shiva-code 0.7.2 → 0.7.3

package/dist/chunk-UZKDLLPA.js

@@ -0,0 +1,891 @@
+import {
+  colors,
+  log
+} from "./chunk-Z6NXFC4Q.js";
+import {
+  api
+} from "./chunk-QQZRCJZK.js";
+import {
+  clearAuth,
+  getConfig,
+  isAuthenticated,
+  setAuth
+} from "./chunk-OP4HYQZZ.js";
+import {
+  __require
+} from "./chunk-3RG5ZIWI.js";
+
+// src/commands/auth/login.ts
+import { Command } from "commander";
+import inquirer2 from "inquirer";
+
+// src/services/auth/auth.ts
+import inquirer from "inquirer";
+import open from "open";
+import http from "http";
+import { URL } from "url";
+
+// src/services/auth/two-factor.ts
+import * as crypto from "crypto";
+function generateSecret(length = 20) {
+  const buffer = crypto.randomBytes(length);
+  return base32Encode(buffer);
+}
+function base32Encode(buffer) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  let result = "";
+  let bits = 0;
+  let value = 0;
+  for (let i = 0; i < buffer.length; i++) {
+    value = value << 8 | buffer[i];
+    bits += 8;
+    while (bits >= 5) {
+      result += alphabet[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) {
+    result += alphabet[value << 5 - bits & 31];
+  }
+  return result;
+}
+function base32Decode(encoded) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  const lookup = /* @__PURE__ */ new Map();
+  for (let i = 0; i < alphabet.length; i++) {
+    lookup.set(alphabet[i], i);
+  }
+  const bytes = [];
+  let bits = 0;
+  let value = 0;
+  for (const char of encoded.toUpperCase()) {
+    if (char === "=") continue;
+    const index = lookup.get(char);
+    if (index === void 0) continue;
+    value = value << 5 | index;
+    bits += 5;
+    if (bits >= 8) {
+      bytes.push(value >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return Buffer.from(bytes);
+}
+function generateTOTP(secret, timeStep = 30) {
+  const time = Math.floor(Date.now() / 1e3 / timeStep);
+  const key = base32Decode(secret);
+  const counter = Buffer.alloc(8);
+  counter.writeBigUInt64BE(BigInt(time));
+  const hmac = crypto.createHmac("sha1", key);
+  hmac.update(counter);
+  const hash = hmac.digest();
+  const offset = hash[hash.length - 1] & 15;
+  const code = ((hash[offset] & 127) << 24 | (hash[offset + 1] & 255) << 16 | (hash[offset + 2] & 255) << 8 | hash[offset + 3] & 255) % 1e6;
+  return code.toString().padStart(6, "0");
+}
+function verifyTOTP(secret, code, timeStep = 30) {
+  for (let i = -1; i <= 1; i++) {
+    const time = Math.floor(Date.now() / 1e3 / timeStep) + i;
+    const expectedCode = generateTOTPForTime(secret, time, timeStep);
+    if (expectedCode === code) {
+      return true;
+    }
+  }
+  return false;
+}
+function generateTOTPForTime(secret, time, timeStep) {
+  const key = base32Decode(secret);
+  const counter = Buffer.alloc(8);
+  counter.writeBigUInt64BE(BigInt(time));
+  const hmac = crypto.createHmac("sha1", key);
+  hmac.update(counter);
+  const hash = hmac.digest();
+  const offset = hash[hash.length - 1] & 15;
+  const code = ((hash[offset] & 127) << 24 | (hash[offset + 1] & 255) << 16 | (hash[offset + 2] & 255) << 8 | hash[offset + 3] & 255) % 1e6;
+  return code.toString().padStart(6, "0");
+}
+function generateOtpAuthUrl(secret, email, issuer = "SHIVA Code") {
+  const encodedIssuer = encodeURIComponent(issuer);
+  const encodedEmail = encodeURIComponent(email);
+  return `otpauth://totp/${encodedIssuer}:${encodedEmail}?secret=${secret}&issuer=${encodedIssuer}&algorithm=SHA1&digits=6&period=30`;
+}
+function generateBackupCodes(count = 10) {
+  const codes = [];
+  for (let i = 0; i < count; i++) {
+    const buffer = crypto.randomBytes(6);
+    const code = buffer.toString("hex").toUpperCase();
+    codes.push(`${code.slice(0, 3)}-${code.slice(3, 6)}-${code.slice(6, 9)}-${code.slice(9, 12)}`);
+  }
+  return codes;
+}
+function generateDeviceFingerprint() {
+  const os = __require("os");
+  const components = [
+    os.hostname(),
+    os.platform(),
+    os.arch(),
+    os.cpus()[0]?.model || "unknown",
+    os.userInfo().username
+  ];
+  const fingerprint = crypto.createHash("sha256").update(components.join("|")).digest("hex").slice(0, 32);
+  return fingerprint;
+}
+function getDeviceName() {
+  const os = __require("os");
+  const hostname = os.hostname();
+  const platform = os.platform();
+  const platformNames = {
+    darwin: "macOS",
+    linux: "Linux",
+    win32: "Windows"
+  };
+  return `${hostname} (${platformNames[platform] || platform})`;
+}
+var TwoFactorService = class {
+  /**
+   * Start 2FA setup - generate secret and QR code
+   */
+  async startSetup(email) {
+    try {
+      const response = await api.setup2FA();
+      if (!response.setup) {
+        throw new Error(response.message || "2FA-Setup fehlgeschlagen");
+      }
+      return response.setup;
+    } catch (error) {
+      const secret = generateSecret();
+      const otpAuthUrl = generateOtpAuthUrl(secret, email);
+      const backupCodes = generateBackupCodes();
+      return {
+        secret,
+        qrCodeDataUrl: otpAuthUrl,
+        // In real implementation, would be a data URL
+        backupCodes
+      };
+    }
+  }
+  /**
+   * Verify TOTP code and complete setup
+   */
+  async verifySetup(code) {
+    try {
+      const response = await api.verify2FA(code);
+      return response.success;
+    } catch (error) {
+      throw error;
+    }
+  }
+  /**
+   * Verify TOTP code during login
+   */
+  async verifyCode(code) {
+    try {
+      const response = await api.verify2FACode(code);
+      return response.success;
+    } catch (error) {
+      throw error;
+    }
+  }
+  /**
+   * Verify backup code
+   */
+  async verifyBackupCode(code) {
+    try {
+      const response = await api.verifyBackupCode(code);
+      return response.success;
+    } catch (error) {
+      throw error;
+    }
+  }
+  /**
+   * Get 2FA status
+   */
+  async getStatus() {
+    try {
+      const response = await api.get2FAStatus();
+      return response;
+    } catch (error) {
+      return {
+        enabled: false,
+        backupCodesRemaining: 0
+      };
+    }
+  }
+  /**
+   * Disable 2FA
+   */
+  async disable(code) {
+    try {
+      const response = await api.disable2FA(code);
+      return response.success;
+    } catch (error) {
+      throw error;
+    }
+  }
+  /**
+   * Generate new backup codes
+   */
+  async regenerateBackupCodes() {
+    try {
+      const response = await api.regenerateBackupCodes();
+      return response.codes;
+    } catch (error) {
+      throw error;
+    }
+  }
+  /**
+   * Verify TOTP code locally (for testing)
+   */
+  verifyLocal(secret, code) {
+    return verifyTOTP(secret, code);
+  }
+  /**
+   * Generate TOTP code locally (for testing)
+   */
+  generateLocal(secret) {
+    return generateTOTP(secret);
+  }
+};
+var DeviceTrustService = class {
+  /**
+   * Get current device fingerprint
+   */
+  getFingerprint() {
+    return generateDeviceFingerprint();
+  }
+  /**
+   * Get current device name
+   */
+  getDeviceName() {
+    return getDeviceName();
+  }
+  /**
+   * Register current device as trusted
+   */
+  async trustDevice(name) {
+    const fingerprint = this.getFingerprint();
+    const deviceName = name || this.getDeviceName();
+    try {
+      const response = await api.trustDevice({
+        name: deviceName,
+        fingerprint
+      });
+      return response.device;
+    } catch (error) {
+      throw error;
+    }
+  }
+  /**
+   * Check if current device is trusted
+   */
+  async isDeviceTrusted() {
+    const fingerprint = this.getFingerprint();
+    try {
+      const devices = await api.getDevices();
+      return devices.devices.some((d) => d.fingerprint === fingerprint);
+    } catch (error) {
+      return false;
+    }
+  }
+  /**
+   * List all trusted devices
+   */
+  async listDevices() {
+    try {
+      const response = await api.getDevices();
+      const currentFingerprint = this.getFingerprint();
+      return response.devices.map((d) => ({
+        ...d,
+        isCurrent: d.fingerprint === currentFingerprint
+      }));
+    } catch (error) {
+      return [];
+    }
+  }
+  /**
+   * Revoke a trusted device
+   */
+  async revokeDevice(deviceId) {
+    try {
+      const response = await api.revokeDevice(deviceId);
+      return response.success;
+    } catch (error) {
+      throw error;
+    }
+  }
+  /**
+   * Revoke all devices except current
+   */
+  async revokeAllDevices() {
+    try {
+      const response = await api.revokeAllDevices();
+      return response.revokedCount;
+    } catch (error) {
+      throw error;
+    }
+  }
+};
+var twoFactorService = new TwoFactorService();
+var deviceTrustService = new DeviceTrustService();
+function displayQRCode(url) {
+  log.newline();
+  log.info("Scan diesen QR-Code mit deiner Authenticator App:");
+  log.newline();
+  log.dim("(QR-Code-Anzeige erfordert qrcode-terminal Paket)");
+  log.newline();
+  log.plain(`URL: ${url}`);
+  log.newline();
+}
+function displayBackupCodes(codes) {
+  log.newline();
+  console.log(colors.orange.bold("Backup-Codes (speichern!)"));
+  console.log(colors.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log.newline();
+  for (let i = 0; i < codes.length; i++) {
+    console.log(`  ${i + 1}. ${codes[i]}`);
+  }
+  log.newline();
+  log.warn("Diese Codes k\xF6nnen nur einmal verwendet werden!");
+  log.dim("Speichere sie an einem sicheren Ort.");
+  log.newline();
+}
+function displayDevices(devices) {
+  log.newline();
+  console.log(colors.orange.bold("Vertrauensw\xFCrdige Ger\xE4te"));
+  console.log(colors.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log.newline();
+  if (devices.length === 0) {
+    log.dim("Keine Ger\xE4te registriert");
+    return;
+  }
+  for (const device of devices) {
+    const current = device.isCurrent ? colors.green(" (aktuell)") : "";
+    console.log(`  ${device.name}${current}`);
+    log.dim(`    ID: ${device.id}`);
+    log.dim(`    Zuletzt: ${formatRelativeTime(device.lastUsed)}`);
+    if (device.expiresAt) {
+      log.dim(`    L\xE4uft ab: ${formatRelativeTime(device.expiresAt)}`);
+    } else {
+      log.dim("    L\xE4uft ab: nie");
+    }
+    log.newline();
+  }
+}
+function formatRelativeTime(dateStr) {
+  const date = new Date(dateStr);
+  const now = /* @__PURE__ */ new Date();
+  const diffMs = now.getTime() - date.getTime();
+  const diffSec = Math.floor(diffMs / 1e3);
+  const diffMin = Math.floor(diffSec / 60);
+  const diffHour = Math.floor(diffMin / 60);
+  const diffDay = Math.floor(diffHour / 24);
+  if (diffSec < 60) return "gerade eben";
+  if (diffMin < 60) return `vor ${diffMin} Minuten`;
+  if (diffHour < 24) return `vor ${diffHour} Stunden`;
+  if (diffDay < 30) return `vor ${diffDay} Tagen`;
+  return date.toLocaleDateString("de-DE");
+}
+
+// src/services/auth/auth.ts
+var PORT_RANGE_START = 9876;
+var PORT_RANGE_END = 9886;
+async function loginWithOtp(email) {
+  try {
+    log.info(`Sende Login-Code an ${email}...`);
+    const otpResponse = await api.requestOtp(email);
+    if (!otpResponse.success) {
+      log.error(otpResponse.message || "Fehler beim Senden des Codes");
+      return false;
+    }
+    log.success("Code wurde gesendet!");
+    log.dim(`Verbleibende Versuche: ${otpResponse.remainingAttempts}`);
+    log.newline();
+    const { otp } = await inquirer.prompt([
+      {
+        type: "input",
+        name: "otp",
+        message: "Code eingeben:",
+        validate: (input) => {
+          if (!/^\d{6}$/.test(input)) {
+            return "Bitte gib den 6-stelligen Code ein";
+          }
+          return true;
+        }
+      }
+    ]);
+    const authResponse = await api.verifyOtp(otpResponse.token, otp);
+    if (!authResponse.success || !authResponse.token || !authResponse.user) {
+      log.error(authResponse.message || "Ung\xFCltiger Code");
+      return false;
+    }
+    setAuth(authResponse.token, authResponse.user);
+    try {
+      const tfaStatus = await twoFactorService.getStatus();
+      if (tfaStatus.enabled) {
+        log.newline();
+        log.info("2FA ist aktiviert. Bitte verifiziere dich.");
+        log.newline();
+        const isDeviceTrusted = await deviceTrustService.isDeviceTrusted();
+        if (!isDeviceTrusted) {
+          const verified = await prompt2FAVerification();
+          if (!verified) {
+            clearAuth();
+            log.error("2FA-Verifizierung fehlgeschlagen");
+            return false;
+          }
+          const { trustDevice } = await inquirer.prompt([{
+            type: "confirm",
+            name: "trustDevice",
+            message: "Diesem Ger\xE4t vertrauen? (Kein 2FA bei zuk\xFCnftigen Logins)",
+            default: true
+          }]);
+          if (trustDevice) {
+            try {
+              await deviceTrustService.trustDevice();
+              log.success("Ger\xE4t als vertrauensw\xFCrdig markiert");
+            } catch {
+            }
+          }
+        } else {
+          log.dim("Ger\xE4t ist vertrauensw\xFCrdig - 2FA \xFCbersprungen");
+        }
+      }
+    } catch {
+    }
+    log.newline();
+    log.success(`Angemeldet als ${authResponse.user.email} (${authResponse.user.tier.toUpperCase()})`);
+    return true;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unbekannter Fehler";
+    log.error(`Login fehlgeschlagen: ${message}`);
+    return false;
+  }
+}
+async function findAvailablePort() {
+  for (let port = PORT_RANGE_START; port <= PORT_RANGE_END; port++) {
+    const isAvailable = await checkPort(port);
+    if (isAvailable) {
+      return port;
+    }
+  }
+  throw new Error("Kein freier Port f\xFCr Callback-Server gefunden");
+}
+function checkPort(port) {
+  return new Promise((resolve) => {
+    const server = http.createServer();
+    server.once("error", () => resolve(false));
+    server.once("listening", () => {
+      server.close();
+      resolve(true);
+    });
+    server.listen(port, "127.0.0.1");
+  });
+}
+function getCallbackHtml(type, data) {
+  const baseStyles = `
+    * { margin: 0; padding: 0; box-sizing: border-box; }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      background: linear-gradient(135deg, #0a0a0a 0%, #1a1a2e 50%, #16213e 100%);
+      color: #fff;
+    }
+    .container {
+      text-align: center;
+      padding: 3rem;
+      max-width: 420px;
+    }
+    .logo {
+      width: 80px;
+      height: 80px;
+      margin: 0 auto 1.5rem;
+      background: linear-gradient(135deg, #f97316 0%, #ea580c 100%);
+      border-radius: 20px;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      box-shadow: 0 10px 40px rgba(249, 115, 22, 0.3);
+    }
+    .logo svg {
+      width: 48px;
+      height: 48px;
+    }
+    h1 {
+      font-size: 1.75rem;
+      font-weight: 700;
+      margin-bottom: 0.75rem;
+    }
+    .subtitle {
+      color: #9ca3af;
+      font-size: 1rem;
+      line-height: 1.5;
+    }
+    .email {
+      color: #f97316;
+      font-weight: 600;
+    }
+    .status-icon {
+      width: 64px;
+      height: 64px;
+      margin: 0 auto 1.5rem;
+      border-radius: 50%;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+    }
+    .status-icon.success {
+      background: linear-gradient(135deg, #22c55e 0%, #16a34a 100%);
+      box-shadow: 0 10px 40px rgba(34, 197, 94, 0.3);
+    }
+    .status-icon.error {
+      background: linear-gradient(135deg, #ef4444 0%, #dc2626 100%);
+      box-shadow: 0 10px 40px rgba(239, 68, 68, 0.3);
+    }
+    .status-icon svg {
+      width: 32px;
+      height: 32px;
+    }
+    .spinner {
+      width: 48px;
+      height: 48px;
+      margin: 0 auto 1.5rem;
+      border: 3px solid rgba(249, 115, 22, 0.2);
+      border-top-color: #f97316;
+      border-radius: 50%;
+      animation: spin 1s linear infinite;
+    }
+    @keyframes spin {
+      to { transform: rotate(360deg); }
+    }
+    .hint {
+      margin-top: 1.5rem;
+      padding-top: 1.5rem;
+      border-top: 1px solid rgba(255, 255, 255, 0.1);
+      color: #6b7280;
+      font-size: 0.875rem;
+    }
+  `;
+  const shivaLogo = `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 2L2 7l10 5 10-5-10-5z"/><path d="M2 17l10 5 10-5"/><path d="M2 12l10 5 10-5"/></svg>`;
+  const checkIcon = `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"><polyline points="20 6 9 17 4 12"/></svg>`;
+  const xIcon = `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>`;
+  if (type === "success") {
+    return `<!DOCTYPE html>
+<html lang="de">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>SHIVA CLI - Angemeldet</title>
+  <style>${baseStyles}</style>
+</head>
+<body>
+  <div class="container">
+    <div class="status-icon success">${checkIcon}</div>
+    <h1>Erfolgreich angemeldet!</h1>
+    <p class="subtitle">Willkommen zur\xFCck, <span class="email">${data.email}</span></p>
+    <p class="hint">Du kannst dieses Fenster jetzt schlie\xDFen und zum Terminal zur\xFCckkehren.</p>
+  </div>
+  <script>setTimeout(() => window.close(), 3000);</script>
+</body>
+</html>`;
+  }
+  if (type === "error") {
+    return `<!DOCTYPE html>
+<html lang="de">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>SHIVA CLI - Fehler</title>
+  <style>${baseStyles}</style>
+</head>
+<body>
+  <div class="container">
+    <div class="status-icon error">${xIcon}</div>
+    <h1>Anmeldung fehlgeschlagen</h1>
+    <p class="subtitle">${data.message || "Ein unbekannter Fehler ist aufgetreten."}</p>
+    <p class="hint">Du kannst dieses Fenster schlie\xDFen und es erneut versuchen.</p>
+  </div>
+</body>
+</html>`;
+  }
+  return `<!DOCTYPE html>
+<html lang="de">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>SHIVA CLI</title>
+  <style>${baseStyles}</style>
+</head>
+<body>
+  <div class="container">
+    <div class="logo">${shivaLogo}</div>
+    <div class="spinner"></div>
+    <h1>SHIVA CLI</h1>
+    <p class="subtitle">Warte auf Login-Callback...</p>
+  </div>
+</body>
+</html>`;
+}
+function startCallbackServer(port) {
+  return new Promise((resolve, reject) => {
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url || "/", `http://127.0.0.1:${port}`);
+      if (url.pathname === "/callback") {
+        const token = url.searchParams.get("token");
+        const userId = url.searchParams.get("userId");
+        const email = url.searchParams.get("email");
+        const tier = url.searchParams.get("tier");
+        const error = url.searchParams.get("error");
+        if (error) {
+          res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+          res.end(getCallbackHtml("error", { message: error }));
+          server.close();
+          reject(new Error(error));
+          return;
+        }
+        if (!token || !userId || !email) {
+          res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+          res.end(getCallbackHtml("error", { message: "Token oder Benutzer-Daten fehlen." }));
+          server.close();
+          reject(new Error("Ung\xFCltige Callback-Parameter"));
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(getCallbackHtml("success", { email }));
+        server.close();
+        resolve({
+          token,
+          user: {
+            id: parseInt(userId, 10),
+            email,
+            tier: tier || "free"
+          }
+        });
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(getCallbackHtml("waiting", {}));
+    });
+    const timeout = setTimeout(() => {
+      server.close();
+      reject(new Error("Login-Timeout - keine Antwort erhalten"));
+    }, 12e4);
+    server.once("close", () => {
+      clearTimeout(timeout);
+    });
+    server.once("error", (err) => {
+      clearTimeout(timeout);
+      reject(err);
+    });
+    server.listen(port, "127.0.0.1");
+  });
+}
+async function loginWithBrowser() {
+  const config = getConfig();
+  try {
+    const port = await findAvailablePort();
+    const callbackUrl = `http://127.0.0.1:${port}/callback`;
+    const baseUrl = config.apiEndpoint.replace("/api", "");
+    const loginUrl = `${baseUrl}/auth/cli-login?callback=${encodeURIComponent(callbackUrl)}`;
+    const serverPromise = startCallbackServer(port);
+    log.newline();
+    log.info("\xD6ffne Browser zur Anmeldung...");
+    try {
+      await open(loginUrl);
+    } catch {
+    }
+    log.newline();
+    log.plain("Bitte \xF6ffne diese URL in deinem Browser um die Anmeldung abzuschlie\xDFen:");
+    log.newline();
+    console.log(`  ${colors.cyan(loginUrl)}`);
+    log.newline();
+    log.dim("Warte auf Anmeldung... (Timeout: 2 Minuten)");
+    log.newline();
+    const result = await serverPromise;
+    setAuth(result.token, result.user);
+    try {
+      const tfaStatus = await twoFactorService.getStatus();
+      if (tfaStatus.enabled) {
+        log.newline();
+        log.info("2FA ist aktiviert. Bitte verifiziere dich.");
+        log.newline();
+        const isDeviceTrusted = await deviceTrustService.isDeviceTrusted();
+        if (!isDeviceTrusted) {
+          const verified = await prompt2FAVerification();
+          if (!verified) {
+            clearAuth();
+            log.error("2FA-Verifizierung fehlgeschlagen");
+            return false;
+          }
+          const { trustDevice } = await inquirer.prompt([{
+            type: "confirm",
+            name: "trustDevice",
+            message: "Diesem Ger\xE4t vertrauen?",
+            default: true
+          }]);
+          if (trustDevice) {
+            try {
+              await deviceTrustService.trustDevice();
+              log.success("Ger\xE4t als vertrauensw\xFCrdig markiert");
+            } catch {
+            }
+          }
+        } else {
+          log.dim("Ger\xE4t ist vertrauensw\xFCrdig - 2FA \xFCbersprungen");
+        }
+      }
+    } catch {
+    }
+    log.success(`Angemeldet als ${result.user.email} (${result.user.tier.toUpperCase()})`);
+    return true;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unbekannter Fehler";
+    log.error(`Login fehlgeschlagen: ${message}`);
+    log.newline();
+    log.info("Fallback: Manueller Token-Eintrag");
+    const loginUrl = `${config.apiEndpoint.replace("/api", "")}/auth/cli-login`;
+    log.dim(`URL: ${loginUrl}`);
+    log.newline();
+    const { useManual } = await inquirer.prompt([{
+      type: "confirm",
+      name: "useManual",
+      message: "Token manuell eingeben?",
+      default: true
+    }]);
+    if (!useManual) {
+      return false;
+    }
+    try {
+      await open(loginUrl);
+    } catch {
+      log.dim("Browser konnte nicht ge\xF6ffnet werden");
+      log.dim(`\xD6ffne manuell: ${loginUrl}`);
+    }
+    const { token } = await inquirer.prompt([{
+      type: "password",
+      name: "token",
+      message: "Token:",
+      mask: "*"
+    }]);
+    if (!token) {
+      log.error("Kein Token eingegeben");
+      return false;
+    }
+    setAuth(token, { id: 0, email: "", tier: "free" });
+    try {
+      const response = await api.getCurrentUser();
+      setAuth(token, response.user);
+      log.success(`Angemeldet als ${response.user.email}`);
+      return true;
+    } catch {
+      clearAuth();
+      log.error("Ung\xFCltiger Token");
+      return false;
+    }
+  }
+}
+function logout() {
+  clearAuth();
+  log.success("Abgemeldet");
+}
+async function prompt2FAVerification() {
+  const MAX_ATTEMPTS = 3;
+  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+    const { method } = await inquirer.prompt([{
+      type: "list",
+      name: "method",
+      message: "Verifizierungsmethode:",
+      choices: [
+        { name: "Authenticator App Code", value: "totp" },
+        { name: "Backup Code", value: "backup" },
+        { name: "Abbrechen", value: "cancel" }
+      ]
+    }]);
+    if (method === "cancel") {
+      return false;
+    }
+    const promptMessage = method === "totp" ? "6-stelliger Code aus deiner Authenticator App:" : "Backup-Code (Format: XXX-XXX-XXX-XXX):";
+    const { code } = await inquirer.prompt([{
+      type: "input",
+      name: "code",
+      message: promptMessage,
+      validate: (input) => {
+        if (method === "totp") {
+          return /^\d{6}$/.test(input) || "Bitte gib einen 6-stelligen Code ein";
+        }
+        return input.length > 0 || "Bitte gib einen Backup-Code ein";
+      }
+    }]);
+    try {
+      let verified = false;
+      if (method === "totp") {
+        verified = await twoFactorService.verifyCode(code);
+      } else {
+        verified = await twoFactorService.verifyBackupCode(code);
+      }
+      if (verified) {
+        log.success("2FA-Verifizierung erfolgreich");
+        return true;
+      }
+    } catch (error) {
+    }
+    if (attempt < MAX_ATTEMPTS) {
+      log.error(`Ung\xFCltiger Code. Noch ${MAX_ATTEMPTS - attempt} Versuche.`);
+    }
+  }
+  return false;
+}
+
+// src/commands/auth/login.ts
+var loginCommand = new Command("login").description("Mit shiva.li anmelden").option("-e, --email <email>", "Email-Adresse f\xFCr OTP-Login").option("--otp", "OTP-Login statt Browser verwenden").action(async (options) => {
+  if (isAuthenticated()) {
+    const config = getConfig();
+    log.info(`Bereits angemeldet als ${config.email}`);
+    const { relogin } = await inquirer2.prompt([
+      {
+        type: "confirm",
+        name: "relogin",
+        message: "M\xF6chtest du dich neu anmelden?",
+        default: false
+      }
+    ]);
+    if (!relogin) {
+      return;
+    }
+  }
+  log.brand();
+  if (options.email) {
+    await loginWithOtp(options.email);
+    return;
+  }
+  if (options.otp) {
+    const { email } = await inquirer2.prompt([
+      {
+        type: "input",
+        name: "email",
+        message: "Email-Adresse:",
+        validate: (input) => {
+          if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(input)) {
+            return "Bitte gib eine g\xFCltige Email-Adresse ein";
+          }
+          return true;
+        }
+      }
+    ]);
+    await loginWithOtp(email);
+    return;
+  }
+  await loginWithBrowser();
+});
+
+export {
+  twoFactorService,
+  deviceTrustService,
+  displayQRCode,
+  displayBackupCodes,
+  displayDevices,
+  logout,
+  loginCommand
+};