@aaronsb/kg-cli 0.6.1

package/dist/lib/auth/token-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-manager.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/token-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,YAAY;IACX,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,aAAa;IAEzC;;;;OAIG;IACH,UAAU,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAWtC;;;;OAIG;IACH,QAAQ,IAAI,SAAS,GAAG,IAAI;IAsB5B;;;;;OAKG;IACH,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO;IAO7C;;OAEG;IACH,UAAU,IAAI,IAAI;IAIlB;;;;OAIG;IACH,UAAU,IAAI,OAAO;IAIrB;;;;OAIG;IACH,WAAW,IAAI,MAAM,GAAG,IAAI;IAK5B;;;;OAIG;IACH,OAAO,IAAI,MAAM,GAAG,IAAI;IAKxB;;;;OAIG;IACH,mBAAmB,IAAI,MAAM,GAAG,IAAI;IAUpC;;;;OAIG;IACH,yBAAyB,IAAI,MAAM,GAAG,IAAI;IAY1C;;;;;OAKG;IACH,MAAM,CAAC,iBAAiB,CAAC,aAAa,EAAE;QACtC,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE;YACJ,QAAQ,EAAE,MAAM,CAAC;YACjB,IAAI,EAAE,MAAM,CAAC;SACd,CAAC;KACH,GAAG,SAAS;CAWd"}

package/dist/lib/auth/token-manager.js

@@ -0,0 +1,139 @@
+"use strict";
+/**
+ * Token Manager
+ *
+ * Manages JWT token lifecycle: storage, retrieval, validation, expiration.
+ * Tokens are stored in the user's config file (~/.config/kg/config.json).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenManager = void 0;
+class TokenManager {
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Store JWT token with metadata
+     *
+     * @param tokenInfo Token information including access token, expiration, user details
+     */
+    storeToken(tokenInfo) {
+        this.config.set('auth.token', tokenInfo.access_token);
+        this.config.set('auth.token_type', tokenInfo.token_type);
+        this.config.set('auth.expires_at', tokenInfo.expires_at);
+        this.config.set('auth.username', tokenInfo.username);
+        this.config.set('auth.role', tokenInfo.role);
+        // Also update top-level username for backwards compatibility
+        this.config.set('username', tokenInfo.username);
+    }
+    /**
+     * Retrieve stored token (returns null if expired or not found)
+     *
+     * @returns Token information or null if not authenticated
+     */
+    getToken() {
+        const token = this.config.get('auth.token');
+        if (!token) {
+            return null;
+        }
+        const tokenInfo = {
+            access_token: token,
+            token_type: this.config.get('auth.token_type') || 'bearer',
+            expires_at: this.config.get('auth.expires_at') || 0,
+            username: this.config.get('auth.username') || '',
+            role: this.config.get('auth.role') || ''
+        };
+        // Check if token is expired (with 5-minute buffer)
+        if (this.isTokenExpired(tokenInfo)) {
+            return null;
+        }
+        return tokenInfo;
+    }
+    /**
+     * Check if token is expired (with 5-minute buffer for safety)
+     *
+     * @param tokenInfo Token information to check
+     * @returns true if token is expired or will expire within 5 minutes
+     */
+    isTokenExpired(tokenInfo) {
+        const now = Math.floor(Date.now() / 1000);
+        const BUFFER_SECONDS = 5 * 60; // 5-minute buffer
+        return tokenInfo.expires_at <= now + BUFFER_SECONDS;
+    }
+    /**
+     * Clear stored token (logout)
+     */
+    clearToken() {
+        this.config.delete('auth');
+    }
+    /**
+     * Check if user is logged in (valid token exists)
+     *
+     * @returns true if user has a valid, non-expired token
+     */
+    isLoggedIn() {
+        return this.getToken() !== null;
+    }
+    /**
+     * Get current username from token
+     *
+     * @returns Username or null if not logged in
+     */
+    getUsername() {
+        const tokenInfo = this.getToken();
+        return tokenInfo ? tokenInfo.username : null;
+    }
+    /**
+     * Get current user role from token
+     *
+     * @returns User role or null if not logged in
+     */
+    getRole() {
+        const tokenInfo = this.getToken();
+        return tokenInfo ? tokenInfo.role : null;
+    }
+    /**
+     * Get token expiration time as a human-readable string
+     *
+     * @returns Formatted expiration time or null if not logged in
+     */
+    getExpirationString() {
+        const tokenInfo = this.getToken();
+        if (!tokenInfo) {
+            return null;
+        }
+        const expiresAt = new Date(tokenInfo.expires_at * 1000);
+        return expiresAt.toLocaleString();
+    }
+    /**
+     * Get minutes until token expiration
+     *
+     * @returns Minutes until expiration or null if not logged in
+     */
+    getMinutesUntilExpiration() {
+        const tokenInfo = this.getToken();
+        if (!tokenInfo) {
+            return null;
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const secondsUntilExpiration = tokenInfo.expires_at - now;
+        return Math.floor(secondsUntilExpiration / 60);
+    }
+    /**
+     * Create TokenInfo from login response
+     *
+     * @param loginResponse Response from /auth/login endpoint
+     * @returns TokenInfo object ready to be stored
+     */
+    static fromLoginResponse(loginResponse) {
+        const now = Math.floor(Date.now() / 1000);
+        return {
+            access_token: loginResponse.access_token,
+            token_type: loginResponse.token_type,
+            expires_at: now + loginResponse.expires_in,
+            username: loginResponse.user.username,
+            role: loginResponse.user.role
+        };
+    }
+}
+exports.TokenManager = TokenManager;
+//# sourceMappingURL=token-manager.js.map

package/dist/lib/auth/token-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-manager.js","sourceRoot":"","sources":["../../../src/lib/auth/token-manager.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAYH,MAAa,YAAY;IACvB,YAAoB,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAE7C;;;;OAIG;IACH,UAAU,CAAC,SAAoB;QAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAE7C,6DAA6D;QAC7D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,QAAQ;QACN,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAc;YAC3B,YAAY,EAAE,KAAK;YACnB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,QAAQ;YAC1D,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC;YACnD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;YAChD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;SACzC,CAAC;QAEF,mDAAmD;QACnD,IAAI,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,SAAoB;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,CAAC,CAAE,kBAAkB;QAElD,OAAO,SAAS,CAAC,UAAU,IAAI,GAAG,GAAG,cAAc,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,WAAW;QACT,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,OAAO;QACL,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,mBAAmB;QACjB,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QACxD,OAAO,SAAS,CAAC,cAAc,EAAE,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,yBAAyB;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,sBAAsB,GAAG,SAAS,CAAC,UAAU,GAAG,GAAG,CAAC;QAE1D,OAAO,IAAI,CAAC,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,iBAAiB,CAAC,aAQxB;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,OAAO;YACL,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,UAAU,EAAE,GAAG,GAAG,aAAa,CAAC,UAAU;YAC1C,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ;YACrC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI;SAC9B,CAAC;IACJ,CAAC;CACF;AAxJD,oCAwJC"}

package/dist/lib/auth/token-refresh.d.ts

@@ -0,0 +1,63 @@
+/**
+ * OAuth Token Refresh Manager (ADR-054)
+ *
+ * Handles automatic token refresh using refresh_token grant.
+ *
+ * Note: Only works with grants that return refresh tokens (device flow, authorization code).
+ * Client credentials grant does NOT receive refresh tokens - must re-authenticate instead.
+ */
+import type { OAuthTokenInfo } from './oauth-types';
+export interface TokenRefreshCallbacks {
+    onRefreshStart?: () => void;
+    onRefreshSuccess?: (tokenInfo: OAuthTokenInfo) => void;
+    onRefreshError?: (error: Error) => void;
+}
+export declare class TokenRefreshManager {
+    private client;
+    constructor(apiUrl: string);
+    /**
+     * Refresh an expired access token using a refresh token
+     *
+     * POST /auth/oauth/token
+     * Body: grant_type=refresh_token&refresh_token=<token>&client_id=<client_id>
+     *
+     * Returns new access token and same refresh token
+     *
+     * @param tokenInfo - Current token information (must have refresh_token)
+     * @param callbacks - Optional callbacks for progress tracking
+     * @returns New token information with refreshed access token
+     */
+    refreshToken(tokenInfo: OAuthTokenInfo, callbacks?: TokenRefreshCallbacks): Promise<OAuthTokenInfo>;
+    /**
+     * Automatically refresh token if expired or about to expire
+     *
+     * Checks if token is expired (or will expire within buffer period).
+     * If so, refreshes it. Otherwise, returns the original token.
+     *
+     * @param tokenInfo - Current token information
+     * @param bufferSeconds - Refresh if expiring within this many seconds (default: 60)
+     * @param callbacks - Optional callbacks for progress tracking
+     * @returns Token information (refreshed if needed)
+     */
+    autoRefresh(tokenInfo: OAuthTokenInfo | null, bufferSeconds?: number, callbacks?: TokenRefreshCallbacks): Promise<OAuthTokenInfo>;
+    /**
+     * Revoke a token (access or refresh)
+     *
+     * POST /auth/oauth/revoke
+     * Body: token=<token>&token_type_hint=access_token|refresh_token&client_id=<client_id>
+     *
+     * @param token - Token to revoke (access_token or refresh_token)
+     * @param tokenTypeHint - Type of token ('access_token' or 'refresh_token')
+     * @param clientId - OAuth client ID
+     */
+    revokeToken(token: string, tokenTypeHint?: 'access_token' | 'refresh_token', clientId?: string): Promise<void>;
+    /**
+     * Revoke all tokens for a user (access and refresh)
+     *
+     * Convenience method to revoke both access and refresh tokens
+     *
+     * @param tokenInfo - Token information
+     */
+    revokeAll(tokenInfo: OAuthTokenInfo): Promise<void>;
+}
+//# sourceMappingURL=token-refresh.d.ts.map

package/dist/lib/auth/token-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/token-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAsB,cAAc,EAAsB,MAAM,eAAe,CAAC;AAG5F,MAAM,WAAW,qBAAqB;IACpC,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,cAAc,KAAK,IAAI,CAAC;IACvD,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CACzC;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,MAAM,CAAgB;gBAElB,MAAM,EAAE,MAAM;IAU1B;;;;;;;;;;;OAWG;IACG,YAAY,CAChB,SAAS,EAAE,cAAc,EACzB,SAAS,CAAC,EAAE,qBAAqB,GAChC,OAAO,CAAC,cAAc,CAAC;IA0C1B;;;;;;;;;;OAUG;IACG,WAAW,CACf,SAAS,EAAE,cAAc,GAAG,IAAI,EAChC,aAAa,GAAE,MAAW,EAC1B,SAAS,CAAC,EAAE,qBAAqB,GAChC,OAAO,CAAC,cAAc,CAAC;IAe1B;;;;;;;;;OASG;IACG,WAAW,CACf,KAAK,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,EAChD,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAqBhB;;;;;;OAMG;IACG,SAAS,CAAC,SAAS,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;CAS1D"}

package/dist/lib/auth/token-refresh.js

@@ -0,0 +1,141 @@
+"use strict";
+/**
+ * OAuth Token Refresh Manager (ADR-054)
+ *
+ * Handles automatic token refresh using refresh_token grant.
+ *
+ * Note: Only works with grants that return refresh tokens (device flow, authorization code).
+ * Client credentials grant does NOT receive refresh tokens - must re-authenticate instead.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenRefreshManager = void 0;
+const axios_1 = __importDefault(require("axios"));
+const oauth_utils_1 = require("./oauth-utils");
+class TokenRefreshManager {
+    constructor(apiUrl) {
+        this.client = axios_1.default.create({
+            baseURL: apiUrl,
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            timeout: 10000, // 10 seconds
+        });
+    }
+    /**
+     * Refresh an expired access token using a refresh token
+     *
+     * POST /auth/oauth/token
+     * Body: grant_type=refresh_token&refresh_token=<token>&client_id=<client_id>
+     *
+     * Returns new access token and same refresh token
+     *
+     * @param tokenInfo - Current token information (must have refresh_token)
+     * @param callbacks - Optional callbacks for progress tracking
+     * @returns New token information with refreshed access token
+     */
+    async refreshToken(tokenInfo, callbacks) {
+        if (!tokenInfo.refresh_token) {
+            throw new Error('Cannot refresh token: No refresh token available (client_credentials grant?)');
+        }
+        callbacks?.onRefreshStart?.();
+        try {
+            const params = new URLSearchParams({
+                grant_type: 'refresh_token',
+                refresh_token: tokenInfo.refresh_token,
+                client_id: tokenInfo.client_id,
+            });
+            const response = await this.client.post('/auth/oauth/token', params.toString());
+            // Convert response and preserve client_id
+            const newTokenInfo = (0, oauth_utils_1.convertTokenResponse)(response.data, tokenInfo.client_id);
+            callbacks?.onRefreshSuccess?.(newTokenInfo);
+            return newTokenInfo;
+        }
+        catch (error) {
+            if (axios_1.default.isAxiosError(error)) {
+                const axiosError = error;
+                const errorMessage = axiosError.response?.data?.error_description ||
+                    axiosError.response?.data?.error ||
+                    axiosError.message;
+                const err = new Error(`Token refresh failed: ${errorMessage}`);
+                callbacks?.onRefreshError?.(err);
+                throw err;
+            }
+            const err = error instanceof Error ? error : new Error('Unknown error during token refresh');
+            callbacks?.onRefreshError?.(err);
+            throw err;
+        }
+    }
+    /**
+     * Automatically refresh token if expired or about to expire
+     *
+     * Checks if token is expired (or will expire within buffer period).
+     * If so, refreshes it. Otherwise, returns the original token.
+     *
+     * @param tokenInfo - Current token information
+     * @param bufferSeconds - Refresh if expiring within this many seconds (default: 60)
+     * @param callbacks - Optional callbacks for progress tracking
+     * @returns Token information (refreshed if needed)
+     */
+    async autoRefresh(tokenInfo, bufferSeconds = 60, callbacks) {
+        if (!tokenInfo) {
+            throw new Error('Cannot refresh token: No token information available');
+        }
+        // Check if token needs refresh
+        if (!(0, oauth_utils_1.isTokenExpired)(tokenInfo, bufferSeconds)) {
+            // Token is still valid, no refresh needed
+            return tokenInfo;
+        }
+        // Token expired or about to expire - refresh it
+        return await this.refreshToken(tokenInfo, callbacks);
+    }
+    /**
+     * Revoke a token (access or refresh)
+     *
+     * POST /auth/oauth/revoke
+     * Body: token=<token>&token_type_hint=access_token|refresh_token&client_id=<client_id>
+     *
+     * @param token - Token to revoke (access_token or refresh_token)
+     * @param tokenTypeHint - Type of token ('access_token' or 'refresh_token')
+     * @param clientId - OAuth client ID
+     */
+    async revokeToken(token, tokenTypeHint, clientId) {
+        try {
+            const params = new URLSearchParams({
+                token: token,
+                ...(tokenTypeHint && { token_type_hint: tokenTypeHint }),
+                ...(clientId && { client_id: clientId }),
+            });
+            await this.client.post('/auth/oauth/revoke', params.toString());
+        }
+        catch (error) {
+            if (axios_1.default.isAxiosError(error)) {
+                const axiosError = error;
+                const errorMessage = axiosError.response?.data?.error_description ||
+                    axiosError.response?.data?.error ||
+                    axiosError.message;
+                throw new Error(`Token revocation failed: ${errorMessage}`);
+            }
+            throw error;
+        }
+    }
+    /**
+     * Revoke all tokens for a user (access and refresh)
+     *
+     * Convenience method to revoke both access and refresh tokens
+     *
+     * @param tokenInfo - Token information
+     */
+    async revokeAll(tokenInfo) {
+        // Revoke access token
+        await this.revokeToken(tokenInfo.access_token, 'access_token', tokenInfo.client_id);
+        // Revoke refresh token if present
+        if (tokenInfo.refresh_token) {
+            await this.revokeToken(tokenInfo.refresh_token, 'refresh_token', tokenInfo.client_id);
+        }
+    }
+}
+exports.TokenRefreshManager = TokenRefreshManager;
+//# sourceMappingURL=token-refresh.js.map

package/dist/lib/auth/token-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.js","sourceRoot":"","sources":["../../../src/lib/auth/token-refresh.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;AAEH,kDAAyD;AAEzD,+CAAqE;AAQrE,MAAa,mBAAmB;IAG9B,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,eAAK,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,MAAM;YACf,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,OAAO,EAAE,KAAK,EAAG,aAAa;SAC/B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,YAAY,CAChB,SAAyB,EACzB,SAAiC;QAEjC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;QAClG,CAAC;QAED,SAAS,EAAE,cAAc,EAAE,EAAE,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;gBACjC,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,SAAS,CAAC,aAAa;gBACtC,SAAS,EAAE,SAAS,CAAC,SAAS;aAC/B,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACrC,mBAAmB,EACnB,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;YAEF,0CAA0C;YAC1C,MAAM,YAAY,GAAG,IAAA,kCAAoB,EAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;YAC9E,SAAS,EAAE,gBAAgB,EAAE,CAAC,YAAY,CAAC,CAAC;YAC5C,OAAO,YAAY,CAAC;QAEtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,eAAK,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,KAAuC,CAAC;gBAC3D,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,iBAAiB;oBAC7C,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK;oBAChC,UAAU,CAAC,OAAO,CAAC;gBAEvC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;gBAC/D,SAAS,EAAE,cAAc,EAAE,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAC7F,SAAS,EAAE,cAAc,EAAE,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,WAAW,CACf,SAAgC,EAChC,gBAAwB,EAAE,EAC1B,SAAiC;QAEjC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC,IAAA,4BAAc,EAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;YAC9C,0CAA0C;YAC1C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,gDAAgD;QAChD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,WAAW,CACf,KAAa,EACb,aAAgD,EAChD,QAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;gBACjC,KAAK,EAAE,KAAK;gBACZ,GAAG,CAAC,aAAa,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC;gBACxD,GAAG,CAAC,QAAQ,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aACzC,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,eAAK,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,KAAuC,CAAC;gBAC3D,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,iBAAiB;oBAC7C,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK;oBAChC,UAAU,CAAC,OAAO,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,4BAA4B,YAAY,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,SAAyB;QACvC,sBAAsB;QACtB,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,YAAY,EAAE,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAEpF,kCAAkC;QAClC,IAAI,SAAS,CAAC,aAAa,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,EAAE,eAAe,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;CACF;AAvJD,kDAuJC"}

package/dist/lib/config.d.ts

@@ -0,0 +1,286 @@
+/**
+ * Configuration Manager for kg CLI
+ *
+ * Manages user configuration stored at ~/.config/kg/config.json
+ *
+ * ADR-054: OAuth 2.0 Authentication
+ * - All authentication uses personal OAuth clients (GitHub CLI-style)
+ * - Client credentials (client_id + client_secret) are long-lived
+ * - Fresh access tokens obtained on-demand via client credentials grant
+ * - JWT support removed (OAuth-only)
+ */
+export interface AuthTokenConfig {
+    oauth_client_id?: string;
+    oauth_client_secret?: string;
+    oauth_client_name?: string;
+    oauth_scopes?: string[];
+    oauth_created_at?: string;
+    token_type?: string;
+    username?: string;
+    role?: string;
+}
+export interface DisplayConfig {
+    enableChafa?: boolean;
+    chafaWidth?: number;
+    chafaScale?: number;
+    chafaAlign?: 'left' | 'center' | 'right';
+    chafaColors?: '256' | '16' | '2' | 'full';
+}
+export interface SearchConfig {
+    showEvidence?: boolean;
+    showImages?: boolean;
+}
+export interface KgConfig {
+    username?: string;
+    secret?: string;
+    api_url?: string;
+    backup_dir?: string;
+    auto_approve?: boolean;
+    auth?: AuthTokenConfig;
+    aliases?: Record<string, string[]>;
+    display?: DisplayConfig;
+    search?: SearchConfig;
+}
+export declare class ConfigManager {
+    private configDir;
+    private configPath;
+    private config;
+    constructor();
+    /**
+     * Get configuration directory path
+     */
+    getConfigDir(): string;
+    /**
+     * Get configuration file path
+     */
+    getConfigPath(): string;
+    /**
+     * Load configuration from disk
+     */
+    private load;
+    /**
+     * Get default configuration
+     */
+    private getDefaultConfig;
+    /**
+     * Save configuration to disk
+     */
+    save(): void;
+    /**
+     * Get entire configuration
+     */
+    getAll(): KgConfig;
+    /**
+     * Get a configuration value by key (supports nested keys with dot notation)
+     */
+    get(key: string): any;
+    /**
+     * Set a configuration value by key (supports nested keys with dot notation)
+     */
+    set(key: string, value: any): void;
+    /**
+     * Delete a configuration key
+     */
+    delete(key: string): void;
+    /**
+     * Check if config file exists
+     */
+    exists(): boolean;
+    /**
+     * Initialize config with defaults and save
+     */
+    init(): void;
+    /**
+     * Reset configuration to defaults
+     */
+    reset(): void;
+    /**
+     * Get API URL (from config or environment variable)
+     */
+    getApiUrl(): string;
+    /**
+     * Get client ID (from config or environment variable)
+     */
+    getClientId(): string | undefined;
+    /**
+     * Get API key/secret (from config or environment variable)
+     */
+    getApiKey(): string | undefined;
+    /**
+     * Get backup directory (expands ~ to home directory)
+     */
+    getBackupDir(): string;
+    /**
+     * Ensure backup directory exists
+     */
+    ensureBackupDir(): string;
+    /**
+     * Get auto-approve setting (ADR-014)
+     */
+    getAutoApprove(): boolean;
+    /**
+     * Set auto-approve setting (ADR-014)
+     */
+    setAutoApprove(value: boolean): void;
+    /**
+     * Store OAuth client credentials (ADR-054 - personal OAuth clients)
+     *
+     * Stores long-lived client_id + client_secret for client credentials grant.
+     * This is the preferred authentication method for CLI tools.
+     *
+     * @param credentials OAuth client credentials
+     */
+    storeOAuthCredentials(credentials: {
+        client_id: string;
+        client_secret: string;
+        client_name: string;
+        scopes: string[];
+        created_at: string;
+        username?: string;
+    }): void;
+    /**
+     * Get OAuth client credentials (ADR-054)
+     *
+     * @returns OAuth client credentials or null if not stored
+     */
+    getOAuthCredentials(): {
+        client_id: string;
+        client_secret: string;
+        client_name: string;
+        scopes: string[];
+        created_at: string;
+        username?: string;
+    } | null;
+    /**
+     * Clear authentication token
+     */
+    clearAuthToken(): void;
+    /**
+     * Check if user is authenticated (has OAuth client credentials)
+     *
+     * OAuth client credentials are long-lived and do not expire.
+     * Fresh access tokens are obtained on-demand via client credentials grant.
+     *
+     * @returns true if user has OAuth client credentials
+     */
+    isAuthenticated(): boolean;
+    /**
+     * Get command aliases from config
+     *
+     * @returns Record mapping command names to their aliases
+     */
+    getAliases(): Record<string, string[]>;
+    /**
+     * Get aliases for a specific command
+     *
+     * @param commandName Name of the command
+     * @returns Array of aliases for this command
+     */
+    getCommandAliases(commandName: string): string[];
+    /**
+     * Add an alias for a command
+     *
+     * @param commandName Name of the command
+     * @param alias Alias to add
+     */
+    addAlias(commandName: string, alias: string): void;
+    /**
+     * Remove an alias for a command
+     *
+     * @param commandName Name of the command
+     * @param alias Alias to remove
+     */
+    removeAlias(commandName: string, alias: string): void;
+    /**
+     * Check if chafa terminal image display is enabled
+     * If not explicitly set, defaults to true (will check for chafa availability at runtime)
+     *
+     * @returns true if chafa display is enabled in config
+     */
+    isChafaEnabled(): boolean;
+    /**
+     * Enable or disable chafa terminal image display
+     *
+     * @param enabled Whether to enable chafa
+     */
+    setChafaEnabled(enabled: boolean): void;
+    /**
+     * Get chafa display width
+     *
+     * @returns Width in characters, or undefined for auto-sizing
+     */
+    getChafaWidth(): number | undefined;
+    /**
+     * Set chafa display width
+     *
+     * @param width Width in characters (undefined for auto)
+     */
+    setChafaWidth(width: number | undefined): void;
+    /**
+     * Get chafa color mode
+     *
+     * @returns Color mode ('256', '16', '2', or 'full')
+     */
+    getChafaColors(): '256' | '16' | '2' | 'full';
+    /**
+     * Set chafa color mode
+     *
+     * @param colors Color mode
+     */
+    setChafaColors(colors: '256' | '16' | '2' | 'full'): void;
+    /**
+     * Get chafa scale factor
+     *
+     * @returns Scale factor (0.0-1.0, e.g., 0.3 for 1/3 width)
+     */
+    getChafaScale(): number;
+    /**
+     * Set chafa scale factor
+     *
+     * @param scale Scale factor (0.0-1.0)
+     */
+    setChafaScale(scale: number): void;
+    /**
+     * Get chafa alignment
+     *
+     * @returns Alignment ('left', 'center', or 'right')
+     */
+    getChafaAlign(): 'left' | 'center' | 'right';
+    /**
+     * Set chafa alignment
+     *
+     * @param align Alignment
+     */
+    setChafaAlign(align: 'left' | 'center' | 'right'): void;
+    /**
+     * Check if search should show evidence by default
+     * Defaults to true for rich terminal experience
+     *
+     * @returns true if evidence should be shown by default
+     */
+    getSearchShowEvidence(): boolean;
+    /**
+     * Set whether search should show evidence by default
+     *
+     * @param enabled Whether to show evidence by default
+     */
+    setSearchShowEvidence(enabled: boolean): void;
+    /**
+     * Check if search should show images by default
+     * Defaults to true for rich terminal experience
+     *
+     * @returns true if images should be shown by default
+     */
+    getSearchShowImages(): boolean;
+    /**
+     * Set whether search should show images by default
+     *
+     * @param enabled Whether to show images by default
+     */
+    setSearchShowImages(enabled: boolean): void;
+}
+/**
+ * Get or create global config instance
+ */
+export declare function getConfig(): ConfigManager;
+//# sourceMappingURL=config.d.ts.map

package/dist/lib/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,MAAM,WAAW,eAAe;IAE9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAE5B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;IACzC,WAAW,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,GAAG,GAAG,MAAM,CAAC;CAC3C;AAED,MAAM,WAAW,YAAY;IAE3B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,MAAM,CAAW;;IAUzB;;OAEG;IACH,YAAY,IAAI,MAAM;IAItB;;OAEG;IACH,aAAa,IAAI,MAAM;IAIvB;;OAEG;IACH,OAAO,CAAC,IAAI;IAcZ;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAwBxB;;OAEG;IACH,IAAI,IAAI,IAAI;IAkBZ;;OAEG;IACH,MAAM,IAAI,QAAQ;IAIlB;;OAEG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG;IAerB;;OAEG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI;IAiBlC;;OAEG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAiBzB;;OAEG;IACH,MAAM,IAAI,OAAO;IAIjB;;OAEG;IACH,IAAI,IAAI,IAAI;IAOZ;;OAEG;IACH,KAAK,IAAI,IAAI;IAKb;;OAEG;IACH,SAAS,IAAI,MAAM;IAInB;;OAEG;IACH,WAAW,IAAI,MAAM,GAAG,SAAS;IAIjC;;OAEG;IACH,SAAS,IAAI,MAAM,GAAG,SAAS;IAI/B;;OAEG;IACH,YAAY,IAAI,MAAM;IAKtB;;OAEG;IACH,eAAe,IAAI,MAAM;IAQzB;;OAEG;IACH,cAAc,IAAI,OAAO;IAIzB;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAOpC;;;;;;;OAOG;IACH,qBAAqB,CAAC,WAAW,EAAE;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI;IAsBR;;;;OAIG;IACH,mBAAmB,IAAI;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI;IAmBR;;OAEG;IACH,cAAc,IAAI,IAAI;IAItB;;;;;;;OAOG;IACH,eAAe,IAAI,OAAO;IAM1B;;;;OAIG;IACH,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAItC;;;;;OAKG;IACH,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE;IAIhD;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAelD;;;;;OAKG;IACH,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAoBrD;;;;;OAKG;IACH,cAAc,IAAI,OAAO;IAIzB;;;;OAIG;IACH,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAQvC;;;;OAIG;IACH,aAAa,IAAI,MAAM,GAAG,SAAS;IAInC;;;;OAIG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAQ9C;;;;OAIG;IACH,cAAc,IAAI,KAAK,GAAG,IAAI,GAAG,GAAG,GAAG,MAAM;IAI7C;;;;OAIG;IACH,cAAc,CAAC,MAAM,EAAE,KAAK,GAAG,IAAI,GAAG,GAAG,GAAG,MAAM,GAAG,IAAI;IAQzD;;;;OAIG;IACH,aAAa,IAAI,MAAM;IAIvB;;;;OAIG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAQlC;;;;OAIG;IACH,aAAa,IAAI,MAAM,GAAG,QAAQ,GAAG,OAAO;IAI5C;;;;OAIG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI;IAUvD;;;;;OAKG;IACH,qBAAqB,IAAI,OAAO;IAIhC;;;;OAIG;IACH,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAQ7C;;;;;OAKG;IACH,mBAAmB,IAAI,OAAO;IAI9B;;;;OAIG;IACH,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;CAO5C;AAOD;;GAEG;AACH,wBAAgB,SAAS,IAAI,aAAa,CAKzC"}