creatorverse-cli 0.0.0-stage → 1.0.3

package/README.md

@@ -1,3 +1,98 @@
-# Temporary Holding Version
+# CreatorVerse Network CLI (`creatorverse-cli`)
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Official Command-Line Interface for the **CreatorVerse Network**.
+
+This package provides two dedicated CLI executables:
+1. `creatorverse` — Registered User CLI for browsing channels, verifying identity, and accessing creator tools.
+2. `creatorverse-admin` — Administrative CLI with strictly enforced Multi-Factor Authentication (TOTP), role-based privilege checks, device binding, and encrypted credential storage.
+
+---
+
+## 1. System Requirements
+
+- **Node.js**: `>= 18.0.0`
+- **Supported Operating Systems**:
+  - Windows 10/11 (CMD & PowerShell)
+  - macOS 12+ (Terminal / zsh / bash)
+  - Linux (Ubuntu, Debian, Fedora, Arch, CentOS)
+
+---
+
+## 2. Installation & Setup
+
+### Local / Staging Installation (Recommended for Development)
+```bash
+# Build the distributable artifacts
+cd cli
+npm run build
+
+# Install globally from the local archive
+npm pack
+npm install -g ./creatorverse-cli-1.0.0.tgz
+```
+
+### Verification
+```bash
+creatorverse --version
+creatorverse-admin --version
+```
+
+### Upgrading
+```bash
+npm install -g ./creatorverse-cli-1.0.1.tgz
+```
+
+### Removal
+```bash
+npm uninstall -g creatorverse-cli
+```
+
+---
+
+## 3. User CLI (`creatorverse`) Commands
+
+### Interactive Browser Login (PKCE)
+```bash
+creatorverse login --browser --api-url https://api.creatorverse.network
+```
+1. Initiates an ephemeral loopback listener on `127.0.0.1:<random-port>`.
+2. Directs your browser to complete Firebase Authentication.
+3. Automatically exchanges the single-use ticket via SHA-256 PKCE.
+4. Stores encrypted credentials in `~/.creatorverse/auth-secure.enc`.
+
+### Offline Sandbox Mode
+```bash
+creatorverse login --offline
+creatorverse whoami
+creatorverse channels
+creatorverse logout
+```
+
+---
+
+## 4. Admin CLI (`creatorverse-admin`) Commands
+
+### Interactive Administrator Login (Browser + TOTP MFA)
+```bash
+creatorverse-admin login --browser --api-url https://api.creatorverse.network --device-id my-workstation-01
+```
+1. Directs to the secure administrator verification portal.
+2. Validates Platform Owner claims and requests mandatory 6-digit TOTP MFA.
+3. Issues a 30-minute administrative session backed by server-authoritative Firestore records.
+
+### Inspect Server Identity & RBAC Matrix
+```bash
+creatorverse-admin whoami
+creatorverse-admin permissions
+creatorverse-admin audit-logs
+creatorverse-admin logout
+```
+
+---
+
+## 5. Security & Vault Architecture
+
+- **Credential Encryption**: All session tokens and credentials are encrypted using **AES-256-GCM** with an HKDF-derived key bound to workstation-specific entropy.
+- **POSIX Permissions**: Vault files are created with strict `0o600` permissions (user read/write only) within `~/.creatorverse/`.
+- **Zero Token Leakage**: Tokens, secrets, and passwords are automatically redacted (`[REDACTED]`) from terminal outputs and error traces.
+- **Fail-Closed Networking**: AbortController enforcement guarantees immediate fail-closed termination upon network timeout (5000ms default) or unreachable services.

package/bin/creatorverse

@@ -0,0 +1,7 @@
+#!/usr/bin/env sh
+DIR="$(cd "$(dirname "$0")" && pwd)"
+if [ -f "$DIR/../dist/creatorverse.js" ]; then
+  exec node "$DIR/../dist/creatorverse.js" "$@"
+else
+  exec node "$DIR/creatorverse.js" "$@"
+fi

package/bin/creatorverse-admin

@@ -0,0 +1,7 @@
+#!/usr/bin/env sh
+DIR="$(cd "$(dirname "$0")" && pwd)"
+if [ -f "$DIR/../dist/creatorverse-admin.js" ]; then
+  exec node "$DIR/../dist/creatorverse-admin.js" "$@"
+else
+  exec node "$DIR/creatorverse-admin.js" "$@"
+fi

package/bin/creatorverse-admin.cmd

@@ -0,0 +1,16 @@
+@ECHO off
+GOTO start
+:find_dp0
+SET dp0=%~dp0
+EXIT /b
+:start
+SETLOCAL
+CALL :find_dp0
+
+IF EXIST "%dp0%..\dist\creatorverse-admin.js" (
+  SET "_prog=%dp0%..\dist\creatorverse-admin.js"
+) ELSE (
+  SET "_prog=%dp0%creatorverse-admin.js"
+)
+
+endLocal & node "%_prog%" %*

package/bin/creatorverse-admin.ps1

@@ -0,0 +1,8 @@
+#!/usr/bin/env pwsh
+$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$distPath = Join-Path $scriptDir "..\dist\creatorverse-admin.js"
+if (-Not (Test-Path $distPath)) {
+    $distPath = Join-Path $scriptDir "creatorverse-admin.js"
+}
+& node "$distPath" $args
+exit $LASTEXITCODE

package/bin/creatorverse.cmd

@@ -0,0 +1,16 @@
+@ECHO off
+GOTO start
+:find_dp0
+SET dp0=%~dp0
+EXIT /b
+:start
+SETLOCAL
+CALL :find_dp0
+
+IF EXIST "%dp0%..\dist\creatorverse.js" (
+  SET "_prog=%dp0%..\dist\creatorverse.js"
+) ELSE (
+  SET "_prog=%dp0%creatorverse.js"
+)
+
+endLocal & node "%_prog%" %*

package/bin/creatorverse.ps1

@@ -0,0 +1,8 @@
+#!/usr/bin/env pwsh
+$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$distPath = Join-Path $scriptDir "..\dist\creatorverse.js"
+if (-Not (Test-Path $distPath)) {
+    $distPath = Join-Path $scriptDir "creatorverse.js"
+}
+& node "$distPath" $args
+exit $LASTEXITCODE

package/dist/creatorverse-admin.d.ts

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+/**
+ * CreatorVerse Admin CLI — Stage E1.2 & E1.3 Controlled Admin CLI Integration
+ *
+ * Secure Administrative Command-Line Interface connecting to:
+ * - /api/admin/cli-session (POST)
+ * - /api/admin/cli-session/verify (GET)
+ * - /api/admin/cli-session/revoke (POST)
+ * - /api/admin/cli-session/audit-logs (GET)
+ * - /api/cli/auth/exchange (POST)
+ *
+ * Security Guardrails:
+ * 1. ADMIN_CLI_PRODUCTION_ENABLED = false: Disables live production execution pending verified browser auth.
+ * 2. Mandatory MFA interactive masking / Browser MFA: TOTP codes are entered privately without exposure in shell history, argv, or process listings.
+ * 3. Server-authoritative privilege checks: Local tokens/roles/permissions are never trusted; backend enforces RBAC, device binding, and revocation.
+ * 4. AES-256-GCM encrypted credential vault with strict 0o600 file / 0o700 directory permissions.
+ * 5. Safe network timeouts (5000ms AbortController) and fail-closed handling on network or authentication failure.
+ * 6. Total isolation between production and offline test mode (retaining 100% backward compatibility for existing suites).
+ */
+export declare const VERSION = "1.0.3";
+export declare const CONFIG_DIR: string;
+export declare const ADMIN_CONFIG_FILE: string;
+export declare const ADMIN_CLI_PRODUCTION_ENABLED = false;
+export interface AdminSession {
+    sessionId?: string;
+    token: string;
+    sessionToken?: string;
+    uid: string;
+    email: string;
+    role: 'admin' | 'platform-owner' | 'approved-developer';
+    permissions?: string[];
+    mfaVerified: boolean;
+    deviceId: string;
+    expiresAt: number;
+    apiUrl?: string;
+}
+export interface AdminCliOptions {
+    apiUrl?: string;
+    isRemote?: boolean;
+    isOffline?: boolean;
+    isBrowser?: boolean;
+    timeoutMs?: number;
+    token?: string;
+    email?: string;
+    role?: AdminSession['role'];
+    mfaCode?: string;
+    deviceId?: string;
+    deviceName?: string;
+    isTestMode?: boolean;
+}
+export declare function getStoredAdminSession(): AdminSession | null;
+export declare function fetchWithTimeout(url: string, options: RequestInit, timeoutMs?: number): Promise<Response>;
+export declare function promptMfaInteractive(providedCode?: string, isTestMode?: boolean): Promise<string>;
+export declare function validateEnvironmentSecurity(options: AdminCliOptions): void;
+export declare function executeAdminLogin(options: AdminCliOptions): Promise<any>;
+export declare function executeAdminLogout(options?: AdminCliOptions): Promise<any>;
+export declare function executeAdminWhoami(options?: AdminCliOptions): Promise<any>;
+export declare function executeAdminPermissions(options?: AdminCliOptions): Promise<any>;
+export declare function executeAdminSessionStatus(options?: AdminCliOptions): Promise<any>;
+export declare function executeAdminAuditLogs(options?: AdminCliOptions): Promise<any>;
+export declare function printHelp(): void;
+export declare function main(): Promise<void>;
+//# sourceMappingURL=creatorverse-admin.d.ts.map

package/dist/creatorverse-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"creatorverse-admin.d.ts","sourceRoot":"","sources":["../src/creatorverse-admin.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;GAiBG;AAQH,eAAO,MAAM,OAAO,UAAU,CAAC;AAC/B,eAAO,MAAM,UAAU,QAA2C,CAAC;AACnE,eAAO,MAAM,iBAAiB,QAAiD,CAAC;AAGhF,eAAO,MAAM,4BAA4B,QAAQ,CAAC;AAElD,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;IACxD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,wBAAgB,qBAAqB,IAAI,YAAY,GAAG,IAAI,CAM3D;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkB7G;AAED,wBAAsB,oBAAoB,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,UAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CA0CrG;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,eAAe,QAsCnE;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,CAkL9E;AAED,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,CA2BpF;AAED,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,CAqDpF;AAED,wBAAsB,uBAAuB,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,CA6CzF;AAED,wBAAsB,yBAAyB,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,CAkD3F;AAED,wBAAsB,qBAAqB,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,CAiDvF;AAED,wBAAgB,SAAS,SA8BxB;AAED,wBAAsB,IAAI,kBAwIzB"}