ccprofiles-core 0.1.1 → 0.3.0

package/dist/adopt.d.ts

@@ -2,3 +2,11 @@ import type { LiveProfile } from './discovery.js';
 import type { Manifest } from './manifest.js';
 import { type Platform } from './platform.js';
 export declare function buildManifest(live: LiveProfile[], platform: Platform): Manifest;
+/**
+ * Re-migrate secret refs after a snapshot/adopt rebuilds the manifest from live state.
+ * Live settings.json holds resolved plaintext values, so a freshly built manifest would
+ * re-leak a previously migrated token as plaintext. For each profile that existed before,
+ * if the old manifest had a secret:// ref whose resolved value matches the newly-discovered
+ * plaintext value, restore the ref instead of the plaintext.
+ */
+export declare function preserveSecretRefs(newM: Manifest, oldM: Manifest, getSecret: (name: string) => Promise<string | null>): Promise<void>;

package/dist/adopt.js

@@ -32,7 +32,29 @@ export function buildManifest(live, platform) {
             env: {},
             links,
             mcp: Object.keys(lp.mcpServers).sort(),
+            settingsEnv: lp.settingsEnv,
         };
     });
     return { version: 1, hub, profiles, mcpServers };
 }
+/**
+ * Re-migrate secret refs after a snapshot/adopt rebuilds the manifest from live state.
+ * Live settings.json holds resolved plaintext values, so a freshly built manifest would
+ * re-leak a previously migrated token as plaintext. For each profile that existed before,
+ * if the old manifest had a secret:// ref whose resolved value matches the newly-discovered
+ * plaintext value, restore the ref instead of the plaintext.
+ */
+export async function preserveSecretRefs(newM, oldM, getSecret) {
+    for (const pr of newM.profiles) {
+        const old = oldM.profiles.find(p => p.name === pr.name);
+        if (!old)
+            continue;
+        for (const [k, v] of Object.entries(old.settingsEnv ?? {})) {
+            if (!v.startsWith('secret://'))
+                continue;
+            const resolved = await getSecret(v.slice('secret://'.length));
+            if (resolved !== null && pr.settingsEnv[k] === resolved)
+                pr.settingsEnv[k] = v;
+        }
+    }
+}

package/dist/apply.d.ts

@@ -16,8 +16,14 @@ export type ApplyAction = {
     kind: 'rc-block';
     rcFile: string;
     block: string;
+} | {
+    kind: 'set-settings-env';
+    settingsPath: string;
+    env: Record<string, string>;
 };
-export declare function planApply(m: Manifest, live: LiveProfile[], p: Platform): ApplyAction[];
+/** Resolve secret:// refs in every profile's settingsEnv. Throws on a missing secret. */
+export declare function resolveSettingsEnv(m: Manifest, getSecret: (name: string) => Promise<string | null>): Promise<Record<string, Record<string, string>>>;
+export declare function planApply(m: Manifest, live: LiveProfile[], p: Platform, resolvedSettingsEnv?: Record<string, Record<string, string>>): ApplyAction[];
 export declare function executeApply(actions: ApplyAction[], opts: {
     backupRoot: string;
     stamp: string;

package/dist/apply.js

@@ -10,7 +10,28 @@ function configPathFor(dir, home) {
 function sortKeys(o) {
     return Object.fromEntries(Object.entries(o).sort(([a], [b]) => a.localeCompare(b)));
 }
-export function planApply(m, live, p) {
+const SECRET_PREFIX = 'secret://';
+/** Resolve secret:// refs in every profile's settingsEnv. Throws on a missing secret. */
+export async function resolveSettingsEnv(m, getSecret) {
+    const out = {};
+    for (const pr of m.profiles) {
+        const env = {};
+        for (const [k, v] of Object.entries(pr.settingsEnv ?? {})) {
+            if (v.startsWith(SECRET_PREFIX)) {
+                const ref = v.slice(SECRET_PREFIX.length);
+                const val = await getSecret(ref);
+                if (val === null)
+                    throw new Error(`profile "${pr.name}": secret not found: ${ref} (for ${k})`);
+                env[k] = val;
+            }
+            else
+                env[k] = v;
+        }
+        out[pr.name] = env;
+    }
+    return out;
+}
+export function planApply(m, live, p, resolvedSettingsEnv) {
     const actions = [];
     const hubProfile = m.profiles.find(x => x.name === m.hub) ?? null;
     for (const pr of m.profiles) {
@@ -34,6 +55,19 @@ export function planApply(m, live, p) {
                 continue;
             actions.push({ kind: 'link', from, to });
         }
+        const senv = pr.settingsEnv ?? {}; // literals in older tests may omit the field
+        if (Object.keys(senv).length > 0) {
+            let desired = resolvedSettingsEnv?.[pr.name];
+            if (!desired) {
+                if (Object.values(senv).some(v => v.startsWith(SECRET_PREFIX)))
+                    throw new Error(`profile "${pr.name}": settingsEnv has secret refs — pass resolved settings env to planApply`);
+                desired = senv;
+            }
+            const currentEnv = lp?.settingsEnv ?? null;
+            if (!currentEnv || JSON.stringify(sortKeys(currentEnv)) !== JSON.stringify(sortKeys(desired))) {
+                actions.push({ kind: 'set-settings-env', settingsPath: join(dir, 'settings.json'), env: desired });
+            }
+        }
     }
     const block = renderRcBlock(m, p);
     let rcCurrent = '';
@@ -49,7 +83,10 @@ export async function executeApply(actions, opts) {
     const performed = actions.map(describe);
     if (opts.dryRun)
         return { backupDir: null, performed };
-    const touched = actions.flatMap(a => a.kind === 'set-mcp-servers' ? [a.configPath] : a.kind === 'rc-block' ? [a.rcFile] : []);
+    const touched = actions.flatMap(a => a.kind === 'set-mcp-servers' ? [a.configPath]
+        : a.kind === 'rc-block' ? [a.rcFile]
+            : a.kind === 'set-settings-env' ? [a.settingsPath]
+                : []);
     const backupDir = touched.length ? await backupFiles(touched, opts.backupRoot, opts.stamp) : null;
     for (const a of actions) {
         if (a.kind === 'create-profile-dir') {
@@ -89,6 +126,16 @@ export async function executeApply(actions, opts) {
             await mkdir(dirname(a.rcFile), { recursive: true });
             await atomicWrite(a.rcFile, upsertManagedBlock(rc, a.block));
         }
+        else if (a.kind === 'set-settings-env') {
+            let cfg = {};
+            try {
+                cfg = JSON.parse(await readFile(a.settingsPath, 'utf8'));
+            }
+            catch { /* new file */ }
+            cfg.env = a.env;
+            await mkdir(dirname(a.settingsPath), { recursive: true });
+            await atomicWrite(a.settingsPath, JSON.stringify(cfg, null, 2));
+        }
     }
     return { backupDir, performed };
 }
@@ -98,5 +145,6 @@ function describe(a) {
         case 'create-profile-dir': return `create ${a.dir}`;
         case 'link': return `link ${a.from} -> ${a.to}`;
         case 'rc-block': return `update managed block in ${a.rcFile}`;
+        case 'set-settings-env': return `set settings env (${Object.keys(a.env).length}) in ${a.settingsPath}`;
     }
 }

package/dist/devices.js

@@ -2,7 +2,7 @@ import { readFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { atomicWrite } from './fsutil.js';
-const IGNORE = ['secrets.enc', 'secret-names.json', 'devices.json', 'backups/', '*.ccp-tmp'];
+const IGNORE = ['secrets.enc', 'secrets.dpapi.json', 'secret-names.json', 'devices.json', 'backups/', '*.ccp-tmp'];
 export async function loadDevices(root) {
     const f = join(root, 'devices.json');
     if (!existsSync(f))

package/dist/discovery.d.ts

@@ -6,5 +6,6 @@ export interface LiveProfile {
     account: string | null;
     mcpServers: Record<string, McpServerDef>;
     links: Record<string, string>;
+    settingsEnv: Record<string, string>;
 }
 export declare function discoverProfiles(home: string): Promise<LiveProfile[]>;

package/dist/discovery.js

@@ -26,6 +26,15 @@ export async function discoverProfiles(home) {
                 catch { /* skip */ }
             }
         }
+        const settingsEnv = {};
+        try {
+            const s = JSON.parse(await readFile(join(dir, 'settings.json'), 'utf8'));
+            if (s && typeof s.env === 'object' && s.env !== null)
+                for (const [k, v] of Object.entries(s.env))
+                    if (typeof v === 'string')
+                        settingsEnv[k] = v;
+        }
+        catch { /* no settings.json */ }
         out.push({
             dirName: e.name,
             dir,
@@ -33,6 +42,7 @@ export async function discoverProfiles(home) {
             account: cfg?.oauthAccount?.emailAddress ?? null,
             mcpServers: cfg?.mcpServers ?? {},
             links,
+            settingsEnv,
         });
     }
     return out.sort((a, b) => a.dirName.localeCompare(b.dirName));

package/dist/manifest.d.ts

@@ -1,20 +1,32 @@
 import { z } from 'zod';
 export declare class ManifestError extends Error {
 }
-declare const McpServerSchema: z.ZodObject<{
-    command: z.ZodString;
+declare const McpServerSchema: z.ZodEffects<z.ZodObject<{
+    command: z.ZodOptional<z.ZodString>;
     args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     type: z.ZodOptional<z.ZodString>;
     url: z.ZodOptional<z.ZodString>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    command: z.ZodString;
+    command: z.ZodOptional<z.ZodString>;
     args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     type: z.ZodOptional<z.ZodString>;
     url: z.ZodOptional<z.ZodString>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    command: z.ZodString;
+    command: z.ZodOptional<z.ZodString>;
+    args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    type: z.ZodOptional<z.ZodString>;
+    url: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>, z.objectOutputType<{
+    command: z.ZodOptional<z.ZodString>;
+    args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    type: z.ZodOptional<z.ZodString>;
+    url: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    command: z.ZodOptional<z.ZodString>;
     args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     type: z.ZodOptional<z.ZodString>;
@@ -28,6 +40,7 @@ declare const ProfileSchema: z.ZodObject<{
     env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     links: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     mcp: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    settingsEnv: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, "strip", z.ZodTypeAny, {
     env: Record<string, string>;
     name: string;
@@ -36,6 +49,7 @@ declare const ProfileSchema: z.ZodObject<{
     auth: "env" | "oauth" | "api-key";
     links: Record<string, string>;
     mcp: string[];
+    settingsEnv: Record<string, string>;
 }, {
     name: string;
     dir: string;
@@ -44,6 +58,7 @@ declare const ProfileSchema: z.ZodObject<{
     env?: Record<string, string> | undefined;
     links?: Record<string, string> | undefined;
     mcp?: string[] | undefined;
+    settingsEnv?: Record<string, string> | undefined;
 }>;
 declare const ManifestSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
@@ -56,6 +71,7 @@ declare const ManifestSchema: z.ZodObject<{
         env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
         links: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
         mcp: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        settingsEnv: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     }, "strip", z.ZodTypeAny, {
         env: Record<string, string>;
         name: string;
@@ -64,6 +80,7 @@ declare const ManifestSchema: z.ZodObject<{
         auth: "env" | "oauth" | "api-key";
         links: Record<string, string>;
         mcp: string[];
+        settingsEnv: Record<string, string>;
     }, {
         name: string;
         dir: string;
@@ -72,21 +89,34 @@ declare const ManifestSchema: z.ZodObject<{
         env?: Record<string, string> | undefined;
         links?: Record<string, string> | undefined;
         mcp?: string[] | undefined;
+        settingsEnv?: Record<string, string> | undefined;
     }>, "many">;
-    mcpServers: z.ZodRecord<z.ZodString, z.ZodObject<{
-        command: z.ZodString;
+    mcpServers: z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
+        command: z.ZodOptional<z.ZodString>;
         args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         type: z.ZodOptional<z.ZodString>;
         url: z.ZodOptional<z.ZodString>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        command: z.ZodString;
+        command: z.ZodOptional<z.ZodString>;
+        args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        type: z.ZodOptional<z.ZodString>;
+        url: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        command: z.ZodOptional<z.ZodString>;
+        args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        type: z.ZodOptional<z.ZodString>;
+        url: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>, z.objectOutputType<{
+        command: z.ZodOptional<z.ZodString>;
         args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         type: z.ZodOptional<z.ZodString>;
         url: z.ZodOptional<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        command: z.ZodString;
+        command: z.ZodOptional<z.ZodString>;
         args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         type: z.ZodOptional<z.ZodString>;
@@ -103,9 +133,10 @@ declare const ManifestSchema: z.ZodObject<{
         auth: "env" | "oauth" | "api-key";
         links: Record<string, string>;
         mcp: string[];
+        settingsEnv: Record<string, string>;
     }[];
     mcpServers: Record<string, z.objectOutputType<{
-        command: z.ZodString;
+        command: z.ZodOptional<z.ZodString>;
         args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         type: z.ZodOptional<z.ZodString>;
@@ -122,9 +153,10 @@ declare const ManifestSchema: z.ZodObject<{
         env?: Record<string, string> | undefined;
         links?: Record<string, string> | undefined;
         mcp?: string[] | undefined;
+        settingsEnv?: Record<string, string> | undefined;
     }[];
     mcpServers: Record<string, z.objectInputType<{
-        command: z.ZodString;
+        command: z.ZodOptional<z.ZodString>;
         args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         type: z.ZodOptional<z.ZodString>;

package/dist/manifest.js

@@ -8,12 +8,12 @@ const exec = promisify(execFile);
 export class ManifestError extends Error {
 }
 const McpServerSchema = z.object({
-    command: z.string(),
+    command: z.string().optional(),
     args: z.array(z.string()).optional(),
     env: z.record(z.string()).optional(),
     type: z.string().optional(),
     url: z.string().optional(),
-}).passthrough();
+}).passthrough().refine(s => s.command !== undefined || s.url !== undefined, { message: 'mcp server must have either "command" (local) or "url" (remote)' });
 const ProfileSchema = z.object({
     name: z.string().min(1),
     dir: z.string().min(1),
@@ -22,6 +22,7 @@ const ProfileSchema = z.object({
     env: z.record(z.string()).default({}),
     links: z.record(z.string()).default({}),
     mcp: z.array(z.string()).default([]),
+    settingsEnv: z.record(z.string()).default({}),
 });
 const ManifestSchema = z.object({
     version: z.literal(1),
@@ -56,6 +57,15 @@ export function assertSafeManifest(m) {
                     throw new ManifestError(`unsafe secret reference in profile "${p.name}": ${JSON.stringify(v)}`);
             }
         }
+        for (const [k, v] of Object.entries(p.settingsEnv)) {
+            if (!SAFE_ENV_KEY.test(k))
+                throw new ManifestError(`unsafe settings env var name in profile "${p.name}": ${JSON.stringify(k)}`);
+            if (v.startsWith(SECRET_PREFIX)) {
+                const ref = v.slice(SECRET_PREFIX.length);
+                if (!SAFE_NAME.test(ref))
+                    throw new ManifestError(`unsafe secret reference in profile "${p.name}": ${JSON.stringify(v)}`);
+            }
+        }
     }
 }
 export function parseManifest(text) {
@@ -84,8 +94,10 @@ export async function loadManifest(root) {
     return parseManifest(await readFile(join(root, 'manifest.yaml'), 'utf8'));
 }
 export async function saveManifest(root, m) {
+    const yaml = serializeManifest(m);
+    parseManifest(yaml); // guard: never write a manifest that cannot be reloaded
     await mkdir(root, { recursive: true });
-    await writeFile(join(root, 'manifest.yaml'), serializeManifest(m), 'utf8');
+    await writeFile(join(root, 'manifest.yaml'), yaml, 'utf8');
     try {
         await exec('git', ['-C', root, 'rev-parse', '--git-dir']);
         await exec('git', ['-C', root, 'add', '-A']);

package/dist/secrets.d.ts

@@ -35,6 +35,21 @@ export declare class SecretToolBackend implements SecretsBackend {
     get(key: string): Promise<string | null>;
     delete(key: string): Promise<void>;
 }
+export type DpapiCrypt = {
+    protect(plain: string): Promise<string>;
+    unprotect(b64: string): Promise<string>;
+};
+export declare const powershellDpapi: DpapiCrypt;
+export declare class DpapiBackend implements SecretsBackend {
+    private filePath;
+    private crypt;
+    readonly name = "windows-dpapi";
+    constructor(filePath: string, crypt?: DpapiCrypt);
+    private load;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+}
 export declare class SecretsStore {
     private backend;
     private indexPath;

package/dist/secrets.js

@@ -100,6 +100,64 @@ export class SecretToolBackend {
         catch { /* absent */ }
     }
 }
+// DPAPI via built-in PowerShell. Secret bytes travel through a spawn env var, never argv.
+export const powershellDpapi = {
+    protect: (plain) => runDpapi(
+    // [string] cast coerces a $null CCP_IN (empty env var) to '' before GetBytes, which
+    // otherwise throws on $null. Only needed here — unprotect's CCP_IN is base64 ciphertext
+    // and is never empty for a stored value.
+    "$b=[Text.Encoding]::UTF8.GetBytes([string]$env:CCP_IN);" +
+        "[Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Protect($b,$null,'CurrentUser'))", plain),
+    unprotect: async (b64) => {
+        // PS emits base64 of the *decrypted bytes* (not the decoded string) so runDpapi's
+        // trim is always ASCII-safe and we never depend on the PowerShell console's
+        // stdout encoding to round-trip arbitrary plaintext (e.g. non-ASCII, trailing whitespace).
+        const out = await runDpapi("$b=[Convert]::FromBase64String($env:CCP_IN);" +
+            "[Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser'))", b64);
+        return Buffer.from(out, 'base64').toString('utf8');
+    },
+};
+async function runDpapi(script, input) {
+    const child = await import('node:child_process');
+    return new Promise((resolve, reject) => {
+        const proc = child.spawn('powershell', ['-NoProfile', '-NonInteractive', '-Command', 'Add-Type -AssemblyName System.Security;' + script], { env: { ...process.env, CCP_IN: input }, stdio: ['ignore', 'pipe', 'pipe'] });
+        let out = '';
+        let err = '';
+        proc.stdout.on('data', d => { out += d; });
+        proc.stderr.on('data', d => { err += d; });
+        proc.on('error', reject);
+        proc.on('close', code => (code === 0 ? resolve(out.trim()) : reject(new Error(`powershell dpapi exited ${code}: ${err.trim()}`))));
+    });
+}
+export class DpapiBackend {
+    filePath;
+    crypt;
+    name = 'windows-dpapi';
+    constructor(filePath, crypt = powershellDpapi) {
+        this.filePath = filePath;
+        this.crypt = crypt;
+    }
+    async load() {
+        if (!existsSync(this.filePath))
+            return { entries: {} };
+        return JSON.parse(await readFile(this.filePath, 'utf8'));
+    }
+    async get(key) {
+        const f = await this.load();
+        const ct = f.entries[key];
+        return ct === undefined ? null : this.crypt.unprotect(ct);
+    }
+    async set(key, value) {
+        const f = await this.load();
+        f.entries[key] = await this.crypt.protect(value);
+        await atomicWrite(this.filePath, JSON.stringify(f));
+    }
+    async delete(key) {
+        const f = await this.load();
+        delete f.entries[key];
+        await atomicWrite(this.filePath, JSON.stringify(f));
+    }
+}
 export class SecretsStore {
     backend;
     indexPath;
@@ -137,6 +195,8 @@ export async function defaultBackend(p, opts) {
         }
         catch { /* fall through */ }
     }
+    if (p.os === 'win32')
+        return new DpapiBackend(opts.filePath.replace(/\.enc$/, '.dpapi.json'));
     const pw = opts.passphrase ? await opts.passphrase() : '';
     if (!pw)
         throw new Error('encrypted-file backend requires a passphrase');

package/package.json

@@ -1,16 +1,33 @@
 {
   "name": "ccprofiles-core",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "description": "Core library for ccprofiles — discovery, manifest, secrets, apply, and LAN sync for Claude Code multi-account setups",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
-  "files": ["dist"],
+  "files": [
+    "dist"
+  ],
   "license": "MIT",
-  "repository": { "type": "git", "url": "git+https://github.com/tmfadhlul/claude-code-profile.git", "directory": "packages/core" },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tmfadhlul/claude-code-profile.git",
+    "directory": "packages/core"
+  },
   "homepage": "https://github.com/tmfadhlul/claude-code-profile#readme",
   "bugs": "https://github.com/tmfadhlul/claude-code-profile/issues",
-  "keywords": ["claude-code", "claude", "profiles", "mcp", "config-management"],
-  "engines": { "node": ">=20" },
-  "dependencies": { "yaml": "^2.5.0", "zod": "^3.23.0" }
+  "keywords": [
+    "claude-code",
+    "claude",
+    "profiles",
+    "mcp",
+    "config-management"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "yaml": "^2.5.0",
+    "zod": "^3.23.0"
+  }
 }