@gojinko/api-client 0.2.0 → 0.3.0

package/dist/auth.d.ts

@@ -3,18 +3,22 @@ export interface ResolvedAuth {
     readonly method: AuthMethod;
     readonly token: string;
 }
+export interface OAuthConfig {
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly expires_at: number;
+}
 interface ConfigFile {
     readonly api_key?: string;
-    readonly oauth_token?: string;
+    readonly oauth?: OAuthConfig;
 }
 declare const DEFAULT_BASE_URL = "https://mcp-bff.gojinko.com";
 declare const CONFIG_DIR: string;
 declare const CONFIG_FILE: string;
 /**
- * Resolve auth credentials with precedence: param > env > config file.
+ * Resolve auth credentials with precedence: param > env > config file (api_key) > config file (oauth).
  *
- * Currently only API key auth (jnk_...) is supported.
- * OAuth JWT support exists internally but is not exposed to users yet.
+ * OAuth tokens are auto-refreshed if expired.
  */
 export declare function resolveAuth(paramToken?: string): Promise<ResolvedAuth | undefined>;
 /**
@@ -29,5 +33,9 @@ export declare function readConfigFile(): Promise<ConfigFile | undefined>;
  * Write a config value to ~/.jinko/config.yaml.
  */
 export declare function writeConfigFile(updates: Partial<ConfigFile>): Promise<void>;
+/**
+ * Clear all auth credentials from config file.
+ */
+export declare function clearAuthConfig(): Promise<void>;
 export { CONFIG_DIR, CONFIG_FILE, DEFAULT_BASE_URL };
 //# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;AAE7C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,UAAU,UAAU;IAClB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,QAAA,MAAM,gBAAgB,gCAAgC,CAAC;AACvD,QAAA,MAAM,UAAU,QAA4B,CAAC;AAC7C,QAAA,MAAM,WAAW,QAAkC,CAAC;AAEpD;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAYxF;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAOtE;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CASjF;AAED,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;AAE7C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,UAAU,UAAU;IAClB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;CAC9B;AAED,QAAA,MAAM,gBAAgB,gCAAgC,CAAC;AACvD,QAAA,MAAM,UAAU,QAA4B,CAAC;AAC7C,QAAA,MAAM,WAAW,QAAkC,CAAC;AAEpD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAiDxF;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAOtE;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CASjF;AAED;;GAEG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAYrD;AAED,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/auth.js

@@ -2,26 +2,60 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { parse as parseYaml } from 'yaml';
+import { isTokenExpired, refreshAccessToken } from './oauth.js';
 const DEFAULT_BASE_URL = 'https://mcp-bff.gojinko.com';
 const CONFIG_DIR = join(homedir(), '.jinko');
 const CONFIG_FILE = join(CONFIG_DIR, 'config.yaml');
 /**
- * Resolve auth credentials with precedence: param > env > config file.
+ * Resolve auth credentials with precedence: param > env > config file (api_key) > config file (oauth).
  *
- * Currently only API key auth (jnk_...) is supported.
- * OAuth JWT support exists internally but is not exposed to users yet.
+ * OAuth tokens are auto-refreshed if expired.
  */
 export async function resolveAuth(paramToken) {
-    const token = paramToken
-        ?? process.env['JINKO_API_KEY']
-        ?? (await readConfigFile())?.api_key;
-    if (!token)
+    // 1. Explicit param or env — always API key
+    const explicitToken = paramToken ?? process.env['JINKO_API_KEY'];
+    if (explicitToken) {
+        return {
+            method: explicitToken.startsWith('jnk_') ? 'api_key' : 'oauth',
+            token: explicitToken,
+        };
+    }
+    // 2. Config file
+    const config = await readConfigFile();
+    if (!config)
         return undefined;
-    // Internal: keep oauth detection for future use.
-    return {
-        method: token.startsWith('jnk_') ? 'api_key' : 'oauth',
-        token,
-    };
+    // 2a. API key in config
+    if (config.api_key) {
+        return { method: 'api_key', token: config.api_key };
+    }
+    // 2b. OAuth tokens in config
+    if (config.oauth) {
+        const tokens = {
+            access_token: config.oauth.access_token,
+            refresh_token: config.oauth.refresh_token,
+            expires_at: config.oauth.expires_at,
+        };
+        if (isTokenExpired(tokens)) {
+            try {
+                const refreshed = await refreshAccessToken(tokens.refresh_token);
+                // Persist refreshed tokens
+                await writeConfigFile({
+                    oauth: {
+                        access_token: refreshed.access_token,
+                        refresh_token: refreshed.refresh_token,
+                        expires_at: refreshed.expires_at,
+                    },
+                });
+                return { method: 'oauth', token: refreshed.access_token };
+            }
+            catch {
+                // Refresh failed — try with existing token, server will 401 if truly expired
+                return { method: 'oauth', token: tokens.access_token };
+            }
+        }
+        return { method: 'oauth', token: tokens.access_token };
+    }
+    return undefined;
 }
 /**
  * Internal base URL — not configurable by users.
@@ -52,5 +86,19 @@ export async function writeConfigFile(updates) {
     const merged = { ...existing, ...updates };
     await writeFile(CONFIG_FILE, stringifyYaml(merged), 'utf-8');
 }
+/**
+ * Clear all auth credentials from config file.
+ */
+export async function clearAuthConfig() {
+    const config = await readConfigFile();
+    if (!config)
+        return;
+    const { api_key: _, oauth: __, ...rest } = config;
+    const { mkdir, writeFile } = await import('node:fs/promises');
+    const { stringify: stringifyYaml } = await import('yaml');
+    await mkdir(CONFIG_DIR, { recursive: true });
+    const cleaned = Object.keys(rest).length > 0 ? rest : {};
+    await writeFile(CONFIG_FILE, stringifyYaml(cleaned), 'utf-8');
+}
 export { CONFIG_DIR, CONFIG_FILE, DEFAULT_BASE_URL };
 //# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAc1C,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAmB;IACnD,MAAM,KAAK,GAAG,UAAU;WACnB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;WAC5B,CAAC,MAAM,cAAc,EAAE,CAAC,EAAE,OAAO,CAAC;IAEvC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,iDAAiD;IACjD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QACtD,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO,SAAS,CAAC,OAAO,CAAe,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA4B;IAChE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC9D,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAE1D,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,CAAC,MAAM,cAAc,EAAE,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,MAAM,GAAe,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;IACvD,MAAM,SAAS,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAoB,MAAM,YAAY,CAAC;AAoBlF,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAmB;IACnD,4CAA4C;IAC5C,MAAM,aAAa,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACjE,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO;YACL,MAAM,EAAE,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;YAC9D,KAAK,EAAE,aAAa;SACrB,CAAC;IACJ,CAAC;IAED,iBAAiB;IACjB,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,wBAAwB;IACxB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACtD,CAAC;IAED,6BAA6B;IAC7B,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,GAAgB;YAC1B,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;YACvC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa;YACzC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;SACpC,CAAC;QAEF,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;gBACjE,2BAA2B;gBAC3B,MAAM,eAAe,CAAC;oBACpB,KAAK,EAAE;wBACL,YAAY,EAAE,SAAS,CAAC,YAAY;wBACpC,aAAa,EAAE,SAAS,CAAC,aAAa;wBACtC,UAAU,EAAE,SAAS,CAAC,UAAU;qBACjC;iBACF,CAAC,CAAC;gBACH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,6EAA6E;gBAC7E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IACzD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO,SAAS,CAAC,OAAO,CAAe,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA4B;IAChE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC9D,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAE1D,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,CAAC,MAAM,cAAc,EAAE,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,MAAM,GAAe,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;IACvD,MAAM,SAAS,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,MAA8C,CAAC;IAE1F,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC9D,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,SAAS,CAAC,WAAW,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/callback-server.d.ts

@@ -0,0 +1,18 @@
+export interface CallbackResult {
+    readonly code: string;
+    readonly state: string;
+}
+export interface CallbackServer {
+    readonly port: number;
+    readonly result: Promise<CallbackResult>;
+    readonly close: () => void;
+}
+/**
+ * Start a local HTTP server on a random port to receive the OAuth callback.
+ * Returns after the server is listening and the port is known.
+ */
+export declare function startCallbackServer(options: {
+    readonly expectedState: string;
+    readonly timeoutMs?: number;
+}): Promise<CallbackServer>;
+//# sourceMappingURL=callback-server.d.ts.map

package/dist/callback-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-server.d.ts","sourceRoot":"","sources":["../src/callback-server.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;CAC5B;AAsBD;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,cAAc,CAAC,CAuE1B"}

package/dist/callback-server.js

@@ -0,0 +1,85 @@
+import { createServer } from 'node:http';
+import { OAuthError } from './oauth.js';
+const SUCCESS_HTML = `<!DOCTYPE html>
+<html><head><title>Jinko CLI</title><style>
+body { font-family: -apple-system, system-ui, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #f8f9fa; }
+.card { text-align: center; padding: 2rem 3rem; background: white; border-radius: 12px; box-shadow: 0 2px 8px rgba(0,0,0,0.1); }
+h1 { color: #1a1a1a; margin-bottom: 0.5rem; }
+p { color: #666; }
+</style></head><body>
+<div class="card"><h1>Authenticated</h1><p>You can close this tab and return to the terminal.</p></div>
+</body></html>`;
+const ERROR_HTML = `<!DOCTYPE html>
+<html><head><title>Jinko CLI — Error</title><style>
+body { font-family: -apple-system, system-ui, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #f8f9fa; }
+.card { text-align: center; padding: 2rem 3rem; background: white; border-radius: 12px; box-shadow: 0 2px 8px rgba(0,0,0,0.1); }
+h1 { color: #c0392b; margin-bottom: 0.5rem; }
+p { color: #666; }
+</style></head><body>
+<div class="card"><h1>Authentication Failed</h1><p>Please try again from the terminal.</p></div>
+</body></html>`;
+/**
+ * Start a local HTTP server on a random port to receive the OAuth callback.
+ * Returns after the server is listening and the port is known.
+ */
+export async function startCallbackServer(options) {
+    const { expectedState, timeoutMs = 120_000 } = options;
+    const server = createServer();
+    let timeoutHandle;
+    const result = new Promise((resolve, reject) => {
+        server.on('request', (req, res) => {
+            const url = new URL(req.url ?? '/', `http://localhost`);
+            if (url.pathname !== '/callback') {
+                res.writeHead(404);
+                res.end('Not found');
+                return;
+            }
+            const code = url.searchParams.get('code');
+            const state = url.searchParams.get('state');
+            const error = url.searchParams.get('error');
+            if (error) {
+                res.writeHead(200, { 'Content-Type': 'text/html' });
+                res.end(ERROR_HTML);
+                reject(new OAuthError(`OAuth error: ${error}`));
+                return;
+            }
+            if (!code || !state) {
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(ERROR_HTML);
+                reject(new OAuthError('Missing code or state in callback'));
+                return;
+            }
+            if (state !== expectedState) {
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(ERROR_HTML);
+                reject(new OAuthError('State mismatch — possible CSRF attack'));
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.end(SUCCESS_HTML);
+            resolve({ code, state });
+        });
+        timeoutHandle = setTimeout(() => {
+            reject(new OAuthError(`OAuth callback timed out after ${timeoutMs / 1000}s`));
+            server.close();
+        }, timeoutMs);
+    }).finally(() => {
+        clearTimeout(timeoutHandle);
+        server.close();
+    });
+    // Wait for server to start listening so port is assigned
+    await new Promise((resolve) => {
+        server.listen(0, () => resolve());
+    });
+    const address = server.address();
+    const port = typeof address === 'object' && address ? address.port : 0;
+    return {
+        port,
+        result,
+        close: () => {
+            clearTimeout(timeoutHandle);
+            server.close();
+        },
+    };
+}
+//# sourceMappingURL=callback-server.js.map

package/dist/callback-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-server.js","sourceRoot":"","sources":["../src/callback-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAaxC,MAAM,YAAY,GAAG;;;;;;;;eAQN,CAAC;AAEhB,MAAM,UAAU,GAAG;;;;;;;;eAQJ,CAAC;AAEhB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAGzC;IACC,MAAM,EAAE,aAAa,EAAE,SAAS,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC;IAEvD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,IAAI,aAA4C,CAAC;IAEjD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7D,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAE5C,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,UAAU,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YAED,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YAED,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;gBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,UAAU,CAAC,uCAAuC,CAAC,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACtB,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,CAAC,IAAI,UAAU,CAAC,kCAAkC,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;YAC9E,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACd,YAAY,CAAC,aAAa,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,yDAAyD;IACzD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,OAAO;QACL,IAAI;QACJ,MAAM;QACN,KAAK,EAAE,GAAG,EAAE;YACV,YAAY,CAAC,aAAa,CAAC,CAAC;YAC5B,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client.d.ts

@@ -14,6 +14,7 @@ export interface JinkoClient extends JinkoTools {
  * Create a configured openapi-fetch client for the Jinko BFF.
  *
  * Auth: pass an API key (jnk_...) via options, JINKO_API_KEY env, or ~/.jinko/config.yaml.
+ * OAuth tokens are auto-refreshed before each request when expired.
  */
 export declare function createJinkoClient(options?: ClientOptions): Promise<JinkoClient>;
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,YAAiC,MAAM,eAAe,CAAC;AAC9D,OAAO,EAA+B,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAE3E,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAE1D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAEpE,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAkEzF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,YAAiC,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAgD,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAG5F,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAEpE,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;CAC7B;AAQD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAkGzF"}

package/dist/client.js

@@ -1,11 +1,13 @@
 import createClient from 'openapi-fetch';
-import { resolveAuth, resolveBaseUrl } from './auth.js';
+import { resolveAuth, resolveBaseUrl, writeConfigFile } from './auth.js';
+import { isTokenExpired, refreshAccessToken } from './oauth.js';
 import { ApiError, AuthError } from './errors.js';
 import { createTools } from './tools.js';
 /**
  * Create a configured openapi-fetch client for the Jinko BFF.
  *
  * Auth: pass an API key (jnk_...) via options, JINKO_API_KEY env, or ~/.jinko/config.yaml.
+ * OAuth tokens are auto-refreshed before each request when expired.
  */
 export async function createJinkoClient(options = {}) {
     const auth = await resolveAuth(options.apiKey);
@@ -14,7 +16,14 @@ export async function createJinkoClient(options = {}) {
     }
     const baseUrl = resolveBaseUrl();
     const client = createClient({ baseUrl });
-    // Auth middleware — injects the right headers based on auth method.
+    // Mutable token state for OAuth refresh — only used when method is oauth
+    let tokenState;
+    if (auth.method === 'oauth') {
+        // We don't have refresh_token/expires_at here from resolveAuth,
+        // but the token was already refreshed if needed during resolveAuth.
+        // For in-flight refresh during long-running sessions, we read config.
+        tokenState = undefined; // Will lazy-init on first refresh check
+    }
     const authMiddleware = {
         async onRequest({ request }) {
             const headers = new Headers(request.headers);
@@ -25,7 +34,31 @@ export async function createJinkoClient(options = {}) {
                 headers.set('X-API-Key', auth.token);
             }
             else {
-                headers.set('Authorization', `Bearer ${auth.token}`);
+                // OAuth — check if we need to refresh
+                let currentToken = auth.token;
+                if (tokenState && isTokenExpired({ access_token: tokenState.accessToken, refresh_token: tokenState.refreshToken, expires_at: tokenState.expiresAt })) {
+                    try {
+                        const refreshed = await refreshAccessToken(tokenState.refreshToken);
+                        tokenState = {
+                            accessToken: refreshed.access_token,
+                            refreshToken: refreshed.refresh_token,
+                            expiresAt: refreshed.expires_at,
+                        };
+                        currentToken = refreshed.access_token;
+                        // Persist silently
+                        await writeConfigFile({
+                            oauth: {
+                                access_token: refreshed.access_token,
+                                refresh_token: refreshed.refresh_token,
+                                expires_at: refreshed.expires_at,
+                            },
+                        });
+                    }
+                    catch {
+                        // Proceed with current token
+                    }
+                }
+                headers.set('Authorization', `Bearer ${currentToken}`);
             }
             return new Request(request.url, {
                 method: request.method,

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,YAAiC,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAqB,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,WAAW,EAAmB,MAAM,YAAY,CAAC;AAe1D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAyB,EAAE;IACjE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,SAAS,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IAEjC,MAAM,MAAM,GAAG,YAAY,CAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAEhD,oEAAoE;IACpE,MAAM,cAAc,GAAe;QACjC,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;YACzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAE1C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACvD,CAAC;YAED,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO;gBACP,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,gEAAgE;gBAChE,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IAEF,uDAAuD;IACvD,MAAM,eAAe,GAAe;QAClC,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE;YAC3B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,MAAM,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACjE,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;oBAC3C,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;wBAChB,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;oBACxC,CAAC;yBAAM,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC;wBACzB,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;oBAChD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,6CAA6C;gBAC/C,CAAC;gBACD,MAAM,IAAI,QAAQ,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAE5B,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAElC,OAAO;QACL,GAAG,EAAE,MAAM;QACX,IAAI;QACJ,GAAG,KAAK;KACT,CAAC;AACJ,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,YAAiC,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAqB,MAAM,WAAW,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAoB,MAAM,YAAY,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,WAAW,EAAmB,MAAM,YAAY,CAAC;AAoB1D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAyB,EAAE;IACjE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,SAAS,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,YAAY,CAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAEhD,yEAAyE;IACzE,IAAI,UAAkC,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC5B,gEAAgE;QAChE,oEAAoE;QACpE,sEAAsE;QACtE,UAAU,GAAG,SAAS,CAAC,CAAC,wCAAwC;IAClE,CAAC;IAED,MAAM,cAAc,GAAe;QACjC,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;YACzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAE1C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,sCAAsC;gBACtC,IAAI,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC;gBAE9B,IAAI,UAAU,IAAI,cAAc,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;oBACrJ,IAAI,CAAC;wBACH,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;wBACpE,UAAU,GAAG;4BACX,WAAW,EAAE,SAAS,CAAC,YAAY;4BACnC,YAAY,EAAE,SAAS,CAAC,aAAa;4BACrC,SAAS,EAAE,SAAS,CAAC,UAAU;yBAChC,CAAC;wBACF,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;wBACtC,mBAAmB;wBACnB,MAAM,eAAe,CAAC;4BACpB,KAAK,EAAE;gCACL,YAAY,EAAE,SAAS,CAAC,YAAY;gCACpC,aAAa,EAAE,SAAS,CAAC,aAAa;gCACtC,UAAU,EAAE,SAAS,CAAC,UAAU;6BACjC;yBACF,CAAC,CAAC;oBACL,CAAC;oBAAC,MAAM,CAAC;wBACP,6BAA6B;oBAC/B,CAAC;gBACH,CAAC;gBAED,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,YAAY,EAAE,CAAC,CAAC;YACzD,CAAC;YAED,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO;gBACP,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,gEAAgE;gBAChE,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IAEF,uDAAuD;IACvD,MAAM,eAAe,GAAe;QAClC,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE;YAC3B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,MAAM,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACjE,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;oBAC3C,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;wBAChB,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;oBACxC,CAAC;yBAAM,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC;wBACzB,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;oBAChD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,6CAA6C;gBAC/C,CAAC;gBACD,MAAM,IAAI,QAAQ,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAE5B,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAElC,OAAO;QACL,GAAG,EAAE,MAAM;QACX,IAAI;QACJ,GAAG,KAAK;KACT,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 export { createJinkoClient, type ClientOptions, type JinkoClient, type JinkoRawClient } from './client.js';
 export { type JinkoTools } from './tools.js';
-export { resolveAuth, readConfigFile, writeConfigFile, CONFIG_DIR, CONFIG_FILE, type AuthMethod, type ResolvedAuth } from './auth.js';
+export { resolveAuth, readConfigFile, writeConfigFile, clearAuthConfig, CONFIG_DIR, CONFIG_FILE, type AuthMethod, type ResolvedAuth, type OAuthConfig } from './auth.js';
 export { ApiError, AuthError, ValidationError, type ApiErrorDetail } from './errors.js';
+export { requestDeviceAuthorization, pollForToken, refreshAccessToken, isTokenExpired, OAuthError, OAuthRefreshError, type OAuthTokens, type DeviceAuthorization, } from './oauth.js';
 export type { paths, components } from './types/generated.js';
 export type { FlightPassengers, ShopPassengers, FlightSearchFilters, FlightPriceConstraints, DateRange, FlightFindRequest, FlightDestinationSearchRequest, FlightSearchRequest, FlightSearchLiveRequest, FlightSearchPriceCheckRequest, Traveler, Contact, TripUpsertTravelers, TripRequest, CheckoutRequest, BookRequest, } from './types/devplatform.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AACtI,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACxF,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAC9D,YAAY,EACV,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,6BAA6B,EAC7B,QAAQ,EACR,OAAO,EACP,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,WAAW,GACZ,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACzK,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EACL,0BAA0B,EAC1B,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAC9D,YAAY,EACV,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,6BAA6B,EAC7B,QAAQ,EACR,OAAO,EACP,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,WAAW,GACZ,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -1,4 +1,5 @@
 export { createJinkoClient } from './client.js';
-export { resolveAuth, readConfigFile, writeConfigFile, CONFIG_DIR, CONFIG_FILE } from './auth.js';
+export { resolveAuth, readConfigFile, writeConfigFile, clearAuthConfig, CONFIG_DIR, CONFIG_FILE } from './auth.js';
 export { ApiError, AuthError, ValidationError } from './errors.js';
+export { requestDeviceAuthorization, pollForToken, refreshAccessToken, isTokenExpired, OAuthError, OAuthRefreshError, } from './oauth.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA6D,MAAM,aAAa,CAAC;AAE3G,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAsC,MAAM,WAAW,CAAC;AACtI,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAuB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA6D,MAAM,aAAa,CAAC;AAE3G,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAwD,MAAM,WAAW,CAAC;AACzK,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAuB,MAAM,aAAa,CAAC;AACxF,OAAO,EACL,0BAA0B,EAC1B,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,UAAU,EACV,iBAAiB,GAGlB,MAAM,YAAY,CAAC"}

package/dist/oauth.d.ts

@@ -0,0 +1,41 @@
+export interface OAuthTokens {
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly expires_at: number;
+}
+export interface DeviceAuthorization {
+    readonly device_code: string;
+    readonly user_code: string;
+    readonly verification_uri: string;
+    readonly verification_uri_complete: string;
+    readonly expires_in: number;
+    readonly interval: number;
+}
+export declare class OAuthError extends Error {
+    constructor(message: string);
+}
+export declare class OAuthRefreshError extends OAuthError {
+    constructor(message?: string);
+}
+/**
+ * Request device authorization — returns a user code and verification URL.
+ */
+export declare function requestDeviceAuthorization(): Promise<DeviceAuthorization>;
+/**
+ * Poll the token endpoint until the user approves or the code expires.
+ * Calls onPoll() before each attempt (for progress indicators).
+ */
+export declare function pollForToken(deviceCode: string, options: {
+    readonly intervalSeconds: number;
+    readonly expiresIn: number;
+    readonly onPoll?: () => void;
+}): Promise<OAuthTokens>;
+/**
+ * Refresh an expired access token.
+ */
+export declare function refreshAccessToken(refreshToken: string): Promise<OAuthTokens>;
+/**
+ * Check if tokens are expired (with buffer).
+ */
+export declare function isTokenExpired(tokens: OAuthTokens, bufferSeconds?: number): boolean;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,SAAwE;CAI5F;AAED;;GAEG;AACH,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAa/E;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IACP,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;CAC9B,GACA,OAAO,CAAC,WAAW,CAAC,CAqDtB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA0BnF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,aAAa,SAAK,GAAG,OAAO,CAE/E"}

package/dist/oauth.js

@@ -0,0 +1,111 @@
+// WorkOS AuthKit Device Authorization Flow (RFC 8628)
+const DEVICE_AUTHORIZE_URL = 'https://api.workos.com/user_management/authorize/device';
+const AUTHENTICATE_URL = 'https://api.workos.com/user_management/authenticate';
+const TOKEN_URL = 'https://api.workos.com/user_management/authenticate';
+const CLIENT_ID = 'client_01K6AG6ZM86FN92TGSW0VTZHVJ';
+export class OAuthError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'OAuthError';
+    }
+}
+export class OAuthRefreshError extends OAuthError {
+    constructor(message = 'Failed to refresh OAuth token. Please run `jinko auth login` again.') {
+        super(message);
+        this.name = 'OAuthRefreshError';
+    }
+}
+/**
+ * Request device authorization — returns a user code and verification URL.
+ */
+export async function requestDeviceAuthorization() {
+    const response = await fetch(DEVICE_AUTHORIZE_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({ client_id: CLIENT_ID }),
+    });
+    if (!response.ok) {
+        const body = await response.text();
+        throw new OAuthError(`Device authorization request failed (${response.status}): ${body}`);
+    }
+    return await response.json();
+}
+/**
+ * Poll the token endpoint until the user approves or the code expires.
+ * Calls onPoll() before each attempt (for progress indicators).
+ */
+export async function pollForToken(deviceCode, options) {
+    const { intervalSeconds, expiresIn, onPoll } = options;
+    const deadline = Date.now() + expiresIn * 1000;
+    let interval = intervalSeconds;
+    while (Date.now() < deadline) {
+        onPoll?.();
+        await sleep(interval * 1000);
+        const response = await fetch(AUTHENTICATE_URL, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                device_code: deviceCode,
+                client_id: CLIENT_ID,
+            }),
+        });
+        if (response.ok) {
+            const data = await response.json();
+            return {
+                access_token: data.access_token,
+                refresh_token: data.refresh_token,
+                expires_at: Date.now() + data.expires_in * 1000,
+            };
+        }
+        const error = await response.json();
+        if (error.error === 'authorization_pending') {
+            continue;
+        }
+        if (error.error === 'slow_down') {
+            interval += 5;
+            continue;
+        }
+        if (error.error === 'access_denied') {
+            throw new OAuthError('Authorization was denied by the user.');
+        }
+        if (error.error === 'expired_token') {
+            throw new OAuthError('Device code expired. Please try again.');
+        }
+        throw new OAuthError(`Unexpected polling error: ${error.error ?? response.statusText}`);
+    }
+    throw new OAuthError('Device code expired. Please try again.');
+}
+/**
+ * Refresh an expired access token.
+ */
+export async function refreshAccessToken(refreshToken) {
+    const response = await fetch(TOKEN_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'refresh_token',
+            client_id: CLIENT_ID,
+            refresh_token: refreshToken,
+        }),
+    });
+    if (!response.ok) {
+        throw new OAuthRefreshError();
+    }
+    const data = await response.json();
+    return {
+        access_token: data.access_token,
+        refresh_token: data.refresh_token,
+        expires_at: Date.now() + data.expires_in * 1000,
+    };
+}
+/**
+ * Check if tokens are expired (with buffer).
+ */
+export function isTokenExpired(tokens, bufferSeconds = 60) {
+    return Date.now() >= tokens.expires_at - bufferSeconds * 1000;
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,MAAM,oBAAoB,GAAG,yDAAyD,CAAC;AACvF,MAAM,gBAAgB,GAAG,qDAAqD,CAAC;AAC/E,MAAM,SAAS,GAAG,qDAAqD,CAAC;AACxE,MAAM,SAAS,GAAG,mCAAmC,CAAC;AAiBtD,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,OAAO,GAAG,qEAAqE;QACzF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAC9C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;KACpD,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,UAAU,CAAC,wCAAwC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAyB,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,OAIC;IAED,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;IAC/C,IAAI,QAAQ,GAAG,eAAe,CAAC;IAE/B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,EAAE,EAAE,CAAC;QAEX,MAAM,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QAE7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,8CAA8C;gBAC1D,WAAW,EAAE,UAAU;gBACvB,SAAS,EAAE,SAAS;aACrB,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAI/B,CAAC;YACF,OAAO;gBACL,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;aAChD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAwB,CAAC;QAE1D,IAAI,KAAK,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAChC,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,UAAU,CAAC,uCAAuC,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,UAAU,CAAC,wCAAwC,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,IAAI,UAAU,CAAC,6BAA6B,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,IAAI,UAAU,CAAC,wCAAwC,CAAC,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,YAAoB;IAC3D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;QACtC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,YAAY;SAC5B,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAI/B,CAAC;IAEF,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;KAChD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,MAAmB,EAAE,aAAa,GAAG,EAAE;IACpE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,UAAU,GAAG,aAAa,GAAG,IAAI,CAAC;AAChE,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gojinko/api-client",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",