@agentteams/cli 0.1.83 → 0.1.84

package/dist/auth/personalTokenClient.js

@@ -0,0 +1,312 @@
+/**
+ * Personal opaque-token client for the CLI.
+ *
+ * Ported from `desktop/src/main/localAgent/personalTokenClient.ts`, which drives
+ * the same server endpoints (`/api/auth/desktop/{authorize,token,revoke}`). The
+ * two clients must keep the same three guarantees, because each one exists to
+ * stop a specific failure that has bitten this flow before:
+ *
+ *  1. Refresh ahead of expiry (60s skew) so a request never races the clock.
+ *  2. Collapse concurrent refreshes into one in-flight promise, so five
+ *     parallel calls rotate the refresh token once rather than five times.
+ *  3. Delete the stored refresh token **only** on an explicit `invalid_grant`.
+ *     A flaky network must not log the user out — otherwise one offline moment
+ *     costs a full re-login even after connectivity returns.
+ */
+import { createPersonalTokenStore } from './personalTokenStore.js';
+/** Registered in `api/src/services/personalTokenClients.ts`; the server rejects anything else. */
+export const CLI_OAUTH_CLIENT_ID = 'agentteams-cli';
+/** Refresh this far before the server-declared expiry rather than at it. */
+export const ACCESS_REFRESH_SKEW_MS = 60_000;
+export class PersonalTokenError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'PersonalTokenError';
+    }
+}
+/**
+ * Classify a token-endpoint response.
+ *
+ * The split that matters is `invalid_grant` (the server has definitively
+ * refused this refresh token) versus everything else (5xx, a proxy error page,
+ * a truncated body). Only the first justifies destroying local credentials.
+ */
+export async function parseTokenResponse(response) {
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        return { kind: 'transient', detail: `HTTP ${response.status} with an unreadable body` };
+    }
+    const error = body && typeof body === 'object' && 'error' in body ? body.error : undefined;
+    if (!response.ok) {
+        if ((response.status === 400 || response.status === 401) && error === 'invalid_grant') {
+            return { kind: 'invalidGrant' };
+        }
+        return { kind: 'transient', detail: `HTTP ${response.status}` };
+    }
+    const data = body && typeof body === 'object' && 'data' in body ? body.data : undefined;
+    const identity = data?.identity && typeof data.identity === 'object' ? data.identity : undefined;
+    if (typeof data?.accessToken !== 'string' ||
+        typeof data.refreshToken !== 'string' ||
+        typeof data.expiresIn !== 'number' ||
+        !identity ||
+        typeof identity.memberId !== 'string' ||
+        typeof identity.email !== 'string' ||
+        typeof identity.nickname !== 'string') {
+        return { kind: 'transient', detail: 'the server returned an unexpected token payload' };
+    }
+    return {
+        kind: 'success',
+        tokens: {
+            accessToken: data.accessToken,
+            refreshToken: data.refreshToken,
+            expiresIn: data.expiresIn,
+            identity: {
+                memberId: identity.memberId,
+                email: identity.email,
+                nickname: identity.nickname,
+            },
+        },
+    };
+}
+export class PersonalTokenClient {
+    deps;
+    accessToken = null;
+    accessExpiresAt = 0;
+    identity = null;
+    reconnectRequired = false;
+    refreshInFlight = null;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    state() {
+        const storeStatus = this.deps.store.status();
+        return {
+            connected: this.deps.store.read() !== null,
+            persisted: storeStatus.persisted,
+            storeBackend: storeStatus.backend,
+            storeReason: storeStatus.reason,
+            identity: this.identity,
+            expiresAt: this.accessToken ? this.accessExpiresAt : null,
+            reconnectRequired: this.reconnectRequired,
+        };
+    }
+    hasCredential() {
+        return this.deps.store.read() !== null;
+    }
+    /**
+     * Trade a PKCE authorization code for the first token pair.
+     *
+     * A failure here leaves nothing behind: there is no prior credential to
+     * protect, and a half-finished login must not look like a connected one.
+     * That includes the case where the store refuses to keep the credential — a
+     * fresh login the next command cannot see is not a login, and the refresh
+     * token the server just minted would outlive this process with nobody able to
+     * use or cancel it. It is revoked rather than left orphaned.
+     */
+    async exchangeAuthorizationCode(grant) {
+        let parsed;
+        try {
+            parsed = await this.postToken({
+                grantType: 'authorization_code',
+                clientId: CLI_OAUTH_CLIENT_ID,
+                code: grant.code,
+                codeVerifier: grant.codeVerifier,
+                redirectUri: grant.redirectUri,
+            });
+        }
+        catch (error) {
+            throw new PersonalTokenError('TRANSIENT', `Could not reach the server to exchange the authorization code: ${error instanceof Error ? error.message : String(error)}.`);
+        }
+        if (parsed.kind === 'invalidGrant') {
+            throw new PersonalTokenError('INVALID_GRANT', 'The authorization code was rejected. It may have expired or already been used — run `agentteams auth login` again.');
+        }
+        if (parsed.kind !== 'success') {
+            throw new PersonalTokenError('TRANSIENT', `Token exchange failed: ${parsed.detail}.`);
+        }
+        const stored = this.acceptTokens(parsed.tokens);
+        this.reconnectRequired = false;
+        if (!stored.persisted) {
+            await this.discardUnstorableTokens(stored);
+        }
+        return {
+            accessToken: parsed.tokens.accessToken,
+            expiresAt: this.accessExpiresAt,
+            identity: parsed.tokens.identity,
+        };
+    }
+    /**
+     * Undo a login whose credential could not be stored.
+     *
+     * Revoking is best-effort — an unreachable server is not a reason to keep a
+     * dangling local state — but the local copy always goes, so `hasCredential()`
+     * never reports a login the next process will not find.
+     */
+    async discardUnstorableTokens(outcome) {
+        let serverRevoked = true;
+        try {
+            await this.revoke();
+        }
+        catch {
+            serverRevoked = false;
+            this.clear();
+        }
+        const cause = outcome.reason === 'WRITE_FAILED'
+            ? `the OS credential store rejected the write${outcome.detail ? ` (${outcome.detail})` : ''}`
+            : 'this machine has no usable OS credential store';
+        throw new PersonalTokenError('STORE_UNAVAILABLE', `Signed in, but the login could not be saved: ${cause}. ` +
+            (serverRevoked
+                ? 'The issued token was revoked so nothing is left behind. '
+                : 'The token could not be revoked either — cancel it from the AgentTeams web app. ') +
+            'On CI, containers and headless machines use an API key (AGENTTEAMS_API_KEY) instead.');
+    }
+    /**
+     * Current access token, refreshing pre-emptively when it is close to expiry.
+     * Returns null when there is nothing usable — the caller decides whether that
+     * is a hard failure or a reason to fall back to another credential.
+     */
+    async getAccessToken() {
+        const now = this.now();
+        if (this.accessToken && this.accessExpiresAt - ACCESS_REFRESH_SKEW_MS > now) {
+            return this.accessToken;
+        }
+        if (!this.refreshInFlight) {
+            this.refreshInFlight = this.refresh().finally(() => {
+                this.refreshInFlight = null;
+            });
+        }
+        return this.refreshInFlight;
+    }
+    /** Force the next {@link getAccessToken} to refresh even if the cached token looks fresh. */
+    invalidateAccessToken() {
+        this.accessToken = null;
+        this.accessExpiresAt = 0;
+    }
+    /**
+     * Revoke the token family server-side, then drop the local copy.
+     *
+     * The order is not negotiable: clearing first and failing the revoke would
+     * leave a live refresh token on the server that the user can no longer see or
+     * cancel.
+     */
+    async revoke() {
+        const refreshToken = this.deps.store.read();
+        if (!refreshToken) {
+            throw new PersonalTokenError('NOT_LOGGED_IN', 'No personal token is stored for this server.');
+        }
+        const doFetch = this.deps.fetch ?? globalThis.fetch;
+        let response;
+        try {
+            response = await doFetch(`${this.baseUrl()}/api/auth/desktop/revoke`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ clientId: CLI_OAUTH_CLIENT_ID, token: refreshToken }),
+            });
+        }
+        catch (error) {
+            throw new PersonalTokenError('REVOKE_FAILED', `Could not reach the server to revoke the token: ${error instanceof Error ? error.message : String(error)}. The local credential was kept.`);
+        }
+        if (!response.ok) {
+            throw new PersonalTokenError('REVOKE_FAILED', `The server refused to revoke the token (HTTP ${response.status}). The local credential was kept.`);
+        }
+        this.clear();
+    }
+    /**
+     * Drop the local credential without asking the server.
+     *
+     * The offline escape hatch behind `auth logout --local`: the token stays valid
+     * server-side, so the caller owes the user a "revoke it in the web app" note.
+     */
+    forgetLocalCredential() {
+        this.clear();
+    }
+    async refresh() {
+        const refreshToken = this.deps.store.read();
+        if (!refreshToken)
+            return null;
+        let parsed;
+        try {
+            parsed = await this.postToken({
+                grantType: 'refresh_token',
+                clientId: CLI_OAUTH_CLIENT_ID,
+                refreshToken,
+            });
+        }
+        catch {
+            // Network-level failure. The refresh token is still presumed valid, so it
+            // stays exactly where it is; the next command can try again.
+            return null;
+        }
+        if (parsed.kind === 'invalidGrant') {
+            this.clear();
+            this.reconnectRequired = true;
+            return null;
+        }
+        if (parsed.kind !== 'success')
+            return null;
+        this.acceptTokens(parsed.tokens);
+        this.reconnectRequired = false;
+        return this.accessToken;
+    }
+    async postToken(body) {
+        const doFetch = this.deps.fetch ?? globalThis.fetch;
+        const response = await doFetch(`${this.baseUrl()}/api/auth/desktop/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+        return parseTokenResponse(response);
+    }
+    /**
+     * A failed save is reported, never thrown: a long-running `agentteams mcp`
+     * that rotates its refresh token must keep running on the in-memory copy
+     * rather than die at the rotation.
+     */
+    acceptTokens(tokens) {
+        this.accessToken = tokens.accessToken;
+        // TTL is the server's call (`ACCESS_TOKEN_TTL_MS` in api/src/services/personalToken.ts);
+        // the client never assumes a duration of its own.
+        this.accessExpiresAt = this.now() + tokens.expiresIn * 1000;
+        this.identity = tokens.identity;
+        return this.deps.store.save(tokens.refreshToken);
+    }
+    clear() {
+        this.accessToken = null;
+        this.accessExpiresAt = 0;
+        this.identity = null;
+        this.reconnectRequired = false;
+        this.deps.store.remove();
+    }
+    now() {
+        return (this.deps.now ?? Date.now)();
+    }
+    baseUrl() {
+        return this.deps.apiUrl.replace(/\/+$/, '');
+    }
+}
+/**
+ * One client per API server for the lifetime of the process.
+ *
+ * The in-flight refresh suppression and the cached access token only work if
+ * every caller shares the same instance — a per-call client would rotate the
+ * refresh token once per command, and `agentteams mcp` would do it per tool call.
+ */
+const clients = new Map();
+export function getPersonalTokenClient(apiUrl) {
+    const key = apiUrl.replace(/\/+$/, '');
+    let client = clients.get(key);
+    if (!client) {
+        client = new PersonalTokenClient({ apiUrl: key, store: createPersonalTokenStore(key) });
+        clients.set(key, client);
+    }
+    return client;
+}
+/** Test-only: drop every cached client so a test can inject its own deps. */
+export function resetPersonalTokenClientsForTests() {
+    clients.clear();
+}
+//# sourceMappingURL=personalTokenClient.js.map

package/dist/auth/personalTokenClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"personalTokenClient.js","sourceRoot":"","sources":["../../src/auth/personalTokenClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,wBAAwB,EAA2B,MAAM,yBAAyB,CAAC;AAE5F,kGAAkG;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAEpD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAW7C,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEhC;IADX,YACW,IAA4B,EACrC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAwB;QAIrC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAsDD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAkB;IACzD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,0BAA0B,EAAE,CAAC;IAC1F,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,IAAI,CAAC,CAAC,CAAE,IAA4B,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YACtF,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAClC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,IAAI,GACR,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,CAAC,CAAC,CAAE,IAA2C,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,MAAM,QAAQ,GACZ,IAAI,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,QAAoC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE/G,IACE,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ;QACrC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;QACrC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QAClC,CAAC,QAAQ;QACT,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ;QACrC,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;QAClC,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EACrC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAC1F,CAAC;IAED,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM,EAAE;YACN,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE;gBACR,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,mBAAmB;IAOD;IANrB,WAAW,GAAkB,IAAI,CAAC;IAClC,eAAe,GAAG,CAAC,CAAC;IACpB,QAAQ,GAAiC,IAAI,CAAC;IAC9C,iBAAiB,GAAG,KAAK,CAAC;IAC1B,eAAe,GAAkC,IAAI,CAAC;IAE9D,YAA6B,IAA6B;QAA7B,SAAI,GAAJ,IAAI,CAAyB;IAAG,CAAC;IAE9D,KAAK;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7C,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI;YAC1C,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,YAAY,EAAE,WAAW,CAAC,OAAO;YACjC,WAAW,EAAE,WAAW,CAAC,MAAM;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI;YACzD,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC;IACJ,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC;IACzC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,yBAAyB,CAAC,KAA6B;QAC3D,IAAI,MAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;gBAC5B,SAAS,EAAE,oBAAoB;gBAC/B,QAAQ,EAAE,mBAAmB;gBAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAC1B,WAAW,EACX,kEAAkE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAC5H,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,oHAAoH,CACrH,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,0BAA0B,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAE/B,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW;YACtC,SAAS,EAAE,IAAI,CAAC,eAAe;YAC/B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,uBAAuB,CAAC,OAA8B;QAClE,IAAI,aAAa,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,GAAG,KAAK,CAAC;YACtB,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GACT,OAAO,CAAC,MAAM,KAAK,cAAc;YAC/B,CAAC,CAAC,6CAA6C,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7F,CAAC,CAAC,gDAAgD,CAAC;QAEvD,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,gDAAgD,KAAK,IAAI;YACvD,CAAC,aAAa;gBACZ,CAAC,CAAC,0DAA0D;gBAC5D,CAAC,CAAC,iFAAiF,CAAC;YACtF,sFAAsF,CACzF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,eAAe,GAAG,sBAAsB,GAAG,GAAG,EAAE,CAAC;YAC5E,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBACjD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC9B,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,6FAA6F;IAC7F,qBAAqB;QACnB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,8CAA8C,CAAC,CAAC;QAChG,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QACpD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,0BAA0B,EAAE;gBACpE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;aAC7E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,mDAAmD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAC5I,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,gDAAgD,QAAQ,CAAC,MAAM,mCAAmC,CACnG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,qBAAqB;QACnB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAE/B,IAAI,MAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;gBAC5B,SAAS,EAAE,eAAe;gBAC1B,QAAQ,EAAE,mBAAmB;gBAC7B,YAAY;aACb,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,6DAA6D;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAE3C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAC/B,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAA6B;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,yBAAyB,EAAE;YACzE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,MAAqB;QACxC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,yFAAyF;QACzF,kDAAkD;QAClD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QAC5D,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAC3B,CAAC;IAEO,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAEO,OAAO;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;AAEvD,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iCAAiC;IAC/C,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC"}

package/dist/auth/personalTokenStore.d.ts

@@ -0,0 +1,16 @@
+import { type CredentialSaveOutcome, type CredentialStore, type CredentialStoreStatus } from './credentialStore.js';
+export interface PersonalTokenStore {
+    status(): CredentialStoreStatus;
+    read(): string | null;
+    save(refreshToken: string): CredentialSaveOutcome;
+    remove(): void;
+}
+export declare function personalTokenSlot(apiUrl: string): string;
+/**
+ * Wrap the OS credential store in a single-slot view.
+ *
+ * Access tokens deliberately have no way in here — they live for 15 minutes and
+ * stay in process memory, so there is nothing to revoke if a disk is imaged.
+ */
+export declare function createPersonalTokenStore(apiUrl: string, store?: CredentialStore): PersonalTokenStore;
+//# sourceMappingURL=personalTokenStore.d.ts.map

package/dist/auth/personalTokenStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"personalTokenStore.d.ts","sourceRoot":"","sources":["../../src/auth/personalTokenStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAU9B,MAAM,WAAW,kBAAkB;IACjC,MAAM,IAAI,qBAAqB,CAAC;IAChC,IAAI,IAAI,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CAAC;IAClD,MAAM,IAAI,IAAI,CAAC;CAChB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,eAAsC,GAC5C,kBAAkB,CASpB"}

package/dist/auth/personalTokenStore.js

@@ -0,0 +1,27 @@
+import { getCredentialStore, } from './credentialStore.js';
+/**
+ * The refresh token is the only long-lived secret the new auth path keeps, and
+ * it is bound to the server that issued it: a token from the dev API must never
+ * be replayed against production. The API URL is therefore part of the account
+ * name rather than shared across every server.
+ */
+const SLOT_PREFIX = 'personal-refresh';
+export function personalTokenSlot(apiUrl) {
+    return `${SLOT_PREFIX}:${apiUrl.replace(/\/+$/, '')}`;
+}
+/**
+ * Wrap the OS credential store in a single-slot view.
+ *
+ * Access tokens deliberately have no way in here — they live for 15 minutes and
+ * stay in process memory, so there is nothing to revoke if a disk is imaged.
+ */
+export function createPersonalTokenStore(apiUrl, store = getCredentialStore()) {
+    const slot = personalTokenSlot(apiUrl);
+    return {
+        status: () => store.status(),
+        read: () => store.read(slot),
+        save: (refreshToken) => store.save(slot, refreshToken),
+        remove: () => store.remove(slot),
+    };
+}
+//# sourceMappingURL=personalTokenStore.js.map

package/dist/auth/personalTokenStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"personalTokenStore.js","sourceRoot":"","sources":["../../src/auth/personalTokenStore.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,GAInB,MAAM,sBAAsB,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,WAAW,GAAG,kBAAkB,CAAC;AASvC,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,GAAG,WAAW,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAc,EACd,QAAyB,kBAAkB,EAAE;IAE7C,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAEvC,OAAO;QACL,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE;QAC5B,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5B,IAAI,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QACtD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC"}

package/dist/commands/agentConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agentConfig.d.ts","sourceRoot":"","sources":["../../src/commands/agentConfig.ts"],"names":[],"mappings":"AAwBA,wBAAsB,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,CAOpD;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAO7D;AAED,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAUhE"}
+{"version":3,"file":"agentConfig.d.ts","sourceRoot":"","sources":["../../src/commands/agentConfig.ts"],"names":[],"mappings":"AA0BA,wBAAsB,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,CAOpD;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAO7D;AAED,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAUhE"}

package/dist/commands/agentConfig.js

@@ -1,9 +1,11 @@
 import httpClient from '../utils/httpClient.js';
-import { getConfigurationNotFoundMessage, loadConfig } from '../utils/config.js';
+import { getConfigurationNotFoundMessage, loadConfigWithCredential } from '../utils/config.js';
 import { withoutJsonContentType } from '../utils/httpHeaders.js';
 import { buildAuthHeaders } from '../utils/apiContext.js';
-function getConfigOrThrow() {
-    const config = loadConfig();
+async function getConfigOrThrow() {
+    // Credential-aware: a personal-token project has no `apiKey` on disk, so the
+    // plain config loader would report it as "not initialized".
+    const config = await loadConfigWithCredential();
     if (!config) {
         throw new Error(getConfigurationNotFoundMessage());
     }
@@ -19,7 +21,7 @@ function getApiBaseUrl(apiUrl) {
     return apiUrl.endsWith('/') ? apiUrl.slice(0, -1) : apiUrl;
 }
 export async function agentConfigList() {
-    const config = getConfigOrThrow();
+    const config = await getConfigOrThrow();
     const apiBaseUrl = getApiBaseUrl(config.apiUrl);
     const response = await httpClient.get(`${apiBaseUrl}/api/projects/${config.projectId}/agent-configs`, {
         headers: getHeaders(config.apiKey),
@@ -27,7 +29,7 @@ export async function agentConfigList() {
     return response.data;
 }
 export async function agentConfigGet(id) {
-    const config = getConfigOrThrow();
+    const config = await getConfigOrThrow();
     const apiBaseUrl = getApiBaseUrl(config.apiUrl);
     const response = await httpClient.get(`${apiBaseUrl}/api/projects/${config.projectId}/agent-configs/${id}`, {
         headers: getHeaders(config.apiKey),
@@ -35,7 +37,7 @@ export async function agentConfigGet(id) {
     return response.data;
 }
 export async function agentConfigDelete(id) {
-    const config = getConfigOrThrow();
+    const config = await getConfigOrThrow();
     const apiBaseUrl = getApiBaseUrl(config.apiUrl);
     const response = await httpClient.delete(`${apiBaseUrl}/api/projects/${config.projectId}/agent-configs/${id}`, {
         headers: withoutJsonContentType(getHeaders(config.apiKey)),

package/dist/commands/agentConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentConfig.js","sourceRoot":"","sources":["../../src/commands/agentConfig.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,+BAA+B,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO;QACL,GAAG,gBAAgB,CAAC,MAAM,CAAC;QAC3B,cAAc,EAAE,kBAAkB;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,UAAU,iBAAiB,MAAM,CAAC,SAAS,gBAAgB,EAAE;QACpG,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU;IAC7C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,UAAU,iBAAiB,MAAM,CAAC,SAAS,kBAAkB,EAAE,EAAE,EAAE;QAC1G,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAU;IAChD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,UAAU,iBAAiB,MAAM,CAAC,SAAS,kBAAkB,EAAE,EAAE,EAAE;QAC7G,OAAO,EAAE,sBAAsB,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KAC3D,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC"}
+{"version":3,"file":"agentConfig.js","sourceRoot":"","sources":["../../src/commands/agentConfig.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,KAAK,UAAU,gBAAgB;IAC7B,6EAA6E;IAC7E,4DAA4D;IAC5D,MAAM,MAAM,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO;QACL,GAAG,gBAAgB,CAAC,MAAM,CAAC;QAC3B,cAAc,EAAE,kBAAkB;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,UAAU,iBAAiB,MAAM,CAAC,SAAS,gBAAgB,EAAE;QACpG,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU;IAC7C,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,UAAU,iBAAiB,MAAM,CAAC,SAAS,kBAAkB,EAAE,EAAE,EAAE;QAC1G,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAU;IAChD,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,UAAU,iBAAiB,MAAM,CAAC,SAAS,kBAAkB,EAAE,EAAE,EAAE;QAC7G,OAAO,EAAE,sBAAsB,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KAC3D,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC"}

package/dist/commands/auth.d.ts

@@ -0,0 +1,97 @@
+/**
+ * `agentteams auth login | status | logout`.
+ *
+ * The default authentication path for new projects and the migration path for
+ * legacy configs. The stored credential is picked up by `resolveCredential()`
+ * when the config has no `key_`, or when a migrated legacy project carries
+ * `authMode: 'personal-token'`.
+ */
+import type { CredentialBackendId, CredentialStoreReason } from '../auth/credentialStore.js';
+import type { Config } from '../types/index.js';
+import { type CredentialSource } from '../utils/config.js';
+export type AuthLoginResult = {
+    success: true;
+    authUrl: string;
+    apiUrl: string;
+    identity: {
+        memberId: string;
+        email: string;
+        nickname: string;
+    };
+    /**
+     * Always true on success: a login that could not be persisted is rejected and
+     * revoked inside `exchangeAuthorizationCode` rather than reported as a
+     * half-login. The field stays in the payload because scripts read it.
+     */
+    persisted: boolean;
+    /** Which OS store holds the credential — the same vocabulary as `auth status`. */
+    storeBackend: CredentialBackendId;
+    storeReason: CredentialStoreReason;
+    configPath: string | null;
+    authMode: 'personal-token';
+    warning?: string;
+};
+export type AuthStatusResult = {
+    apiUrl: string;
+    configPath: string | null;
+    /** Which credential the next command would authenticate with. */
+    credentialSource: CredentialSource | null;
+    authMode: Config['authMode'] | null;
+    hasProjectApiKey: boolean;
+    personalToken: {
+        connected: boolean;
+        persisted: boolean;
+        storeBackend: CredentialBackendId;
+        storeReason: CredentialStoreReason;
+        reconnectRequired: boolean;
+        identity: {
+            memberId: string;
+            email: string;
+            nickname: string;
+        } | null;
+        expiresAt: string | null;
+    };
+    problem?: string;
+};
+export type AuthLogoutResult = {
+    success: true;
+    apiUrl: string;
+    configPath: string | null;
+    /** false → the token is still live server-side (`--local`, or nothing was stored). */
+    revokedOnServer: boolean;
+    /** true when the project reverted to an `agentteams init` API key that is still on disk. */
+    fellBackToApiKey: boolean;
+    warning?: string;
+};
+/**
+ * Where to log in. Unlike the legacy `init` path this honours the project's own
+ * `apiUrl`, because a refresh token issued by the dev API is worthless against
+ * production and storing it under the wrong server would silently fail later.
+ */
+export declare function resolveAuthApiUrl(options?: {
+    apiUrl?: string;
+}): string;
+export declare function buildPersonalTokenAuthorizeUrl(input: {
+    port: number;
+    state: string;
+    codeChallenge: string;
+    projectName?: string;
+}): string;
+/**
+ * Run the browser round trip and exchange the resulting code for tokens.
+ *
+ * Exported so `init --auth personal-token` reuses the identical flow rather than
+ * growing a second copy of the PKCE handshake.
+ */
+export declare function performPersonalTokenLogin(input: {
+    apiUrl: string;
+    projectName?: string;
+}): Promise<{
+    authUrl: string;
+    identity: AuthLoginResult['identity'];
+    persisted: boolean;
+    storeBackend: CredentialBackendId;
+    storeReason: CredentialStoreReason;
+}>;
+export declare function executeAuthCommand(action: string, options?: Record<string, unknown>): Promise<unknown>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/commands/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAE7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAML,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAM5B,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,IAAI,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,mBAAmB,CAAC;IAClC,WAAW,EAAE,qBAAqB,CAAC;IACnC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACpC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,aAAa,EAAE;QACb,SAAS,EAAE,OAAO,CAAC;QACnB,SAAS,EAAE,OAAO,CAAC;QACnB,YAAY,EAAE,mBAAmB,CAAC;QAClC,WAAW,EAAE,qBAAqB,CAAC;QACnC,iBAAiB,EAAE,OAAO,CAAC;QAC3B,QAAQ,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;QACvE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sFAAsF;IACtF,eAAe,EAAE,OAAO,CAAC;IACzB,4FAA4F;IAC5F,gBAAgB,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAOvE;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAUT;AAuBD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC;IACxG,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,mBAAmB,CAAC;IAClC,WAAW,EAAE,qBAAqB,CAAC;CACpC,CAAC,CA0CD;AAmJD,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAahH"}