@glbgpt/cli 0.1.0-test.1

package/README.md

@@ -0,0 +1,111 @@
+# GlobalGPT CLI
+
+GlobalGPT in your terminal — chat, image and video generation, and an `exec` entry point for
+scripts and other agents. You sign in with your GlobalGPT account (no API key); billing is your
+normal account balance.
+
+> Test build (`0.1.0-test.x`), pointing at `https://tw.broly.ai`. Requires Node.js ≥ 18.
+
+## Install
+
+```bash
+npm install -g @glbgpt/cli@test
+```
+
+Installs two interchangeable commands: **`glbgpt`** and **`globalgpt`**.
+
+```bash
+glbgpt login   # authorize in your browser
+glbgpt         # start chatting
+```
+
+## Commands
+
+Run `glbgpt <command> --help` for the full flags of any command.
+
+### Chat
+
+| Command | What it does |
+|---|---|
+| `glbgpt` | Start the interactive chat TUI. |
+| `glbgpt "<prompt>"` | Start the TUI with a first message. |
+| `glbgpt resume last` · `glbgpt resume <id>` | Resume a previous conversation. |
+
+Inside the TUI, type `/` for commands: `/model` `/models` `/image` `/video` `/tasks` `/status`
+`/account` `/transactions` `/cost` `/login` `/logout` `/new` `/resume` `/help` `/exit`.
+Attach images with `@image` (last generation), `Ctrl+V` or `@clipboard`, or `@./photo.png`.
+Multi-line: end a line with `\` then Enter (or Ctrl+J); plain Enter sends; Esc interrupts.
+
+### Account
+
+| Command | What it does |
+|---|---|
+| `glbgpt login [--no-browser] [--code]` | Sign in. `--no-browser` prints the URL; `--code` pastes a one-time code (headless/SSH). |
+| `glbgpt logout` | Sign out and remove stored credentials. |
+| `glbgpt whoami` | Show the signed-in account. |
+| `glbgpt account` | Membership and credit balance. |
+| `glbgpt account transactions` | Recent spend (authoritative billing). |
+
+### Images and video
+
+| Command | What it does |
+|---|---|
+| `glbgpt image "<prompt>"` | Generate an image (asks before spending). |
+| `glbgpt video "<prompt>"` | Generate a video (asks before spending). |
+
+Common flags: `-m/--model`, `--ar 16:9`, `--res 2K`, `--seed N`, `--negative-prompt "..."`,
+`-i ./ref.png` (reference image), `--duration N` and `--audio/--no-audio` (video),
+`-o/--out <dir>`, `--estimate` (price only, don't generate), `--detach` (submit and print the
+task id without waiting).
+
+### Models and tasks
+
+| Command | What it does |
+|---|---|
+| `glbgpt model list [chat\|image\|video]` | List available models. |
+| `glbgpt model show <model>` | Parameters and limits for one model. |
+| `glbgpt task list` | Recent generation tasks. |
+| `glbgpt task show last` · `glbgpt task show <id>` | A task's status. |
+| `glbgpt task wait last` | Block until a task finishes. |
+| `glbgpt task download last` | Download a finished result. |
+
+### exec — non-interactive
+
+One request in, the model's answer out. For scripts and external agents; never opens the TUI.
+
+```bash
+glbgpt exec "capital of France? one word"     # plain text on stdout
+echo "summarize this" | glbgpt exec -         # prompt from stdin
+glbgpt exec "what is in this image?" -i shot.png
+glbgpt exec "extract facts" --json            # one result object
+glbgpt exec "say hi" --jsonl                   # streaming events, one JSON per line
+```
+
+Flags: `-m/--model`, `--system <text>`, `--file <path...>`, `-i/--image <path|url...>`,
+`--output-schema <file>` (structured output), `--json`, `--jsonl`, `-o/--output-last-message <file>`.
+Exit code is `0` on success, non-zero on a usage/auth/turn error.
+
+### mcp — use from other agents
+
+`glbgpt mcp` runs a [Model Context Protocol](https://modelcontextprotocol.io) server over stdio,
+exposing a `glbgpt_chat` tool. Register it with any MCP client, e.g. Claude Code:
+
+```bash
+claude mcp add glbgpt -- glbgpt mcp
+```
+
+### config
+
+| Command | What it does |
+|---|---|
+| `glbgpt config list` | Show persisted settings. |
+| `glbgpt config get <key>` · `set <key> <value>` · `unset <key>` | Manage settings. |
+
+Keys: `api-base-url`, `web-base-url`, `lang`. One-shot overrides via env vars
+(`GLBGPT_BASE_URL`, `GLBGPT_WEB_URL`, `GLBGPT_LANG`, `GLBGPT_TOKEN`) always win.
+
+## Notes
+
+Credentials are stored at `~/.config/glbgpt/credentials.json` (dir `0700`, file `0600`). The
+token is long-lived; on a 401 the CLI asks you to `glbgpt login` again. This is a pre-release
+test build — please report anything that looks wrong.

package/dist/src/auth/authClient.d.ts

@@ -0,0 +1,32 @@
+export interface UserInfo {
+    email?: string;
+    name?: string;
+    balance?: number | string;
+    plan?: string;
+}
+export interface BillRecord {
+    model: string;
+    /** Cost in USD (1 credit ≈ $0.001). */
+    cost: number;
+    accountType?: string;
+    createdAt?: string;
+}
+export interface AuthClientOptions {
+    /** GlobalGPT API base, e.g. https://testtapi2.broly.ai. */
+    baseUrl: string;
+    fetchImpl?: typeof fetch;
+}
+export declare class AuthClient {
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    private readonly host;
+    constructor(opts: AuthClientOptions);
+    /** fetch against the account API, with a friendly message on a transient network failure. */
+    private request;
+    /** Exchange a one-time code (temp token) for the real JWT. */
+    exchange(code: string): Promise<string>;
+    /** Fetch recent billing records (for `account transactions`). */
+    bills(token: string, page?: number, size?: number): Promise<BillRecord[]>;
+    /** Fetch the signed-in user's info (for whoami and the post-login greeting). */
+    userInfo(token: string): Promise<UserInfo>;
+}

package/dist/src/auth/authClient.js

@@ -0,0 +1,88 @@
+/**
+ * Talks to the GlobalGPT account API (/user-api/*, chatpal deployment) for the login flow.
+ *
+ * Response envelope is `{ code, message, data }` with success `code === 1` (HTTP is typically 200
+ * even for business errors). We parse defensively: success is decided by the presence of the
+ * expected payload, not solely the code.
+ */
+import { fetchOrDescribe, hostOf } from '../util/retry.js';
+export class AuthClient {
+    baseUrl;
+    fetchImpl;
+    host;
+    constructor(opts) {
+        this.baseUrl = opts.baseUrl.replace(/\/+$/, '');
+        this.fetchImpl = opts.fetchImpl ?? fetch;
+        this.host = hostOf(this.baseUrl);
+    }
+    /** fetch against the account API, with a friendly message on a transient network failure. */
+    request(pathname, init) {
+        return fetchOrDescribe(this.fetchImpl, `${this.baseUrl}${pathname}`, init, this.host);
+    }
+    /** Exchange a one-time code (temp token) for the real JWT. */
+    async exchange(code) {
+        const res = await this.request('/user-api/api/temp-token/exchange', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ tempToken: code }),
+        });
+        const body = await parseJson(res);
+        const token = body?.data?.token;
+        if (typeof token !== 'string' || !token) {
+            throw new Error(errorMessage(body) ?? 'Login code is invalid or already used.');
+        }
+        return token;
+    }
+    /** Fetch recent billing records (for `account transactions`). */
+    async bills(token, page = 1, size = 20) {
+        const res = await this.request(`/user-api/api/user/bill?page=${page}&size=${size}`, {
+            method: 'GET',
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        const body = await parseJson(res);
+        const rows = body?.data?.data;
+        if (!Array.isArray(rows)) {
+            throw new Error(errorMessage(body) ?? 'Failed to fetch transactions.');
+        }
+        return rows.map((r) => ({
+            model: r.model ?? '(unknown)',
+            cost: Number(r.cost ?? 0),
+            accountType: r.account_type,
+            createdAt: r.created_at,
+        }));
+    }
+    /** Fetch the signed-in user's info (for whoami and the post-login greeting). */
+    async userInfo(token) {
+        const res = await this.request('/user-api/api/user/info', {
+            method: 'GET',
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        const body = await parseJson(res);
+        const data = body?.data;
+        if (!data || typeof data !== 'object') {
+            throw new Error(errorMessage(body) ?? 'Failed to fetch account info.');
+        }
+        return {
+            email: data.email,
+            name: data.name,
+            balance: data.balance,
+            plan: data.subscriptionTag ?? data.plan,
+        };
+    }
+}
+async function parseJson(res) {
+    const text = await res.text();
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return { message: text || `HTTP ${res.status}` };
+    }
+}
+function errorMessage(body) {
+    if (body && typeof body.message === 'string' && body.message && body.message !== 'success') {
+        return body.message;
+    }
+    return null;
+}
+//# sourceMappingURL=authClient.js.map

package/dist/src/auth/authClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authClient.js","sourceRoot":"","sources":["../../../src/auth/authClient.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAsB3D,MAAM,OAAO,UAAU;IACJ,OAAO,CAAS;IAChB,SAAS,CAAe;IACxB,IAAI,CAAS;IAE9B,YAAY,IAAuB;QACjC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,6FAA6F;IACrF,OAAO,CAAC,QAAgB,EAAE,IAAiB;QACjD,OAAO,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,mCAAmC,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,wCAAwC,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gCAAgC,IAAI,SAAS,IAAI,EAAE,EAAE;YAClF,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,+BAA+B,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,WAAW;YAC7B,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACzB,WAAW,EAAE,CAAC,CAAC,YAAY;YAC3B,SAAS,EAAE,CAAC,CAAC,UAAU;SACxB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE;YACxD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,+BAA+B,CAAC,CAAC;QACzE,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI;SACxC,CAAC;IACJ,CAAC;CACF;AAED,KAAK,UAAU,SAAS,CAAC,GAAa;IACpC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAS;IAC7B,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/auth/credentialStore.d.ts

@@ -0,0 +1,22 @@
+/** Stored GlobalGPT credentials. */
+export interface Credentials {
+    token: string;
+    email?: string;
+    savedAt: number;
+}
+/**
+ * Local credential storage at ~/.config/glbgpt/credentials.json (dir 0700, file 0600).
+ *
+ * The JWT is long-lived and there is no refresh; on a 401 the CLI prompts the user to
+ * `glbgpt login` again. `logout` removes this file (the server does not revoke the JWT).
+ */
+export declare class CredentialStore {
+    private readonly file;
+    private readonly dir;
+    constructor(file?: string, dir?: string);
+    save(creds: Credentials): Promise<void>;
+    load(): Promise<Credentials | null>;
+    clear(): Promise<boolean>;
+    /** Directory the credentials file lives in (exposed for logging). */
+    location(): string;
+}

package/dist/src/auth/credentialStore.js

@@ -0,0 +1,51 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { configDir, credentialsPath } from '../config/paths.js';
+/**
+ * Local credential storage at ~/.config/glbgpt/credentials.json (dir 0700, file 0600).
+ *
+ * The JWT is long-lived and there is no refresh; on a 401 the CLI prompts the user to
+ * `glbgpt login` again. `logout` removes this file (the server does not revoke the JWT).
+ */
+export class CredentialStore {
+    file;
+    dir;
+    constructor(file = credentialsPath(), dir = configDir()) {
+        this.file = file;
+        this.dir = dir;
+    }
+    async save(creds) {
+        await fs.mkdir(this.dir, { recursive: true, mode: 0o700 });
+        // Atomic write via a fresh 0600 temp file + rename, so the token is never briefly written
+        // with looser permissions (an existing file's mode is not reapplied by writeFile), and a
+        // crash mid-write cannot corrupt the credentials file.
+        const tmp = `${this.file}.${process.pid}.tmp`;
+        await fs.writeFile(tmp, JSON.stringify(creds, null, 2), { mode: 0o600 });
+        await fs.chmod(tmp, 0o600);
+        await fs.rename(tmp, this.file);
+    }
+    async load() {
+        try {
+            const raw = await fs.readFile(this.file, 'utf8');
+            const creds = JSON.parse(raw);
+            return creds.token ? creds : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async clear() {
+        try {
+            await fs.rm(this.file);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Directory the credentials file lives in (exposed for logging). */
+    location() {
+        return path.dirname(this.file);
+    }
+}
+//# sourceMappingURL=credentialStore.js.map

package/dist/src/auth/credentialStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialStore.js","sourceRoot":"","sources":["../../../src/auth/credentialStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAShE;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAEP;IACA;IAFnB,YACmB,OAAe,eAAe,EAAE,EAChC,MAAc,SAAS,EAAE;QADzB,SAAI,GAAJ,IAAI,CAA4B;QAChC,QAAG,GAAH,GAAG,CAAsB;IACzC,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,KAAkB;QAC3B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,0FAA0F;QAC1F,yFAAyF;QACzF,uDAAuD;QACvD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;YAC7C,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,QAAQ;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;CACF"}

package/dist/src/auth/loginFlow.d.ts

@@ -0,0 +1,30 @@
+import type { CredentialStore } from './credentialStore.js';
+import type { UserInfo } from './authClient.js';
+/** Minimal account-API surface the login flow needs (real AuthClient satisfies this). */
+export interface AuthApi {
+    exchange(code: string): Promise<string>;
+    userInfo(token: string): Promise<UserInfo>;
+}
+export interface BrowserLoginDeps {
+    /** Web frontend base that serves the /cli-auth page (may differ from the API base). */
+    webBaseUrl: string;
+    lang: string;
+    authClient: AuthApi;
+    credentialStore: CredentialStore;
+    /** Open (or print) the authorization URL. Injected for testing / --no-browser. */
+    openUrl: (url: string) => void | Promise<void>;
+    genState?: () => string;
+    timeoutMs?: number;
+}
+export interface LoginResult {
+    email?: string;
+    authUrl: string;
+}
+/** Main login flow: loopback + state. Returns once credentials are stored. */
+export declare function browserLogin(deps: BrowserLoginDeps): Promise<LoginResult>;
+export interface CodeLoginDeps {
+    authClient: AuthApi;
+    credentialStore: CredentialStore;
+}
+/** Fallback login: exchange a code the user pasted from the web page. */
+export declare function codeLogin(deps: CodeLoginDeps, code: string): Promise<LoginResult>;

package/dist/src/auth/loginFlow.js

@@ -0,0 +1,43 @@
+import crypto from 'node:crypto';
+import { LoopbackServer } from './loopbackServer.js';
+/** Main login flow: loopback + state. Returns once credentials are stored. */
+export async function browserLogin(deps) {
+    const state = (deps.genState ?? defaultState)();
+    const server = new LoopbackServer(state, deps.timeoutMs);
+    const { redirectUri } = await server.listen();
+    const authUrl = `${trimSlash(deps.webBaseUrl)}/${deps.lang}/cli-auth` +
+        `?redirect_uri=${encodeURIComponent(redirectUri)}&state=${encodeURIComponent(state)}`;
+    try {
+        await deps.openUrl(authUrl);
+        const code = await server.waitForCode();
+        const info = await finishLogin(deps.authClient, deps.credentialStore, code);
+        return { email: info.email, authUrl };
+    }
+    finally {
+        server.close();
+    }
+}
+/** Fallback login: exchange a code the user pasted from the web page. */
+export async function codeLogin(deps, code) {
+    const info = await finishLogin(deps.authClient, deps.credentialStore, code.trim());
+    return { email: info.email, authUrl: '' };
+}
+async function finishLogin(authClient, store, code) {
+    const token = await authClient.exchange(code);
+    let info = {};
+    try {
+        info = await authClient.userInfo(token);
+    }
+    catch {
+        // A token that cannot fetch user info is still usable; store it without the email.
+    }
+    await store.save({ token, email: info.email, savedAt: Date.now() });
+    return info;
+}
+function defaultState() {
+    return crypto.randomBytes(16).toString('hex');
+}
+function trimSlash(url) {
+    return url.replace(/\/+$/, '');
+}
+//# sourceMappingURL=loginFlow.js.map

package/dist/src/auth/loginFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../../src/auth/loginFlow.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA2BrD,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAsB;IACvD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;IAC9C,MAAM,OAAO,GACX,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,IAAI,WAAW;QACrD,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QAC5E,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;IACxC,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAOD,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAmB,EAAE,IAAY;IAC/D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnF,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,UAAmB,EAAE,KAAsB,EAAE,IAAY;IAClF,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,IAAI,GAAa,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,mFAAmF;IACrF,CAAC;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC"}

package/dist/src/auth/loopbackServer.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Local loopback HTTP server that receives the browser redirect for the login flow.
+ *
+ * Binds 127.0.0.1 on an OS-assigned port and waits for a single
+ * `GET /callback?code=<one-time-code>&state=<state>` request. The one-time code is delivered
+ * to the local machine, so a remote attacker cannot receive it (phishing resistance); `state`
+ * guards against CSRF/stale callbacks.
+ *
+ * Hardening (we have no PKCE endpoint, so the loopback surface itself carries the weight —
+ * see docs; Codex/Claude Code lean on PKCE instead and skip some of these):
+ * - Only `GET /callback` from a loopback `Host` header is honored; everything else 404s and
+ *   the server keeps listening (a stray/hostile local request can't hijack or DoS the login).
+ * - `state` is compared in constant time.
+ * - A state mismatch responds 400 but does NOT settle the login — the real callback is still
+ *   awaited (Codex's resilient shape, not Claude Code's fail-closed reject).
+ */
+export declare class LoopbackServer {
+    private readonly expectedState;
+    private readonly timeoutMs;
+    private server;
+    private port;
+    private settled;
+    private timer;
+    private readonly result;
+    private resolveResult;
+    private rejectResult;
+    constructor(expectedState: string, timeoutMs?: number);
+    /** Bind the server and return the redirect URI the browser will be sent back to. */
+    listen(): Promise<{
+        redirectUri: string;
+    }>;
+    /** Resolve with the one-time code once the browser hits the callback with a matching state. */
+    waitForCode(): Promise<string>;
+    close(): void;
+    private handle;
+    /** Host must be a loopback literal on our port (127.0.0.1 / localhost / [::1]). */
+    private isLoopbackHost;
+    /** Constant-time state comparison (avoids leaking match progress via timing). */
+    private stateMatches;
+    private settle;
+}

package/dist/src/auth/loopbackServer.js

@@ -0,0 +1,141 @@
+import http from 'node:http';
+import crypto from 'node:crypto';
+/**
+ * Local loopback HTTP server that receives the browser redirect for the login flow.
+ *
+ * Binds 127.0.0.1 on an OS-assigned port and waits for a single
+ * `GET /callback?code=<one-time-code>&state=<state>` request. The one-time code is delivered
+ * to the local machine, so a remote attacker cannot receive it (phishing resistance); `state`
+ * guards against CSRF/stale callbacks.
+ *
+ * Hardening (we have no PKCE endpoint, so the loopback surface itself carries the weight —
+ * see docs; Codex/Claude Code lean on PKCE instead and skip some of these):
+ * - Only `GET /callback` from a loopback `Host` header is honored; everything else 404s and
+ *   the server keeps listening (a stray/hostile local request can't hijack or DoS the login).
+ * - `state` is compared in constant time.
+ * - A state mismatch responds 400 but does NOT settle the login — the real callback is still
+ *   awaited (Codex's resilient shape, not Claude Code's fail-closed reject).
+ */
+export class LoopbackServer {
+    expectedState;
+    timeoutMs;
+    server = null;
+    port = 0;
+    settled = false;
+    timer = null;
+    result;
+    resolveResult;
+    rejectResult;
+    constructor(expectedState, timeoutMs = 300_000) {
+        this.expectedState = expectedState;
+        this.timeoutMs = timeoutMs;
+        // Create the deferred up front so a callback that arrives before waitForCode() is not lost.
+        this.result = new Promise((resolve, reject) => {
+            this.resolveResult = resolve;
+            this.rejectResult = reject;
+        });
+    }
+    /** Bind the server and return the redirect URI the browser will be sent back to. */
+    async listen() {
+        this.server = http.createServer((req, res) => this.handle(req, res));
+        this.server.on('error', () => { }); // ignore post-bind socket errors
+        await new Promise((resolve, reject) => {
+            const onError = (err) => reject(err);
+            this.server.once('error', onError);
+            this.server.listen(0, '127.0.0.1', () => {
+                this.server.off('error', onError);
+                resolve();
+            });
+        });
+        this.port = this.server.address().port;
+        return { redirectUri: `http://127.0.0.1:${this.port}/callback` };
+    }
+    /** Resolve with the one-time code once the browser hits the callback with a matching state. */
+    waitForCode() {
+        if (!this.settled && !this.timer) {
+            this.timer = setTimeout(() => {
+                this.settle(() => this.rejectResult(new Error('Timed out waiting for browser authorization.')));
+            }, this.timeoutMs);
+            if (typeof this.timer.unref === 'function')
+                this.timer.unref();
+        }
+        return this.result;
+    }
+    close() {
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.server?.closeAllConnections?.();
+        this.server?.close();
+        this.server = null;
+    }
+    handle(req, res) {
+        // Defense-in-depth against DNS-rebinding: only accept GET from a loopback Host. A page on
+        // a hostile domain that resolves to 127.0.0.1 cannot forge a loopback Host header.
+        if (req.method !== 'GET' || !this.isLoopbackHost(req.headers.host)) {
+            respond(res, 404, page('Not found', 'You can close this tab.'));
+            return; // keep listening
+        }
+        const url = new URL(req.url ?? '/', `http://127.0.0.1:${this.port}`);
+        if (url.pathname !== '/callback') {
+            respond(res, 404, page('Not found', 'You can close this tab.'));
+            return; // keep listening
+        }
+        const state = url.searchParams.get('state');
+        // A mismatched/absent state is a stale or hostile hit — reject THIS request but keep the
+        // login alive for the genuine callback (do not settle).
+        if (!state || !this.stateMatches(state)) {
+            respond(res, 400, page('Authorization failed', 'State mismatch. You can close this tab.'));
+            return;
+        }
+        const code = url.searchParams.get('code');
+        const error = url.searchParams.get('error');
+        if (error) {
+            respond(res, 400, page('Authorization failed', 'You can close this tab and return to the terminal.'));
+            this.settle(() => this.rejectResult(new Error(`Authorization was denied (${error}).`)));
+            return;
+        }
+        if (!code) {
+            respond(res, 400, page('Authorization failed', 'Missing code. You can close this tab.'));
+            this.settle(() => this.rejectResult(new Error('Authorization callback did not include a code.')));
+            return;
+        }
+        respond(res, 200, page('Signed in to GlobalGPT CLI', 'You can close this tab and return to the terminal.'));
+        this.settle(() => this.resolveResult(code));
+    }
+    /** Host must be a loopback literal on our port (127.0.0.1 / localhost / [::1]). */
+    isLoopbackHost(host) {
+        if (!host)
+            return false;
+        const suffix = `:${this.port}`;
+        if (!host.endsWith(suffix))
+            return false;
+        const name = host.slice(0, -suffix.length);
+        return name === '127.0.0.1' || name === 'localhost' || name === '[::1]';
+    }
+    /** Constant-time state comparison (avoids leaking match progress via timing). */
+    stateMatches(state) {
+        const a = Buffer.from(state);
+        const b = Buffer.from(this.expectedState);
+        return a.length === b.length && crypto.timingSafeEqual(a, b);
+    }
+    settle(action) {
+        if (this.settled)
+            return;
+        this.settled = true;
+        if (this.timer)
+            clearTimeout(this.timer);
+        action();
+    }
+}
+function respond(res, status, html) {
+    // Force Connection: close — a kept-alive socket would wedge the next login on the same port
+    // (Codex hits this with fixed ports; cheap insurance for us too).
+    res.writeHead(status, { 'Content-Type': 'text/html; charset=utf-8', Connection: 'close' });
+    res.end(html);
+}
+function page(title, body) {
+    return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head>` +
+        `<body style="font-family:system-ui;max-width:32rem;margin:4rem auto;text-align:center">` +
+        `<h2>${title}</h2><p>${body}</p></body></html>`;
+}
+//# sourceMappingURL=loopbackServer.js.map

package/dist/src/auth/loopbackServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopbackServer.js","sourceRoot":"","sources":["../../../src/auth/loopbackServer.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,cAAc;IAUN;IACA;IAVX,MAAM,GAAuB,IAAI,CAAC;IAClC,IAAI,GAAG,CAAC,CAAC;IACT,OAAO,GAAG,KAAK,CAAC;IAChB,KAAK,GAA0B,IAAI,CAAC;IAC3B,MAAM,CAAkB;IACjC,aAAa,CAA0B;IACvC,YAAY,CAAwB;IAE5C,YACmB,aAAqB,EACrB,YAAY,OAAO;QADnB,kBAAa,GAAb,aAAa,CAAQ;QACrB,cAAS,GAAT,SAAS,CAAU;QAEpC,4FAA4F;QAC5F,IAAI,CAAC,MAAM,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;YAC7B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,iCAAiC;QACpE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACpC,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBACvC,IAAI,CAAC,MAAO,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACnC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAI,IAAI,CAAC,MAAO,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;QACzD,OAAO,EAAE,WAAW,EAAE,oBAAoB,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;IACnE,CAAC;IAED,+FAA+F;IAC/F,WAAW;QACT,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC3B,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC,CAAC,CAAC;YAClG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACnB,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,GAAyB,EAAE,GAAwB;QAChE,0FAA0F;QAC1F,mFAAmF;QACnF,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,iBAAiB;QAC3B,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACrE,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,iBAAiB;QAC3B,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,yFAAyF;QACzF,wDAAwD;QACxD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,sBAAsB,EAAE,yCAAyC,CAAC,CAAC,CAAC;YAC3F,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,sBAAsB,EAAE,oDAAoD,CAAC,CAAC,CAAC;YACtG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,6BAA6B,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,sBAAsB,EAAE,uCAAuC,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,4BAA4B,EAAE,oDAAoD,CAAC,CAAC,CAAC;QAC5G,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,mFAAmF;IAC3E,cAAc,CAAC,IAAwB;QAC7C,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO,CAAC;IAC1E,CAAC;IAED,iFAAiF;IACzE,YAAY,CAAC,KAAa;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;IAEO,MAAM,CAAC,MAAkB;QAC/B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,EAAE,CAAC;IACX,CAAC;CACF;AAED,SAAS,OAAO,CAAC,GAAwB,EAAE,MAAc,EAAE,IAAY;IACrE,4FAA4F;IAC5F,kEAAkE;IAClE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3F,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,IAAY;IACvC,OAAO,2DAA2D,KAAK,iBAAiB;QACtF,yFAAyF;QACzF,OAAO,KAAK,WAAW,IAAI,oBAAoB,CAAC;AACpD,CAAC"}

package/dist/src/auth/token.d.ts

@@ -0,0 +1,8 @@
+import { CredentialStore } from './credentialStore.js';
+/**
+ * Resolve the JWT to use for API calls.
+ *
+ * Precedence: the GLBGPT_TOKEN env var wins if set (explicit override / CI escape hatch);
+ * otherwise the token stored by `glbgpt login`. Returns null when neither is available.
+ */
+export declare function resolveToken(store?: CredentialStore): Promise<string | null>;

package/dist/src/auth/token.js

@@ -0,0 +1,15 @@
+import { CredentialStore } from './credentialStore.js';
+/**
+ * Resolve the JWT to use for API calls.
+ *
+ * Precedence: the GLBGPT_TOKEN env var wins if set (explicit override / CI escape hatch);
+ * otherwise the token stored by `glbgpt login`. Returns null when neither is available.
+ */
+export async function resolveToken(store = new CredentialStore()) {
+    const env = process.env.GLBGPT_TOKEN;
+    if (env && env.trim())
+        return env.trim();
+    const creds = await store.load();
+    return creds?.token ?? null;
+}
+//# sourceMappingURL=token.js.map

package/dist/src/auth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/auth/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAyB,IAAI,eAAe,EAAE;IAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACrC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACjC,OAAO,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC;AAC9B,CAAC"}

package/dist/src/commands/accountCommand.d.ts

@@ -0,0 +1,2 @@
+export declare function runAccount(): Promise<void>;
+export declare function runAccountTransactions(): Promise<void>;