@agentteams/cli 0.1.83 → 0.1.85

package/dist/auth/refreshLock.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Cross-process mutex for refresh-token rotation.
+ *
+ * Rotation is destructive on the server: presenting a refresh token that has
+ * already been rotated is reuse, and the server answers reuse by revoking the
+ * **entire token family** (`rotatePersonalRefreshToken` in
+ * `api/src/services/personalToken.ts`). Every `agentteams` invocation rotates,
+ * and several can run at once — one-shot commands next to a long-lived
+ * `agentteams mcp` server. Without serialization, two processes reading the same
+ * token and rotating it concurrently log the user out of every process at once,
+ * recoverable only by a fresh `agentteams auth login`.
+ *
+ * The lock is a file created with `wx`, which is atomic on every platform the
+ * CLI supports, so no native dependency is needed. Two failure modes are
+ * deliberately not treated as errors:
+ *
+ *  - **No usable lock directory** (read-only home, sandbox) → run unlocked.
+ *    The lock protects against a race; refusing to authenticate at all because
+ *    the guard is unavailable would be the worse outcome.
+ *  - **A lock left behind by a crashed process** → broken once it is older than
+ *    {@link DEFAULT_STALE_AFTER_MS}, so a killed process cannot lock the user
+ *    out permanently.
+ *
+ * Contention that outlives the timeout raises {@link RefreshLockTimeoutError}
+ * instead of rotating anyway: the caller treats it like a network failure and
+ * keeps the credential, which costs one retry. Rotating unlocked would risk the
+ * family revocation this module exists to prevent.
+ */
+/**
+ * How long a held lock stays credible. A token request that has not finished by
+ * then is either hung or its process is gone; both justify taking over.
+ */
+export declare const DEFAULT_STALE_AFTER_MS = 20000;
+/** Long enough to outlast a slow-but-real rotation ahead of us in the queue. */
+export declare const DEFAULT_TIMEOUT_MS = 30000;
+export interface RefreshLock {
+    withLock<T>(run: () => Promise<T>): Promise<T>;
+}
+export declare class RefreshLockTimeoutError extends Error {
+    readonly lockPath: string;
+    readonly timeoutMs: number;
+    constructor(lockPath: string, timeoutMs: number);
+}
+/**
+ * The lock file itself could not be maintained — distinct from losing a race for
+ * it. Kept separate so the caller can say which one happened instead of
+ * reporting every lock problem as a network failure.
+ */
+export declare class RefreshLockUnavailableError extends Error {
+    readonly lockPath: string;
+    readonly cause: unknown;
+    constructor(lockPath: string, cause: unknown);
+}
+/**
+ * A lock that never blocks. The default for {@link PersonalTokenClient} so unit
+ * tests touch no filesystem; production wiring passes a real lock.
+ */
+export declare const noopRefreshLock: RefreshLock;
+export interface CreateFileRefreshLockOptions {
+    /** Defaults to `~/.agentteams/locks`. */
+    directory?: string;
+    staleAfterMs?: number;
+    timeoutMs?: number;
+    retryDelayMs?: number;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+}
+/**
+ * One lock file per credential slot, named by hash: a slot embeds an API URL,
+ * whose `:` and `/` are not portable in a filename.
+ */
+export declare function refreshLockFileName(slot: string): string;
+export declare function createFileRefreshLock(slot: string, options?: CreateFileRefreshLockOptions): RefreshLock;
+//# sourceMappingURL=refreshLock.d.ts.map

package/dist/auth/refreshLock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refreshLock.d.ts","sourceRoot":"","sources":["../../src/auth/refreshLock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAUH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAOzC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAChD;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAE9C,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM;gBADjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM;CAK7B;AAED;;;;GAIG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IAElD,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO;gBADd,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO;CAS1B;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,WAE7B,CAAC;AAEF,MAAM,WAAW,4BAA4B;IAC3C,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAOD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAMD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,4BAAiC,GAAG,WAAW,CA2I3G"}

package/dist/auth/refreshLock.js

@@ -0,0 +1,225 @@
+/**
+ * Cross-process mutex for refresh-token rotation.
+ *
+ * Rotation is destructive on the server: presenting a refresh token that has
+ * already been rotated is reuse, and the server answers reuse by revoking the
+ * **entire token family** (`rotatePersonalRefreshToken` in
+ * `api/src/services/personalToken.ts`). Every `agentteams` invocation rotates,
+ * and several can run at once — one-shot commands next to a long-lived
+ * `agentteams mcp` server. Without serialization, two processes reading the same
+ * token and rotating it concurrently log the user out of every process at once,
+ * recoverable only by a fresh `agentteams auth login`.
+ *
+ * The lock is a file created with `wx`, which is atomic on every platform the
+ * CLI supports, so no native dependency is needed. Two failure modes are
+ * deliberately not treated as errors:
+ *
+ *  - **No usable lock directory** (read-only home, sandbox) → run unlocked.
+ *    The lock protects against a race; refusing to authenticate at all because
+ *    the guard is unavailable would be the worse outcome.
+ *  - **A lock left behind by a crashed process** → broken once it is older than
+ *    {@link DEFAULT_STALE_AFTER_MS}, so a killed process cannot lock the user
+ *    out permanently.
+ *
+ * Contention that outlives the timeout raises {@link RefreshLockTimeoutError}
+ * instead of rotating anyway: the caller treats it like a network failure and
+ * keeps the credential, which costs one retry. Rotating unlocked would risk the
+ * family revocation this module exists to prevent.
+ */
+import { createHash, randomUUID } from 'node:crypto';
+import { linkSync, mkdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/** Same `.agentteams` directory the global config lives in. */
+const LOCK_DIR = ['.agentteams', 'locks'];
+/**
+ * How long a held lock stays credible. A token request that has not finished by
+ * then is either hung or its process is gone; both justify taking over.
+ */
+export const DEFAULT_STALE_AFTER_MS = 20_000;
+/** Long enough to outlast a slow-but-real rotation ahead of us in the queue. */
+export const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_RETRY_DELAY_MS = 50;
+const DIRECTORY_MODE = 0o700;
+const FILE_MODE = 0o600;
+export class RefreshLockTimeoutError extends Error {
+    lockPath;
+    timeoutMs;
+    constructor(lockPath, timeoutMs) {
+        super(`Timed out after ${timeoutMs}ms waiting for the credential rotation lock at ${lockPath}.`);
+        this.lockPath = lockPath;
+        this.timeoutMs = timeoutMs;
+        this.name = 'RefreshLockTimeoutError';
+    }
+}
+/**
+ * The lock file itself could not be maintained — distinct from losing a race for
+ * it. Kept separate so the caller can say which one happened instead of
+ * reporting every lock problem as a network failure.
+ */
+export class RefreshLockUnavailableError extends Error {
+    lockPath;
+    cause;
+    constructor(lockPath, cause) {
+        super(`Could not maintain the credential rotation lock at ${lockPath}: ${cause instanceof Error ? cause.message : String(cause)}`);
+        this.lockPath = lockPath;
+        this.cause = cause;
+        this.name = 'RefreshLockUnavailableError';
+    }
+}
+/**
+ * A lock that never blocks. The default for {@link PersonalTokenClient} so unit
+ * tests touch no filesystem; production wiring passes a real lock.
+ */
+export const noopRefreshLock = {
+    withLock: (run) => run(),
+};
+/**
+ * One lock file per credential slot, named by hash: a slot embeds an API URL,
+ * whose `:` and `/` are not portable in a filename.
+ */
+export function refreshLockFileName(slot) {
+    return `personal-token-${createHash('sha256').update(slot).digest('hex').slice(0, 16)}.lock`;
+}
+function isAlreadyExists(error) {
+    return error?.code === 'EEXIST';
+}
+export function createFileRefreshLock(slot, options = {}) {
+    const directory = options.directory ?? join(homedir(), ...LOCK_DIR);
+    const lockPath = join(directory, refreshLockFileName(slot));
+    const staleAfterMs = options.staleAfterMs ?? DEFAULT_STALE_AFTER_MS;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const retryDelayMs = options.retryDelayMs ?? DEFAULT_RETRY_DELAY_MS;
+    const now = options.now ?? Date.now;
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    /**
+     * When the lock was taken, or null if that cannot be established.
+     *
+     * The timestamp inside the file is preferred so the clock the caller injects is
+     * the one that decides. An unreadable or half-written file falls back to mtime
+     * rather than counting as "no holder": the file existing is itself evidence
+     * that someone created it, and treating it as free would delete a live lock.
+     */
+    const readHeldSince = () => {
+        try {
+            const record = JSON.parse(readFileSync(lockPath, 'utf-8'));
+            if (typeof record.startedAt === 'number')
+                return record.startedAt;
+        }
+        catch {
+            // Gone, or content we cannot interpret. mtime is the fallback below.
+        }
+        try {
+            return statSync(lockPath).mtimeMs;
+        }
+        catch {
+            // Really gone — the holder released between the two calls.
+            return null;
+        }
+    };
+    const breakIfStale = () => {
+        const heldSince = readHeldSince();
+        if (heldSince !== null && now() - heldSince < staleAfterMs) {
+            return;
+        }
+        try {
+            unlinkSync(lockPath);
+        }
+        catch {
+            // Another waiter won the race to break it. Either way it is gone.
+        }
+    };
+    /**
+     * Publish the lock file with its content already in place.
+     *
+     * `writeFileSync` with `wx` creates the file and writes afterwards, leaving a
+     * window in which the lock exists but is empty — long enough for a waiter to
+     * read nothing, conclude there is no holder, and delete a lock that was just
+     * taken. Writing to a private path and `link`ing it into place closes that
+     * window: `link` is atomic and fails with EEXIST when the target exists, which
+     * is the same mutual exclusion `wx` provides.
+     */
+    const publishLockFile = (owner, record) => {
+        const stagingPath = `${lockPath}.${process.pid}.${randomUUID()}`;
+        writeFileSync(stagingPath, JSON.stringify(record), { flag: 'wx', mode: FILE_MODE });
+        try {
+            linkSync(stagingPath, lockPath);
+        }
+        finally {
+            try {
+                unlinkSync(stagingPath);
+            }
+            catch {
+                // The link either succeeded (the content lives on at lockPath) or threw
+                // and is being propagated; either way the staging copy is disposable.
+            }
+        }
+    };
+    /** Returns the owner token, or null when this machine cannot host a lock. */
+    const acquire = async () => {
+        try {
+            // `recursive` makes an existing directory a no-op, so anything thrown here
+            // means no lock is possible at all (read-only home, no permission, a file
+            // sitting on the path). Proceed unguarded rather than block every command.
+            mkdirSync(directory, { recursive: true, mode: DIRECTORY_MODE });
+        }
+        catch {
+            return null;
+        }
+        const deadline = now() + timeoutMs;
+        let firstWriteError;
+        for (;;) {
+            const owner = `${process.pid}:${randomUUID()}`;
+            const record = { owner, startedAt: now() };
+            try {
+                publishLockFile(owner, record);
+                return owner;
+            }
+            catch (error) {
+                if (!isAlreadyExists(error)) {
+                    // Not contention. A transient failure (ENOSPC, a permission change
+                    // mid-run) must not silently downgrade to an unguarded rotation, so it
+                    // is retried within the same deadline and only reported if it persists.
+                    firstWriteError ??= error;
+                    if (now() >= deadline) {
+                        throw new RefreshLockUnavailableError(lockPath, firstWriteError);
+                    }
+                    await sleep(retryDelayMs);
+                    continue;
+                }
+            }
+            breakIfStale();
+            if (now() >= deadline) {
+                throw new RefreshLockTimeoutError(lockPath, timeoutMs);
+            }
+            await sleep(retryDelayMs);
+        }
+    };
+    const release = (owner) => {
+        if (owner === null)
+            return;
+        try {
+            // Only remove a lock still recorded as ours: if it was broken as stale
+            // while we ran, the file now belongs to whoever took over.
+            const record = JSON.parse(readFileSync(lockPath, 'utf-8'));
+            if (record.owner !== owner)
+                return;
+            unlinkSync(lockPath);
+        }
+        catch {
+            // Already gone, or unreadable. Nothing left to release.
+        }
+    };
+    return {
+        async withLock(run) {
+            const owner = await acquire();
+            try {
+                return await run();
+            }
+            finally {
+                release(owner);
+            }
+        },
+    };
+}
+//# sourceMappingURL=refreshLock.js.map

package/dist/auth/refreshLock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refreshLock.js","sourceRoot":"","sources":["../../src/auth/refreshLock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,+DAA+D;AAC/D,MAAM,QAAQ,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,SAAS,GAAG,KAAK,CAAC;AAMxB,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAErC;IACA;IAFX,YACW,QAAgB,EAChB,SAAiB;QAE1B,KAAK,CAAC,mBAAmB,SAAS,kDAAkD,QAAQ,GAAG,CAAC,CAAC;QAHxF,aAAQ,GAAR,QAAQ,CAAQ;QAChB,cAAS,GAAT,SAAS,CAAQ;QAG1B,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAEzC;IACA;IAFX,YACW,QAAgB,EAChB,KAAc;QAEvB,KAAK,CACH,sDAAsD,QAAQ,KAC5D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QAPO,aAAQ,GAAR,QAAQ,CAAQ;QAChB,UAAK,GAAL,KAAK,CAAS;QAOvB,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAgB;IAC1C,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE;CACzB,CAAC;AAiBF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,kBAAkB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;AAC/F,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAQ,KAAkC,EAAE,IAAI,KAAK,QAAQ,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,UAAwC,EAAE;IAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAEzG;;;;;;;OAOG;IACH,MAAM,aAAa,GAAG,GAAkB,EAAE;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAe,CAAC;YACzE,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC,SAAS,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;QAED,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAClC,IAAI,SAAS,KAAK,IAAI,IAAI,GAAG,EAAE,GAAG,SAAS,GAAG,YAAY,EAAE,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC,CAAC;IAEF;;;;;;;;;OASG;IACH,MAAM,eAAe,GAAG,CAAC,KAAa,EAAE,MAAkB,EAAQ,EAAE;QAClE,MAAM,WAAW,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,EAAE,CAAC;QACjE,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC;YACH,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,UAAU,CAAC,WAAW,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,wEAAwE;gBACxE,sEAAsE;YACxE,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,6EAA6E;IAC7E,MAAM,OAAO,GAAG,KAAK,IAA4B,EAAE;QACjD,IAAI,CAAC;YACH,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC;QACnC,IAAI,eAAwB,CAAC;QAE7B,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAe,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;YAEvD,IAAI,CAAC;gBACH,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC/B,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5B,mEAAmE;oBACnE,uEAAuE;oBACvE,wEAAwE;oBACxE,eAAe,KAAK,KAAK,CAAC;oBAC1B,IAAI,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;wBACtB,MAAM,IAAI,2BAA2B,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;oBACnE,CAAC;oBACD,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;oBAC1B,SAAS;gBACX,CAAC;YACH,CAAC;YAED,YAAY,EAAE,CAAC;YAEf,IAAI,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACtB,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,KAAoB,EAAQ,EAAE;QAC7C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO;QAE3B,IAAI,CAAC;YACH,uEAAuE;YACvE,2DAA2D;YAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAe,CAAC;YACzE,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;gBAAE,OAAO;YACnC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,QAAQ,CAAI,GAAqB;YACrC,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,EAAE,CAAC;YACrB,CAAC;oBAAS,CAAC;gBACT,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/commands/agentConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agentConfig.d.ts","sourceRoot":"","sources":["../../src/commands/agentConfig.ts"],"names":[],"mappings":"AAwBA,wBAAsB,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,CAOpD;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAO7D;AAED,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAUhE"}
+{"version":3,"file":"agentConfig.d.ts","sourceRoot":"","sources":["../../src/commands/agentConfig.ts"],"names":[],"mappings":"AA0BA,wBAAsB,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,CAOpD;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAO7D;AAED,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAUhE"}

package/dist/commands/agentConfig.js

@@ -1,9 +1,11 @@
 import httpClient from '../utils/httpClient.js';
-import { getConfigurationNotFoundMessage, loadConfig } from '../utils/config.js';
+import { getConfigurationNotFoundMessage, loadConfigWithCredential } from '../utils/config.js';
 import { withoutJsonContentType } from '../utils/httpHeaders.js';
 import { buildAuthHeaders } from '../utils/apiContext.js';
-function getConfigOrThrow() {
-    const config = loadConfig();
+async function getConfigOrThrow() {
+    // Credential-aware: a personal-token project has no `apiKey` on disk, so the
+    // plain config loader would report it as "not initialized".
+    const config = await loadConfigWithCredential();
     if (!config) {
         throw new Error(getConfigurationNotFoundMessage());
     }
@@ -19,7 +21,7 @@ function getApiBaseUrl(apiUrl) {
     return apiUrl.endsWith('/') ? apiUrl.slice(0, -1) : apiUrl;
 }
 export async function agentConfigList() {
-    const config = getConfigOrThrow();
+    const config = await getConfigOrThrow();
     const apiBaseUrl = getApiBaseUrl(config.apiUrl);
     const response = await httpClient.get(`${apiBaseUrl}/api/projects/${config.projectId}/agent-configs`, {
         headers: getHeaders(config.apiKey),
@@ -27,7 +29,7 @@ export async function agentConfigList() {
     return response.data;
 }
 export async function agentConfigGet(id) {
-    const config = getConfigOrThrow();
+    const config = await getConfigOrThrow();
     const apiBaseUrl = getApiBaseUrl(config.apiUrl);
     const response = await httpClient.get(`${apiBaseUrl}/api/projects/${config.projectId}/agent-configs/${id}`, {
         headers: getHeaders(config.apiKey),
@@ -35,7 +37,7 @@ export async function agentConfigGet(id) {
     return response.data;
 }
 export async function agentConfigDelete(id) {
-    const config = getConfigOrThrow();
+    const config = await getConfigOrThrow();
     const apiBaseUrl = getApiBaseUrl(config.apiUrl);
     const response = await httpClient.delete(`${apiBaseUrl}/api/projects/${config.projectId}/agent-configs/${id}`, {
         headers: withoutJsonContentType(getHeaders(config.apiKey)),

package/dist/commands/agentConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentConfig.js","sourceRoot":"","sources":["../../src/commands/agentConfig.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,+BAA+B,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO;QACL,GAAG,gBAAgB,CAAC,MAAM,CAAC;QAC3B,cAAc,EAAE,kBAAkB;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,UAAU,iBAAiB,MAAM,CAAC,SAAS,gBAAgB,EAAE;QACpG,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU;IAC7C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,UAAU,iBAAiB,MAAM,CAAC,SAAS,kBAAkB,EAAE,EAAE,EAAE;QAC1G,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAU;IAChD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,UAAU,iBAAiB,MAAM,CAAC,SAAS,kBAAkB,EAAE,EAAE,EAAE;QAC7G,OAAO,EAAE,sBAAsB,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KAC3D,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC"}
+{"version":3,"file":"agentConfig.js","sourceRoot":"","sources":["../../src/commands/agentConfig.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,KAAK,UAAU,gBAAgB;IAC7B,6EAA6E;IAC7E,4DAA4D;IAC5D,MAAM,MAAM,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO;QACL,GAAG,gBAAgB,CAAC,MAAM,CAAC;QAC3B,cAAc,EAAE,kBAAkB;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,UAAU,iBAAiB,MAAM,CAAC,SAAS,gBAAgB,EAAE;QACpG,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU;IAC7C,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,UAAU,iBAAiB,MAAM,CAAC,SAAS,kBAAkB,EAAE,EAAE,EAAE;QAC1G,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAU;IAChD,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,UAAU,iBAAiB,MAAM,CAAC,SAAS,kBAAkB,EAAE,EAAE,EAAE;QAC7G,OAAO,EAAE,sBAAsB,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KAC3D,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC"}

package/dist/commands/attachment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attachment.d.ts","sourceRoot":"","sources":["../../src/commands/attachment.ts"],"names":[],"mappings":"AAmEA,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,OAAO,CAAC,CA8DlB"}
+{"version":3,"file":"attachment.d.ts","sourceRoot":"","sources":["../../src/commands/attachment.ts"],"names":[],"mappings":"AA2EA,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,OAAO,CAAC,CAiElB"}

package/dist/commands/attachment.js

@@ -27,9 +27,14 @@ const CONTENT_TYPE_BY_EXTENSION = {
     pdf: 'application/pdf',
     html: 'text/html',
     htm: 'text/html',
+    docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+    xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
 };
+const OFFICE_EXTENSIONS = new Set(['docx', 'pptx', 'xlsx']);
+const resolveExtension = (fileName) => fileName.includes('.') ? (fileName.split('.').pop()?.toLowerCase() ?? '') : '';
 const resolveContentType = (fileName) => {
-    const ext = fileName.includes('.') ? (fileName.split('.').pop()?.toLowerCase() ?? '') : '';
+    const ext = resolveExtension(fileName);
     const contentType = CONTENT_TYPE_BY_EXTENSION[ext];
     if (!contentType) {
         throw new Error(`Unsupported attachment type ".${ext}". Allowed: ${Object.keys(CONTENT_TYPE_BY_EXTENSION).join(', ')}`);
@@ -83,9 +88,12 @@ export async function executeAttachmentCommand(apiUrl, headers, action, options)
         }
         const fileName = basename(filePath);
         const contentType = resolveContentType(fileName);
+        if (OFFICE_EXTENSIONS.has(resolveExtension(fileName)) && targetType !== 'document') {
+            throw new Error('Office attachments are supported only with --document-id.');
+        }
         printFileSizeInfo(filePathOption, buffer.length);
         // 1) Presigned draft 업로드 URL 발급
-        const draftResponse = await axios.post(`${apiUrl}/api/attachments/draft-upload-url`, { fileName, contentType, size: buffer.length }, { headers });
+        const draftResponse = await axios.post(`${apiUrl}/api/attachments/draft-upload-url`, { fileName, contentType, size: buffer.length, targetType }, { headers });
         const { uploadUrl, key } = draftResponse.data.data;
         // 2) R2에 파일 바이트 직접 PUT (API 서버를 경유하지 않음)
         await axios.put(uploadUrl, buffer, { headers: { 'Content-Type': contentType } });

package/dist/commands/attachment.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachment.js","sourceRoot":"","sources":["../../src/commands/attachment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,MAAM,wBAAwB,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,aAAa,GAAG,CAAC,KAAc,EAAE,IAAY,EAAE,EAAE;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,KAAc,EAAsB,EAAE;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAA2B;IACxD,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,YAAY;IACjB,EAAE,EAAE,eAAe;IACnB,QAAQ,EAAE,eAAe;IACzB,GAAG,EAAE,iBAAiB;IACtB,IAAI,EAAE,WAAW;IACjB,GAAG,EAAE,WAAW;CACjB,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAU,EAAE;IACtD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,WAAW,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,iCAAiC,GAAG,eAAe,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvG,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,OAAgC,EACkD,EAAE;IACpF,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,kBAAkB,GAAG,cAAc,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG;QACd,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAqB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI;QACnF,kBAAkB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,kBAA2B,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI;QACrG,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;KAC9E,CAAC,MAAM,CAAC,CAAC,MAAM,EAAwC,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAE5E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;AAC5G,CAAC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,OAA+B,EAC/B,MAAc,EACd,OAAgC;IAEhC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,IAAI,GAAG,UAAU;YACrB,CAAC,CAAC,kBAAkB,UAAU,cAAc;YAC5C,CAAC,CAAC,wBAAwB,SAAS,cAAc,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,cAAc,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7D,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,mBAAmB,cAAc,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACjD,iBAAiB,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAEjD,gCAAgC;QAChC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,IAAI,CACpC,GAAG,MAAM,mCAAmC,EAC5C,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,EAC9C,EAAE,OAAO,EAAE,CACZ,CAAC;QACF,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,IAA0C,CAAC;QAEzF,yCAAyC;QACzC,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;QAEjF,sBAAsB;QACtB,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,IAAI,CACrC,GAAG,MAAM,kBAAkB,EAC3B,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,EACrD,EAAE,OAAO,EAAE,CACZ,CAAC;QACF,OAAO,cAAc,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,eAAe,MAAM,iCAAiC;YACpD,sFAAsF,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"attachment.js","sourceRoot":"","sources":["../../src/commands/attachment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,MAAM,wBAAwB,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,aAAa,GAAG,CAAC,KAAc,EAAE,IAAY,EAAE,EAAE;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,KAAc,EAAsB,EAAE;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAA2B;IACxD,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,YAAY;IACjB,EAAE,EAAE,eAAe;IACnB,QAAQ,EAAE,eAAe;IACzB,GAAG,EAAE,iBAAiB;IACtB,IAAI,EAAE,WAAW;IACjB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,yEAAyE;IAC/E,IAAI,EAAE,2EAA2E;IACjF,IAAI,EAAE,mEAAmE;CAC1E,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE5D,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAU,EAAE,CACpD,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAEjF,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAU,EAAE;IACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,iCAAiC,GAAG,eAAe,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvG,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,OAAgC,EACkD,EAAE;IACpF,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,kBAAkB,GAAG,cAAc,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG;QACd,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAqB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI;QACnF,kBAAkB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,kBAA2B,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI;QACrG,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;KAC9E,CAAC,MAAM,CAAC,CAAC,MAAM,EAAwC,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAE5E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;AAC5G,CAAC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,OAA+B,EAC/B,MAAc,EACd,OAAgC;IAEhC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,IAAI,GAAG,UAAU;YACrB,CAAC,CAAC,kBAAkB,UAAU,cAAc;YAC5C,CAAC,CAAC,wBAAwB,SAAS,cAAc,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,cAAc,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7D,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,mBAAmB,cAAc,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,iBAAiB,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAEjD,gCAAgC;QAChC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,IAAI,CACpC,GAAG,MAAM,mCAAmC,EAC5C,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,EAC1D,EAAE,OAAO,EAAE,CACZ,CAAC;QACF,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,IAA0C,CAAC;QAEzF,yCAAyC;QACzC,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;QAEjF,sBAAsB;QACtB,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,IAAI,CACrC,GAAG,MAAM,kBAAkB,EAC3B,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,EACrD,EAAE,OAAO,EAAE,CACZ,CAAC;QACF,OAAO,cAAc,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,eAAe,MAAM,iCAAiC;YACpD,sFAAsF,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;AAC1D,CAAC"}

package/dist/commands/auth.d.ts

@@ -0,0 +1,97 @@
+/**
+ * `agentteams auth login | status | logout`.
+ *
+ * The default authentication path for new projects and the migration path for
+ * legacy configs. The stored credential is picked up by `resolveCredential()`
+ * when the config has no `key_`, or when a migrated legacy project carries
+ * `authMode: 'personal-token'`.
+ */
+import type { CredentialBackendId, CredentialStoreReason } from '../auth/credentialStore.js';
+import type { Config } from '../types/index.js';
+import { type CredentialSource } from '../utils/config.js';
+export type AuthLoginResult = {
+    success: true;
+    authUrl: string;
+    apiUrl: string;
+    identity: {
+        memberId: string;
+        email: string;
+        nickname: string;
+    };
+    /**
+     * Always true on success: a login that could not be persisted is rejected and
+     * revoked inside `exchangeAuthorizationCode` rather than reported as a
+     * half-login. The field stays in the payload because scripts read it.
+     */
+    persisted: boolean;
+    /** Which OS store holds the credential — the same vocabulary as `auth status`. */
+    storeBackend: CredentialBackendId;
+    storeReason: CredentialStoreReason;
+    configPath: string | null;
+    authMode: 'personal-token';
+    warning?: string;
+};
+export type AuthStatusResult = {
+    apiUrl: string;
+    configPath: string | null;
+    /** Which credential the next command would authenticate with. */
+    credentialSource: CredentialSource | null;
+    authMode: Config['authMode'] | null;
+    hasProjectApiKey: boolean;
+    personalToken: {
+        connected: boolean;
+        persisted: boolean;
+        storeBackend: CredentialBackendId;
+        storeReason: CredentialStoreReason;
+        reconnectRequired: boolean;
+        identity: {
+            memberId: string;
+            email: string;
+            nickname: string;
+        } | null;
+        expiresAt: string | null;
+    };
+    problem?: string;
+};
+export type AuthLogoutResult = {
+    success: true;
+    apiUrl: string;
+    configPath: string | null;
+    /** false → the token is still live server-side (`--local`, or nothing was stored). */
+    revokedOnServer: boolean;
+    /** true when the project reverted to an `agentteams init` API key that is still on disk. */
+    fellBackToApiKey: boolean;
+    warning?: string;
+};
+/**
+ * Where to log in. Unlike the legacy `init` path this honours the project's own
+ * `apiUrl`, because a refresh token issued by the dev API is worthless against
+ * production and storing it under the wrong server would silently fail later.
+ */
+export declare function resolveAuthApiUrl(options?: {
+    apiUrl?: string;
+}): string;
+export declare function buildPersonalTokenAuthorizeUrl(input: {
+    port: number;
+    state: string;
+    codeChallenge: string;
+    projectName?: string;
+}): string;
+/**
+ * Run the browser round trip and exchange the resulting code for tokens.
+ *
+ * Exported so `init --auth personal-token` reuses the identical flow rather than
+ * growing a second copy of the PKCE handshake.
+ */
+export declare function performPersonalTokenLogin(input: {
+    apiUrl: string;
+    projectName?: string;
+}): Promise<{
+    authUrl: string;
+    identity: AuthLoginResult['identity'];
+    persisted: boolean;
+    storeBackend: CredentialBackendId;
+    storeReason: CredentialStoreReason;
+}>;
+export declare function executeAuthCommand(action: string, options?: Record<string, unknown>): Promise<unknown>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/commands/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAE7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAML,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAM5B,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,IAAI,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,mBAAmB,CAAC;IAClC,WAAW,EAAE,qBAAqB,CAAC;IACnC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACpC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,aAAa,EAAE;QACb,SAAS,EAAE,OAAO,CAAC;QACnB,SAAS,EAAE,OAAO,CAAC;QACnB,YAAY,EAAE,mBAAmB,CAAC;QAClC,WAAW,EAAE,qBAAqB,CAAC;QACnC,iBAAiB,EAAE,OAAO,CAAC;QAC3B,QAAQ,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;QACvE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sFAAsF;IACtF,eAAe,EAAE,OAAO,CAAC;IACzB,4FAA4F;IAC5F,gBAAgB,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAOvE;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAUT;AAuBD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC;IACxG,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,mBAAmB,CAAC;IAClC,WAAW,EAAE,qBAAqB,CAAC;CACpC,CAAC,CA0CD;AAmJD,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAahH"}