@archastro/intern 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ArchAstro Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,67 @@
+# Intern CLI
+
+`intern` gives coding agents and people direct access to TryIntern's hosted
+tools, without requiring MCP support in the coding agent. It talks directly to
+`https://tryintern.dev/mcp`.
+
+## Install
+
+```sh
+npm install --global --@archastro:registry=https://registry.npmjs.org @archastro/intern
+intern login
+```
+
+Login opens TryIntern in your browser and stores the resulting OAuth refresh
+session in `~/.config/intern/credentials.json` with mode `0600`.
+
+## Publish a site
+
+Point `publish` at a deploy-ready static directory. New slugs are created and
+published in one call. Existing slugs are updated against their exact current
+revision, uploading changed files and deleting files absent from the directory.
+
+```sh
+intern publish ./dist --site launch-room
+```
+
+Sites stay private unless visibility is changed explicitly:
+
+```sh
+intern visibility launch-room public
+intern invite launch-room teammate@example.com
+```
+
+`.git`, `.intern`, `node_modules`, local environment files, private keys, and
+symlinks are not published. Source limits are checked before any remote write.
+
+## Use from a coding agent
+
+All output is JSON. The live remote MCP schemas are authoritative:
+
+```sh
+intern tools
+intern call intern_auth_status '{}'
+intern call intern_create_site --input-file request.json
+printf '%s' '{"site":"launch-room"}' | intern call intern_get_site_source
+```
+
+`intern call` exposes every hosted tool, including tools added after this CLI
+was installed. `intern resources` and `intern read` expose the MCP resource
+surface as well.
+
+Common shortcuts:
+
+```text
+intern status
+intern sites
+intern source SITE
+intern plugins [SITE]
+intern guide
+intern fetch URL
+intern guests SITE
+intern revoke SITE GRANT_ID
+intern delete SITE --yes
+```
+
+Use `INTERN_ACCESS_TOKEN` for an ephemeral bearer override. Development and
+self-hosted tests can set `INTERN_BASE_URL` or pass `--origin`.

package/dist/args.d.ts

@@ -0,0 +1,10 @@
+export interface ParsedArguments {
+    command: string;
+    positionals: string[];
+    options: Map<string, string[]>;
+}
+export declare function parseArguments(argv: string[]): ParsedArguments;
+export declare function option(args: ParsedArguments, name: string): string | undefined;
+export declare function options(args: ParsedArguments, name: string): string[];
+export declare function flag(args: ParsedArguments, name: string): boolean;
+export declare function parseToolInput(args: ParsedArguments): Promise<Record<string, unknown>>;

package/dist/args.js

@@ -0,0 +1,101 @@
+import fs from "node:fs/promises";
+import { InternError } from "./errors.js";
+const valueOptions = new Set([
+    "origin",
+    "input",
+    "input-file",
+    "site",
+    "message",
+    "plugin",
+]);
+const booleanOptions = new Set([
+    "compact",
+    "no-open",
+    "yes",
+    "help",
+    "version",
+]);
+export function parseArguments(argv) {
+    const positionals = [];
+    const options = new Map();
+    let optionsEnded = false;
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (!optionsEnded && argument === "--") {
+            optionsEnded = true;
+            continue;
+        }
+        if (!optionsEnded && argument.startsWith("--")) {
+            const equal = argument.indexOf("=");
+            const name = argument.slice(2, equal === -1 ? undefined : equal);
+            if (!valueOptions.has(name) && !booleanOptions.has(name)) {
+                throw new InternError("usage", `Unknown option --${name}`);
+            }
+            if (booleanOptions.has(name)) {
+                if (equal !== -1)
+                    throw new InternError("usage", `--${name} does not take a value`);
+                append(options, name, "true");
+                continue;
+            }
+            const value = equal === -1 ? argv[++index] : argument.slice(equal + 1);
+            if (value === undefined)
+                throw new InternError("usage", `--${name} requires a value`);
+            append(options, name, value);
+            continue;
+        }
+        positionals.push(argument);
+    }
+    return {
+        command: positionals.shift() ?? "help",
+        positionals,
+        options,
+    };
+}
+export function option(args, name) {
+    return args.options.get(name)?.at(-1);
+}
+export function options(args, name) {
+    return args.options.get(name) ?? [];
+}
+export function flag(args, name) {
+    return args.options.has(name);
+}
+export async function parseToolInput(args) {
+    const inline = option(args, "input") ?? args.positionals[1];
+    const inputFile = option(args, "input-file");
+    if (inline !== undefined && inputFile !== undefined) {
+        throw new InternError("usage", "Use only one of inline JSON and --input-file");
+    }
+    let raw;
+    if (inline !== undefined)
+        raw = inline;
+    else if (inputFile !== undefined)
+        raw =
+            inputFile === "-"
+                ? await readStdin()
+                : await fs.readFile(inputFile, "utf8");
+    else if (!process.stdin.isTTY)
+        raw = await readStdin();
+    if (raw === undefined || !raw.trim())
+        return {};
+    try {
+        const value = JSON.parse(raw);
+        if (typeof value !== "object" || value === null || Array.isArray(value)) {
+            throw new Error("not an object");
+        }
+        return value;
+    }
+    catch {
+        throw new InternError("invalid_json", "Tool input must be a JSON object");
+    }
+}
+function append(map, name, value) {
+    map.set(name, [...(map.get(name) ?? []), value]);
+}
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks).toString("utf8");
+}
+//# sourceMappingURL=args.js.map

package/dist/args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAQ1C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,QAAQ;IACR,OAAO;IACP,YAAY;IACZ,MAAM;IACN,SAAS;IACT,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,SAAS;IACT,SAAS;IACT,KAAK;IACL,MAAM;IACN,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,IAAc;IAC3C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACvC,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,WAAW,CAAC,OAAO,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,IAAI,KAAK,KAAK,CAAC,CAAC;oBACd,MAAM,IAAI,WAAW,CAAC,OAAO,EAAE,KAAK,IAAI,wBAAwB,CAAC,CAAC;gBACpE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC9B,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACvE,IAAI,KAAK,KAAK,SAAS;gBACrB,MAAM,IAAI,WAAW,CAAC,OAAO,EAAE,KAAK,IAAI,mBAAmB,CAAC,CAAC;YAC/D,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO;QACL,OAAO,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,MAAM;QACtC,WAAW;QACX,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,MAAM,CACpB,IAAqB,EACrB,IAAY;IAEZ,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAqB,EAAE,IAAY;IACzD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAqB,EAAE,IAAY;IACtD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAqB;IAErB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,WAAW,CACnB,OAAO,EACP,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,GAAuB,CAAC;IAC5B,IAAI,MAAM,KAAK,SAAS;QAAE,GAAG,GAAG,MAAM,CAAC;SAClC,IAAI,SAAS,KAAK,SAAS;QAC9B,GAAG;YACD,SAAS,KAAK,GAAG;gBACf,CAAC,CAAC,MAAM,SAAS,EAAE;gBACnB,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;SACxC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IACvD,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,KAAgC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,kCAAkC,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,GAA0B,EAAE,IAAY,EAAE,KAAa;IACrE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,11 @@
+export declare const DEFAULT_INTERN_ORIGIN = "https://tryintern.dev";
+export declare const OAUTH_SCOPES: readonly ["profile", "offline_access", "sites:read", "sites:write", "entitlements:read"];
+export interface InternConfig {
+    origin: string;
+    resource: string;
+    configRoot: string;
+    accessToken?: string;
+}
+export declare function loadConfig(overrides?: {
+    origin?: string;
+}): InternConfig;

package/dist/config.js

@@ -0,0 +1,42 @@
+import os from "node:os";
+import path from "node:path";
+export const DEFAULT_INTERN_ORIGIN = "https://tryintern.dev";
+export const OAUTH_SCOPES = [
+    "profile",
+    "offline_access",
+    "sites:read",
+    "sites:write",
+    "entitlements:read",
+];
+export function loadConfig(overrides = {}) {
+    const rawOrigin = overrides.origin ?? process.env.INTERN_BASE_URL ?? DEFAULT_INTERN_ORIGIN;
+    const origin = normalizeOrigin(rawOrigin);
+    return {
+        origin,
+        resource: new URL("/mcp", origin).toString(),
+        configRoot: process.env.INTERN_CONFIG_DIR ??
+            path.join(process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), ".config"), "intern"),
+        accessToken: process.env.INTERN_ACCESS_TOKEN?.trim() || undefined,
+    };
+}
+function normalizeOrigin(value) {
+    const url = new URL(value);
+    if (url.username ||
+        url.password ||
+        url.pathname !== "/" ||
+        url.search ||
+        url.hash) {
+        throw new Error("Intern origin must contain only a scheme, host, and optional port");
+    }
+    if (url.protocol !== "https:" && !isLoopback(url)) {
+        throw new Error("Intern origin must use HTTPS unless it is a loopback test server");
+    }
+    return url.origin;
+}
+function isLoopback(url) {
+    return (url.protocol === "http:" &&
+        (url.hostname === "127.0.0.1" ||
+            url.hostname === "[::1]" ||
+            url.hostname === "localhost"));
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAC7D,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS;IACT,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,mBAAmB;CACX,CAAC;AASX,MAAM,UAAU,UAAU,CAAC,YAAiC,EAAE;IAC5D,MAAM,SAAS,GACb,SAAS,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,qBAAqB,CAAC;IAC3E,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE;QAC5C,UAAU,EACR,OAAO,CAAC,GAAG,CAAC,iBAAiB;YAC7B,IAAI,CAAC,IAAI,CACP,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EACjE,QAAQ,CACT;QACH,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,SAAS;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IACE,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI,EACR,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,GAAQ;IAC1B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW;YAC3B,GAAG,CAAC,QAAQ,KAAK,OAAO;YACxB,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,CAChC,CAAC;AACJ,CAAC"}

package/dist/credentials.d.ts

@@ -0,0 +1,33 @@
+import type { InternConfig } from "./config.js";
+export interface OAuthTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresAtMs: number;
+    scope: string;
+}
+export interface CredentialRecord {
+    version: 1;
+    issuer: string;
+    resource: string;
+    clientId: string;
+    tokenEndpoint: string;
+    tokens: OAuthTokens;
+}
+export declare class CredentialStore {
+    private readonly config;
+    constructor(config: InternConfig);
+    read(): Promise<CredentialRecord | null>;
+    write(record: CredentialRecord): Promise<void>;
+    remove(): Promise<boolean>;
+    private file;
+}
+export declare class Credentials {
+    private readonly config;
+    private readonly fetchFn;
+    private readonly store;
+    constructor(config: InternConfig, fetchFn?: typeof fetch);
+    accessToken(forceRefresh?: boolean): Promise<string>;
+    save(record: CredentialRecord): Promise<void>;
+    logout(): Promise<boolean>;
+}
+export declare function parseTokens(value: unknown): OAuthTokens;

package/dist/credentials.js

@@ -0,0 +1,179 @@
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { InternError } from "./errors.js";
+const refreshWindowMs = 60_000;
+export class CredentialStore {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    async read() {
+        let parsed;
+        try {
+            parsed = JSON.parse(await fs.readFile(this.file(), "utf8"));
+        }
+        catch (error) {
+            if (hasCode(error, "ENOENT"))
+                return null;
+            throw new InternError("credentials_invalid", "Stored Intern credentials are unreadable; run `intern login` again");
+        }
+        const record = parseRecord(parsed);
+        if (!record ||
+            record.issuer !== this.config.origin ||
+            record.resource !== this.config.resource ||
+            !isIssuerEndpoint(record.tokenEndpoint, record.issuer)) {
+            throw new InternError("credentials_invalid", "Stored Intern credentials do not belong to this Intern origin; run `intern login` again");
+        }
+        return record;
+    }
+    async write(record) {
+        if (!parseRecord(record) ||
+            record.issuer !== this.config.origin ||
+            record.resource !== this.config.resource ||
+            !isIssuerEndpoint(record.tokenEndpoint, record.issuer)) {
+            throw new Error("Refusing to store invalid Intern credentials");
+        }
+        await fs.mkdir(this.config.configRoot, { recursive: true, mode: 0o700 });
+        await fs.chmod(this.config.configRoot, 0o700);
+        const temporary = path.join(this.config.configRoot, `.credentials.${process.pid}.${randomUUID()}`);
+        try {
+            await fs.writeFile(temporary, `${JSON.stringify(record, null, 2)}\n`, {
+                flag: "wx",
+                mode: 0o600,
+            });
+            await fs.chmod(temporary, 0o600);
+            await fs.rename(temporary, this.file());
+        }
+        catch (error) {
+            await fs.rm(temporary, { force: true }).catch(() => { });
+            throw error;
+        }
+    }
+    async remove() {
+        try {
+            await fs.rm(this.file());
+            return true;
+        }
+        catch (error) {
+            if (hasCode(error, "ENOENT"))
+                return false;
+            throw error;
+        }
+    }
+    file() {
+        return path.join(this.config.configRoot, "credentials.json");
+    }
+}
+export class Credentials {
+    config;
+    fetchFn;
+    store;
+    constructor(config, fetchFn = fetch) {
+        this.config = config;
+        this.fetchFn = fetchFn;
+        this.store = new CredentialStore(config);
+    }
+    async accessToken(forceRefresh = false) {
+        if (this.config.accessToken)
+            return this.config.accessToken;
+        const record = await this.store.read();
+        if (!record) {
+            throw new InternError("auth_required", "Intern is not connected; run `intern login`");
+        }
+        if (!forceRefresh &&
+            record.tokens.expiresAtMs > Date.now() + refreshWindowMs) {
+            return record.tokens.accessToken;
+        }
+        const response = await this.fetchFn(record.tokenEndpoint, {
+            method: "POST",
+            redirect: "error",
+            signal: AbortSignal.timeout(30_000),
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "refresh_token",
+                client_id: record.clientId,
+                refresh_token: record.tokens.refreshToken,
+            }),
+        });
+        const body = await responseJSON(response);
+        if (!response.ok) {
+            throw new InternError("auth_required", `Intern session refresh failed; run \`intern login\` again (${oauthError(body, response.status)})`);
+        }
+        const tokens = parseTokens(body);
+        const updated = { ...record, tokens };
+        await this.store.write(updated);
+        return tokens.accessToken;
+    }
+    save(record) {
+        return this.store.write(record);
+    }
+    logout() {
+        return this.store.remove();
+    }
+}
+export function parseTokens(value) {
+    if (!isRecord(value))
+        throw new InternError("oauth_invalid_response", "OAuth server returned invalid JSON");
+    const accessToken = value.access_token;
+    const refreshToken = value.refresh_token;
+    const expiresIn = value.expires_in;
+    const scope = value.scope;
+    if (typeof accessToken !== "string" ||
+        !accessToken ||
+        typeof refreshToken !== "string" ||
+        !refreshToken ||
+        typeof expiresIn !== "number" ||
+        !Number.isFinite(expiresIn) ||
+        expiresIn <= 0 ||
+        typeof scope !== "string") {
+        throw new InternError("oauth_invalid_response", "OAuth server returned incomplete credentials");
+    }
+    return {
+        accessToken,
+        refreshToken,
+        expiresAtMs: Date.now() + expiresIn * 1_000,
+        scope,
+    };
+}
+function parseRecord(value) {
+    if (!isRecord(value) || value.version !== 1 || !isRecord(value.tokens))
+        return null;
+    if (typeof value.issuer !== "string" ||
+        typeof value.resource !== "string" ||
+        typeof value.clientId !== "string" ||
+        typeof value.tokenEndpoint !== "string" ||
+        typeof value.tokens.accessToken !== "string" ||
+        typeof value.tokens.refreshToken !== "string" ||
+        typeof value.tokens.expiresAtMs !== "number" ||
+        typeof value.tokens.scope !== "string")
+        return null;
+    return value;
+}
+function oauthError(value, status) {
+    return isRecord(value) && typeof value.error === "string"
+        ? value.error
+        : `HTTP ${status}`;
+}
+async function responseJSON(response) {
+    return response.json().catch(() => null);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isIssuerEndpoint(value, issuer) {
+    try {
+        const url = new URL(value);
+        return url.origin === issuer && !url.username && !url.password;
+    }
+    catch {
+        return false;
+    }
+}
+function hasCode(error, code) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === code);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAkB1C,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAErD,KAAK,CAAC,IAAI;QACR,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1C,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,oEAAoE,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,IACE,CAAC,MAAM;YACP,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM;YACpC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ;YACxC,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EACtD,CAAC;YACD,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAwB;QAClC,IACE,CAAC,WAAW,CAAC,MAAM,CAAC;YACpB,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM;YACpC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ;YACxC,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EACtD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,gBAAgB,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,EAAE,CAC9C,CAAC;QACF,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBACpE,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACjC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,IAAI;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAIH;IACA;IAJF,KAAK,CAAkB;IAExC,YACmB,MAAoB,EACpB,UAAwB,KAAK;QAD7B,WAAM,GAAN,MAAM,CAAc;QACpB,YAAO,GAAP,OAAO,CAAsB;QAE9C,IAAI,CAAC,KAAK,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,YAAY,GAAG,KAAK;QACpC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CACnB,eAAe,EACf,6CAA6C,CAC9C,CAAC;QACJ,CAAC;QACD,IACE,CAAC,YAAY;YACb,MAAM,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,EACxD,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QACnC,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACnC,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY;aAC1C,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,WAAW,CACnB,eAAe,EACf,8DAA8D,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CACnG,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,IAAI,CAAC,MAAwB;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClB,MAAM,IAAI,WAAW,CACnB,wBAAwB,EACxB,oCAAoC,CACrC,CAAC;IACJ,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC;IACvC,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,CAAC;IACzC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,IACE,OAAO,WAAW,KAAK,QAAQ;QAC/B,CAAC,WAAW;QACZ,OAAO,YAAY,KAAK,QAAQ;QAChC,CAAC,YAAY;QACb,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,SAAS,IAAI,CAAC;QACd,OAAO,KAAK,KAAK,QAAQ,EACzB,CAAC;QACD,MAAM,IAAI,WAAW,CACnB,wBAAwB,EACxB,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,WAAW;QACX,YAAY;QACZ,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK;QAC3C,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,IACE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,OAAO,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ;QAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,YAAY,KAAK,QAAQ;QAC7C,OAAO,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ;QAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;QAEtC,OAAO,IAAI,CAAC;IACd,OAAO,KAAoC,CAAC;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,MAAc;IAChD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QACvD,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,MAAc;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY;IAC3C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACf,KAAK,CAAC,IAAI,KAAK,IAAI,CACpB,CAAC;AACJ,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,6 @@
+export declare class InternError extends Error {
+    readonly code: string;
+    readonly details?: unknown | undefined;
+    constructor(code: string, message: string, details?: unknown | undefined);
+}
+export declare function errorMessage(error: unknown): string;

package/dist/errors.js

@@ -0,0 +1,14 @@
+export class InternError extends Error {
+    code;
+    details;
+    constructor(code, message, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = "InternError";
+    }
+}
+export function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,WAAY,SAAQ,KAAK;IAEzB;IAEA;IAHX,YACW,IAAY,EACrB,OAAe,EACN,OAAiB;QAE1B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAAU;QAG1B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export declare function run(argv: string[]): Promise<number>;