ragevault 0.2.3

package/dist/ragevault.js

@@ -0,0 +1,814 @@
+#!/usr/bin/env node
+/**
+ * `ragevault` — the command-line front door to your self-hosted vault.
+ *
+ *   ragevault init                 create an encrypted vault (asks a master key)
+ *   ragevault add                  add a secret (generate or type the password)
+ *   ragevault ls [query]           list items — secrets stay blurred
+ *   ragevault get <query> [--reveal|--copy]
+ *   ragevault gen [--length N | --words N | --pronounceable]
+ *   ragevault passwd               change the master password (fast re-wrap)
+ *   ragevault users [add <name> <role>]
+ *   ragevault wg                   set up WireGuard for remote access (optional)
+ *   ragevault version
+ *
+ * Secrets are shown blurred (••••••) by default; you ask to reveal or copy them,
+ * so a shoulder-surfer never sees every password at a glance.
+ *
+ * Part of RageVault.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync, chmodSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, join } from "node:path";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+import { ASCII_BANNER, BRAND } from "./branding.js";
+import { ask, askSecret, confirm } from "./prompt.js";
+import { canDo, emptyVault, newId, ROLE_RANK } from "./model.js";
+import { estimateStrength, generatePassphrase, generatePassword, generatePronounceable } from "./generator.js";
+import { createVault, readVaultFile, rewrapForPassword, saveVault, unlockVault } from "./store/vaultfile.js";
+import { startServer } from "./server/server.js";
+import { extractTotpSecret, totp } from "./totp.js";
+import { auditVault, breachCount } from "./audit.js";
+import { exportCsv, exportJson, importAny } from "./porters.js";
+import { updateNoticeLine } from "./update/channel.js";
+const A = "\x1b[38;5;39m", B = "\x1b[1m", D = "\x1b[2m", G = "\x1b[32m", Y = "\x1b[33m", R0 = "\x1b[0m", RED = "\x1b[31m";
+const say = (s = "") => process.stdout.write(s + "\n");
+const err = (s) => process.stderr.write(s + "\n");
+function vaultPath() {
+    const base = process.env.RAGEVAULT_HOME?.trim() || join(homedir(), ".ragevault");
+    return join(base, "vault.ragevault");
+}
+/** Blur a secret, keeping length obscured. */
+function blur() {
+    return `${D}••••••••${R0}`;
+}
+/** Copy text to the clipboard via OSC 52 (works over SSH). Only to a real
+ *  terminal — never emit the (base64) secret when stdout is piped to a file/log. */
+function clip(text) {
+    if (!process.stdout.isTTY)
+        return false;
+    process.stdout.write(`\x1b]52;c;${Buffer.from(text).toString("base64")}\x07`);
+    return true;
+}
+async function readMaster(prompt = "Master password:") {
+    const pw = await askSecret(prompt);
+    if (!pw) {
+        err(`${RED}✗ No password entered.${R0}`);
+        process.exit(1);
+    }
+    return pw;
+}
+async function openExisting() {
+    const path = vaultPath();
+    if (!existsSync(path)) {
+        err(`${Y}No vault yet.${R0} Create one with ${B}ragevault init${R0}.`);
+        process.exit(1);
+    }
+    const file = readVaultFile(path);
+    const pw = await readMaster();
+    try {
+        return { vault: unlockVault(file, pw), path };
+    }
+    catch (e) {
+        err(`${RED}✗ ${e.message}${R0}`);
+        process.exit(1);
+    }
+}
+async function cmdInit() {
+    const path = vaultPath();
+    if (existsSync(path)) {
+        if (!(await confirm(`A vault already exists at ${path}. Overwrite it?`)))
+            return;
+    }
+    say(`${A}${ASCII_BANNER}${R0}`);
+    say(`  ${B}Create your vault.${R0} Choose a strong master password — it is the ${B}only${R0} key,`);
+    say(`  ${D}it is never stored, and it cannot be recovered. Write it down somewhere safe.${R0}\n`);
+    const name = await ask("Vault name", "Personal");
+    const owner = await ask("Your name (vault owner)", "me");
+    say(`\n  ${B}Choose your master key:${R0}`);
+    say(`    ${A}1${R0}  Type my own password / passphrase`);
+    say(`    ${A}2${R0}  Generate a strong word-seed for me ${D}(recommended)${R0}`);
+    const choice = await ask("Pick 1-2", "2");
+    let pw;
+    if (choice === "1") {
+        pw = await askSecret("Master password:");
+        if (pw.length < 8) {
+            err(`${RED}✗ Use at least 8 characters (a passphrase is better).${R0}`);
+            process.exit(1);
+        }
+        const pw2 = await askSecret("Confirm master password:");
+        if (pw !== pw2) {
+            err(`${RED}✗ Passwords don't match.${R0}`);
+            process.exit(1);
+        }
+    }
+    else {
+        // Generate a 6-word seed; let the user re-roll until they like it.
+        do {
+            pw = generatePassphrase(6);
+            const s = estimateStrength(pw);
+            say(`\n  ${A}${B}${pw}${R0}`);
+            say(`  ${D}${s.bits} bits · ${s.label} — write this down; it is the ONLY key and cannot be recovered.${R0}`);
+        } while (!(await confirm("Use this seed? (n to roll a new one)", true)));
+        say(`\n  ${Y}⚠ Save your seed somewhere safe now${R0} — it will not be shown again.`);
+        if (!(await confirm("I've written it down — continue?", true))) {
+            say(`  ${D}Cancelled.${R0}`);
+            return;
+        }
+    }
+    const now = new Date().toISOString();
+    const vault = createVault(emptyVault(name, owner, now), pw);
+    saveVault(path, vault);
+    say(`\n  ${G}✓ Vault created${R0} at ${D}${path}${R0} ${D}(owner-readable only).${R0}`);
+    say(`  ${D}Add your first secret with${R0} ${B}ragevault add${R0}.`);
+    say(`\n  ${Y}Security tip:${R0} keep this behind a VPN. Run ${B}ragevault wg${R0} to set up WireGuard.\n`);
+}
+async function cmdAdd() {
+    const { vault, path } = await openExisting();
+    const owner = vault.data.users[0];
+    if (!canDo(owner.role, "item.create")) {
+        err(`${RED}✗ Your role can't add items.${R0}`);
+        process.exit(1);
+    }
+    const title = await ask("Title (e.g. GitHub)");
+    if (!title) {
+        err(`${RED}✗ A title is required.${R0}`);
+        process.exit(1);
+    }
+    const username = await ask("Username / email");
+    const url = await ask("URL");
+    let password = "";
+    if (await confirm("Generate a strong password?", true)) {
+        password = generatePassword({ length: 20 });
+        const s = estimateStrength(password);
+        say(`  ${A}${password}${R0}  ${D}(${s.bits} bits · ${s.label})${R0}`);
+    }
+    else {
+        password = await askSecret("Password:");
+    }
+    const category = await ask("Category (optional)");
+    const totpRaw = await ask("2FA secret — otpauth:// or base32 (optional)");
+    const now = new Date().toISOString();
+    const item = {
+        id: newId(), title, username: username || undefined, url: url || undefined, password,
+        categoryId: category ? ensureCategory(vault, category) : undefined,
+        // Keep the whole otpauth:// URI (its digits/period/algorithm matter for
+        // Steam/8-digit/SHA-256 tokens); totp() parses it. Bare secrets pass through.
+        totp: totpRaw ? (totpRaw.trim().toLowerCase().startsWith("otpauth://") ? totpRaw.trim() : extractTotpSecret(totpRaw)) || undefined : undefined,
+        tags: [], favorite: false, createdAt: now, updatedAt: now, history: [],
+    };
+    vault.data.items.push(item);
+    saveVault(path, vault);
+    say(`\n  ${G}✓ Saved${R0} “${B}${title}${R0}”. ${D}See it with${R0} ${B}ragevault get ${title}${R0}.\n`);
+}
+function ensureCategory(vault, name) {
+    const existing = vault.data.categories.find((c) => c.name.toLowerCase() === name.toLowerCase());
+    if (existing)
+        return existing.id;
+    const id = newId();
+    vault.data.categories.push({ id, name });
+    return id;
+}
+/** Older vaults predate the trash array — make sure it exists. */
+function ensureTrash(vault) {
+    if (!vault.data.trash)
+        vault.data.trash = [];
+    return vault.data.trash;
+}
+function findItem(vault, query) {
+    const q = query.toLowerCase();
+    return vault.data.items.find((i) => i.title.toLowerCase() === q)
+        ?? vault.data.items.find((i) => i.title.toLowerCase().includes(q) || (i.username ?? "").toLowerCase().includes(q));
+}
+/** Manage custom fields — the flexible way to store cards, SSH keys, tokens, notes. */
+async function cmdField(query, args) {
+    const { vault, path } = await openExisting();
+    const item = findItem(vault, query);
+    if (!item) {
+        err(`${RED}✗ No item matches “${query}”.${R0}`);
+        process.exit(1);
+    }
+    item.fields ??= [];
+    const sub = args[0];
+    if (sub === "add") {
+        if (!canDo(vault.data.users[0].role, "item.update")) {
+            err(`${RED}✗ Your role can't edit items.${R0}`);
+            process.exit(1);
+        }
+        const label = args[1] || await ask("Field label (e.g. Card number, CVV, Private key)");
+        if (!label) {
+            err(`${RED}✗ A label is required.${R0}`);
+            process.exit(1);
+        }
+        const secret = args.includes("--secret") || await confirm("Is this a secret (blur it)?", true);
+        const value = secret ? await askSecret(`${label}:`) : await ask(`${label}:`);
+        item.fields.push({ label, value, secret });
+        item.updatedAt = new Date().toISOString();
+        saveVault(path, vault);
+        say(`  ${G}✓ Added field “${label}” to ${item.title}.${R0}`);
+        return;
+    }
+    if (sub === "rm" || sub === "remove") {
+        const label = args[1] || await ask("Which field label to remove?");
+        const before = item.fields.length;
+        item.fields = item.fields.filter((f) => f.label.toLowerCase() !== label.toLowerCase());
+        if (item.fields.length === before) {
+            err(`${Y}No field named “${label}”.${R0}`);
+            return;
+        }
+        item.updatedAt = new Date().toISOString();
+        saveVault(path, vault);
+        say(`  ${G}✓ Removed field “${label}”.${R0}`);
+        return;
+    }
+    // list
+    say(`\n  ${A}${B}${item.title}${R0} ${D}· custom fields${R0}\n`);
+    if (!item.fields.length) {
+        say(`  ${D}No custom fields. Add one with${R0} ${B}ragevault field ${query} add <label>${R0}.\n`);
+        return;
+    }
+    for (const f of item.fields)
+        say(`  ${B}${f.label.padEnd(16)}${R0} ${f.secret ? blur() + ` ${D}(secret)${R0}` : f.value}`);
+    say(`\n  ${D}Reveal values with${R0} ${B}ragevault get ${query} --reveal${R0}.\n`);
+}
+async function cmdEdit(query) {
+    const { vault, path } = await openExisting();
+    if (!canDo(vault.data.users[0].role, "item.update")) {
+        err(`${RED}✗ Your role can't edit items.${R0}`);
+        process.exit(1);
+    }
+    const item = findItem(vault, query);
+    if (!item) {
+        err(`${RED}✗ No item matches “${query}”.${R0}`);
+        process.exit(1);
+    }
+    say(`  ${D}Editing “${B}${item.title}${R0}${D}” — press Enter to keep each current value.${R0}`);
+    item.title = await ask("Title", item.title);
+    item.username = (await ask("Username", item.username ?? "")) || undefined;
+    item.url = (await ask("URL", item.url ?? "")) || undefined;
+    const cat = await ask("Category", vault.data.categories.find((c) => c.id === item.categoryId)?.name ?? "");
+    item.categoryId = cat ? ensureCategory(vault, cat) : undefined;
+    if (await confirm("Change the password?")) {
+        const gen = await confirm("Generate a new one?", true);
+        const next = gen ? generatePassword({ length: 20 }) : await askSecret("New password:");
+        if (item.password)
+            item.history.unshift({ password: item.password, changedAt: new Date().toISOString() });
+        item.password = next;
+        if (gen) {
+            const s = estimateStrength(next);
+            say(`  ${A}${next}${R0}  ${D}(${s.bits} bits · ${s.label})${R0}`);
+        }
+    }
+    item.updatedAt = new Date().toISOString();
+    saveVault(path, vault);
+    say(`\n  ${G}✓ Updated “${item.title}”.${R0}\n`);
+}
+async function cmdRm(query) {
+    const { vault, path } = await openExisting();
+    if (!canDo(vault.data.users[0].role, "item.delete")) {
+        err(`${RED}✗ Your role can't delete items.${R0}`);
+        process.exit(1);
+    }
+    const item = findItem(vault, query);
+    if (!item) {
+        err(`${RED}✗ No item matches “${query}”.${R0}`);
+        process.exit(1);
+    }
+    if (!(await confirm(`Move “${item.title}” to the trash?`, true)))
+        return;
+    vault.data.items = vault.data.items.filter((i) => i.id !== item.id);
+    ensureTrash(vault).unshift(item);
+    saveVault(path, vault);
+    say(`  ${G}✓ Moved to trash.${R0} ${D}Restore with${R0} ${B}ragevault trash restore${R0}.`);
+}
+async function cmdTrash(args) {
+    const { vault, path } = await openExisting();
+    const trash = ensureTrash(vault);
+    const sub = args[0];
+    if (sub === "empty") {
+        if (!trash.length) {
+            say(`  ${D}Trash is already empty.${R0}`);
+            return;
+        }
+        if (!(await confirm(`Permanently delete ${trash.length} item(s)? This cannot be undone.`)))
+            return;
+        vault.data.trash = [];
+        saveVault(path, vault);
+        say(`  ${G}✓ Trash emptied.${R0}`);
+        return;
+    }
+    if (sub === "restore") {
+        if (!trash.length) {
+            say(`  ${D}Trash is empty.${R0}`);
+            return;
+        }
+        trash.forEach((it, i) => say(`  ${A}${i + 1}${R0}  ${B}${it.title}${R0}`));
+        const n = Number(await ask("Restore which? (number)", "1"));
+        const item = trash[n - 1];
+        if (!item) {
+            err(`${RED}✗ No such entry.${R0}`);
+            process.exit(1);
+        }
+        vault.data.trash = trash.filter((i) => i.id !== item.id);
+        vault.data.items.push(item);
+        saveVault(path, vault);
+        say(`  ${G}✓ Restored “${item.title}”.${R0}`);
+        return;
+    }
+    say(`\n  ${A}${B}Trash${R0} ${D}· ${trash.length} item(s)${R0}\n`);
+    if (!trash.length) {
+        say(`  ${D}Empty.${R0}\n`);
+        return;
+    }
+    for (const it of trash)
+        say(`  ${Y}⌫${R0} ${B}${it.title}${R0} ${D}${it.username ?? ""}${R0}`);
+    say(`\n  ${D}${B}ragevault trash restore${R0} ${D}to recover ·${R0} ${B}ragevault trash empty${R0} ${D}to purge.${R0}\n`);
+}
+async function cmdMv(query, dest) {
+    const { vault, path } = await openExisting();
+    const item = findItem(vault, query);
+    if (!item) {
+        err(`${RED}✗ No item matches “${query}”.${R0}`);
+        process.exit(1);
+    }
+    item.categoryId = dest ? ensureCategory(vault, dest) : undefined;
+    item.updatedAt = new Date().toISOString();
+    saveVault(path, vault);
+    say(`  ${G}✓ Moved “${item.title}” to category ${B}${dest || "(none)"}${R0}.`);
+}
+async function cmdLs(query) {
+    const { vault } = await openExisting();
+    const q = (query ?? "").toLowerCase();
+    const items = vault.data.items.filter((i) => !q || i.title.toLowerCase().includes(q) || (i.username ?? "").toLowerCase().includes(q));
+    if (items.length === 0) {
+        say(`  ${D}No items${q ? " match “" + query + "”" : " yet"}.${R0}`);
+        return;
+    }
+    const catName = (id) => vault.data.categories.find((c) => c.id === id)?.name ?? "—";
+    say(`\n  ${A}${B}${vault.data.meta.name}${R0} ${D}· ${items.length} item(s)${R0}\n`);
+    for (const i of items.sort((a, b) => a.title.localeCompare(b.title))) {
+        const fav = i.favorite ? `${Y}★${R0} ` : "  ";
+        say(`  ${fav}${B}${i.title.padEnd(22)}${R0} ${D}${(i.username ?? "").padEnd(24)}${R0} ${blur()}  ${D}${catName(i.categoryId)}${R0}`);
+    }
+    say(`\n  ${D}Reveal one with${R0} ${B}ragevault get <title> --reveal${R0} ${D}or copy with${R0} ${B}--copy${R0}.\n`);
+}
+async function cmdGet(query, reveal, copy) {
+    const { vault } = await openExisting();
+    const owner = vault.data.users[0];
+    const q = query.toLowerCase();
+    const item = vault.data.items.find((i) => i.title.toLowerCase() === q)
+        ?? vault.data.items.find((i) => i.title.toLowerCase().includes(q) || (i.username ?? "").toLowerCase().includes(q));
+    if (!item) {
+        err(`${RED}✗ No item matches “${query}”.${R0}`);
+        process.exit(1);
+    }
+    say(`\n  ${B}${item.title}${R0}`);
+    if (item.username)
+        say(`  ${D}user    ${R0}${item.username}`);
+    if (item.url)
+        say(`  ${D}url     ${R0}${item.url}`);
+    const canReveal = canDo(owner.role, "item.reveal");
+    if (copy && canReveal) {
+        const ok = clip(item.password ?? "");
+        say(`  ${D}pass    ${R0}${blur()}  ${ok ? G + "✓ copied to clipboard" : D + "(not a terminal — run with --reveal to print)"}${R0}`);
+    }
+    else if (reveal && canReveal) {
+        const s = estimateStrength(item.password ?? "");
+        say(`  ${D}pass    ${R0}${A}${item.password}${R0}  ${D}(${s.bits} bits · ${s.label})${R0}`);
+    }
+    else if (!canReveal)
+        say(`  ${D}pass    ${R0}${blur()} ${D}(your role can't reveal secrets)${R0}`);
+    else
+        say(`  ${D}pass    ${R0}${blur()}  ${D}(add --reveal to show, --copy to copy)${R0}`);
+    if (item.totp)
+        say(`  ${D}totp    ${R0}${reveal ? item.totp : blur()}`);
+    for (const f of item.fields ?? []) {
+        const shown = f.secret ? (reveal && canReveal ? `${A}${f.value}${R0}` : blur()) : f.value;
+        say(`  ${D}${f.label.slice(0, 7).padEnd(7)}${R0} ${shown}${f.secret ? ` ${D}(secret)${R0}` : ""}`);
+    }
+    if (item.notes)
+        say(`  ${D}notes   ${R0}${item.notes}`);
+    say("");
+}
+function cmdGen(args) {
+    const words = numFlag(args, "--words");
+    const length = numFlag(args, "--length") ?? 20;
+    let pw;
+    if (words)
+        pw = generatePassphrase(words);
+    else if (args.includes("--pronounceable"))
+        pw = generatePronounceable();
+    else
+        pw = generatePassword({ length });
+    const s = estimateStrength(pw);
+    say(`  ${A}${B}${pw}${R0}`);
+    say(`  ${D}${s.bits} bits of entropy · ${s.label}${R0}`);
+    if (process.stdout.isTTY) {
+        clip(pw);
+        say(`  ${G}✓ copied to clipboard${R0}`);
+    }
+}
+async function cmdPasswd() {
+    const { vault, path } = await openExisting();
+    const n1 = await askSecret("New master password:");
+    if (n1.length < 8) {
+        err(`${RED}✗ Use at least 8 characters.${R0}`);
+        process.exit(1);
+    }
+    const n2 = await askSecret("Confirm new master password:");
+    if (n1 !== n2) {
+        err(`${RED}✗ Passwords don't match.${R0}`);
+        process.exit(1);
+    }
+    rewrapForPassword(vault, n1);
+    saveVault(path, vault);
+    say(`\n  ${G}✓ Master password changed.${R0} ${D}(The vault key was re-wrapped — items were not re-encrypted.)${R0}\n`);
+}
+async function cmdUsers(args) {
+    const { vault, path } = await openExisting();
+    if (args[0] === "add") {
+        const owner = vault.data.users[0];
+        if (!canDo(owner.role, "vault.manage")) {
+            err(`${RED}✗ Only the owner can manage users.${R0}`);
+            process.exit(1);
+        }
+        const name = args[1] ?? await ask("New user name");
+        const role = args[2] ?? (await ask("Role (admin/member/viewer)", "member"));
+        if (!(role in ROLE_RANK)) {
+            err(`${RED}✗ Unknown role “${role}”.${R0}`);
+            process.exit(1);
+        }
+        vault.data.users.push({ id: newId(), name, role, createdAt: new Date().toISOString() });
+        saveVault(path, vault);
+        say(`  ${G}✓ Added ${name} as ${role}.${R0}`);
+        return;
+    }
+    say(`\n  ${A}${B}Users & roles${R0}\n`);
+    for (const u of vault.data.users) {
+        say(`  ${u.role === "owner" ? Y + "●" : A + "○"}${R0} ${B}${u.name.padEnd(20)}${R0} ${D}${u.role}${R0}`);
+    }
+    say(`\n  ${D}Add one with${R0} ${B}ragevault users add <name> <role>${R0}.`);
+    say(`  ${Y}Note:${R0} ${D}v0.1 has a single master password — whoever unlocks acts as the owner.`);
+    say(`  ${D}Roles are advisory until per-user authentication ships (on the roadmap).${R0}\n`);
+}
+async function cmdTotp(query) {
+    const { vault } = await openExisting();
+    const q = query.toLowerCase();
+    const item = vault.data.items.find((i) => i.title.toLowerCase() === q)
+        ?? vault.data.items.find((i) => i.title.toLowerCase().includes(q));
+    if (!item) {
+        err(`${RED}✗ No item matches “${query}”.${R0}`);
+        process.exit(1);
+    }
+    if (!item.totp) {
+        err(`${Y}No 2FA secret on “${item.title}”.${R0} Add one with ${B}ragevault add${R0}.`);
+        process.exit(1);
+    }
+    try {
+        const { code, remaining } = totp(item.totp);
+        clip(code);
+        say(`\n  ${B}${item.title}${R0}  ${A}${B}${code.replace(/(\d{3})(\d{3})/, "$1 $2")}${R0}  ${D}· expires in ${remaining}s · copied${R0}\n`);
+    }
+    catch (e) {
+        err(`${RED}✗ ${e.message}${R0}`);
+        process.exit(1);
+    }
+}
+async function cmdAudit(breach) {
+    const { vault } = await openExisting();
+    const report = auditVault(vault.data);
+    say(`\n  ${A}${B}Password health${R0} ${D}· ${report.total} item(s)${R0}\n`);
+    say(`  ${report.weak ? RED : G}weak ${report.weak}${R0}   ${report.reused ? RED : G}reused ${report.reused}${R0}   ${report.old ? Y : G}old ${report.old}${R0}`);
+    if (report.findings.length) {
+        say("");
+        const name = (id) => vault.data.items.find((i) => i.id === id)?.title ?? id;
+        for (const f of report.findings)
+            say(`  ${Y}•${R0} ${B}${name(f.itemId).padEnd(22)}${R0} ${D}${f.issues.join(", ")}${R0}`);
+    }
+    else {
+        say(`\n  ${G}✓ No weak, reused or stale passwords. Nicely done.${R0}`);
+    }
+    if (breach) {
+        say(`\n  ${D}Checking Have I Been Pwned (k-anonymity — passwords never leave this machine)…${R0}`);
+        let hits = 0, failed = 0, checked = 0;
+        for (const i of vault.data.items) {
+            if (!i.password)
+                continue;
+            const n = await breachCount(i.password);
+            if (n < 0) {
+                failed++;
+                continue;
+            } // -1 = couldn't reach HIBP
+            checked++;
+            if (n > 0) {
+                hits++;
+                say(`  ${RED}⚠ ${i.title}${R0} appears in ${B}${n.toLocaleString()}${R0} breaches — change it.`);
+            }
+        }
+        if (failed && !checked)
+            say(`  ${Y}Couldn't reach Have I Been Pwned — no passwords were checked.${R0}`);
+        else if (!hits)
+            say(`  ${G}✓ None of your passwords were found in known breaches.${R0}${failed ? ` ${D}(${failed} couldn't be checked)${R0}` : ""}`);
+        else if (failed)
+            say(`  ${D}(${failed} password(s) couldn't be checked — network issue.)${R0}`);
+    }
+    else {
+        say(`\n  ${D}Add${R0} ${B}--breach${R0} ${D}to also check Have I Been Pwned (needs network).${R0}`);
+    }
+    say("");
+}
+async function cmdImport(file) {
+    if (!file || !existsSync(file)) {
+        err(`${RED}✗ File not found: ${file}${R0}`);
+        process.exit(1);
+    }
+    const { vault, path } = await openExisting();
+    const { items, source } = importAny(readFileSync(file, "utf8"), file);
+    if (!items.length) {
+        err(`${Y}No items found${R0} — supported: Bitwarden/Proton Pass JSON, or CSV (1Password/Chrome/KeePass).`);
+        process.exit(1);
+    }
+    say(`  ${D}Detected format:${R0} ${B}${source}${R0}`);
+    if (!(await confirm(`Import ${items.length} item(s) into “${vault.data.meta.name}”?`, true)))
+        return;
+    vault.data.items.push(...items);
+    saveVault(path, vault);
+    say(`  ${G}✓ Imported ${items.length} item(s).${R0}`);
+}
+async function cmdExport(csv, out) {
+    const { vault } = await openExisting();
+    say(`  ${RED}${B}⚠ WARNING${R0} ${Y}This writes your secrets in PLAINTEXT.${R0} Store it briefly, then delete it securely.`);
+    if (!(await confirm("Continue with a plaintext export?"))) {
+        say(`  ${D}Cancelled.${R0}`);
+        return;
+    }
+    const data = csv ? exportCsv(vault.data) : exportJson(vault.data);
+    const dest = out ?? `ragevault-export.${csv ? "csv" : "json"}`;
+    // Create restricted from the first byte (umask only clears bits) so the plaintext
+    // is never briefly world-readable; chmod covers a pre-existing looser file.
+    writeFileSync(dest, data, { encoding: "utf8", mode: 0o600 });
+    try {
+        chmodSync(dest, 0o600);
+    }
+    catch { /* windows */ }
+    say(`  ${G}✓ Exported${R0} to ${B}${dest}${R0} ${D}(0600). Delete it when you're done.${R0}`);
+}
+function backupDir() {
+    const base = process.env.RAGEVAULT_HOME?.trim() || join(homedir(), ".ragevault");
+    return join(base, "backups");
+}
+function stamp() {
+    const d = new Date(), p = (n) => String(n).padStart(2, "0");
+    return `${d.getFullYear()}${p(d.getMonth() + 1)}${p(d.getDate())}-${p(d.getHours())}${p(d.getMinutes())}${p(d.getSeconds())}`;
+}
+/** Back up the (already-encrypted) vault file. Keeps the last 20, prunes older. */
+async function cmdBackup() {
+    const src = vaultPath();
+    if (!existsSync(src)) {
+        err(`${Y}No vault to back up.${R0} Create one with ${B}ragevault init${R0}.`);
+        process.exit(1);
+    }
+    const dir = backupDir();
+    mkdirSync(dir, { recursive: true });
+    const dest = join(dir, `vault-${stamp()}.ragevault`);
+    copyFileSync(src, dest);
+    try {
+        chmodSync(dest, 0o600);
+    }
+    catch { /* windows */ }
+    // Prune to the 20 most recent.
+    const backups = readdirSync(dir).filter((f) => f.endsWith(".ragevault")).sort();
+    for (const old of backups.slice(0, Math.max(0, backups.length - 20))) {
+        try {
+            unlinkSync(join(dir, old));
+        }
+        catch { /* ignore */ }
+    }
+    say(`  ${G}✓ Backup written${R0} to ${B}${dest}${R0} ${D}(still encrypted; keeps the last 20).${R0}`);
+}
+/** Restore the vault from a backup file (validated, current one saved first). */
+async function cmdRestore(file) {
+    const dir = backupDir();
+    let src = file;
+    if (!src) {
+        const backups = existsSync(dir) ? readdirSync(dir).filter((f) => f.endsWith(".ragevault")).sort().reverse() : [];
+        if (!backups.length) {
+            err(`${Y}No backups found${R0} in ${D}${dir}${R0}.`);
+            process.exit(1);
+        }
+        say(`\n  ${A}${B}Backups${R0} ${D}(newest first)${R0}\n`);
+        backups.slice(0, 9).forEach((f, i) => say(`  ${A}${i + 1}${R0}  ${f}  ${D}${(statSync(join(dir, f)).size)} bytes${R0}`));
+        const pick = Number(await ask("\n  Restore which? (1-9)", "1"));
+        src = join(dir, backups[pick - 1] ?? backups[0]);
+    }
+    if (!existsSync(src)) {
+        err(`${RED}✗ Not found: ${src}${R0}`);
+        process.exit(1);
+    }
+    // Validate it's a RageVault file before overwriting anything.
+    try {
+        const f = JSON.parse(readFileSync(src, "utf8"));
+        if (f.magic !== "ragevault")
+            throw new Error("not a RageVault file");
+    }
+    catch (e) {
+        err(`${RED}✗ ${basename(src)} is not a valid vault (${e.message}).${R0}`);
+        process.exit(1);
+    }
+    const target = vaultPath();
+    if (existsSync(target)) {
+        if (!(await confirm(`This replaces your current vault at ${target}. A safety backup is taken first. Continue?`)))
+            return;
+        mkdirSync(dir, { recursive: true });
+        copyFileSync(target, join(dir, `vault-prerestore-${stamp()}.ragevault`));
+    }
+    copyFileSync(src, target);
+    try {
+        chmodSync(target, 0o600);
+    }
+    catch { /* windows */ }
+    say(`  ${G}✓ Restored${R0} from ${B}${basename(src)}${R0}. ${D}Unlock as usual with your master password.${R0}`);
+}
+async function cmdWg() {
+    say(`\n  ${A}${B}WireGuard setup${R0}`);
+    say(`  ${D}RageVault is meant to live behind a VPN. This runs the bundled setup script${R0}`);
+    say(`  ${D}which installs & configures WireGuard and prints a client config / QR.${R0}\n`);
+    if (process.platform === "win32") {
+        say(`  ${Y}On Windows${R0}, run the server side on a Linux host and import the client config`);
+        say(`  into the WireGuard app. See ${B}scripts/wireguard-setup.sh${R0} and the README.\n`);
+        return;
+    }
+    if (!(await confirm("Run the WireGuard setup script now (needs sudo)?"))) {
+        say(`  ${D}Skipped. It's optional — for purely local/personal use you don't need it.${R0}\n`);
+        return;
+    }
+    const here = dirname(fileURLToPath(import.meta.url));
+    const script = resolve(here, "..", "scripts", "wireguard-setup.sh");
+    const child = spawn("sudo", ["sh", script], { stdio: "inherit" });
+    await new Promise((r) => child.on("close", () => r()));
+}
+function numFlag(args, flag) {
+    const i = args.indexOf(flag);
+    if (i >= 0 && args[i + 1]) {
+        const n = Number(args[i + 1]);
+        if (!Number.isNaN(n))
+            return n;
+    }
+    return undefined;
+}
+function printHelp() {
+    say(`${A}${ASCII_BANNER}${R0}`);
+    say(`  ${B}${BRAND.product}${R0} ${D}v${BRAND.version} · by ${BRAND.author}${R0}\n`);
+    say(`  ${B}Usage:${R0} ${A}ragevault${R0} ${D}<command>${R0}\n`);
+    say(`    ${A}init${R0}       create an encrypted vault`);
+    say(`    ${A}add${R0}        add a secret`);
+    say(`    ${A}tui${R0}        full-screen terminal dashboard (blur, reveal, 2FA, copy)`);
+    say(`    ${A}ls${R0} ${D}[query]${R0} list items (secrets blurred)`);
+    say(`    ${A}get${R0} ${D}<q>${R0}    show an item ${D}(--reveal to show, --copy to clipboard)${R0}`);
+    say(`    ${A}edit${R0} ${D}<q>${R0}   edit an item ${D}(keeps password history)${R0}`);
+    say(`    ${A}rm${R0} ${D}<q>${R0}     move an item to the trash`);
+    say(`    ${A}trash${R0}      view / restore / empty the trash`);
+    say(`    ${A}mv${R0} ${D}<q> <cat>${R0} move an item to a category`);
+    say(`    ${A}field${R0} ${D}<q>${R0}  custom fields ${D}(add/rm — cards, SSH keys, tokens, notes)${R0}`);
+    say(`    ${A}gen${R0}        generate a password ${D}(--length N | --words N | --pronounceable)${R0}`);
+    say(`    ${A}totp${R0} ${D}<q>${R0}   show the live 2FA code for an item`);
+    say(`    ${A}audit${R0}      password health ${D}(--breach checks Have I Been Pwned)${R0}`);
+    say(`    ${A}import${R0} ${D}<f>${R0} import Bitwarden / Proton Pass (JSON) or 1Password / Chrome / KeePass (CSV)`);
+    say(`    ${A}export${R0}     export ${D}(--csv, --out FILE)${R0} — plaintext, use with care`);
+    say(`    ${A}backup${R0}     save an encrypted backup ${D}(keeps the last 20)${R0}`);
+    say(`    ${A}restore${R0}    restore the vault from a backup`);
+    say(`    ${A}passwd${R0}     change the master password`);
+    say(`    ${A}users${R0}      list / add users & roles`);
+    say(`    ${A}serve${R0}      start the self-hosted web UI + API ${D}(RAGEVAULT_HOST/PORT)${R0}`);
+    say(`    ${A}wg${R0}         set up WireGuard (optional, recommended)`);
+    say(`    ${A}version${R0}    print the version\n`);
+    say(`  ${Y}⚠ Use a VPN.${R0} ${D}RageVault is self-hosted; never expose it to the open Internet.${R0}`);
+    say(`  ${D}${BRAND.author} · ${BRAND.url}${R0}\n`);
+}
+async function main() {
+    const argv = process.argv.slice(2);
+    const cmd = (argv.find((a) => !a.startsWith("-")) || "help").toLowerCase();
+    const rest = argv.slice(argv.indexOf(cmd) + 1);
+    // A one-line "there's an update" notice on stderr (never on stdout, so it
+    // can't pollute secrets/exports). Skipped for the full-screen TUI and help.
+    if (!["tui", "dashboard", "help", "version", "--version", "-v"].includes(cmd)) {
+        const notice = await updateNoticeLine();
+        if (notice)
+            err(`  ${A}${notice}${R0}`);
+    }
+    switch (cmd) {
+        case "init": return cmdInit();
+        case "add": return cmdAdd();
+        case "ls":
+        case "list": return cmdLs(rest.find((a) => !a.startsWith("-")));
+        case "get":
+        case "show": {
+            const q = rest.find((a) => !a.startsWith("-"));
+            if (!q) {
+                err(`${RED}✗ Usage: ragevault get <query> [--reveal|--copy]${R0}`);
+                process.exit(1);
+            }
+            return cmdGet(q, rest.includes("--reveal"), rest.includes("--copy"));
+        }
+        case "edit": {
+            const q = rest.find((a) => !a.startsWith("-"));
+            if (!q) {
+                err(`${RED}✗ Usage: ragevault edit <query>${R0}`);
+                process.exit(1);
+            }
+            return cmdEdit(q);
+        }
+        case "rm":
+        case "del":
+        case "delete": {
+            const q = rest.find((a) => !a.startsWith("-"));
+            if (!q) {
+                err(`${RED}✗ Usage: ragevault rm <query>${R0}`);
+                process.exit(1);
+            }
+            return cmdRm(q);
+        }
+        case "trash": return cmdTrash(rest);
+        case "field":
+        case "fields": {
+            const q = rest.find((a) => !a.startsWith("-"));
+            if (!q) {
+                err(`${RED}✗ Usage: ragevault field <query> [add <label> [--secret] | rm <label>]${R0}`);
+                process.exit(1);
+            }
+            return cmdField(q, rest.slice(rest.indexOf(q) + 1));
+        }
+        case "mv":
+        case "move": {
+            const args = rest.filter((a) => !a.startsWith("-"));
+            if (args.length < 2) {
+                err(`${RED}✗ Usage: ragevault mv <query> <category>${R0}`);
+                process.exit(1);
+            }
+            return cmdMv(args[0], args[1]);
+        }
+        case "gen":
+        case "generate": return void cmdGen(rest);
+        case "totp":
+        case "2fa": {
+            const q = rest.find((a) => !a.startsWith("-"));
+            if (!q) {
+                err(`${RED}✗ Usage: ragevault totp <query>${R0}`);
+                process.exit(1);
+            }
+            return cmdTotp(q);
+        }
+        case "audit":
+        case "health": return cmdAudit(rest.includes("--breach"));
+        case "import": {
+            const f = rest.find((a) => !a.startsWith("-"));
+            if (!f) {
+                err(`${RED}✗ Usage: ragevault import <file.csv>${R0}`);
+                process.exit(1);
+            }
+            return cmdImport(f);
+        }
+        case "export": {
+            const outIdx = rest.indexOf("--out");
+            return cmdExport(rest.includes("--csv"), outIdx >= 0 ? rest[outIdx + 1] : undefined);
+        }
+        case "backup": return cmdBackup();
+        case "restore": return cmdRestore(rest.find((a) => !a.startsWith("-")));
+        case "passwd": return cmdPasswd();
+        case "users": return cmdUsers(rest);
+        case "wg":
+        case "wireguard": return cmdWg();
+        case "tui":
+        case "dashboard": {
+            if (!existsSync(vaultPath())) {
+                err(`${Y}No vault yet.${R0} Create one first with ${B}ragevault init${R0}.`);
+                process.exit(1);
+            }
+            const { VaultTui } = await import("./tui/app.js");
+            new VaultTui(vaultPath()).start();
+            return;
+        }
+        case "serve":
+        case "web": {
+            const host = process.env.RAGEVAULT_HOST?.trim() || "127.0.0.1";
+            const port = Number(process.env.RAGEVAULT_PORT ?? 8722);
+            say(`${A}${ASCII_BANNER}${R0}`);
+            // No vault yet is fine — the web UI shows a "create your vault" screen (the
+            // desktop app relies on this for first run).
+            if (!existsSync(vaultPath()))
+                say(`  ${Y}No vault yet${R0} — open the page to create one.\n`);
+            await startServer({ vaultPath: vaultPath(), host, port });
+            return;
+        }
+        case "version":
+        case "--version":
+        case "-v": return void say(`${BRAND.product} v${BRAND.version} — ${BRAND.author}`);
+        default: return void printHelp();
+    }
+}
+main().catch((e) => { err(`${RED}Fatal: ${e instanceof Error ? e.message : e}${R0}`); process.exit(1); });
+//# sourceMappingURL=ragevault.js.map