAAAA,EAAa;AACrB,MAAA;AACD,IAAA;AAGA,IAAA,MAAME,cAAAA,GAAiB,MAAMzE,oBAAAA,EAAAA;AAC7B,IAAA,IAAIyE,cAAAA,IAAmB,MAAMA,cAAAA,CAAetE,WAAAA,EAAW,EAAK;AAC3D,MAAA,IAAA,CAAKmE,QAAAA,GAAWG,cAAAA;AAChB,MAAA,IAAA,CAAKF,WAAAA,GAAc,IAAA;AACnB,MAAA;AACD,IAAA;AAGA,IAAA,IAAA,CAAKD,WAAWR,2BAAAA,EAAAA;AAChB,IAAA,IAAA,CAAKS,WAAAA,GAAc,IAAA;AACpB,EAAA;;;;EAKAG,eAAAA,GAA0B;AACzB,IAAA,OAAO,IAAA,CAAKJ,UAAUpE,IAAAA,IAAQ,MAAA;AAC/B,EAAA;;;;AAKA,EAAA,MAAMyE,cAAAA,GAAoD;AACzD,IAAA,MAAM,KAAKH,UAAAA,EAAU;AACrB,IAAA,IAAI,CAAC,KAAKF,QAAAA,EAAU;AACnB,MAAA,OAAO,IAAA;AACR,IAAA;AAEA,IAAA,MAAMM,SAAS,MAAM,IAAA,CAAKN,QAAAA,CAASlE,WAAAA,CAAYlB,cAAcC,YAAAA,CAAAA;AAC7D,IAAA,IAAI,CAACyF,MAAAA,EAAQ;AAEZ,MAAA,MAAMC,MAAAA,GAAS,MAAM,IAAA,CAAKC,oBAAAA,EAAoB;AAC9C,MAAA,IAAID,MAAAA,EAAQ;AAEX,QAAA,MAAM,IAAA,CAAKE,eAAeF,MAAAA,CAAAA;AAE1B,QAAA,IAAI;AACH,UAAA,MAAMT,OAAOxE,gBAAAA,CAAAA;QACd,CAAA,CAAA,MAAQ;AAER,QAAA;AACA,QAAA,OAAOiF,MAAAA;AACR,MAAA;AACA,MAAA,OAAO,IAAA;AACR,IAAA;AAEA,IAAA,IAAI;AACH,MAAA,OAAO/B,IAAAA,CAAKc,MAAMgB,MAAAA,CAAAA;IACnB,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO,IAAA;AACR,IAAA;AACD,EAAA;;;;AAKA,EAAA,MAAcE,oBAAAA,GAA0D;AACvE,IAAA,IAAI;AACH,MAAA,MAAME,OAAAA,GAAU,MAAMf,QAAAA,CAASrE,gBAAAA,EAAkB,MAAA,CAAA;AACjD,MAAA,OAAOkD,IAAAA,CAAKc,MAAMoB,OAAAA,CAAAA;IACnB,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO,IAAA;AACR,IAAA;AACD,EAAA;;;;AAKA,EAAA,MAAMD,eAAevC,WAAAA,EAA+C;AACnE,IAAA,MAAM,KAAKgC,UAAAA,EAAU;AACrB,IAAA,IAAI,CAAC,KAAKF,QAAAA,EAAU;AACnB,MAAA,MAAM,IAAIW,MAAM,mCAAA,CAAA;AACjB,IAAA;AAEA,IAAA,MAAM,IAAA,CAAKX,SAAS/D,WAAAA,CAAYrB,YAAAA,EAAcC,cAAc2D,IAAAA,CAAKC,SAAAA,CAAUP,WAAAA,CAAAA,CAAAA;AAC5E,EAAA;;;;AAKA,EAAA,MAAM0C,gBAAAA,GAAkC;AACvC,IAAA,MAAM,KAAKV,UAAAA,EAAU;AACrB,IAAA,IAAI,CAAC,KAAKF,QAAAA,EAAU;AACnB,MAAA;AACD,IAAA;AAEA,IAAA,MAAM,IAAA,CAAKA,QAAAA,CAAS7D,cAAAA,CAAevB,YAAAA,EAAcC,YAAAA,CAAAA;AAGjD,IAAA,IAAI;AACH,MAAA,MAAMiF,OAAOxE,gBAAAA,CAAAA;IACd,CAAA,CAAA,MAAQ;AAER,IAAA;AACA,IAAA,IAAI;AACH,MAAA,MAAMwE,OAAOvE,0BAAAA,CAAAA;IACd,CAAA,CAAA,MAAQ;AAER,IAAA;AACD,EAAA;;;;AAKA,EAAA,MAAMsF,UAAAA,GAA+B;AACpC,IAAA,MAAM3C,WAAAA,GAAc,MAAM,IAAA,CAAKmC,cAAAA,EAAc;AAC7C,IAAA,IAAI,CAACnC,aAAa4C,WAAAA,EAAa;AAC9B,MAAA,OAAO,KAAA;AACR,IAAA;AAGA,IAAA,IAAI5C,YAAY6C,SAAAA,EAAW;AAC1B,MAAA,MAAMA,SAAAA,GAAY,IAAIC,IAAAA,CAAK9C,WAAAA,CAAY6C,SAAS,CAAA;AAChD,MAAA,IAAIA,SAAAA,mBAAY,IAAIC,IAAAA,EAAAA,EAAQ;AAC3B,QAAA,OAAO,KAAA;AACR,MAAA;AACD,IAAA;AAEA,IAAA,OAAO,IAAA;AACR,EAAA;AACD;AAOA,IAAIC,wBAAAA,GAA4D,IAAA;AAKzD,SAASC,oBAAAA,GAAAA;AACf,EAAA,IAAI,CAACD,wBAAAA,EAA0B;AAC9BA,IAAAA,wBAAAA,GAA2B,IAAIlB,wBAAAA,EAAAA;AAChC,EAAA;AACA,EAAA,OAAOkB,wBAAAA;AACR;AALgBC,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAUhB,eAAsBC,oBAAAA,GAAAA;AACrB,EAAA,OAAOD,oBAAAA,GAAuBb,cAAAA,EAAc;AAC7C;AAFsBc,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAItB,eAAsBC,sBAAsBlD,WAAAA,EAA8B;AACzE,EAAA,OAAOgD,oBAAAA,EAAAA,CAAuBT,cAAAA,CAAevC,WAAAA,CAAAA;AAC9C;AAFsBkD,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;AAItB,eAAsBC,sBAAAA,GAAAA;AACrB,EAAA,OAAOH,oBAAAA,GAAuBN,gBAAAA,EAAgB;AAC/C;AAFsBS,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAItB,eAAsBC,gBAAAA,GAAAA;AACrB,EAAA,OAAOJ,oBAAAA,GAAuBL,UAAAA,EAAU;AACzC;AAFsBS,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA","file":"secure-credentials-JXWAQLS2.js","sourcesContent":["/**\n * Secure Credentials Storage for Vreko CLI\n *\n * FIX 4: Implements OS keychain storage with file fallback\n *\n * Security Hierarchy:\n * 1. OS Keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service)\n * 2. Encrypted file fallback (AES-256-GCM with machine-derived key)\n * 3. Plain text fallback (development only, with warning)\n *\n * @module services/secure-credentials\n */\n\nimport { createCipheriv, createDecipheriv, randomBytes, scryptSync } from \"node:crypto\";\nimport { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { mkdir, readFile, unlink, writeFile } from \"node:fs/promises\";\nimport { homedir, hostname, platform, userInfo } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nimport type { GlobalCredentials } from \"./vreko-dir\";\n\n// =============================================================================\n// CONSTANTS\n// =============================================================================\n\nconst SERVICE_NAME = \"vreko-cli\";\nconst ACCOUNT_NAME = \"default\";\nconst ENCRYPTION_ALGORITHM = \"aes-256-gcm\";\nconst KEY_LENGTH = 32;\nconst IV_LENGTH = 12;\nconst AUTH_TAG_LENGTH = 16;\nconst SALT_LENGTH = 32;\n\n// File paths\nconst GLOBAL_DIR = join(homedir(), \".vreko\");\nconst CREDENTIALS_FILE = join(GLOBAL_DIR, \"credentials.json\");\nconst ENCRYPTED_CREDENTIALS_FILE = join(GLOBAL_DIR, \"credentials.enc\");\n/**\n * AUTH-04: per-install secret. Random entropy generated once, persisted at 0o600,\n * and NEVER written into the credential file header. The encrypted file stores\n * only the KDF salt; without this secret a same-UID reader of credentials.enc\n * cannot recompute the key from machine values alone.\n */\nconst PER_INSTALL_SECRET_FILE = join(GLOBAL_DIR, \".cred-key\");\nconst PER_INSTALL_SECRET_LENGTH = 32;\n\n// =============================================================================\n// KEYCHAIN INTERFACE\n// =============================================================================\n\n/**\n * Keychain abstraction interface\n * Allows for different implementations based on availability\n */\ninterface KeychainProvider {\n\tname: string;\n\tisAvailable(): Promise<boolean>;\n\tgetPassword(service: string, account: string): Promise<string | null>;\n\tsetPassword(service: string, account: string, password: string): Promise<void>;\n\tdeletePassword(service: string, account: string): Promise<boolean>;\n}\n\n// =============================================================================\n// KEYTAR PROVIDER (OS KEYCHAIN)\n// =============================================================================\n\n/**\n * Keytar-based keychain provider\n * Uses OS-level secure credential storage\n */\nasync function createKeytarProvider(): Promise<KeychainProvider | null> {\n\ttry {\n\t\t// Dynamic import to handle missing keytar gracefully\n\t\tconst keytar = await import(\"keytar\");\n\n\t\treturn {\n\t\t\tname: \"keytar\",\n\t\t\tasync isAvailable(): Promise<boolean> {\n\t\t\t\ttry {\n\t\t\t\t\t// Test availability by trying a no-op operation\n\t\t\t\t\tawait keytar.getPassword(\"__vreko_test__\", \"__test__\");\n\t\t\t\t\treturn true;\n\t\t\t\t} catch {\n\t\t\t\t\treturn false;\n\t\t\t\t}\n\t\t\t},\n\t\t\tasync getPassword(service: string, account: string): Promise<string | null> {\n\t\t\t\treturn keytar.getPassword(service, account);\n\t\t\t},\n\t\t\tasync setPassword(service: string, account: string, password: string): Promise<void> {\n\t\t\t\tawait keytar.setPassword(service, account, password);\n\t\t\t},\n\t\t\tasync deletePassword(service: string, account: string): Promise<boolean> {\n\t\t\t\treturn keytar.deletePassword(service, account);\n\t\t\t},\n\t\t};\n\t} catch {\n\t\t// keytar not available (not installed or native module issues)\n\t\treturn null;\n\t}\n}\n\n// =============================================================================\n// ENCRYPTED FILE PROVIDER\n// =============================================================================\n\n/**\n * Read or create the per-install secret (AUTH-04).\n *\n * Generated once with crypto.randomBytes, stored at PER_INSTALL_SECRET_FILE with\n * mode 0o600, and read on subsequent calls. This secret is the real key entropy:\n * it is never embedded in the credential file, so a reader of credentials.enc\n * (who sees only the salt) cannot derive the key from recomputable machine values.\n * Two installs on the same machine generate different secrets → different keys.\n */\nfunction getOrCreatePerInstallSecret(): Buffer {\n\ttry {\n\t\tif (existsSync(PER_INSTALL_SECRET_FILE)) {\n\t\t\tconst existing = readFileSync(PER_INSTALL_SECRET_FILE);\n\t\t\tif (existing.length >= PER_INSTALL_SECRET_LENGTH) {\n\t\t\t\treturn existing;\n\t\t\t}\n\t\t}\n\t} catch {\n\t\t// fall through to (re)generate\n\t}\n\n\tconst secret = randomBytes(PER_INSTALL_SECRET_LENGTH);\n\tmkdirSync(dirname(PER_INSTALL_SECRET_FILE), { recursive: true });\n\t// Write with restrictive permissions, then chmod to guarantee 0o600 even if\n\t// the umask widened the create mode.\n\twriteFileSync(PER_INSTALL_SECRET_FILE, secret, { mode: 0o600 });\n\ttry {\n\t\tchmodSync(PER_INSTALL_SECRET_FILE, 0o600);\n\t} catch {\n\t\t// best-effort on platforms without POSIX modes\n\t}\n\treturn secret;\n}\n\n/**\n * Derive an encryption key from machine-specific data PLUS a per-install secret.\n *\n * The machine values alone are recomputable by any same-UID process, and the salt\n * lives in the credential file header  -  so without the per-install secret the key\n * is offline-derivable (AUTH-04 / F-5). Mixing in the secret closes that gap.\n */\nfunction machineDataString(): string {\n\treturn [\n\t\thostname(),\n\t\tplatform(),\n\t\tuserInfo().username,\n\t\thomedir(),\n\t\t// Add some entropy from process info\n\t\tprocess.arch,\n\t\tprocess.platform,\n\t].join(\"|\");\n}\n\n/**\n * Pure key derivation from machine data + a per-install secret + salt.\n * Exported for testing (R-4.1): with identical machine data and salt, two\n * different per-install secrets MUST yield different keys.\n */\nexport function deriveKeyFromSecret(salt: Buffer, perInstallSecret: Buffer): Buffer {\n\tconst keyMaterial = Buffer.concat([\n\t\tBuffer.from(machineDataString(), \"utf8\"),\n\t\tBuffer.from(\"|\", \"utf8\"),\n\t\tperInstallSecret,\n\t]);\n\treturn scryptSync(keyMaterial, salt, KEY_LENGTH);\n}\n\nfunction deriveMachineKey(salt: Buffer): Buffer {\n\t// AUTH-04: bind the key to the per-install secret. The secret is not stored\n\t// anywhere recomputable from the credential file (only the salt is).\n\treturn deriveKeyFromSecret(salt, getOrCreatePerInstallSecret());\n}\n\n/**\n * Encrypt credentials with machine-derived key\n */\nfunction encryptCredentials(credentials: GlobalCredentials, salt: Buffer): Buffer {\n\tconst key = deriveMachineKey(salt);\n\tconst iv = randomBytes(IV_LENGTH);\n\tconst cipher = createCipheriv(ENCRYPTION_ALGORITHM, key, iv);\n\n\tconst plaintext = JSON.stringify(credentials);\n\tconst encrypted = Buffer.concat([cipher.update(plaintext, \"utf8\"), cipher.final()]);\n\tconst authTag = cipher.getAuthTag();\n\n\t// Format: salt (32) + iv (12) + authTag (16) + encrypted data\n\treturn Buffer.concat([salt, iv, authTag, encrypted]);\n}\n\n/**\n * Decrypt credentials with machine-derived key\n */\nfunction decryptCredentials(data: Buffer): GlobalCredentials {\n\t// Extract components\n\tconst salt = data.subarray(0, SALT_LENGTH);\n\tconst iv = data.subarray(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);\n\tconst authTag = data.subarray(SALT_LENGTH + IV_LENGTH, SALT_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH);\n\tconst encrypted = data.subarray(SALT_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH);\n\n\tconst key = deriveMachineKey(salt);\n\tconst decipher = createDecipheriv(ENCRYPTION_ALGORITHM, key, iv);\n\tdecipher.setAuthTag(authTag);\n\n\tconst decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);\n\treturn JSON.parse(decrypted.toString(\"utf8\")) as GlobalCredentials;\n}\n\n/**\n * Encrypted file provider\n * Uses AES-256-GCM with machine-derived key\n */\nfunction createEncryptedFileProvider(): KeychainProvider {\n\treturn {\n\t\tname: \"encrypted-file\",\n\t\tasync isAvailable(): Promise<boolean> {\n\t\t\treturn true; // Always available as fallback\n\t\t},\n\t\tasync getPassword(_service: string, _account: string): Promise<string | null> {\n\t\t\ttry {\n\t\t\t\tconst data = await readFile(ENCRYPTED_CREDENTIALS_FILE);\n\t\t\t\tconst credentials = decryptCredentials(data);\n\t\t\t\treturn JSON.stringify(credentials);\n\t\t\t} catch {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t},\n\t\tasync setPassword(_service: string, _account: string, password: string): Promise<void> {\n\t\t\tconst credentials = JSON.parse(password) as GlobalCredentials;\n\t\t\tconst salt = randomBytes(SALT_LENGTH);\n\t\t\tconst encrypted = encryptCredentials(credentials, salt);\n\n\t\t\tawait mkdir(dirname(ENCRYPTED_CREDENTIALS_FILE), { recursive: true });\n\t\t\tawait writeFile(ENCRYPTED_CREDENTIALS_FILE, encrypted);\n\t\t},\n\t\tasync deletePassword(_service: string, _account: string): Promise<boolean> {\n\t\t\ttry {\n\t\t\t\tawait unlink(ENCRYPTED_CREDENTIALS_FILE);\n\t\t\t\treturn true;\n\t\t\t} catch {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t},\n\t};\n}\n\n// =============================================================================\n// PLAIN FILE PROVIDER (DEVELOPMENT FALLBACK)\n// =============================================================================\n\n/**\n * Plain file provider (legacy, development only)\n * Shows warning when used in production\n * @deprecated Use encrypted file provider instead\n */\n// eslint-disable-next-line @typescript-eslint/no-unused-vars\nfunction _createPlainFileProvider(): KeychainProvider {\n\tlet warningShown = false;\n\n\treturn {\n\t\tname: \"plain-file\",\n\t\tasync isAvailable(): Promise<boolean> {\n\t\t\treturn true;\n\t\t},\n\t\tasync getPassword(_service: string, _account: string): Promise<string | null> {\n\t\t\ttry {\n\t\t\t\tconst content = await readFile(CREDENTIALS_FILE, \"utf8\");\n\t\t\t\treturn content;\n\t\t\t} catch {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t},\n\t\tasync setPassword(_service: string, _account: string, password: string): Promise<void> {\n\t\t\tif (process.env.NODE_ENV === \"production\" && !warningShown) {\n\t\t\t\twarningShown = true;\n\t\t\t}\n\n\t\t\tawait mkdir(dirname(CREDENTIALS_FILE), { recursive: true });\n\t\t\tawait writeFile(CREDENTIALS_FILE, password, { mode: 0o600 }); // Restrict file permissions\n\t\t},\n\t\tasync deletePassword(_service: string, _account: string): Promise<boolean> {\n\t\t\ttry {\n\t\t\t\tawait unlink(CREDENTIALS_FILE);\n\t\t\t\treturn true;\n\t\t\t} catch {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t},\n\t};\n}\n\n// =============================================================================\n// SECURE CREDENTIALS MANAGER\n// =============================================================================\n\n/**\n * Secure Credentials Manager\n *\n * Automatically selects the most secure available storage:\n * 1. OS Keychain (via keytar)\n * 2. Encrypted file\n * 3. Plain file (with warning)\n */\nclass SecureCredentialsManager {\n\tprivate provider: KeychainProvider | null = null;\n\tprivate initialized = false;\n\n\t/**\n\t * Initialize the credentials manager\n\t * Selects the best available provider\n\t */\n\tasync initialize(): Promise<void> {\n\t\tif (this.initialized) {\n\t\t\treturn;\n\t\t}\n\n\t\t// Try keytar first (OS keychain)\n\t\tconst keytarProvider = await createKeytarProvider();\n\t\tif (keytarProvider && (await keytarProvider.isAvailable())) {\n\t\t\tthis.provider = keytarProvider;\n\t\t\tthis.initialized = true;\n\t\t\treturn;\n\t\t}\n\n\t\t// Fall back to encrypted file\n\t\tthis.provider = createEncryptedFileProvider();\n\t\tthis.initialized = true;\n\t}\n\n\t/**\n\t * Get the name of the active provider\n\t */\n\tgetProviderName(): string {\n\t\treturn this.provider?.name ?? \"none\";\n\t}\n\n\t/**\n\t * Get stored credentials\n\t */\n\tasync getCredentials(): Promise<GlobalCredentials | null> {\n\t\tawait this.initialize();\n\t\tif (!this.provider) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst stored = await this.provider.getPassword(SERVICE_NAME, ACCOUNT_NAME);\n\t\tif (!stored) {\n\t\t\t// Check legacy plain file as migration fallback\n\t\t\tconst legacy = await this.getLegacyCredentials();\n\t\t\tif (legacy) {\n\t\t\t\t// Migrate to secure storage\n\t\t\t\tawait this.setCredentials(legacy);\n\t\t\t\t// Delete legacy file after successful migration\n\t\t\t\ttry {\n\t\t\t\t\tawait unlink(CREDENTIALS_FILE);\n\t\t\t\t} catch {\n\t\t\t\t\t// Ignore if file doesn't exist\n\t\t\t\t}\n\t\t\t\treturn legacy;\n\t\t\t}\n\t\t\treturn null;\n\t\t}\n\n\t\ttry {\n\t\t\treturn JSON.parse(stored) as GlobalCredentials;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\t/**\n\t * Get legacy plain-text credentials for migration\n\t */\n\tprivate async getLegacyCredentials(): Promise<GlobalCredentials | null> {\n\t\ttry {\n\t\t\tconst content = await readFile(CREDENTIALS_FILE, \"utf8\");\n\t\t\treturn JSON.parse(content) as GlobalCredentials;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\t/**\n\t * Save credentials securely\n\t */\n\tasync setCredentials(credentials: GlobalCredentials): Promise<void> {\n\t\tawait this.initialize();\n\t\tif (!this.provider) {\n\t\t\tthrow new Error(\"No credentials provider available\");\n\t\t}\n\n\t\tawait this.provider.setPassword(SERVICE_NAME, ACCOUNT_NAME, JSON.stringify(credentials));\n\t}\n\n\t/**\n\t * Clear stored credentials\n\t */\n\tasync clearCredentials(): Promise<void> {\n\t\tawait this.initialize();\n\t\tif (!this.provider) {\n\t\t\treturn;\n\t\t}\n\n\t\tawait this.provider.deletePassword(SERVICE_NAME, ACCOUNT_NAME);\n\n\t\t// Also clean up any legacy files\n\t\ttry {\n\t\t\tawait unlink(CREDENTIALS_FILE);\n\t\t} catch {\n\t\t\t// Ignore\n\t\t}\n\t\ttry {\n\t\t\tawait unlink(ENCRYPTED_CREDENTIALS_FILE);\n\t\t} catch {\n\t\t\t// Ignore\n\t\t}\n\t}\n\n\t/**\n\t * Check if user is logged in\n\t */\n\tasync isLoggedIn(): Promise<boolean> {\n\t\tconst credentials = await this.getCredentials();\n\t\tif (!credentials?.accessToken) {\n\t\t\treturn false;\n\t\t}\n\n\t\t// Check if token is expired\n\t\tif (credentials.expiresAt) {\n\t\t\tconst expiresAt = new Date(credentials.expiresAt);\n\t\t\tif (expiresAt < new Date()) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t}\n\n\t\treturn true;\n\t}\n}\n\n// =============================================================================\n// EXPORTS\n// =============================================================================\n\n// Singleton instance\nlet secureCredentialsManager: SecureCredentialsManager | null = null;\n\n/**\n * Get the secure credentials manager singleton\n */\nexport function getSecureCredentials(): SecureCredentialsManager {\n\tif (!secureCredentialsManager) {\n\t\tsecureCredentialsManager = new SecureCredentialsManager();\n\t}\n\treturn secureCredentialsManager;\n}\n\n/**\n * Secure versions of credential functions (drop-in replacements)\n */\nexport async function getCredentialsSecure(): Promise<GlobalCredentials | null> {\n\treturn getSecureCredentials().getCredentials();\n}\n\nexport async function saveCredentialsSecure(credentials: GlobalCredentials): Promise<void> {\n\treturn getSecureCredentials().setCredentials(credentials);\n}\n\nexport async function clearCredentialsSecure(): Promise<void> {\n\treturn getSecureCredentials().clearCredentials();\n}\n\nexport async function isLoggedInSecure(): Promise<boolean> {\n\treturn getSecureCredentials().isLoggedIn();\n}\n\nexport { SecureCredentialsManager };\n"]}

package/dist/tui-TPJPUS2R.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+export { TuiApp } from './chunk-W5B4GTXR.js';
+import { Sentry } from './chunk-YPTTIXKC.js';
+import { cliState } from './chunk-GRMRYWYS.js';
+import { createServiceClient, connectServiceClient } from './chunk-GSUGROXB.js';
+import './chunk-DMXC2JTC.js';
+import './chunk-VTSNRV3V.js';
+import { __name } from './chunk-EWOJGXRX.js';
+import { readFile, writeFile, unlink } from 'fs/promises';
+import { homedir } from 'os';
+import { join } from 'path';
+import chalk from 'chalk';
+import { render } from 'ink';
+import React from 'react';
+
+process.env.VREKO_CLI='true';process.env.NODE_NO_WARNINGS='1';
+var PID_FILE = join(homedir(), ".vreko", "tui.pid");
+var isShuttingDown = false;
+var inkInstance = null;
+async function acquirePidLock() {
+  try {
+    const existing = await readFile(PID_FILE, "utf-8");
+    const pid = Number.parseInt(existing.trim(), 10);
+    try {
+      process.kill(pid, 0);
+      console.error(`A Vreko TUI session is already running (PID ${pid}). Run \`vr stop\` first.`);
+      process.exit(1);
+    } catch {
+    }
+  } catch {
+  }
+  await writeFile(PID_FILE, String(process.pid), "utf-8");
+}
+__name(acquirePidLock, "acquirePidLock");
+async function releasePidLock() {
+  try {
+    await unlink(PID_FILE);
+  } catch {
+  }
+}
+__name(releasePidLock, "releasePidLock");
+function shutdown(code) {
+  if (isShuttingDown) return;
+  isShuttingDown = true;
+  if (inkInstance) {
+    inkInstance.unmount();
+  }
+  process.stdout.write("\x1B[?25h");
+  process.stdout.write("\x1B[0m\n");
+  releasePidLock().finally(() => process.exit(code));
+}
+__name(shutdown, "shutdown");
+async function launchTui(panelOrOptions = "dashboard") {
+  if (cliState.renderMode !== "ink") {
+    return;
+  }
+  await acquirePidLock();
+  for (const sig of [
+    "SIGINT",
+    "SIGTERM"
+  ]) {
+    process.on(sig, () => shutdown(0));
+  }
+  process.on("uncaughtException", (err) => {
+    Sentry.captureException(err);
+    shutdown(1);
+  });
+  process.on("unhandledRejection", (reason) => {
+    Sentry.captureException(reason instanceof Error ? reason : new Error(String(reason)));
+    shutdown(1);
+  });
+  const opts = typeof panelOrOptions === "string" ? {
+    panel: panelOrOptions
+  } : panelOrOptions;
+  const panel = opts.panel ?? opts.initialPanel ?? "dashboard";
+  const statusFocus = opts.statusFocus ?? false;
+  const client = createServiceClient();
+  try {
+    await connectServiceClient(client);
+  } catch (err) {
+    console.error(chalk.red("Failed to connect to Vreko service:"), err instanceof Error ? err.message : String(err));
+    console.log(chalk.gray("Start the service with: vr service start"));
+    await releasePidLock();
+    process.exit(1);
+  }
+  const { detectOverlayCapability, writeGeckoOverlay, renderGeckoArt } = await import('./gecko-53ITAGG6.js');
+  const capability = detectOverlayCapability();
+  if (capability !== "none") {
+    writeGeckoOverlay(() => renderGeckoArt(capability));
+  }
+  const { TuiApp: TuiApp2 } = await import('./TuiApp-FX23XQBK.js');
+  const instance = render(React.createElement(TuiApp2, {
+    client,
+    initialPanel: panel,
+    statusFocus
+  }), {
+    exitOnCtrlC: false
+  });
+  inkInstance = instance;
+  try {
+    await instance.waitUntilExit();
+  } finally {
+    inkInstance = null;
+    await releasePidLock();
+  }
+}
+__name(launchTui, "launchTui");
+
+export { launchTui };
+//# sourceMappingURL=tui-TPJPUS2R.js.map
+//# sourceMappingURL=tui-TPJPUS2R.js.map

package/dist/tui-TPJPUS2R.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/ui/tui/index.ts"],"names":["PID_FILE","join","homedir","isShuttingDown","inkInstance","acquirePidLock","existing","readFile","pid","Number","parseInt","trim","process","kill","console","error","exit","writeFile","String","releasePidLock","unlink","shutdown","code","unmount","stdout","write","finally","launchTui","panelOrOptions","cliState","renderMode","sig","on","err","Sentry","captureException","reason","Error","opts","panel","initialPanel","statusFocus","client","createServiceClient","connectServiceClient","chalk","red","message","log","gray","detectOverlayCapability","writeGeckoOverlay","renderGeckoArt","capability","TuiApp","instance","render","React","createElement","exitOnCtrlC","waitUntilExit"],"mappings":";;;;;;;;;;;;;;;;AAiCA,IAAMA,QAAAA,GAAWC,IAAAA,CAAKC,OAAAA,EAAAA,EAAW,UAAU,SAAA,CAAA;AAE3C,IAAIC,cAAAA,GAAiB,KAAA;AACrB,IAAIC,WAAAA,GAAqF,IAAA;AAMzF,eAAeC,cAAAA,GAAAA;AACd,EAAA,IAAI;AACH,IAAA,MAAMC,QAAAA,GAAW,MAAMC,QAAAA,CAASP,QAAAA,EAAU,OAAA,CAAA;AAC1C,IAAA,MAAMQ,MAAMC,MAAAA,CAAOC,QAAAA,CAASJ,QAAAA,CAASK,IAAAA,IAAQ,EAAA,CAAA;AAC7C,IAAA,IAAI;AACHC,MAAAA,OAAAA,CAAQC,IAAAA,CAAKL,KAAK,CAAA,CAAA;AAClBM,MAAAA,OAAAA,CAAQC,KAAAA,CAAM,CAAA,4CAAA,EAA+CP,GAAAA,CAAAA,yBAAAA,CAA8B,CAAA;AAC3FI,MAAAA,OAAAA,CAAQI,KAAK,CAAA,CAAA;IACd,CAAA,CAAA,MAAQ;AAER,IAAA;EACD,CAAA,CAAA,MAAQ;AAER,EAAA;AACA,EAAA,MAAMC,UAAUjB,QAAAA,EAAUkB,MAAAA,CAAON,OAAAA,CAAQJ,GAAG,GAAG,OAAA,CAAA;AAChD;AAfeH,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAiBf,eAAec,cAAAA,GAAAA;AACd,EAAA,IAAI;AACH,IAAA,MAAMC,OAAOpB,QAAAA,CAAAA;EACd,CAAA,CAAA,MAAQ;AAER,EAAA;AACD;AANemB,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAYf,SAASE,SAASC,IAAAA,EAAY;AAC7B,EAAA,IAAInB,cAAAA,EAAgB;AACpBA,EAAAA,cAAAA,GAAiB,IAAA;AACjB,EAAA,IAAIC,WAAAA,EAAa;AAChBA,IAAAA,WAAAA,CAAYmB,OAAAA,EAAO;AACpB,EAAA;AACAX,EAAAA,OAAAA,CAAQY,MAAAA,CAAOC,MAAM,WAAA,CAAA;AACrBb,EAAAA,OAAAA,CAAQY,MAAAA,CAAOC,MAAM,WAAA,CAAA;AACrBN,EAAAA,cAAAA,GAAiBO,OAAAA,CAAQ,MAAMd,OAAAA,CAAQI,IAAAA,CAAKM,IAAAA,CAAAA,CAAAA;AAC7C;AATSD,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAeT,eAAsBM,SAAAA,CACrBC,iBAAmE,WAAA,EAAW;AAE9E,EAAA,IAAIC,QAAAA,CAASC,eAAe,KAAA,EAAO;AAElC,IAAA;AACD,EAAA;AAEA,EAAA,MAAMzB,cAAAA,EAAAA;AAGN,EAAA,KAAA,MAAW0B,GAAAA,IAAO;AAAC,IAAA,QAAA;AAAU,IAAA;AAAqB,GAAA,EAAA;AACjDnB,IAAAA,OAAAA,CAAQoB,EAAAA,CAAGD,GAAAA,EAAK,MAAMV,QAAAA,CAAS,CAAA,CAAA,CAAA;AAChC,EAAA;AACAT,EAAAA,OAAAA,CAAQoB,EAAAA,CAAG,mBAAA,EAAqB,CAACC,GAAAA,KAAAA;AAChCC,IAAAA,MAAAA,CAAOC,iBAAiBF,GAAAA,CAAAA;AACxBZ,IAAAA,QAAAA,CAAS,CAAA,CAAA;EACV,CAAA,CAAA;AACAT,EAAAA,OAAAA,CAAQoB,EAAAA,CAAG,oBAAA,EAAsB,CAACI,MAAAA,KAAAA;AACjCF,IAAAA,MAAAA,CAAOC,gBAAAA,CAAiBC,kBAAkBC,KAAAA,GAAQD,MAAAA,GAAS,IAAIC,KAAAA,CAAMnB,MAAAA,CAAOkB,MAAAA,CAAAA,CAAAA,CAAAA;AAC5Ef,IAAAA,QAAAA,CAAS,CAAA,CAAA;EACV,CAAA,CAAA;AAEA,EAAA,MAAMiB,IAAAA,GAAyB,OAAOV,cAAAA,KAAmB,QAAA,GAAW;IAAEW,KAAAA,EAAOX;GAAe,GAAIA,cAAAA;AAChG,EAAA,MAAMW,KAAAA,GAAQD,IAAAA,CAAKC,KAAAA,IAASD,IAAAA,CAAKE,YAAAA,IAAgB,WAAA;AACjD,EAAA,MAAMC,WAAAA,GAAcH,KAAKG,WAAAA,IAAe,KAAA;AAExC,EAAA,MAAMC,SAASC,mBAAAA,EAAAA;AACf,EAAA,IAAI;AACH,IAAA,MAAMC,qBAAqBF,MAAAA,CAAAA;AAC5B,EAAA,CAAA,CAAA,OAAST,GAAAA,EAAK;AACbnB,IAAAA,OAAAA,CAAQC,KAAAA,CACP8B,KAAAA,CAAMC,GAAAA,CAAI,qCAAA,CAAA,EACVb,GAAAA,YAAeI,KAAAA,GAAQJ,GAAAA,CAAIc,OAAAA,GAAU7B,MAAAA,CAAOe,GAAAA,CAAAA,CAAAA;AAE7CnB,IAAAA,OAAAA,CAAQkC,GAAAA,CAAIH,KAAAA,CAAMI,IAAAA,CAAK,0CAAA,CAAA,CAAA;AACvB,IAAA,MAAM9B,cAAAA,EAAAA;AACNP,IAAAA,OAAAA,CAAQI,KAAK,CAAA,CAAA;AACd,EAAA;AAGA,EAAA,MAAM,EAAEkC,uBAAAA,EAAyBC,iBAAAA,EAAmBC,gBAAc,GAAK,MAAM,OAAO,qBAAA,CAAA;AACpF,EAAA,MAAMC,aAAaH,uBAAAA,EAAAA;AACnB,EAAA,IAAIG,eAAe,MAAA,EAAQ;AAC1BF,IAAAA,iBAAAA,CAAkB,MAAMC,cAAAA,CAAeC,UAAAA,CAAAA,CAAAA;AACxC,EAAA;AAEA,EAAA,MAAM,EAAEC,MAAAA,EAAAA,OAAAA,EAAM,GAAK,MAAM,OAAO,sBAAA,CAAA;AAChC,EAAA,MAAMC,QAAAA,GAAWC,MAAAA,CAAOC,KAAAA,CAAMC,aAAAA,CAAcJ,OAAAA,EAAQ;AAAEZ,IAAAA,MAAAA;IAAQF,YAAAA,EAAcD,KAAAA;AAAOE,IAAAA;AAAY,GAAA,CAAA,EAAI;IAClGkB,WAAAA,EAAa;GACd,CAAA;AACAvD,EAAAA,WAAAA,GAAcmD,QAAAA;AAEd,EAAA,IAAI;AACH,IAAA,MAAMA,SAASK,aAAAA,EAAa;EAC7B,CAAA,SAAA;AACCxD,IAAAA,WAAAA,GAAc,IAAA;AACd,IAAA,MAAMe,cAAAA,EAAAA;AACP,EAAA;AACD;AA3DsBQ,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA","file":"tui-TPJPUS2R.js","sourcesContent":["/**\n * Vreko TUI  -  barrel export + launchTui() entry function.\n *\n * launchTui() is the single entry point called by all commands that open the TUI.\n * It handles: PID lockfile, signal/error registration, gecko overlay, Ink render.\n * daemon close() lives in TuiApp useEffect cleanup  -  NOT in this file.\n * Pattern: commands/init/init-command.ts TTY guard + service client lifecycle\n */\nimport { readFile, unlink, writeFile } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { Sentry } from \"@vreko/sentry-privacy\";\nimport chalk from \"chalk\";\nimport { render } from \"ink\";\nimport React from \"react\";\nimport { cliState } from \"../../cli-state.js\";\nimport { connectServiceClient, createServiceClient } from \"../../service-adapter/local-service-adapter.js\";\n\nexport type { PanelId, TuiAppProps } from \"./TuiApp.js\";\nexport { TuiApp } from \"./TuiApp.js\";\n\nexport interface LaunchTuiOptions {\n\tpanel?: import(\"./TuiApp.js\").PanelId;\n\t/** Alias for `panel`  -  preferred spelling in command call sites (TUI-01). */\n\tinitialPanel?: import(\"./TuiApp.js\").PanelId;\n\t/** When true, shows StatusPanel on the dashboard tab (used by `vr status`) */\n\tstatusFocus?: boolean;\n}\n\n// =============================================================================\n// MODULE-LEVEL STATE\n// =============================================================================\n\nconst PID_FILE = join(homedir(), \".vreko\", \"tui.pid\");\n\nlet isShuttingDown = false;\nlet inkInstance: { unmount: () => void; waitUntilExit: () => Promise<unknown> } | null = null;\n\n// =============================================================================\n// PID LOCKFILE HELPERS\n// =============================================================================\n\nasync function acquirePidLock(): Promise<void> {\n\ttry {\n\t\tconst existing = await readFile(PID_FILE, \"utf-8\");\n\t\tconst pid = Number.parseInt(existing.trim(), 10);\n\t\ttry {\n\t\t\tprocess.kill(pid, 0); // throws ESRCH if PID does not exist\n\t\t\tconsole.error(`A Vreko TUI session is already running (PID ${pid}). Run \\`vr stop\\` first.`);\n\t\t\tprocess.exit(1);\n\t\t} catch {\n\t\t\t// Stale PID  -  file exists but process is dead. Fall through to overwrite.\n\t\t}\n\t} catch {\n\t\t// PID file does not exist  -  first launch. Proceed.\n\t}\n\tawait writeFile(PID_FILE, String(process.pid), \"utf-8\");\n}\n\nasync function releasePidLock(): Promise<void> {\n\ttry {\n\t\tawait unlink(PID_FILE);\n\t} catch {\n\t\t// Best effort  -  file may already be removed\n\t}\n}\n\n// =============================================================================\n// SHUTDOWN CONTRACT\n// =============================================================================\n\nfunction shutdown(code: number): void {\n\tif (isShuttingDown) return;\n\tisShuttingDown = true;\n\tif (inkInstance) {\n\t\tinkInstance.unmount(); // triggers useEffect cleanup → daemon close() runs in TuiApp\n\t}\n\tprocess.stdout.write(\"\\x1b[?25h\"); // restore cursor\n\tprocess.stdout.write(\"\\x1b[0m\\n\"); // reset color + newline\n\treleasePidLock().finally(() => process.exit(code));\n}\n\n/**\n * Launch the Vreko TUI for a given initial panel.\n * Machine mode: if cliState.renderMode !== \"ink\", this function does nothing (caller handles output).\n */\nexport async function launchTui(\n\tpanelOrOptions: import(\"./TuiApp.js\").PanelId | LaunchTuiOptions = \"dashboard\",\n): Promise<void> {\n\tif (cliState.renderMode !== \"ink\") {\n\t\t// Machine mode: caller is responsible for JSON output\n\t\treturn;\n\t}\n\n\tawait acquirePidLock();\n\n\t// Register signal and error handlers before render\n\tfor (const sig of [\"SIGINT\", \"SIGTERM\"] as const) {\n\t\tprocess.on(sig, () => shutdown(0));\n\t}\n\tprocess.on(\"uncaughtException\", (err) => {\n\t\tSentry.captureException(err);\n\t\tshutdown(1);\n\t});\n\tprocess.on(\"unhandledRejection\", (reason) => {\n\t\tSentry.captureException(reason instanceof Error ? reason : new Error(String(reason)));\n\t\tshutdown(1);\n\t});\n\n\tconst opts: LaunchTuiOptions = typeof panelOrOptions === \"string\" ? { panel: panelOrOptions } : panelOrOptions;\n\tconst panel = opts.panel ?? opts.initialPanel ?? \"dashboard\";\n\tconst statusFocus = opts.statusFocus ?? false;\n\n\tconst client = createServiceClient();\n\ttry {\n\t\tawait connectServiceClient(client);\n\t} catch (err) {\n\t\tconsole.error(\n\t\t\tchalk.red(\"Failed to connect to Vreko service:\"),\n\t\t\terr instanceof Error ? err.message : String(err),\n\t\t);\n\t\tconsole.log(chalk.gray(\"Start the service with: vr service start\"));\n\t\tawait releasePidLock();\n\t\tprocess.exit(1);\n\t}\n\n\t// Gecko overlay  -  write before Ink render()\n\tconst { detectOverlayCapability, writeGeckoOverlay, renderGeckoArt } = await import(\"../gecko/index.js\");\n\tconst capability = detectOverlayCapability();\n\tif (capability !== \"none\") {\n\t\twriteGeckoOverlay(() => renderGeckoArt(capability));\n\t}\n\n\tconst { TuiApp } = await import(\"./TuiApp.js\");\n\tconst instance = render(React.createElement(TuiApp, { client, initialPanel: panel, statusFocus }), {\n\t\texitOnCtrlC: false, // We manage shutdown ourselves\n\t});\n\tinkInstance = instance;\n\n\ttry {\n\t\tawait instance.waitUntilExit();\n\t} finally {\n\t\tinkInstance = null;\n\t\tawait releasePidLock();\n\t}\n}\n"]}

package/dist/vreko-dir-O3RLG7PI.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+export { GlobalConfigSchema, GlobalCredentialsSchema, LearningEntrySchema, ProtectedFileSchema, SessionStateSchema, ViolationEntrySchema, WorkspaceConfigSchema, WorkspaceVitalsSchema, appendVrekoJsonl, clearCredentials, createGlobalDirectory, createVrekoDirectory, deleteGlobalJson, endCurrentSession, findWorkspaceRoot, getCredentials, getCurrentSession, getGlobalConfig, getGlobalDir, getGlobalPath, getLearnings, getProtectedFiles, getStats, getViolations, getWorkspaceConfig, getWorkspaceDir, getWorkspacePath, getWorkspaceVitals, isLoggedIn, isVrekoInitialized, loadVrekoJsonl, pathExists, readGlobalJson, readVrekoJson, recordLearning, recordViolation, saveBenchmarkOptIn, saveCredentials, saveCurrentSession, saveGlobalConfig, saveProtectedFiles, saveWorkspaceConfig, saveWorkspaceVitals, writeGlobalJson, writeVrekoJson } from './chunk-HFQHU5LC.js';
+export { generateId } from './chunk-KJWKY4L4.js';
+import './chunk-EWOJGXRX.js';
+
+process.env.VREKO_CLI='true';process.env.NODE_NO_WARNINGS='1';
+//# sourceMappingURL=vreko-dir-O3RLG7PI.js.map
+//# sourceMappingURL=vreko-dir-O3RLG7PI.js.map

package/dist/vreko-dir-O3RLG7PI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"vreko-dir-O3RLG7PI.js"}

package/package.json

@@ -0,0 +1,132 @@
+{
+  "name": "@vreko/cli",
+  "version": "3.0.1",
+  "description": "Vreko CLI — AI-aware developer intelligence for the command line",
+  "homepage": "https://vreko.dev",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/vreko-dev/vreko-cli.git"
+  },
+  "bugs": {
+    "url": "https://github.com/vreko-dev/vreko-cli/issues"
+  },
+  "license": "Apache-2.0",
+  "author": {
+    "name": "Vreko Team",
+    "url": "https://vreko.dev"
+  },
+  "keywords": [
+    "vreko",
+    "ambient-codebase-intelligence",
+    "codebase-intelligence",
+    "ai-codebase-intelligence",
+    "ai-coding-mistakes-prevention",
+    "fragile-files",
+    "cursor-companion",
+    "claude-code-companion",
+    "copilot-companion",
+    "ai-agent-context",
+    "cli",
+    "snapshots",
+    "intelligence"
+  ],
+  "bin": {
+    "vreko": "dist/index.js",
+    "vr": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "scripts",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "@better-auth/passkey": "1.6.5",
+    "@better-auth/sso": "1.6.5",
+    "@clack/prompts": "^1.1.0",
+    "@electric-sql/pglite": "0.2.0",
+    "@inkjs/ui": "^2.0.0",
+    "@modelcontextprotocol/sdk": "1.28.0",
+    "@sentry/node": "10.32.1",
+    "better-auth": "1.6.5",
+    "boxen": "8.0.1",
+    "chalk": "4.1.2",
+    "chokidar": "4.0.3",
+    "cli-table3": "0.6.5",
+    "commander": "9.5.0",
+    "conf": "13.0.1",
+    "cookie": "1.1.1",
+    "dotenv": "17.2.2",
+    "drizzle-orm": "0.45.2",
+    "eventemitter2": "6.4.9",
+    "execa": "9.5.2",
+    "ink": "^6.8.0",
+    "ky": "1.7.2",
+    "listr2": "10.2.1",
+    "llm-guard": "^0.1.8",
+    "log-update": "6.1.0",
+    "opossum": "9.0.0",
+    "ora": "5.4.1",
+    "react": "19.1.2",
+    "zod": "3.25.76",
+    "@vreko/claims-ledger": "0.1.0",
+    "@vreko/contracts": "1.0.0",
+    "@vreko/auth": "0.1.0",
+    "@vreko/intelligence": "0.1.0",
+    "@vreko/mcp": "0.1.0",
+    "@vreko/local-service-client": "0.0.1",
+    "@vreko/local-service": "3.0.0",
+    "@vreko/mcp-client": "0.1.0",
+    "@vreko/sentry-privacy": "0.0.1",
+    "@vreko/mcp-config": "1.0.0"
+  },
+  "optionalDependencies": {
+    "keytar": "7.9.0"
+  },
+  "devDependencies": {
+    "@types/react": "19.1.13",
+    "@vitest/coverage-v8": "3.2.4",
+    "ink-gradient": "^4.0.0",
+    "ink-testing-library": "^4.0.0",
+    "react-devtools-core": "^6.1.2",
+    "tsup": "8.5.0",
+    "tsx": "4.20.5",
+    "typescript": "5.9.2",
+    "vitest": "3.2.4"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "exports": {
+    ".": "./dist/index.js",
+    "./services/vreko-dir": "./dist/services/vreko-dir.js"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=20.9.0",
+    "npm": ">=8.0.0",
+    "pnpm": ">=8.0.0"
+  },
+  "scripts": {
+    "postinstall": "node scripts/postinstall.mjs",
+    "preuninstall": "node scripts/preuninstall.mjs",
+    "build": "tsup && tsc --build tsconfig.build.json --emitDeclarationOnly && node scripts/verify-jsx-transform.mjs",
+    "check": "biome check .",
+    "check:banned-words": "tsx scripts/check-banned-words.ts",
+    "dev": "tsup --watch",
+    "format": "biome format --write .",
+    "lint": "biome lint .",
+    "lint:fix": "biome lint --fix .",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "test:watch": "vitest",
+    "type-check": "tsc -p tsconfig.json --noEmit",
+    "cli:install": "pnpm build && pnpm link --global && echo '✅ CLI installed globally. Run: vreko --help or vr --help'",
+    "cli:uninstall": "pnpm unlink --global && echo '✅ CLI uninstalled globally'",
+    "cli:reinstall": "pnpm run cli:uninstall && pnpm run cli:install",
+    "mcp:configure": "node dist/index.js tools configure --yes",
+    "mcp:configure:dev": "node dist/index.js tools configure --yes --dev",
+    "mcp:status": "node dist/index.js tools configure --list"
+  }
+}