ds-01 1.0.9 → 1.0.11

package/dist/commands/add.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuDpC,eAAO,MAAM,GAAG,SA0MZ,CAAC"}
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsGpC,eAAO,MAAM,GAAG,SAwTZ,CAAC"}

package/dist/commands/add.js

@@ -9,7 +9,9 @@ import { signWithDeviceKey } from "../utils/secureKeyStore.js";
 import machineIdPkg from "node-machine-id";
 const { machineIdSync } = machineIdPkg;
 const API_BASE_URL = process.env.DS01_API_URL || "https://ds-01.vercel.app";
-// Helper to verify Tailwind exists before doing anything
+// ---------------------------------------------------------
+// Helper: Verify Tailwind exists
+// ---------------------------------------------------------
 function checkTailwindInstallation() {
     const targetDir = process.cwd();
     const pkgJsonPath = path.join(targetDir, "package.json");
@@ -32,6 +34,24 @@ function checkTailwindInstallation() {
         process.exit(1);
     }
 }
+// ---------------------------------------------------------
+// Helper: Find dependencies that are actually missing
+// ---------------------------------------------------------
+function getMissingDependencies(dependencies) {
+    const packageJsonPath = path.join(process.cwd(), "package.json");
+    if (!fs.existsSync(packageJsonPath)) {
+        return dependencies;
+    }
+    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+    const installedDependencies = {
+        ...(packageJson.dependencies || {}),
+        ...(packageJson.devDependencies || {}),
+    };
+    return dependencies.filter((dependency) => !installedDependencies[dependency]);
+}
+// ---------------------------------------------------------
+// ADD COMMAND
+// ---------------------------------------------------------
 export const add = new Command()
     .name("add")
     .description("Add a component from DS01 to your project")
@@ -39,6 +59,9 @@ export const add = new Command()
     .action(async (componentName) => {
     console.log();
     intro(`${pc.bgWhite(pc.black(pc.bold(" DS01 ")))} ${pc.gray("Adding Component")}`);
+    // -----------------------------------------------------
+    // 1. Validate project
+    // -----------------------------------------------------
     checkTailwindInstallation();
     const cwd = process.cwd();
     const configPath = path.join(cwd, "ds01.config.json");
@@ -47,6 +70,9 @@ export const add = new Command()
         process.exit(1);
     }
     const config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    // -----------------------------------------------------
+    // 2. Authentication
+    // -----------------------------------------------------
     const token = getToken();
     const machineId = machineIdSync();
     if (!token || !machineId) {
@@ -57,7 +83,7 @@ export const add = new Command()
     s.start(`Fetching ${pc.cyan(`<${componentName} />`)} from registry...`);
     try {
         // --------------------------------------------------
-        // 1. Create request-specific message
+        // 3. Create request-specific signed message
         // --------------------------------------------------
         const timestamp = Date.now().toString();
         const message = [
@@ -67,12 +93,12 @@ export const add = new Command()
             machineId,
         ].join("\n");
         // --------------------------------------------------
-        // 2. Sign message using the device private key
+        // 4. Sign request with secure device private key
         // --------------------------------------------------
         const signature = await signWithDeviceKey(new TextEncoder().encode(message));
         const signatureBase64 = Buffer.from(signature).toString("base64");
         // --------------------------------------------------
-        // 3. Send token + machine ID + signature
+        // 5. Request component from registry
         // --------------------------------------------------
         const response = await fetch(`${API_BASE_URL}/api/registry/${componentName}`, {
             method: "GET",
@@ -83,15 +109,19 @@ export const add = new Command()
                 "X-DS01-Signature": signatureBase64,
             },
         });
+        // --------------------------------------------------
+        // 6. Handle registry errors
+        // --------------------------------------------------
         if (!response.ok) {
             const errorData = await response.json().catch(() => null);
             s.stop(pc.red("Component fetch failed."));
-            cancel(errorData?.error || `Server returned HTTP ${response.status}`);
+            cancel(errorData?.error ||
+                `Server returned HTTP ${response.status}`);
             process.exit(1);
         }
         const componentData = await response.json();
         // --------------------------------------------------
-        // 4. Create component folder
+        // 7. Create component directory
         // --------------------------------------------------
         const targetDir = path.join(cwd, config.componentsPath, componentName);
         if (!fs.existsSync(targetDir)) {
@@ -100,11 +130,11 @@ export const add = new Command()
             });
         }
         // --------------------------------------------------
-        // 5. Extract bundled file names
+        // 8. Extract bundled file names
         // --------------------------------------------------
         const bundledFileNames = componentData.files.map((file) => file.name.replace(/\.[^/.]+$/, ""));
         // --------------------------------------------------
-        // 6. Write component files
+        // 9. Write component files
         // --------------------------------------------------
         for (const file of componentData.files) {
             const filePath = path.join(targetDir, file.name);
@@ -117,10 +147,14 @@ export const add = new Command()
         }
         s.stop(pc.green(`Downloaded ${componentData.files.length} files into ${pc.white(`/${config.componentsPath}/${componentName}`)}`));
         // --------------------------------------------------
-        // 7. Install dependencies
+        // 10. Install ONLY missing dependencies
         // --------------------------------------------------
-        if (componentData.dependencies && componentData.dependencies.length > 0) {
-            const depsToInstall = componentData.dependencies.join(" ");
+        const registryDependencies = Array.isArray(componentData.dependencies)
+            ? componentData.dependencies
+            : [];
+        const missingDependencies = getMissingDependencies(registryDependencies);
+        if (missingDependencies.length > 0) {
+            const depsToInstall = missingDependencies.join(" ");
             s.start(`Installing missing dependencies: ${pc.cyan(depsToInstall)}...`);
             try {
                 execSync(`npm install ${depsToInstall}`, {
@@ -134,16 +168,31 @@ export const add = new Command()
             }
         }
         // --------------------------------------------------
-        // 8. Success
+        // 11. No dependencies needed
+        // --------------------------------------------------
+        // We intentionally don't show a spinner here.
+        //
+        // Example:
+        //
+        // DS01 requires ["motion"]
+        // package.json already contains "motion"
+        //
+        // → Nothing happens.
+        // → No npm install.
+        // → No unnecessary package changes.
+        // --------------------------------------------------
+        // 12. Success
         // --------------------------------------------------
-        const mainFile = bundledFileNames.find((name) => name.toLowerCase() === componentName.toLowerCase()) || bundledFileNames[0];
+        const mainFile = bundledFileNames.find((name) => name.toLowerCase() ===
+            componentName.toLowerCase()) || bundledFileNames[0];
         outro(`${pc.white("✔")} ${pc.bold(`Component <${componentName} /> is ready!`)}\n` +
             pc.gray("Import it: ") +
             pc.cyan(`import { ${mainFile} } from "@/${config.componentsPath}/${componentName}/${mainFile}"`));
     }
     catch (error) {
         s.stop(pc.red("An error occurred during injection."));
-        cancel(pc.gray(error?.message || "Unknown CLI Error"));
+        cancel(pc.gray(error?.message ||
+            "Unknown CLI Error"));
         process.exit(1);
     }
 });

package/dist/utils/secureKeyStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secureKeyStore.d.ts","sourceRoot":"","sources":["../../src/utils/secureKeyStore.ts"],"names":[],"mappings":"AAmZA;;;;GAIG;AAEH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAQ1D;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD"}
+{"version":3,"file":"secureKeyStore.d.ts","sourceRoot":"","sources":["../../src/utils/secureKeyStore.ts"],"names":[],"mappings":"AA2WA;;;;GAIG;AAEH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAQ1D;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD"}

package/dist/utils/secureKeyStore.js

@@ -9,8 +9,6 @@ const KEY_NAME = "DS01-CLI-Device-Key";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 function getMacHelperPath() {
-    // dist/utils/secureKeyStore.js
-    // ../native/macos-key-helper.swift
     return path.resolve(__dirname, "../native/macos-key-helper.swift");
 }
 function ensureSupportedOS() {
@@ -23,52 +21,16 @@ function ensureSupportedOS() {
  * ---------------------------------------------------------
  * WINDOWS
  * ---------------------------------------------------------
- *
- * Windows uses:
- *
- * Microsoft Platform Crypto Provider
- * RSA 2048
- * NonExportable private key
- *
- * The private key never enters Node.js.
- *
- * Node -> PowerShell -> Windows crypto provider
- *                         ↓
- *                    private key
- *                         ↓
- *                    signature
- *                         ↓
- *                      Node
- *
- * IMPORTANT:
- *
- * We identify the certificate using its properties rather
- * than blindly taking the first certificate with the same
- * subject.
  */
-/**
- * PowerShell expression used to identify a valid DS01
- * certificate.
- *
- * Requirements:
- *
- * - Correct subject
- * - Has private key
- * - RSA certificate
- * - Platform Crypto Provider
- */
-const WINDOWS_CERT_FILTER = `
-$_.Subject -eq "CN=${KEY_NAME}" -and
-$_.HasPrivateKey -and
-$_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
-`;
 async function createWindowsDeviceKey() {
     const script = `
 $ErrorActionPreference = "Stop"
 
 $certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    ${WINDOWS_CERT_FILTER}
+    $_.Subject -eq "CN=${KEY_NAME}" -and
+    $_.HasPrivateKey -and
+    $_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
   })
 
 if ($certificates.Count -gt 1) {
@@ -82,7 +44,6 @@ if ($certificates.Count -eq 1) {
 
 $params = @{
   Type = "Custom"
-
   Subject = "CN=${KEY_NAME}"
 
   Provider = "Microsoft Platform Crypto Provider"
@@ -90,7 +51,6 @@ $params = @{
   KeyAlgorithm = "RSA"
   KeyLength = 2048
 
-  # Private key cannot be exported.
   KeyExportPolicy = "NonExportable"
 
   KeyUsage = "DigitalSignature"
@@ -125,18 +85,21 @@ Write-Output "CREATED"
     }
 }
 /**
- * Find the exact DS01 certificate.
+ * Find exactly one valid DS01 certificate.
  *
- * We deliberately DO NOT use Select-Object -First 1.
+ * We intentionally do not use Select-Object -First 1.
  *
- * If multiple matching certificates exist, we fail instead
- * of potentially using the wrong private key.
+ * 0 certificates  -> error
+ * 1 certificate   -> use it
+ * 2+ certificates -> error
  */
-function windowsCertificateLookupScript() {
+function getWindowsCertificateLookup() {
     return `
 $certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    ${WINDOWS_CERT_FILTER}
+    $_.Subject -eq "CN=${KEY_NAME}" -and
+    $_.HasPrivateKey -and
+    $_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
   })
 
 if ($certificates.Count -eq 0) {
@@ -147,19 +110,15 @@ if ($certificates.Count -gt 1) {
   throw "Multiple valid DS01 device certificates found."
 }
 
-$certificates[0]
+$cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]$certificates[0]
 `;
 }
 async function getWindowsPublicKey() {
     const script = `
 $ErrorActionPreference = "Stop"
 
-$cert = ${windowsCertificateLookupScript()}
+${getWindowsCertificateLookup()}
 
-# Return the complete public certificate.
-#
-# The certificate contains the public key and certificate
-# metadata, but never the private key.
 [Convert]::ToBase64String($cert.RawData)
 `;
     const { stdout } = await execFileAsync("powershell.exe", [
@@ -183,7 +142,7 @@ async function signWindowsDeviceKey(data) {
     const script = `
 $ErrorActionPreference = "Stop"
 
-$cert = ${windowsCertificateLookupScript()}
+${getWindowsCertificateLookup()}
 
 if (-not $cert.HasPrivateKey) {
   throw "DS01 device certificate has no private key."
@@ -233,7 +192,9 @@ $ErrorActionPreference = "Stop"
 
 $certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    ${WINDOWS_CERT_FILTER}
+    $_.Subject -eq "CN=${KEY_NAME}" -and
+    $_.HasPrivateKey -and
+    $_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
   })
 
 if ($certificates.Count -gt 1) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ds-01",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "description": "Make your site best with DS01",
   "type": "module",
   "bin": {

package/src/commands/add.ts

@@ -12,9 +12,13 @@ import machineIdPkg from "node-machine-id";
 
 const { machineIdSync } = machineIdPkg;
 
-const API_BASE_URL = process.env.DS01_API_URL || "https://ds-01.vercel.app";
+const API_BASE_URL =
+  process.env.DS01_API_URL || "https://ds-01.vercel.app";
+
+// ---------------------------------------------------------
+// Helper: Verify Tailwind exists
+// ---------------------------------------------------------
 
-// Helper to verify Tailwind exists before doing anything
 function checkTailwindInstallation() {
   const targetDir = process.cwd();
   const pkgJsonPath = path.join(targetDir, "package.json");
@@ -25,10 +29,13 @@ function checkTailwindInstallation() {
         "No package.json found. Please run this command inside a Node.js project.",
       ),
     );
+
     process.exit(1);
   }
 
-  const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+  const pkgJson = JSON.parse(
+    fs.readFileSync(pkgJsonPath, "utf-8"),
+  );
 
   const allDeps = {
     ...pkgJson.dependencies,
@@ -37,26 +44,69 @@ function checkTailwindInstallation() {
 
   if (!allDeps["tailwindcss"]) {
     cancel(
-      pc.red("Tailwind CSS is missing from your project dependencies.\n") +
+      pc.red(
+        "Tailwind CSS is missing from your project dependencies.\n",
+      ) +
         pc.gray(
           "DS01 components rely strictly on Tailwind CSS for styling.\n\n",
         ) +
         pc.white(
           "Kindly install it and configure your project, then retry:\n",
         ) +
-        pc.cyan("  npm install tailwindcss @tailwindcss/postcss postcss\n\n") +
+        pc.cyan(
+          "  npm install tailwindcss @tailwindcss/postcss postcss\n\n",
+        ) +
         pc.gray("Official Setup Guide: ") +
-        pc.underline("https://tailwindcss.com/docs/installation"),
+        pc.underline(
+          "https://tailwindcss.com/docs/installation",
+        ),
     );
 
     process.exit(1);
   }
 }
 
+// ---------------------------------------------------------
+// Helper: Find dependencies that are actually missing
+// ---------------------------------------------------------
+
+function getMissingDependencies(
+  dependencies: string[],
+): string[] {
+  const packageJsonPath = path.join(
+    process.cwd(),
+    "package.json",
+  );
+
+  if (!fs.existsSync(packageJsonPath)) {
+    return dependencies;
+  }
+
+  const packageJson = JSON.parse(
+    fs.readFileSync(packageJsonPath, "utf-8"),
+  );
+
+  const installedDependencies = {
+    ...(packageJson.dependencies || {}),
+    ...(packageJson.devDependencies || {}),
+  };
+
+  return dependencies.filter(
+    (dependency) => !installedDependencies[dependency],
+  );
+}
+
+// ---------------------------------------------------------
+// ADD COMMAND
+// ---------------------------------------------------------
+
 export const add = new Command()
   .name("add")
   .description("Add a component from DS01 to your project")
-  .argument("<component>", "The name of the component (e.g., premium-section)")
+  .argument(
+    "<component>",
+    "The name of the component (e.g., premium-section)",
+  )
   .action(async (componentName: string) => {
     console.log();
 
@@ -66,36 +116,61 @@ export const add = new Command()
       )}`,
     );
 
+    // -----------------------------------------------------
+    // 1. Validate project
+    // -----------------------------------------------------
+
     checkTailwindInstallation();
 
     const cwd = process.cwd();
 
-    const configPath = path.join(cwd, "ds01.config.json");
+    const configPath = path.join(
+      cwd,
+      "ds01.config.json",
+    );
 
     if (!fs.existsSync(configPath)) {
-      cancel(pc.red("ds01.config.json not found. Run 'npx ds-01 init' first."));
+      cancel(
+        pc.red(
+          "ds01.config.json not found. Run 'npx ds-01 init' first.",
+        ),
+      );
 
       process.exit(1);
     }
 
-    const config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    const config = JSON.parse(
+      fs.readFileSync(configPath, "utf-8"),
+    );
+
+    // -----------------------------------------------------
+    // 2. Authentication
+    // -----------------------------------------------------
 
     const token = getToken();
     const machineId = machineIdSync();
 
     if (!token || !machineId) {
-      cancel(pc.red("You are not authenticated. Run 'npx ds-01 login' first."));
+      cancel(
+        pc.red(
+          "You are not authenticated. Run 'npx ds-01 login' first.",
+        ),
+      );
 
       process.exit(1);
     }
 
     const s = spinner();
 
-    s.start(`Fetching ${pc.cyan(`<${componentName} />`)} from registry...`);
+    s.start(
+      `Fetching ${pc.cyan(
+        `<${componentName} />`,
+      )} from registry...`,
+    );
 
     try {
       // --------------------------------------------------
-      // 1. Create request-specific message
+      // 3. Create request-specific signed message
       // --------------------------------------------------
 
       const timestamp = Date.now().toString();
@@ -108,17 +183,18 @@ export const add = new Command()
       ].join("\n");
 
       // --------------------------------------------------
-      // 2. Sign message using the device private key
+      // 4. Sign request with secure device private key
       // --------------------------------------------------
 
       const signature = await signWithDeviceKey(
         new TextEncoder().encode(message),
       );
 
-      const signatureBase64 = Buffer.from(signature).toString("base64");
+      const signatureBase64 =
+        Buffer.from(signature).toString("base64");
 
       // --------------------------------------------------
-      // 3. Send token + machine ID + signature
+      // 5. Request component from registry
       // --------------------------------------------------
 
       const response = await fetch(
@@ -138,23 +214,38 @@ export const add = new Command()
         },
       );
 
+      // --------------------------------------------------
+      // 6. Handle registry errors
+      // --------------------------------------------------
+
       if (!response.ok) {
-        const errorData = await response.json().catch(() => null);
+        const errorData =
+          await response.json().catch(() => null);
 
-        s.stop(pc.red("Component fetch failed."));
+        s.stop(
+          pc.red("Component fetch failed."),
+        );
 
-        cancel(errorData?.error || `Server returned HTTP ${response.status}`);
+        cancel(
+          errorData?.error ||
+            `Server returned HTTP ${response.status}`,
+        );
 
         process.exit(1);
       }
 
-      const componentData = await response.json();
+      const componentData =
+        await response.json();
 
       // --------------------------------------------------
-      // 4. Create component folder
+      // 7. Create component directory
       // --------------------------------------------------
 
-      const targetDir = path.join(cwd, config.componentsPath, componentName);
+      const targetDir = path.join(
+        cwd,
+        config.componentsPath,
+        componentName,
+      );
 
       if (!fs.existsSync(targetDir)) {
         fs.mkdirSync(targetDir, {
@@ -163,32 +254,48 @@ export const add = new Command()
       }
 
       // --------------------------------------------------
-      // 5. Extract bundled file names
+      // 8. Extract bundled file names
       // --------------------------------------------------
 
-      const bundledFileNames = componentData.files.map((file: any) =>
-        file.name.replace(/\.[^/.]+$/, ""),
-      );
+      const bundledFileNames =
+        componentData.files.map(
+          (file: any) =>
+            file.name.replace(
+              /\.[^/.]+$/,
+              "",
+            ),
+        );
 
       // --------------------------------------------------
-      // 6. Write component files
+      // 9. Write component files
       // --------------------------------------------------
 
       for (const file of componentData.files) {
-        const filePath = path.join(targetDir, file.name);
+        const filePath = path.join(
+          targetDir,
+          file.name,
+        );
 
         let content = file.content;
 
-        bundledFileNames.forEach((fileName: string) => {
-          const regex = new RegExp(
-            `from\\s+["']\\.[^"']*?\\/${fileName}["']`,
-            "g",
-          );
-
-          content = content.replace(regex, `from "./${fileName}"`);
-        });
+        bundledFileNames.forEach(
+          (fileName: string) => {
+            const regex = new RegExp(
+              `from\\s+["']\\.[^"']*?\\/${fileName}["']`,
+              "g",
+            );
+
+            content = content.replace(
+              regex,
+              `from "./${fileName}"`,
+            );
+          },
+        );
 
-        fs.writeFileSync(filePath, content);
+        fs.writeFileSync(
+          filePath,
+          content,
+        );
       }
 
       s.stop(
@@ -200,43 +307,84 @@ export const add = new Command()
       );
 
       // --------------------------------------------------
-      // 7. Install dependencies
+      // 10. Install ONLY missing dependencies
       // --------------------------------------------------
 
-      if (componentData.dependencies && componentData.dependencies.length > 0) {
-        const depsToInstall = componentData.dependencies.join(" ");
+      const registryDependencies =
+        Array.isArray(componentData.dependencies)
+          ? componentData.dependencies
+          : [];
+
+      const missingDependencies =
+        getMissingDependencies(
+          registryDependencies,
+        );
+
+      if (missingDependencies.length > 0) {
+        const depsToInstall =
+          missingDependencies.join(" ");
 
         s.start(
-          `Installing missing dependencies: ${pc.cyan(depsToInstall)}...`,
+          `Installing missing dependencies: ${pc.cyan(
+            depsToInstall,
+          )}...`,
         );
 
         try {
-          execSync(`npm install ${depsToInstall}`, {
-            stdio: "ignore",
-          });
+          execSync(
+            `npm install ${depsToInstall}`,
+            {
+              stdio: "ignore",
+            },
+          );
 
           s.stop(
             pc.green(
-              `Dependencies installed successfully: ${pc.gray(depsToInstall)}`,
+              `Dependencies installed successfully: ${pc.gray(
+                depsToInstall,
+              )}`,
             ),
           );
         } catch {
-          s.stop(pc.red("Failed to auto-install dependencies."));
+          s.stop(
+            pc.red(
+              "Failed to auto-install dependencies.",
+            ),
+          );
 
           note(
-            `Please run: ${pc.cyan(`npm install ${depsToInstall}`)} manually.`,
+            `Please run: ${pc.cyan(
+              `npm install ${depsToInstall}`,
+            )} manually.`,
             "Manual Action Required",
           );
         }
       }
 
       // --------------------------------------------------
-      // 8. Success
+      // 11. No dependencies needed
+      // --------------------------------------------------
+
+      // We intentionally don't show a spinner here.
+      //
+      // Example:
+      //
+      // DS01 requires ["motion"]
+      // package.json already contains "motion"
+      //
+      // → Nothing happens.
+      // → No npm install.
+      // → No unnecessary package changes.
+
+      // --------------------------------------------------
+      // 12. Success
       // --------------------------------------------------
 
       const mainFile =
         bundledFileNames.find(
-          (name: string) => name.toLowerCase() === componentName.toLowerCase(),
+          (name: string) =>
+            name.toLowerCase() ===
+            componentName.toLowerCase(),
         ) || bundledFileNames[0];
 
       outro(
@@ -249,10 +397,19 @@ export const add = new Command()
           ),
       );
     } catch (error: any) {
-      s.stop(pc.red("An error occurred during injection."));
+      s.stop(
+        pc.red(
+          "An error occurred during injection.",
+        ),
+      );
 
-      cancel(pc.gray(error?.message || "Unknown CLI Error"));
+      cancel(
+        pc.gray(
+          error?.message ||
+            "Unknown CLI Error",
+        ),
+      );
 
       process.exit(1);
     }
-  });
+  });

package/src/utils/secureKeyStore.ts

@@ -14,8 +14,6 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
 function getMacHelperPath(): string {
-  // dist/utils/secureKeyStore.js
-  // ../native/macos-key-helper.swift
   return path.resolve(
     __dirname,
     "../native/macos-key-helper.swift",
@@ -36,54 +34,17 @@ function ensureSupportedOS(): void {
  * ---------------------------------------------------------
  * WINDOWS
  * ---------------------------------------------------------
- *
- * Windows uses:
- *
- * Microsoft Platform Crypto Provider
- * RSA 2048
- * NonExportable private key
- *
- * The private key never enters Node.js.
- *
- * Node -> PowerShell -> Windows crypto provider
- *                         ↓
- *                    private key
- *                         ↓
- *                    signature
- *                         ↓
- *                      Node
- *
- * IMPORTANT:
- *
- * We identify the certificate using its properties rather
- * than blindly taking the first certificate with the same
- * subject.
  */
 
-/**
- * PowerShell expression used to identify a valid DS01
- * certificate.
- *
- * Requirements:
- *
- * - Correct subject
- * - Has private key
- * - RSA certificate
- * - Platform Crypto Provider
- */
-const WINDOWS_CERT_FILTER = `
-$_.Subject -eq "CN=${KEY_NAME}" -and
-$_.HasPrivateKey -and
-$_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
-`;
-
 async function createWindowsDeviceKey(): Promise<void> {
   const script = `
 $ErrorActionPreference = "Stop"
 
 $certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    ${WINDOWS_CERT_FILTER}
+    $_.Subject -eq "CN=${KEY_NAME}" -and
+    $_.HasPrivateKey -and
+    $_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
   })
 
 if ($certificates.Count -gt 1) {
@@ -97,7 +58,6 @@ if ($certificates.Count -eq 1) {
 
 $params = @{
   Type = "Custom"
-
   Subject = "CN=${KEY_NAME}"
 
   Provider = "Microsoft Platform Crypto Provider"
@@ -105,7 +65,6 @@ $params = @{
   KeyAlgorithm = "RSA"
   KeyLength = 2048
 
-  # Private key cannot be exported.
   KeyExportPolicy = "NonExportable"
 
   KeyUsage = "DigitalSignature"
@@ -150,18 +109,21 @@ Write-Output "CREATED"
 }
 
 /**
- * Find the exact DS01 certificate.
+ * Find exactly one valid DS01 certificate.
  *
- * We deliberately DO NOT use Select-Object -First 1.
+ * We intentionally do not use Select-Object -First 1.
  *
- * If multiple matching certificates exist, we fail instead
- * of potentially using the wrong private key.
+ * 0 certificates  -> error
+ * 1 certificate   -> use it
+ * 2+ certificates -> error
  */
-function windowsCertificateLookupScript(): string {
+function getWindowsCertificateLookup(): string {
   return `
 $certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    ${WINDOWS_CERT_FILTER}
+    $_.Subject -eq "CN=${KEY_NAME}" -and
+    $_.HasPrivateKey -and
+    $_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
   })
 
 if ($certificates.Count -eq 0) {
@@ -172,7 +134,7 @@ if ($certificates.Count -gt 1) {
   throw "Multiple valid DS01 device certificates found."
 }
 
-$certificates[0]
+$cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]$certificates[0]
 `;
 }
 
@@ -180,12 +142,8 @@ async function getWindowsPublicKey(): Promise<string> {
   const script = `
 $ErrorActionPreference = "Stop"
 
-$cert = ${windowsCertificateLookupScript()}
+${getWindowsCertificateLookup()}
 
-# Return the complete public certificate.
-#
-# The certificate contains the public key and certificate
-# metadata, but never the private key.
 [Convert]::ToBase64String($cert.RawData)
 `;
 
@@ -224,7 +182,7 @@ async function signWindowsDeviceKey(
   const script = `
 $ErrorActionPreference = "Stop"
 
-$cert = ${windowsCertificateLookupScript()}
+${getWindowsCertificateLookup()}
 
 if (-not $cert.HasPrivateKey) {
   throw "DS01 device certificate has no private key."
@@ -287,7 +245,9 @@ $ErrorActionPreference = "Stop"
 
 $certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    ${WINDOWS_CERT_FILTER}
+    $_.Subject -eq "CN=${KEY_NAME}" -and
+    $_.HasPrivateKey -and
+    $_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
   })
 
 if ($certificates.Count -gt 1) {