@davidwoods/skylight-mcp 0.0.0-stage → 1.7.0

package/dist/api/client.js

@@ -0,0 +1,324 @@
+import { getConfig, usesEmailAuth } from "../config.js";
+import { detectSubscriptionStatus, login } from "./auth.js";
+import { SKYLIGHT_API_VERSION, SKYLIGHT_BASE_URL } from "./constants.js";
+import { CredentialStoreError } from "./credential-types.js";
+import { currentContext } from "../context.js";
+import { OAuthError, isExpired, refreshCredential } from "./oauth.js";
+import { AuthenticationError, NotFoundError, RateLimitError, SkylightError, } from "../utils/errors.js";
+/**
+ * Skylight API Client
+ * Handles authentication and HTTP requests to the Skylight API
+ */
+export class SkylightClient {
+    config;
+    resolvedToken = null;
+    loginPromise = null;
+    subscriptionStatus = null;
+    store;
+    stored = null;
+    storedLoaded = false;
+    refreshPromise = null;
+    /**
+     * @param store Where the OAuth credential lives. `null` means "no stored
+     * credential is available" (hosted mode, where the token arrives in config).
+     */
+    constructor(config, store = null) {
+        this.config = config ?? getConfig();
+        this.store = store;
+    }
+    getStore() {
+        if (!this.store) {
+            throw new AuthenticationError("No credential store is configured for this server.");
+        }
+        return this.store;
+    }
+    /** Load the stored OAuth credential once. Fails closed if the store is unusable. */
+    async loadStored() {
+        if (this.storedLoaded)
+            return this.stored;
+        try {
+            this.stored = await this.getStore().read();
+        }
+        catch (error) {
+            if (error instanceof CredentialStoreError)
+                throw new AuthenticationError(error.message);
+            throw error;
+        }
+        this.storedLoaded = true;
+        if (this.stored) {
+            this.subscriptionStatus = (await detectSubscriptionStatus(this.stored.accessToken));
+        }
+        return this.stored;
+    }
+    /**
+     * Refresh tokens rotate on use, so concurrent refreshes would invalidate each
+     * other. Share one in-flight promise, and re-read the store first in case
+     * another process already rotated the credential.
+     */
+    refreshStored() {
+        if (!this.refreshPromise) {
+            const current = this.stored;
+            if (!current)
+                throw new AuthenticationError("Not signed in. Run `skylight-mcp auth login`.");
+            this.refreshPromise = (async () => {
+                const latest = (await this.getStore().read().catch(() => null)) ?? current;
+                if (!isExpired(latest) && latest.accessToken !== current.accessToken) {
+                    this.stored = latest;
+                    return latest;
+                }
+                let next;
+                try {
+                    next = await refreshCredential(latest);
+                }
+                catch (error) {
+                    if (error instanceof OAuthError) {
+                        throw new AuthenticationError(`${error.message} Run \`skylight-mcp auth login\` again.`);
+                    }
+                    throw error;
+                }
+                this.stored = next;
+                try {
+                    await this.getStore().write(next);
+                }
+                catch (error) {
+                    // The rotated refresh token is only in memory now; this session keeps working.
+                    console.error(`[client] Could not save refreshed credential: ${error.message}`);
+                }
+                return next;
+            })().finally(() => {
+                this.refreshPromise = null;
+            });
+        }
+        return this.refreshPromise;
+    }
+    /**
+     * Get the authentication credentials
+     * If using email/password auth, will login first
+     */
+    async getCredentials() {
+        // 1. Explicit token from the environment
+        if (this.config.token) {
+            return { token: this.config.token };
+        }
+        // 2. Stored OAuth credential (refreshed when expired)
+        const stored = this.store ? await this.loadStored() : null;
+        if (stored) {
+            const fresh = isExpired(this.stored ?? stored) ? await this.refreshStored() : (this.stored ?? stored);
+            return { token: fresh.accessToken };
+        }
+        // 3. Deprecated email/password login
+        if (!usesEmailAuth(this.config)) {
+            throw new AuthenticationError("Not signed in to Skylight. Run `skylight-mcp auth login`, then restart your MCP client.");
+        }
+        if (this.resolvedToken) {
+            return { token: this.resolvedToken };
+        }
+        // If already logging in, wait for that to complete
+        if (this.loginPromise) {
+            return this.loginPromise;
+        }
+        // Login with email/password
+        this.loginPromise = this.performLogin();
+        try {
+            const result = await this.loginPromise;
+            this.resolvedToken = result.token;
+            return result;
+        }
+        finally {
+            this.loginPromise = null;
+        }
+    }
+    /**
+     * Perform login and return token and userId
+     */
+    async performLogin() {
+        const { email, password } = this.config;
+        if (!email || !password) {
+            throw new AuthenticationError("Email and password are required for login");
+        }
+        console.error("Logging in to Skylight...");
+        const result = await login(email, password);
+        this.subscriptionStatus = result.subscriptionStatus;
+        console.error(`Logged in as ${result.email}${result.subscriptionStatus ? ` (${result.subscriptionStatus})` : ""}`);
+        return { token: result.token };
+    }
+    /**
+     * Build the Authorization header
+     * Email/password auth now resolves to an OAuth bearer token.
+     * Manual token auth still respects the configured auth type.
+     */
+    async getAuthHeader() {
+        const { token } = await this.getCredentials();
+        // Only an explicit manual token may use Basic; everything else is a bearer token.
+        if (this.config.token && this.config.authType === "basic") {
+            return `Basic ${token}`;
+        }
+        return `Bearer ${token}`;
+    }
+    /**
+     * Build URL with query parameters
+     */
+    buildUrl(endpoint, params) {
+        const url = new URL(endpoint, SKYLIGHT_BASE_URL);
+        // Pin the host: an absolute or protocol-relative endpoint must never
+        // redirect the bearer token to another origin.
+        if (url.origin !== new URL(SKYLIGHT_BASE_URL).origin) {
+            throw new SkylightError("Refusing to send a request outside the Skylight API host.", "HOST_NOT_ALLOWED");
+        }
+        if (params) {
+            for (const [key, value] of Object.entries(params)) {
+                if (value !== undefined) {
+                    url.searchParams.set(key, String(value));
+                }
+            }
+        }
+        return url.toString();
+    }
+    /**
+     * Handle API response errors
+     */
+    async handleResponseError(response, url) {
+        const status = response.status;
+        if (status === 401) {
+            // Clear cached credentials on auth failure
+            this.resolvedToken = null;
+            console.error(`[client] 401 Unauthorized for ${url}`);
+            if (!this.config.token) {
+                throw new AuthenticationError("API request returned 401. Your frame ID may be wrong or not belong to this account " +
+                    "(check SKYLIGHT_FRAME_ID), or your session may have been revoked " +
+                    "(run `skylight-mcp auth login` again).");
+            }
+            throw new AuthenticationError();
+        }
+        if (status === 404) {
+            throw new NotFoundError("Resource");
+        }
+        if (status === 429) {
+            const retryAfter = response.headers.get("Retry-After");
+            throw new RateLimitError(retryAfter ? parseInt(retryAfter, 10) : undefined);
+        }
+        // Try to get error details from response
+        let errorMessage = `HTTP ${status}`;
+        try {
+            const errorBody = await response.text();
+            if (errorBody) {
+                errorMessage += `: ${errorBody.slice(0, 200)}`;
+            }
+        }
+        catch {
+            // Ignore parse errors
+        }
+        throw new SkylightError(errorMessage, "HTTP_ERROR", status, status >= 500);
+    }
+    /**
+     * Make an authenticated request to the Skylight API
+     */
+    async request(endpoint, options = {}, isRetry = false) {
+        const { method = "GET", params, body, apiVersion } = options;
+        // Replace {frameId} placeholder with actual frame ID
+        const resolvedEndpoint = endpoint.replace("{frameId}", this.config.frameId);
+        const url = this.buildUrl(resolvedEndpoint, params);
+        console.error(`[client] ${method} ${url}`);
+        const headers = {
+            Authorization: await this.getAuthHeader(),
+            Accept: "application/json",
+            "User-Agent": "SkylightMobile (web)",
+            "Skylight-Api-Version": apiVersion ?? SKYLIGHT_API_VERSION,
+        };
+        if (body) {
+            headers["Content-Type"] = "application/json";
+        }
+        const response = await fetch(url, {
+            method,
+            headers,
+            body: body ? JSON.stringify(body) : undefined,
+        });
+        console.error(`[client] Response: ${response.status}`);
+        if (!response.ok) {
+            // Retry once on 401 with a fresh credential (not for an explicit token)
+            if (response.status === 401 && !this.config.token && !isRetry) {
+                console.error("[client] Got 401, refreshing credentials...");
+                this.resolvedToken = null;
+                if (this.stored)
+                    this.stored = { ...this.stored, expiresAt: 0 };
+                return this.request(endpoint, options, true);
+            }
+            await this.handleResponseError(response, url);
+        }
+        // Handle 304 Not Modified
+        if (response.status === 304) {
+            return {};
+        }
+        // Some writes (a message delete) answer 200/204 with no body.
+        if (response.status === 204)
+            return {};
+        const raw = await response.text();
+        if (raw.trim() === "")
+            return {};
+        return JSON.parse(raw);
+    }
+    /**
+     * GET request helper
+     */
+    async get(endpoint, params) {
+        return this.request(endpoint, { method: "GET", params });
+    }
+    /**
+     * POST request helper
+     */
+    async post(endpoint, body) {
+        return this.request(endpoint, { method: "POST", body });
+    }
+    /**
+     * Get the frame ID from config
+     */
+    get frameId() {
+        return this.config.frameId;
+    }
+    /**
+     * Get the timezone from config
+     */
+    get timezone() {
+        return this.config.timezone;
+    }
+    /**
+     * Check if user has Plus subscription
+     */
+    hasPlus() {
+        return this.subscriptionStatus === "plus";
+    }
+    /**
+     * Get the subscription status
+     */
+    getSubscriptionStatus() {
+        return this.subscriptionStatus;
+    }
+    /**
+     * Initialize the client (triggers login if using email/password auth)
+     */
+    async initialize() {
+        await this.getCredentials();
+    }
+}
+// Process-wide instance for the single-user stdio server. A hosted server
+// sets a per-request client via runWithContext() instead.
+let clientInstance = null;
+export function getClient() {
+    const context = currentContext();
+    if (context)
+        return context.client;
+    if (!clientInstance) {
+        throw new AuthenticationError("Skylight client has not been initialized.");
+    }
+    return clientInstance;
+}
+/**
+ * Initialize the process-wide client and return it.
+ * Resolves credentials (and logs in, for the deprecated email/password path).
+ */
+export async function initializeClient(config, store = null) {
+    clientInstance = new SkylightClient(config, store);
+    await clientInstance.initialize();
+    return clientInstance;
+}
+//# sourceMappingURL=client.js.map

package/dist/api/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAe,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAwB,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,EAAyB,MAAM,YAAY,CAAC;AAC7F,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,cAAc,EACd,aAAa,GACd,MAAM,oBAAoB,CAAC;AAe5B;;;GAGG;AACH,MAAM,OAAO,cAAc;IACjB,MAAM,CAAS;IACf,aAAa,GAAkB,IAAI,CAAC;IACpC,YAAY,GAAsC,IAAI,CAAC;IACvD,kBAAkB,GAAuB,IAAI,CAAC;IAC9C,KAAK,CAAyB;IAC9B,MAAM,GAA4B,IAAI,CAAC;IACvC,YAAY,GAAG,KAAK,CAAC;IACrB,cAAc,GAAqC,IAAI,CAAC;IAEhE;;;OAGG;IACH,YAAY,MAAe,EAAE,QAAgC,IAAI;QAC/D,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAEO,QAAQ;QACd,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,mBAAmB,CAAC,oDAAoD,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,oFAAoF;IAC5E,KAAK,CAAC,UAAU;QACtB,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QAC1C,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,oBAAoB;gBAAE,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxF,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,kBAAkB,GAAG,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAuB,CAAC;QAC5G,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACK,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,+CAA+C,CAAC,CAAC;YAC7F,IAAI,CAAC,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;gBAChC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC;gBAC3E,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;oBACrE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;oBACrB,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,IAAI,IAAsB,CAAC;gBAC3B,IAAI,CAAC;oBACH,IAAI,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACzC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;wBAChC,MAAM,IAAI,mBAAmB,CAAC,GAAG,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;oBAC3F,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACpC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,+EAA+E;oBAC/E,OAAO,CAAC,KAAK,CAAC,iDAAkD,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7F,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAChB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc;QAC1B,yCAAyC;QACzC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAED,sDAAsD;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;YACtG,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QACtC,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,mBAAmB,CAC3B,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,CAAC;QAED,mDAAmD;QACnD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACvC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;YAClC,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY;QACxB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACxC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,mBAAmB,CAAC,2CAA2C,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAwC,CAAC;QAC1E,OAAO,CAAC,KAAK,CAAC,gBAAgB,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnH,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,aAAa;QACzB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE9C,kFAAkF;QAClF,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC1D,OAAO,SAAS,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,UAAU,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,QAAQ,CAAC,QAAgB,EAAE,MAA8D;QAC/F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAEjD,qEAAqE;QACrE,+CAA+C;QAC/C,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC;YACrD,MAAM,IAAI,aAAa,CAAC,2DAA2D,EAAE,kBAAkB,CAAC,CAAC;QAC3G,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB,CAAC,QAAkB,EAAE,GAAW;QAC/D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAE/B,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,2CAA2C;YAC3C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,OAAO,CAAC,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;YAEtD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACvB,MAAM,IAAI,mBAAmB,CAC3B,qFAAqF;oBACnF,mEAAmE;oBACnE,wCAAwC,CAC3C,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAClC,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACvD,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9E,CAAC;QAED,yCAAyC;QACzC,IAAI,YAAY,GAAG,QAAQ,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,SAAS,EAAE,CAAC;gBACd,YAAY,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACjD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;QAED,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAI,QAAgB,EAAE,UAA0B,EAAE,EAAE,OAAO,GAAG,KAAK;QAC9E,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAE7D,qDAAqD;QACrD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAEpD,OAAO,CAAC,KAAK,CAAC,YAAY,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAE3C,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,MAAM,IAAI,CAAC,aAAa,EAAE;YACzC,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,sBAAsB;YACpC,sBAAsB,EAAE,UAAU,IAAI,oBAAoB;SAC3D,CAAC;QAEF,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,OAAO,CAAC,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAEvD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,wEAAwE;YACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9D,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBAC7D,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC1B,IAAI,IAAI,CAAC,MAAM;oBAAE,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;gBAChE,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,0BAA0B;QAC1B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,EAAO,CAAC;QACjB,CAAC;QAED,8DAA8D;QAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAO,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAO,CAAC;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CAAI,QAAgB,EAAE,MAA8D;QAC3F,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAI,QAAgB,EAAE,IAAa;QAC3C,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,kBAAkB,KAAK,MAAM,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IAC9B,CAAC;CACF;AAED,0EAA0E;AAC1E,0DAA0D;AAC1D,IAAI,cAAc,GAA0B,IAAI,CAAC;AAEjD,MAAM,UAAU,SAAS;IACvB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IACnC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,mBAAmB,CAAC,2CAA2C,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAe,EAAE,QAAgC,IAAI;IAC1F,cAAc,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,cAAc,CAAC,UAAU,EAAE,CAAC;IAClC,OAAO,cAAc,CAAC;AACxB,CAAC"}

package/dist/api/constants.d.ts

@@ -0,0 +1,4 @@
+export declare const SKYLIGHT_BASE_URL = "https://app.ourskylight.com";
+export declare const SKYLIGHT_WEB_APP_URL = "https://ourskylight.com";
+export declare const SKYLIGHT_API_VERSION = "2026-03-01";
+//# sourceMappingURL=constants.d.ts.map

package/dist/api/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/api/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,gCAAgC,CAAC;AAC/D,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAC9D,eAAO,MAAM,oBAAoB,eAAe,CAAC"}

package/dist/api/constants.js

@@ -0,0 +1,4 @@
+export const SKYLIGHT_BASE_URL = "https://app.ourskylight.com";
+export const SKYLIGHT_WEB_APP_URL = "https://ourskylight.com";
+export const SKYLIGHT_API_VERSION = "2026-03-01";
+//# sourceMappingURL=constants.js.map

package/dist/api/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/api/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG,6BAA6B,CAAC;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC"}

package/dist/api/credential-store.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Local credential storage.
+ *
+ * macOS: the OAuth credential is AES-256-GCM encrypted into a 0600 file; the
+ * 256-bit key lives in the macOS Keychain, so the file alone is useless.
+ * Other platforms: a 0600 file inside a 0700 directory (no encryption; anything
+ * running as your user can read it, same as ~/.ssh keys).
+ *
+ * Neither store ever falls back silently to something weaker: if the Keychain
+ * cannot be used, writes fail with an error.
+ *
+ * Structure informed by kamilio/skylight-calendar-agent (MIT); see
+ * THIRD_PARTY_NOTICES.md.
+ */
+import { CredentialStoreError, type CredentialStore } from "./credential-types.js";
+import { type PendingLogin } from "./oauth.js";
+export { CredentialStoreError, type CredentialStore };
+export declare function defaultConfigDirectory(): string;
+export declare function createFileCredentialStore(options?: {
+    directory?: string;
+}): CredentialStore;
+interface CommandResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+export type KeychainRunner = (args: readonly string[], input?: string) => Promise<CommandResult>;
+export declare function createKeychainCredentialStore(options?: {
+    directory?: string;
+    runner?: KeychainRunner;
+    account?: string;
+}): CredentialStore;
+export declare function defaultCredentialStore(): CredentialStore;
+/** Persist the PKCE verifier + state between `auth login` and `auth complete`. */
+export declare function savePendingLogin(pending: PendingLogin, directory?: string): Promise<void>;
+/** Read and delete the pending login (single use). Returns null if none. */
+export declare function takePendingLogin(directory?: string): Promise<PendingLogin | null>;
+//# sourceMappingURL=credential-store.d.ts.map

package/dist/api/credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../src/api/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,OAAO,EAAE,oBAAoB,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,KAAK,eAAe,EAAE,CAAC;AAStD,wBAAgB,sBAAsB,IAAI,MAAM,CAQ/C;AAwCD,wBAAgB,yBAAyB,CAAC,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,eAAe,CAuB/F;AAID,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAgFjG,wBAAgB,6BAA6B,CAC3C,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9E,eAAe,CA2EjB;AAED,wBAAgB,sBAAsB,IAAI,eAAe,CAExD;AAID,kFAAkF;AAClF,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,SAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjH;AAED,4EAA4E;AAC5E,wBAAsB,gBAAgB,CAAC,SAAS,SAA2B,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAmBzG"}

package/dist/api/credential-store.js

@@ -0,0 +1,273 @@
+/**
+ * Local credential storage.
+ *
+ * macOS: the OAuth credential is AES-256-GCM encrypted into a 0600 file; the
+ * 256-bit key lives in the macOS Keychain, so the file alone is useless.
+ * Other platforms: a 0600 file inside a 0700 directory (no encryption; anything
+ * running as your user can read it, same as ~/.ssh keys).
+ *
+ * Neither store ever falls back silently to something weaker: if the Keychain
+ * cannot be used, writes fail with an error.
+ *
+ * Structure informed by kamilio/skylight-calendar-agent (MIT); see
+ * THIRD_PARTY_NOTICES.md.
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+import { SKYLIGHT_BASE_URL } from "./constants.js";
+import { CredentialStoreError } from "./credential-types.js";
+import { parseStoredCredential } from "./oauth.js";
+export { CredentialStoreError };
+const KEYCHAIN_SERVICE = "skylight-mcp.encryption-key";
+const KEYCHAIN_LABEL = "skylight-mcp";
+const KEYCHAIN_TIMEOUT_MS = 15_000;
+const CREDENTIAL_FILE = "credential.json";
+const ENCRYPTED_FILE = "credential.enc.json";
+const PENDING_FILE = "pending-login.json";
+export function defaultConfigDirectory() {
+    if (process.platform === "darwin") {
+        return path.join(homedir(), "Library", "Application Support", "skylight-mcp");
+    }
+    if (process.platform === "win32") {
+        return path.join(process.env.APPDATA ?? path.join(homedir(), "AppData", "Roaming"), "skylight-mcp");
+    }
+    return path.join(process.env.XDG_CONFIG_HOME ?? path.join(homedir(), ".config"), "skylight-mcp");
+}
+async function ensureDirectory(directory) {
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    await chmod(directory, 0o700);
+}
+/** Write atomically with 0600 permissions. */
+async function writePrivateFile(destination, contents) {
+    const temporary = `${destination}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+    try {
+        await writeFile(temporary, contents, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        await rename(temporary, destination);
+        await chmod(destination, 0o600);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+async function readIfExists(file) {
+    try {
+        return await readFile(file, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+async function removeIfExists(file) {
+    try {
+        await rm(file);
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+// ---------------------------------------------------------------- file store
+export function createFileCredentialStore(options = {}) {
+    const directory = options.directory ?? defaultConfigDirectory();
+    const file = path.join(directory, CREDENTIAL_FILE);
+    return {
+        name: "credential file (0600)",
+        async read() {
+            const raw = await readIfExists(file);
+            if (raw === null)
+                return null;
+            try {
+                return parseStoredCredential(JSON.parse(raw));
+            }
+            catch {
+                throw new CredentialStoreError("The stored credential file is corrupt. Run `skylight-mcp auth login` again.");
+            }
+        },
+        async write(credential) {
+            await ensureDirectory(directory);
+            await writePrivateFile(file, `${JSON.stringify(credential)}\n`);
+        },
+        async delete() {
+            return removeIfExists(file);
+        },
+    };
+}
+function securityRunner(command = "/usr/bin/security") {
+    return (args, input) => new Promise((resolve, reject) => {
+        const child = spawn(command, [...args], { stdio: ["pipe", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        const timer = setTimeout(() => {
+            child.kill();
+            reject(new CredentialStoreError("macOS Keychain operation timed out."));
+        }, KEYCHAIN_TIMEOUT_MS);
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => {
+            if (stdout.length < 20_000)
+                stdout += chunk;
+        });
+        child.stderr.on("data", (chunk) => {
+            if (stderr.length < 20_000)
+                stderr += chunk;
+        });
+        child.on("error", (error) => {
+            clearTimeout(timer);
+            reject(new CredentialStoreError(`macOS Keychain command failed: ${error.message}`));
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            resolve({ code: code ?? 1, stdout, stderr });
+        });
+        child.stdin.end(input);
+    });
+}
+function encrypt(plaintext, key) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", key, iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    return {
+        version: 1,
+        iv: iv.toString("base64"),
+        ciphertext: ciphertext.toString("base64"),
+        tag: cipher.getAuthTag().toString("base64"),
+    };
+}
+function decrypt(payload, key) {
+    try {
+        const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(payload.iv, "base64"));
+        decipher.setAuthTag(Buffer.from(payload.tag, "base64"));
+        return Buffer.concat([decipher.update(Buffer.from(payload.ciphertext, "base64")), decipher.final()]).toString("utf8");
+    }
+    catch {
+        throw new CredentialStoreError("The stored credential could not be decrypted. Run `skylight-mcp auth login` again.");
+    }
+}
+function parseEncrypted(raw) {
+    let parsed = null;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        // handled below
+    }
+    if (!parsed ||
+        parsed.version !== 1 ||
+        typeof parsed.iv !== "string" ||
+        typeof parsed.ciphertext !== "string" ||
+        typeof parsed.tag !== "string") {
+        throw new CredentialStoreError("The encrypted credential file is invalid. Run `skylight-mcp auth login` again.");
+    }
+    return parsed;
+}
+export function createKeychainCredentialStore(options = {}) {
+    const directory = options.directory ?? defaultConfigDirectory();
+    const run = options.runner ?? securityRunner();
+    const account = options.account ?? SKYLIGHT_BASE_URL;
+    const file = path.join(directory, ENCRYPTED_FILE);
+    const readKey = async () => {
+        const result = await run(["find-generic-password", "-a", account, "-s", KEYCHAIN_SERVICE, "-w"]);
+        if (result.code === 44)
+            return null; // item not found
+        if (result.code !== 0) {
+            throw new CredentialStoreError(`Could not read the encryption key from macOS Keychain (exit ${result.code}).`);
+        }
+        const key = Buffer.from(result.stdout.replace(/[\r\n]+$/, ""), "base64");
+        if (key.length !== 32) {
+            throw new CredentialStoreError("The encryption key in macOS Keychain is invalid. Run `skylight-mcp auth logout`, then log in again.");
+        }
+        return key;
+    };
+    const writeKey = async (key) => {
+        const encoded = key.toString("base64");
+        // `security add-generic-password -w` with no value reads from the TTY, not
+        // stdin, so it hangs when run from a program. `security -i` instead reads
+        // whole commands from stdin, which keeps the key out of the process
+        // argument list. None of the values need quoting: the account is a URL,
+        // the service and label have no spaces, and the key is base64.
+        const result = await run(["-i"], `add-generic-password -U -a ${account} -s ${KEYCHAIN_SERVICE} -l ${KEYCHAIN_LABEL} -w ${encoded}\n`);
+        if (result.code !== 0) {
+            throw new CredentialStoreError(`Could not store the encryption key in macOS Keychain (exit ${result.code}).`);
+        }
+        // Interactive mode does not reliably report per-command failures, so
+        // confirm the key is really there before encrypting anything with it.
+        const stored = await readKey();
+        if (stored === null || !stored.equals(key)) {
+            throw new CredentialStoreError("macOS Keychain did not store the encryption key. Nothing was saved.");
+        }
+    };
+    return {
+        name: "macOS Keychain + encrypted file",
+        async read() {
+            const raw = await readIfExists(file);
+            if (raw === null)
+                return null;
+            const key = await readKey();
+            if (key === null) {
+                throw new CredentialStoreError("The encryption key is missing from macOS Keychain. Run `skylight-mcp auth login` again.");
+            }
+            const plaintext = decrypt(parseEncrypted(raw), key);
+            try {
+                return parseStoredCredential(JSON.parse(plaintext));
+            }
+            catch {
+                throw new CredentialStoreError("The stored credential is corrupt. Run `skylight-mcp auth login` again.");
+            }
+        },
+        async write(credential) {
+            let key = await readKey();
+            if (key === null) {
+                key = randomBytes(32);
+                await writeKey(key);
+            }
+            await ensureDirectory(directory);
+            await writePrivateFile(file, `${JSON.stringify(encrypt(JSON.stringify(credential), key))}\n`);
+        },
+        async delete() {
+            const removedFile = await removeIfExists(file);
+            const result = await run(["delete-generic-password", "-a", account, "-s", KEYCHAIN_SERVICE]);
+            if (result.code !== 0 && result.code !== 44) {
+                throw new CredentialStoreError(`Could not remove the encryption key from macOS Keychain (exit ${result.code}).`);
+            }
+            return removedFile || result.code === 0;
+        },
+    };
+}
+export function defaultCredentialStore() {
+    return process.platform === "darwin" ? createKeychainCredentialStore() : createFileCredentialStore();
+}
+// -------------------------------------------------------------- pending login
+/** Persist the PKCE verifier + state between `auth login` and `auth complete`. */
+export async function savePendingLogin(pending, directory = defaultConfigDirectory()) {
+    await ensureDirectory(directory);
+    await writePrivateFile(path.join(directory, PENDING_FILE), `${JSON.stringify(pending)}\n`);
+}
+/** Read and delete the pending login (single use). Returns null if none. */
+export async function takePendingLogin(directory = defaultConfigDirectory()) {
+    const file = path.join(directory, PENDING_FILE);
+    const raw = await readIfExists(file);
+    if (raw === null)
+        return null;
+    await removeIfExists(file);
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.state === "string" &&
+            typeof parsed.codeVerifier === "string" &&
+            typeof parsed.fingerprint === "string" &&
+            typeof parsed.createdAt === "number") {
+            return parsed;
+        }
+    }
+    catch {
+        // fall through
+    }
+    return null;
+}
+//# sourceMappingURL=credential-store.js.map