@agentteams/cli 0.1.83 → 0.1.85

package/dist/auth/personalTokenClient.d.ts

@@ -0,0 +1,189 @@
+/**
+ * Personal opaque-token client for the CLI.
+ *
+ * Ported from `desktop/src/main/localAgent/personalTokenClient.ts`, which drives
+ * the same server endpoints (`/api/auth/desktop/{authorize,token,revoke}`). The
+ * two clients must keep the same three guarantees, because each one exists to
+ * stop a specific failure that has bitten this flow before:
+ *
+ *  1. Refresh ahead of expiry (60s skew) so a request never races the clock.
+ *  2. Collapse concurrent refreshes into one in-flight promise, so five
+ *     parallel calls rotate the refresh token once rather than five times.
+ *  3. Delete the stored refresh token **only** on an explicit `invalid_grant`.
+ *     A flaky network must not log the user out — otherwise one offline moment
+ *     costs a full re-login even after connectivity returns.
+ *
+ * Guarantee 2 covers one process. Rotation also has to be serialized *across*
+ * processes, because a one-shot `agentteams` command and a long-lived
+ * `agentteams mcp` share one credential slot: see {@link RefreshLock}.
+ */
+import type { CredentialBackendId, CredentialStoreReason } from './credentialStore.js';
+import { type PersonalTokenStore } from './personalTokenStore.js';
+import { type RefreshLock } from './refreshLock.js';
+/** Registered in `api/src/services/personalTokenClients.ts`; the server rejects anything else. */
+export declare const CLI_OAUTH_CLIENT_ID = "agentteams-cli";
+/** Refresh this far before the server-declared expiry rather than at it. */
+export declare const ACCESS_REFRESH_SKEW_MS = 60000;
+/**
+ * Cap on a token-endpoint request.
+ *
+ * Deliberately below {@link DEFAULT_STALE_AFTER_MS}: a rotation runs with the
+ * cross-process lock held, and if it could outlast the staleness window another
+ * process would judge the lock abandoned, take it, and rotate the same refresh
+ * token — the reuse that revokes the whole family. Bounding the request keeps the
+ * holder inside the window it promised.
+ */
+export declare const TOKEN_REQUEST_TIMEOUT_MS: number;
+export type PersonalTokenErrorCode = 'INVALID_GRANT' | 'TRANSIENT' | 'NOT_LOGGED_IN' | 'MALFORMED_RESPONSE' | 'REVOKE_FAILED'
+/** A fresh login succeeded but the credential could not be kept anywhere durable. */
+ | 'STORE_UNAVAILABLE';
+export declare class PersonalTokenError extends Error {
+    readonly code: PersonalTokenErrorCode;
+    constructor(code: PersonalTokenErrorCode, message: string);
+}
+export interface PersonalTokenIdentity {
+    memberId: string;
+    email: string;
+    nickname: string;
+}
+export interface PersonalTokenSession {
+    accessToken: string;
+    /** Epoch milliseconds, derived from the server's `expiresIn`. */
+    expiresAt: number;
+    identity: PersonalTokenIdentity;
+}
+/**
+ * Why the last refresh attempt produced no token. `null` once one succeeds.
+ *
+ * Exists so the caller can name the actual problem: every one of these used to
+ * surface as "check your network connection", which sends the user after a
+ * network that is fine.
+ */
+export type PersonalTokenRefreshFailure = 'NETWORK' | 'LOCK_CONTENTION' | 'LOCK_UNAVAILABLE';
+export interface PersonalTokenState {
+    /** A refresh token exists locally. It may still turn out to be revoked. */
+    connected: boolean;
+    /** false → the refresh token is session-memory only and disappears with this process. */
+    persisted: boolean;
+    /** Which OS store is in play, regardless of whether it currently works. */
+    storeBackend: CredentialBackendId;
+    storeReason: CredentialStoreReason;
+    identity: PersonalTokenIdentity | null;
+    expiresAt: number | null;
+    /** The server rejected the refresh token; only a fresh login recovers. */
+    reconnectRequired: boolean;
+    /** Why the last refresh produced nothing; null when it succeeded or never ran. */
+    refreshFailure: PersonalTokenRefreshFailure | null;
+}
+export interface AuthorizationCodeGrant {
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+}
+export interface PersonalTokenClientDeps {
+    apiUrl: string;
+    store: PersonalTokenStore;
+    fetch?: typeof fetch;
+    now?: () => number;
+    /**
+     * Serializes rotation against other processes. Defaults to a pass-through so
+     * a client built in a test touches no filesystem; {@link getPersonalTokenClient}
+     * supplies the real file lock for every shipped code path.
+     */
+    lock?: RefreshLock;
+}
+interface TokenResponse {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+    identity: PersonalTokenIdentity;
+}
+type ParsedTokenResponse = {
+    kind: 'success';
+    tokens: TokenResponse;
+} | {
+    kind: 'invalidGrant';
+} | {
+    kind: 'transient';
+    detail: string;
+};
+/**
+ * Classify a token-endpoint response.
+ *
+ * The split that matters is `invalid_grant` (the server has definitively
+ * refused this refresh token) versus everything else (5xx, a proxy error page,
+ * a truncated body). Only the first justifies destroying local credentials.
+ */
+export declare function parseTokenResponse(response: Response): Promise<ParsedTokenResponse>;
+export declare class PersonalTokenClient {
+    private readonly deps;
+    private accessToken;
+    private accessExpiresAt;
+    private identity;
+    private reconnectRequired;
+    private refreshFailure;
+    private refreshInFlight;
+    constructor(deps: PersonalTokenClientDeps);
+    state(): PersonalTokenState;
+    hasCredential(): boolean;
+    /**
+     * Trade a PKCE authorization code for the first token pair.
+     *
+     * A failure here leaves nothing behind: there is no prior credential to
+     * protect, and a half-finished login must not look like a connected one.
+     * That includes the case where the store refuses to keep the credential — a
+     * fresh login the next command cannot see is not a login, and the refresh
+     * token the server just minted would outlive this process with nobody able to
+     * use or cancel it. It is revoked rather than left orphaned.
+     */
+    exchangeAuthorizationCode(grant: AuthorizationCodeGrant): Promise<PersonalTokenSession>;
+    /**
+     * Undo a login whose credential could not be stored.
+     *
+     * Revoking is best-effort — an unreachable server is not a reason to keep a
+     * dangling local state — but the local copy always goes, so `hasCredential()`
+     * never reports a login the next process will not find.
+     */
+    private discardUnstorableTokens;
+    /**
+     * Current access token, refreshing pre-emptively when it is close to expiry.
+     * Returns null when there is nothing usable — the caller decides whether that
+     * is a hard failure or a reason to fall back to another credential.
+     */
+    getAccessToken(): Promise<string | null>;
+    /** Force the next {@link getAccessToken} to refresh even if the cached token looks fresh. */
+    invalidateAccessToken(): void;
+    /**
+     * Revoke the token family server-side, then drop the local copy.
+     *
+     * The order is not negotiable: clearing first and failing the revoke would
+     * leave a live refresh token on the server that the user can no longer see or
+     * cancel.
+     */
+    revoke(): Promise<void>;
+    /**
+     * Drop the local credential without asking the server.
+     *
+     * The offline escape hatch behind `auth logout --local`: the token stays valid
+     * server-side, so the caller owes the user a "revoke it in the web app" note.
+     */
+    forgetLocalCredential(): void;
+    private refresh;
+    /** The rotation itself. Runs with the cross-process lock held. */
+    private rotate;
+    private postToken;
+    /**
+     * A failed save is reported, never thrown: a long-running `agentteams mcp`
+     * that rotates its refresh token must keep running on the in-memory copy
+     * rather than die at the rotation.
+     */
+    private acceptTokens;
+    private clear;
+    private now;
+    private baseUrl;
+}
+export declare function getPersonalTokenClient(apiUrl: string): PersonalTokenClient;
+/** Test-only: drop every cached client so a test can inject its own deps. */
+export declare function resetPersonalTokenClientsForTests(): void;
+export {};
+//# sourceMappingURL=personalTokenClient.d.ts.map

package/dist/auth/personalTokenClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"personalTokenClient.d.ts","sourceRoot":"","sources":["../../src/auth/personalTokenClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAyB,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC9G,OAAO,EAA+C,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC/G,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAE1B,kGAAkG;AAClG,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAAyC,CAAC;AAE/E,MAAM,MAAM,sBAAsB,GAC9B,eAAe,GACf,WAAW,GACX,eAAe,GACf,oBAAoB,GACpB,eAAe;AACjB,qFAAqF;GACnF,mBAAmB,CAAC;AAExB,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,IAAI,EAAE,sBAAsB;gBAA5B,IAAI,EAAE,sBAAsB,EACrC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,2BAA2B,GAAG,SAAS,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;AAE7F,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,SAAS,EAAE,OAAO,CAAC;IACnB,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,YAAY,EAAE,mBAAmB,CAAC;IAClC,WAAW,EAAE,qBAAqB,CAAC;IACnC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACvC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,iBAAiB,EAAE,OAAO,CAAC;IAC3B,kFAAkF;IAClF,cAAc,EAAE,2BAA2B,GAAG,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;OAIG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED,UAAU,aAAa;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED,KAAK,mBAAmB,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+CzF;AAED,qBAAa,mBAAmB;IAQlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPjC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,cAAc,CAA4C;IAClE,OAAO,CAAC,eAAe,CAAuC;gBAEjC,IAAI,EAAE,uBAAuB;IAE1D,KAAK,IAAI,kBAAkB;IAc3B,aAAa,IAAI,OAAO;IAIxB;;;;;;;;;OASG;IACG,yBAAyB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyC7F;;;;;;OAMG;YACW,uBAAuB;IAwBrC;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAc9C,6FAA6F;IAC7F,qBAAqB,IAAI,IAAI;IAK7B;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAuC7B;;;;;OAKG;IACH,qBAAqB,IAAI,IAAI;YAIf,OAAO;IA0BrB,kEAAkE;YACpD,MAAM;YAmCN,SAAS;IAWvB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,KAAK;IASb,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,OAAO;CAGhB;AAWD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAc1E;AAED,6EAA6E;AAC7E,wBAAgB,iCAAiC,IAAI,IAAI,CAExD"}

package/dist/auth/personalTokenClient.js

@@ -0,0 +1,379 @@
+/**
+ * Personal opaque-token client for the CLI.
+ *
+ * Ported from `desktop/src/main/localAgent/personalTokenClient.ts`, which drives
+ * the same server endpoints (`/api/auth/desktop/{authorize,token,revoke}`). The
+ * two clients must keep the same three guarantees, because each one exists to
+ * stop a specific failure that has bitten this flow before:
+ *
+ *  1. Refresh ahead of expiry (60s skew) so a request never races the clock.
+ *  2. Collapse concurrent refreshes into one in-flight promise, so five
+ *     parallel calls rotate the refresh token once rather than five times.
+ *  3. Delete the stored refresh token **only** on an explicit `invalid_grant`.
+ *     A flaky network must not log the user out — otherwise one offline moment
+ *     costs a full re-login even after connectivity returns.
+ *
+ * Guarantee 2 covers one process. Rotation also has to be serialized *across*
+ * processes, because a one-shot `agentteams` command and a long-lived
+ * `agentteams mcp` share one credential slot: see {@link RefreshLock}.
+ */
+import { createPersonalTokenStore, personalTokenSlot } from './personalTokenStore.js';
+import { createFileRefreshLock, noopRefreshLock, DEFAULT_STALE_AFTER_MS, RefreshLockTimeoutError, RefreshLockUnavailableError, } from './refreshLock.js';
+/** Registered in `api/src/services/personalTokenClients.ts`; the server rejects anything else. */
+export const CLI_OAUTH_CLIENT_ID = 'agentteams-cli';
+/** Refresh this far before the server-declared expiry rather than at it. */
+export const ACCESS_REFRESH_SKEW_MS = 60_000;
+/**
+ * Cap on a token-endpoint request.
+ *
+ * Deliberately below {@link DEFAULT_STALE_AFTER_MS}: a rotation runs with the
+ * cross-process lock held, and if it could outlast the staleness window another
+ * process would judge the lock abandoned, take it, and rotate the same refresh
+ * token — the reuse that revokes the whole family. Bounding the request keeps the
+ * holder inside the window it promised.
+ */
+export const TOKEN_REQUEST_TIMEOUT_MS = Math.floor(DEFAULT_STALE_AFTER_MS / 2);
+export class PersonalTokenError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'PersonalTokenError';
+    }
+}
+/**
+ * Classify a token-endpoint response.
+ *
+ * The split that matters is `invalid_grant` (the server has definitively
+ * refused this refresh token) versus everything else (5xx, a proxy error page,
+ * a truncated body). Only the first justifies destroying local credentials.
+ */
+export async function parseTokenResponse(response) {
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        return { kind: 'transient', detail: `HTTP ${response.status} with an unreadable body` };
+    }
+    const error = body && typeof body === 'object' && 'error' in body ? body.error : undefined;
+    if (!response.ok) {
+        if ((response.status === 400 || response.status === 401) && error === 'invalid_grant') {
+            return { kind: 'invalidGrant' };
+        }
+        return { kind: 'transient', detail: `HTTP ${response.status}` };
+    }
+    const data = body && typeof body === 'object' && 'data' in body ? body.data : undefined;
+    const identity = data?.identity && typeof data.identity === 'object' ? data.identity : undefined;
+    if (typeof data?.accessToken !== 'string' ||
+        typeof data.refreshToken !== 'string' ||
+        typeof data.expiresIn !== 'number' ||
+        !identity ||
+        typeof identity.memberId !== 'string' ||
+        typeof identity.email !== 'string' ||
+        typeof identity.nickname !== 'string') {
+        return { kind: 'transient', detail: 'the server returned an unexpected token payload' };
+    }
+    return {
+        kind: 'success',
+        tokens: {
+            accessToken: data.accessToken,
+            refreshToken: data.refreshToken,
+            expiresIn: data.expiresIn,
+            identity: {
+                memberId: identity.memberId,
+                email: identity.email,
+                nickname: identity.nickname,
+            },
+        },
+    };
+}
+export class PersonalTokenClient {
+    deps;
+    accessToken = null;
+    accessExpiresAt = 0;
+    identity = null;
+    reconnectRequired = false;
+    refreshFailure = null;
+    refreshInFlight = null;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    state() {
+        const storeStatus = this.deps.store.status();
+        return {
+            connected: this.deps.store.read() !== null,
+            persisted: storeStatus.persisted,
+            storeBackend: storeStatus.backend,
+            storeReason: storeStatus.reason,
+            identity: this.identity,
+            expiresAt: this.accessToken ? this.accessExpiresAt : null,
+            reconnectRequired: this.reconnectRequired,
+            refreshFailure: this.refreshFailure,
+        };
+    }
+    hasCredential() {
+        return this.deps.store.read() !== null;
+    }
+    /**
+     * Trade a PKCE authorization code for the first token pair.
+     *
+     * A failure here leaves nothing behind: there is no prior credential to
+     * protect, and a half-finished login must not look like a connected one.
+     * That includes the case where the store refuses to keep the credential — a
+     * fresh login the next command cannot see is not a login, and the refresh
+     * token the server just minted would outlive this process with nobody able to
+     * use or cancel it. It is revoked rather than left orphaned.
+     */
+    async exchangeAuthorizationCode(grant) {
+        let parsed;
+        try {
+            parsed = await this.postToken({
+                grantType: 'authorization_code',
+                clientId: CLI_OAUTH_CLIENT_ID,
+                code: grant.code,
+                codeVerifier: grant.codeVerifier,
+                redirectUri: grant.redirectUri,
+            });
+        }
+        catch (error) {
+            throw new PersonalTokenError('TRANSIENT', `Could not reach the server to exchange the authorization code: ${error instanceof Error ? error.message : String(error)}.`);
+        }
+        if (parsed.kind === 'invalidGrant') {
+            throw new PersonalTokenError('INVALID_GRANT', 'The authorization code was rejected. It may have expired or already been used — run `agentteams auth login` again.');
+        }
+        if (parsed.kind !== 'success') {
+            throw new PersonalTokenError('TRANSIENT', `Token exchange failed: ${parsed.detail}.`);
+        }
+        const stored = this.acceptTokens(parsed.tokens);
+        this.reconnectRequired = false;
+        if (!stored.persisted) {
+            await this.discardUnstorableTokens(stored);
+        }
+        return {
+            accessToken: parsed.tokens.accessToken,
+            expiresAt: this.accessExpiresAt,
+            identity: parsed.tokens.identity,
+        };
+    }
+    /**
+     * Undo a login whose credential could not be stored.
+     *
+     * Revoking is best-effort — an unreachable server is not a reason to keep a
+     * dangling local state — but the local copy always goes, so `hasCredential()`
+     * never reports a login the next process will not find.
+     */
+    async discardUnstorableTokens(outcome) {
+        let serverRevoked = true;
+        try {
+            await this.revoke();
+        }
+        catch {
+            serverRevoked = false;
+            this.clear();
+        }
+        const cause = outcome.reason === 'WRITE_FAILED'
+            ? `the OS credential store rejected the write${outcome.detail ? ` (${outcome.detail})` : ''}`
+            : 'this machine has no usable OS credential store';
+        throw new PersonalTokenError('STORE_UNAVAILABLE', `Signed in, but the login could not be saved: ${cause}. ` +
+            (serverRevoked
+                ? 'The issued token was revoked so nothing is left behind. '
+                : 'The token could not be revoked either — cancel it from the AgentTeams web app. ') +
+            'On CI, containers and headless machines use an API key (AGENTTEAMS_API_KEY) instead.');
+    }
+    /**
+     * Current access token, refreshing pre-emptively when it is close to expiry.
+     * Returns null when there is nothing usable — the caller decides whether that
+     * is a hard failure or a reason to fall back to another credential.
+     */
+    async getAccessToken() {
+        const now = this.now();
+        if (this.accessToken && this.accessExpiresAt - ACCESS_REFRESH_SKEW_MS > now) {
+            return this.accessToken;
+        }
+        if (!this.refreshInFlight) {
+            this.refreshInFlight = this.refresh().finally(() => {
+                this.refreshInFlight = null;
+            });
+        }
+        return this.refreshInFlight;
+    }
+    /** Force the next {@link getAccessToken} to refresh even if the cached token looks fresh. */
+    invalidateAccessToken() {
+        this.accessToken = null;
+        this.accessExpiresAt = 0;
+    }
+    /**
+     * Revoke the token family server-side, then drop the local copy.
+     *
+     * The order is not negotiable: clearing first and failing the revoke would
+     * leave a live refresh token on the server that the user can no longer see or
+     * cancel.
+     */
+    async revoke() {
+        // Fresh: a logout has to revoke the token the family is actually on, not a
+        // copy this process cached before someone else rotated it.
+        //
+        // Falling back to the cached copy is safe and necessary here: revocation
+        // kills the whole family, so a superseded token from the same family does the
+        // same job, and a read that failed (locked keychain, denied prompt) must not
+        // make logout claim there is nothing to revoke while a live token sits in the
+        // store — that would leave it valid server-side with no way to reach it.
+        const refreshToken = this.deps.store.read({ fresh: true }) ?? this.deps.store.read();
+        if (!refreshToken) {
+            throw new PersonalTokenError('NOT_LOGGED_IN', 'No personal token is stored for this server.');
+        }
+        const doFetch = this.deps.fetch ?? globalThis.fetch;
+        let response;
+        try {
+            response = await doFetch(`${this.baseUrl()}/api/auth/desktop/revoke`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ clientId: CLI_OAUTH_CLIENT_ID, token: refreshToken }),
+            });
+        }
+        catch (error) {
+            throw new PersonalTokenError('REVOKE_FAILED', `Could not reach the server to revoke the token: ${error instanceof Error ? error.message : String(error)}. The local credential was kept.`);
+        }
+        if (!response.ok) {
+            throw new PersonalTokenError('REVOKE_FAILED', `The server refused to revoke the token (HTTP ${response.status}). The local credential was kept.`);
+        }
+        this.clear();
+    }
+    /**
+     * Drop the local credential without asking the server.
+     *
+     * The offline escape hatch behind `auth logout --local`: the token stays valid
+     * server-side, so the caller owes the user a "revoke it in the web app" note.
+     */
+    forgetLocalCredential() {
+        this.clear();
+    }
+    async refresh() {
+        // Cheap pre-check off the cache: no credential means there is nothing to
+        // serialize against, so the lock is never taken for a logged-out process.
+        if (!this.deps.store.read())
+            return null;
+        try {
+            const accessToken = await (this.deps.lock ?? noopRefreshLock).withLock(() => this.rotate());
+            if (accessToken)
+                this.refreshFailure = null;
+            return accessToken;
+        }
+        catch (error) {
+            // Both lock problems leave the refresh token exactly where it is, so the
+            // next command retries. Rotating anyway would risk the server's reuse
+            // detection revoking the whole family, which costs a full re-login. They
+            // are recorded distinctly so the caller does not blame the network.
+            if (error instanceof RefreshLockTimeoutError) {
+                this.refreshFailure = 'LOCK_CONTENTION';
+                return null;
+            }
+            if (error instanceof RefreshLockUnavailableError) {
+                this.refreshFailure = 'LOCK_UNAVAILABLE';
+                return null;
+            }
+            throw error;
+        }
+    }
+    /** The rotation itself. Runs with the cross-process lock held. */
+    async rotate() {
+        // Re-read past the store's process-lifetime cache. Another process may have
+        // rotated — or cleared — the family while this one waited for the lock, and
+        // presenting the superseded token is precisely what makes the server revoke
+        // every token in the family.
+        const refreshToken = this.deps.store.read({ fresh: true });
+        if (!refreshToken)
+            return null;
+        let parsed;
+        try {
+            parsed = await this.postToken({
+                grantType: 'refresh_token',
+                clientId: CLI_OAUTH_CLIENT_ID,
+                refreshToken,
+            });
+        }
+        catch {
+            // Network-level failure, which now includes the request outrunning
+            // TOKEN_REQUEST_TIMEOUT_MS. The refresh token is still presumed valid, so
+            // it stays exactly where it is; the next command can try again.
+            this.refreshFailure = 'NETWORK';
+            return null;
+        }
+        if (parsed.kind === 'invalidGrant') {
+            this.clear();
+            this.reconnectRequired = true;
+            return null;
+        }
+        if (parsed.kind !== 'success')
+            return null;
+        this.acceptTokens(parsed.tokens);
+        this.reconnectRequired = false;
+        return this.accessToken;
+    }
+    async postToken(body) {
+        const doFetch = this.deps.fetch ?? globalThis.fetch;
+        const response = await doFetch(`${this.baseUrl()}/api/auth/desktop/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
+        });
+        return parseTokenResponse(response);
+    }
+    /**
+     * A failed save is reported, never thrown: a long-running `agentteams mcp`
+     * that rotates its refresh token must keep running on the in-memory copy
+     * rather than die at the rotation.
+     */
+    acceptTokens(tokens) {
+        this.accessToken = tokens.accessToken;
+        // TTL is the server's call (`ACCESS_TOKEN_TTL_MS` in api/src/services/personalToken.ts);
+        // the client never assumes a duration of its own.
+        this.accessExpiresAt = this.now() + tokens.expiresIn * 1000;
+        this.identity = tokens.identity;
+        return this.deps.store.save(tokens.refreshToken);
+    }
+    clear() {
+        this.accessToken = null;
+        this.accessExpiresAt = 0;
+        this.identity = null;
+        this.reconnectRequired = false;
+        this.refreshFailure = null;
+        this.deps.store.remove();
+    }
+    now() {
+        return (this.deps.now ?? Date.now)();
+    }
+    baseUrl() {
+        return this.deps.apiUrl.replace(/\/+$/, '');
+    }
+}
+/**
+ * One client per API server for the lifetime of the process.
+ *
+ * The in-flight refresh suppression and the cached access token only work if
+ * every caller shares the same instance — a per-call client would rotate the
+ * refresh token once per command, and `agentteams mcp` would do it per tool call.
+ */
+const clients = new Map();
+export function getPersonalTokenClient(apiUrl) {
+    const key = apiUrl.replace(/\/+$/, '');
+    let client = clients.get(key);
+    if (!client) {
+        const slot = personalTokenSlot(key);
+        client = new PersonalTokenClient({
+            apiUrl: key,
+            store: createPersonalTokenStore(key),
+            // Per slot, so a dev-API rotation never blocks a production one.
+            lock: createFileRefreshLock(slot),
+        });
+        clients.set(key, client);
+    }
+    return client;
+}
+/** Test-only: drop every cached client so a test can inject its own deps. */
+export function resetPersonalTokenClientsForTests() {
+    clients.clear();
+}
+//# sourceMappingURL=personalTokenClient.js.map

package/dist/auth/personalTokenClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"personalTokenClient.js","sourceRoot":"","sources":["../../src/auth/personalTokenClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAA2B,MAAM,yBAAyB,CAAC;AAC/G,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,GAE5B,MAAM,kBAAkB,CAAC;AAE1B,kGAAkG;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAEpD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,GAAG,CAAC,CAAC,CAAC;AAW/E,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEhC;IADX,YACW,IAA4B,EACrC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAwB;QAIrC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAuED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAkB;IACzD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,0BAA0B,EAAE,CAAC;IAC1F,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,IAAI,CAAC,CAAC,CAAE,IAA4B,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YACtF,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAClC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,IAAI,GACR,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,CAAC,CAAC,CAAE,IAA2C,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,MAAM,QAAQ,GACZ,IAAI,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,QAAoC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE/G,IACE,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ;QACrC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;QACrC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QAClC,CAAC,QAAQ;QACT,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ;QACrC,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;QAClC,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EACrC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAC1F,CAAC;IAED,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM,EAAE;YACN,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE;gBACR,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,mBAAmB;IAQD;IAPrB,WAAW,GAAkB,IAAI,CAAC;IAClC,eAAe,GAAG,CAAC,CAAC;IACpB,QAAQ,GAAiC,IAAI,CAAC;IAC9C,iBAAiB,GAAG,KAAK,CAAC;IAC1B,cAAc,GAAuC,IAAI,CAAC;IAC1D,eAAe,GAAkC,IAAI,CAAC;IAE9D,YAA6B,IAA6B;QAA7B,SAAI,GAAJ,IAAI,CAAyB;IAAG,CAAC;IAE9D,KAAK;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7C,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI;YAC1C,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,YAAY,EAAE,WAAW,CAAC,OAAO;YACjC,WAAW,EAAE,WAAW,CAAC,MAAM;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI;YACzD,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC;IACJ,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC;IACzC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,yBAAyB,CAAC,KAA6B;QAC3D,IAAI,MAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;gBAC5B,SAAS,EAAE,oBAAoB;gBAC/B,QAAQ,EAAE,mBAAmB;gBAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAC1B,WAAW,EACX,kEAAkE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAC5H,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,oHAAoH,CACrH,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,0BAA0B,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAE/B,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW;YACtC,SAAS,EAAE,IAAI,CAAC,eAAe;YAC/B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,uBAAuB,CAAC,OAA8B;QAClE,IAAI,aAAa,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,GAAG,KAAK,CAAC;YACtB,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GACT,OAAO,CAAC,MAAM,KAAK,cAAc;YAC/B,CAAC,CAAC,6CAA6C,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7F,CAAC,CAAC,gDAAgD,CAAC;QAEvD,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,gDAAgD,KAAK,IAAI;YACvD,CAAC,aAAa;gBACZ,CAAC,CAAC,0DAA0D;gBAC5D,CAAC,CAAC,iFAAiF,CAAC;YACtF,sFAAsF,CACzF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,eAAe,GAAG,sBAAsB,GAAG,GAAG,EAAE,CAAC;YAC5E,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBACjD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC9B,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,6FAA6F;IAC7F,qBAAqB;QACnB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM;QACV,2EAA2E;QAC3E,2DAA2D;QAC3D,EAAE;QACF,yEAAyE;QACzE,8EAA8E;QAC9E,6EAA6E;QAC7E,8EAA8E;QAC9E,yEAAyE;QACzE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACrF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,8CAA8C,CAAC,CAAC;QAChG,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QACpD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,0BAA0B,EAAE;gBACpE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;aAC7E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,mDAAmD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAC5I,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,gDAAgD,QAAQ,CAAC,MAAM,mCAAmC,CACnG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,qBAAqB;QACnB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAEzC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5F,IAAI,WAAW;gBAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC5C,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,sEAAsE;YACtE,yEAAyE;YACzE,oEAAoE;YACpE,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,IAAI,CAAC,cAAc,GAAG,iBAAiB,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,KAAK,YAAY,2BAA2B,EAAE,CAAC;gBACjD,IAAI,CAAC,cAAc,GAAG,kBAAkB,CAAC;gBACzC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,kEAAkE;IAC1D,KAAK,CAAC,MAAM;QAClB,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,6BAA6B;QAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAE/B,IAAI,MAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;gBAC5B,SAAS,EAAE,eAAe;gBAC1B,QAAQ,EAAE,mBAAmB;gBAC7B,YAAY;aACb,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,0EAA0E;YAC1E,gEAAgE;YAChE,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAE3C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAC/B,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAA6B;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,yBAAyB,EAAE;YACzE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC;SACtD,CAAC,CAAC;QACH,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,MAAqB;QACxC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,yFAAyF;QACzF,kDAAkD;QAClD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QAC5D,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAC3B,CAAC;IAEO,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAEO,OAAO;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;AAEvD,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,GAAG,IAAI,mBAAmB,CAAC;YAC/B,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,wBAAwB,CAAC,GAAG,CAAC;YACpC,iEAAiE;YACjE,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iCAAiC;IAC/C,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC"}

package/dist/auth/personalTokenStore.d.ts

@@ -0,0 +1,17 @@
+import { type CredentialReadOptions, type CredentialSaveOutcome, type CredentialStore, type CredentialStoreStatus } from './credentialStore.js';
+export interface PersonalTokenStore {
+    status(): CredentialStoreStatus;
+    /** Pass `{ fresh: true }` before presenting the token — see {@link CredentialReadOptions}. */
+    read(options?: CredentialReadOptions): string | null;
+    save(refreshToken: string): CredentialSaveOutcome;
+    remove(): void;
+}
+export declare function personalTokenSlot(apiUrl: string): string;
+/**
+ * Wrap the OS credential store in a single-slot view.
+ *
+ * Access tokens deliberately have no way in here — they live for 15 minutes and
+ * stay in process memory, so there is nothing to revoke if a disk is imaged.
+ */
+export declare function createPersonalTokenStore(apiUrl: string, store?: CredentialStore): PersonalTokenStore;
+//# sourceMappingURL=personalTokenStore.d.ts.map

package/dist/auth/personalTokenStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"personalTokenStore.d.ts","sourceRoot":"","sources":["../../src/auth/personalTokenStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAU9B,MAAM,WAAW,kBAAkB;IACjC,MAAM,IAAI,qBAAqB,CAAC;IAChC,8FAA8F;IAC9F,IAAI,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,MAAM,GAAG,IAAI,CAAC;IACrD,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CAAC;IAClD,MAAM,IAAI,IAAI,CAAC;CAChB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,eAAsC,GAC5C,kBAAkB,CASpB"}

package/dist/auth/personalTokenStore.js

@@ -0,0 +1,27 @@
+import { getCredentialStore, } from './credentialStore.js';
+/**
+ * The refresh token is the only long-lived secret the new auth path keeps, and
+ * it is bound to the server that issued it: a token from the dev API must never
+ * be replayed against production. The API URL is therefore part of the account
+ * name rather than shared across every server.
+ */
+const SLOT_PREFIX = 'personal-refresh';
+export function personalTokenSlot(apiUrl) {
+    return `${SLOT_PREFIX}:${apiUrl.replace(/\/+$/, '')}`;
+}
+/**
+ * Wrap the OS credential store in a single-slot view.
+ *
+ * Access tokens deliberately have no way in here — they live for 15 minutes and
+ * stay in process memory, so there is nothing to revoke if a disk is imaged.
+ */
+export function createPersonalTokenStore(apiUrl, store = getCredentialStore()) {
+    const slot = personalTokenSlot(apiUrl);
+    return {
+        status: () => store.status(),
+        read: (options) => store.read(slot, options),
+        save: (refreshToken) => store.save(slot, refreshToken),
+        remove: () => store.remove(slot),
+    };
+}
+//# sourceMappingURL=personalTokenStore.js.map

package/dist/auth/personalTokenStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"personalTokenStore.js","sourceRoot":"","sources":["../../src/auth/personalTokenStore.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,GAKnB,MAAM,sBAAsB,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAUvC,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,GAAG,WAAW,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAc,EACd,QAAyB,kBAAkB,EAAE;IAE7C,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAEvC,OAAO;QACL,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE;QAC5B,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAC5C,IAAI,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QACtD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC"}